Per-Tenant Request Context in Express With AsyncLocalStorage and a Scoped Repository

const jwt = require('jsonwebtoken');
const { runWithTenant } = require('./tenantContext');

function tenantResolver(req, res, next) {
  const auth = req.get('authorization') || '';
  const token = auth.startsWith('Bearer ') ? auth.slice(7) : null;

  if (!token) {
    return res.status(401).json({ error: 'missing bearer token' });
  }

  let claims;
  try {
    claims = jwt.verify(token, process.env.JWT_SECRET);
  } catch (err) {
    return res.status(401).json({ error: 'invalid token' });
  }

  const claimedTenant = claims.tenant_id;
  const headerTenant = req.get('x-tenant-id');

  if (!claimedTenant) {
    return res.status(403).json({ error: 'token has no tenant claim' });
  }

  // Defeat cross-tenant token replay when a header is present.
  if (headerTenant && headerTenant !== claimedTenant) {
    return res.status(403).json({ error: 'tenant mismatch' });
  }

  runWithTenant(claimedTenant, claims.sub, () => {
    next();
  });
}

module.exports = tenantResolver;

const { requireTenantId } = require('./tenantContext');

class ScopedRepository {
  constructor(pool, table) {
    this.pool = pool;
    this.table = table;
  }

  async findById(id) {
    const tenantId = requireTenantId();
    const sql = `SELECT * FROM ${this.table} WHERE tenant_id = $1 AND id = $2`;
    const { rows } = await this.pool.query(sql, [tenantId, id]);
    return rows[0] || null;
  }

  async list({ limit = 50, offset = 0 } = {}) {
    const tenantId = requireTenantId();
    const sql = `SELECT * FROM ${this.table}
                 WHERE tenant_id = $1
                 ORDER BY created_at DESC
                 LIMIT $2 OFFSET $3`;
    const { rows } = await this.pool.query(sql, [tenantId, limit, offset]);
    return rows;
  }

  async insert(attrs) {
    const tenantId = requireTenantId();
    const cols = Object.keys(attrs);
    const values = Object.values(attrs);
    const placeholders = cols.map((_, i) => `$${i + 2}`).join(', ');
    const sql = `INSERT INTO ${this.table} (tenant_id, ${cols.join(', ')})
                 VALUES ($1, ${placeholders})
                 RETURNING *`;
    const { rows } = await this.pool.query(sql, [tenantId, ...values]);
    return rows[0];
  }

  async delete(id) {
    const tenantId = requireTenantId();
    const sql = `DELETE FROM ${this.table} WHERE tenant_id = $1 AND id = $2`;
    const { rowCount } = await this.pool.query(sql, [tenantId, id]);
    return rowCount > 0;
  }
}

module.exports = ScopedRepository;

const express = require('express');
const tenantResolver = require('./tenantResolver');
const ScopedRepository = require('./ScopedRepository');
const pool = require('./db');

const router = express.Router();
const orders = new ScopedRepository(pool, 'orders');

router.use(tenantResolver);

router.get('/', async (req, res, next) => {
  try {
    const limit = Math.min(Number(req.query.limit) || 50, 200);
    const rows = await orders.list({ limit, offset: Number(req.query.offset) || 0 });
    res.json({ data: rows });
  } catch (err) {
    next(err);
  }
});

router.get('/:id', async (req, res, next) => {
  try {
    const order = await orders.findById(req.params.id);
    if (!order) return res.status(404).json({ error: 'not found' });
    res.json(order);
  } catch (err) {
    next(err);
  }
});

router.post('/', async (req, res, next) => {
  try {
    const created = await orders.insert({
      customer_id: req.body.customer_id,
      amount_cents: req.body.amount_cents,
      status: 'pending',
    });
    res.status(201).json(created);
  } catch (err) {
    next(err);
  }
});

module.exports = router;