Member Junction
    Preparing search index...

    Function createTenantMiddleware

    • Creates Express middleware that resolves and attaches TenantContext to the authenticated user's UserInfo for each request.

      This middleware runs in the post-auth slot (after createUnifiedAuthMiddleware) so req.userPayload is available. It reads the tenant ID from the configured source and attaches it directly to userPayload.userRecord.TenantContext.

      By the time GraphQL resolvers or REST handlers run, the contextUser already has TenantContext set — no deferred pickup via req['__mj_tenantId'] needed.

      Parameters

      • config: {
            adminRoles?: string[];
            autoExcludeCoreEntities?: boolean;
            contextSource?: "header" | "linkedEntity" | "custom";
            defaultTenantColumn?: string;
            enabled?: boolean;
            entityColumnMappings?: Record<string, string>;
            scopedEntities?: string[];
            scopingStrategy?: "allowlist" | "denylist";
            tenantHeader?: string;
            writeProtection?: "strict" | "log" | "off";
        }
        • OptionaladminRoles?: string[]

          Roles that bypass tenant filtering entirely

        • OptionalautoExcludeCoreEntities?: boolean

          When true, entities in the __mj core schema are never tenant-filtered

        • OptionalcontextSource?: "header" | "linkedEntity" | "custom"

          How the tenant ID is determined for each request

        • OptionaldefaultTenantColumn?: string

          Default column name containing the tenant identifier

        • Optionalenabled?: boolean

          Master switch — when false (default), no tenant isolation is applied

        • OptionalentityColumnMappings?: Record<string, string>

          Per-entity overrides for the tenant column name: { "EntityName": "ColumnName" }

        • OptionalscopedEntities?: string[]

          Entities included/excluded from tenant filtering based on scopingStrategy

        • OptionalscopingStrategy?: "allowlist" | "denylist"

          Whether scopedEntities is an allowlist or denylist of entities to filter

        • OptionaltenantHeader?: string

          HTTP header name used when contextSource is 'header'

        • OptionalwriteProtection?: "strict" | "log" | "off"

          Write protection mode: 'strict' rejects, 'log' warns, 'off' skips validation

      Returns RequestHandler

    Settings

    Member Visibility