Feb 2026 · Profound
Scoping the database by tenant
A 560-line migration adding website scoping to the RPC layer, in my second month.
The CMS serves many client websites out of one database. A set of routing RPCs were not scoped by website — they were correct in practice because of how the application called them, which is a different thing from being correct.
The work
One migration, 560 lines of SQL, threading website scoping through the routing functions and their callers. It is not clever code. It is the kind of change where the only thing that matters is that you didn't miss one, because a miss in a multi-tenant product is a data leak rather than a bug.
The same theme came back twice more — once in the performance work, where a route matcher was scanning across tenants, and once making proxied admin links resolve to the right organisation. Tenancy isn't a feature you finish.
This landed in my second month, which surprised me at the time. It's also the reason the later performance work read as a tenancy problem to me and not just a slow query.