25 lines
780 B
TypeScript
25 lines
780 B
TypeScript
import { PrismaClient } from '@prisma/client';
|
|
|
|
/**
|
|
* Creates a tenant-scoped Prisma client that sets the app.current_tenant
|
|
* PostgreSQL session variable before every query via RLS.
|
|
*
|
|
* Uses parameterized set_config to prevent SQL injection (T-02-05).
|
|
*/
|
|
export function forTenant(prisma: PrismaClient, tenantId: string) {
|
|
return prisma.$extends({
|
|
query: {
|
|
$allOperations({ args, query }: { args: any; query: (args: any) => any }) {
|
|
return (prisma as any).$transaction(async (tx: any) => {
|
|
// Use parameterized query to avoid SQL injection
|
|
await tx.$executeRawUnsafe(
|
|
`SELECT set_config('app.current_tenant', $1, true)`,
|
|
tenantId,
|
|
);
|
|
return query(args);
|
|
});
|
|
},
|
|
},
|
|
});
|
|
}
|