Multi-Tenancy Architecture

Tonnex uses a Table-Based Multi-Tenancy approach with Row Level Security (RLS). Every tenant-specific table has an org_id column that links to the organizations table. Access is enforced at the database level using Postgres RLS policies.

Key Components

1. Organization Membership Check

We use a SECURITY DEFINER function to verify if a user belongs to an organization. This bypasses RLS on the org_memberships table itself to avoid infinite recursion.

CREATE OR REPLACE FUNCTION public.is_org_member(_org_id uuid)
RETURNS boolean AS $$
BEGIN
  RETURN EXISTS (
    SELECT 1 FROM public.org_memberships 
    WHERE user_id = auth.uid() 
      AND org_id = _org_id
  );
END;
$$ LANGUAGE plpgsql SECURITY DEFINER STABLE;

2. Drizzle Integration (Supabase)

We use drizzle-orm/supabase helpers to define RLS policies directly in the schema.

import { pgPolicy } from "drizzle-orm/pg-core";
import { authenticatedRole, isOrgMember } from "./rls";

export const projects = pgTable("projects", {
  // ... columns
  orgId: uuid("org_id").references(() => organizations.id),
}, (table) => [
  // Policy: Users can only see projects in their organizations
  pgPolicy("view_projects", {
    for: "select",
    to: authenticatedRole,
    using: isOrgMember(table.orgId),
  }),
]);

3. RLS-Aware Client

When querying from the application (Server Actions/Components), we use a wrapper that sets the RLS context for the transaction.

import { createDrizzleSupabaseClient } from "@tonnex/db";

// In a Server Action
const db = createDrizzleSupabaseClient(accessToken);
const data = await db.rls((tx) => tx.select().from(projects));

This sets:

auth.uid() via request.jwt.claim.sub
auth.jwt() via request.jwt.claims
role via set local role

Adding a New Module

When creating a new module (e.g., vehicles):

Add orgId to your table schema.
Add the RLS policy usage isOrgMember(table.orgId) for SELECT/UPDATE/DELETE.
Use the createDrizzleSupabaseClient wrapper for all queries.

Getting Started

Guides

Multi-Tenancy & RLS

Multi-Tenancy Architecture

Key Components

1. Organization Membership Check

2. Drizzle Integration (Supabase)

3. RLS-Aware Client

Adding a New Module

​Multi-Tenancy Architecture

​Key Components

​1. Organization Membership Check

​2. Drizzle Integration (Supabase)

​3. RLS-Aware Client

​Adding a New Module

Multi-Tenancy Architecture

Key Components

1. Organization Membership Check

2. Drizzle Integration (Supabase)

3. RLS-Aware Client

Adding a New Module