AuthzKit

Appearance

AuthzKit Tenant Guard ​

Multi-tenant security made impossible to mess up.

AuthzKit Tenant Guard is an automatic tenant isolation system for Prisma applications that makes cross-tenant data violations impossible by construction, not just unlikely. It provides 100% automated protection against the most common and dangerous multi-tenant security vulnerabilities.

The Problem ​

Multi-tenant applications face a critical security challenge: ensuring that every database operation respects tenant boundaries. Traditional approaches require developers to manually validate tenant isolation in every query, leading to:

  • Human error risk: Easy to forget tenant validation in complex nested operations
  • Maintenance burden: Manual validation code scattered throughout the application
  • Security vulnerabilities: Single oversight can compromise entire system
  • Development overhead: Significant boilerplate for every database interaction

The AuthzKit Solution ​

AuthzKit Tenant Guard transforms this manual, error-prone process into an automatic guarantee:

typescript
// Without AuthzKit - Manual validation required everywhere
if (tag.tenantId !== currentTenantId) {
  throw new Error('Cross-tenant access denied');
}
if (todo.tenantId !== currentTenantId) {
  throw new Error('Cross-tenant access denied');
}
// ... hundreds of similar checks needed

// With AuthzKit - Automatic tenant validation
const tenantDb = withTenantGuard(prisma, tenantId);
// ALL operations automatically secured, zero boilerplate

Core Value Propositions ​

🛡️ Security by Construction ​

Cross-tenant violations are impossible, not just caught. No reliance on developer discipline or code reviews.

🚀 Zero Boilerplate ​

No manual tenant validation code required. Automatic protection for all nested operations.

📈 Complete Coverage ​

Validates connects, creates, updates, deletes. Handles complex many-to-many relationships automatically.

🎯 Perfect Developer Experience ​

Write normal Prisma code, get automatic security. Clear error messages with exact violation paths.

⚡ Production Performance ​

O(N) traversal of operation payloads. No additional database queries. Sub-millisecond validation overhead.

How It Works ​

AuthzKit operates at the Prisma Client extension level, intercepting and validating ALL database operations:

mermaid
graph LR
    A[Your Code] --> B[AuthzKit Tenant Guard]
    B --> C[Prisma Client]
    C --> D[Database]

    B --> E[Auto-inject tenantId]
    B --> F[Validate nested ops]
    B --> G[Modify where clauses]

Key Protection Mechanisms ​

  1. Automatic Tenant Field Injection: Auto-injects correct tenantId into all operations
  2. Where Clause Modification: Auto-adds tenant constraints to prevent cross-tenant access
  3. Nested Operation Validation: Validates ALL nested operations recursively
  4. Foreign Key Constraint Enforcement: Database-level protection as final safeguard

Quick Example ​

typescript
import { withTenantGuard } from '@authzkit/prisma-tenant-guard';

// One line for complete tenant protection
const tenantDb = withTenantGuard(prisma, tenantId);

// All operations now automatically secured
await tenantDb.todo.create({
  data: {
    title: "New Task",
    tags: {
      connect: [{ id: tagId }] // ✅ Automatically validates tenant boundary
    }
  }
});

Result: Cross-tenant security violations become impossible, not just unlikely.

Real-World Attack Prevention ​

AuthzKit prevents these actual attack scenarios:

❌ Corporate Espionage Attack ​

typescript
// Attacker tries to connect competitor's confidential tags
await tenantDb.todo.create({
  data: {
    title: "Steal secrets",
    tags: { connect: [{ id: competitorTagId }] } // 🛡️ BLOCKED
  }
});

❌ Mass Data Theft ​

typescript
// Attacker tries to steal all tags from another tenant
await tenantDb.todo.update({
  where: { id: myTodoId },
  data: {
    tags: {
      connect: allCompetitorTags // 🛡️ BLOCKED
    }
  }
});

❌ Cross-tenant Linking ​

typescript
// Direct relationship manipulation attempt
await tenantDb.todoTag.create({
  data: {
    todoId: myTodo,
    tagId: theirTag // 🛡️ BLOCKED
  }
});

Security Guarantee ​

With AuthzKit, it is impossible for a user to access, modify, or link data belonging to another tenant through nested Prisma operations.

This is achieved through construction - AuthzKit makes cross-tenant violations impossible at the ORM level, not through careful coding or extensive testing.

Getting Started ​

Ready to add bulletproof multi-tenant security to your Prisma application?

  1. 📦 Installation - Complete setup for your framework
  2. ⚡ Quick Start - Get running in 5 minutes
  3. 🧠 How It Works - Understand how protection works
  4. ⚙️ Configuration - Advanced settings and modes

Basic Usage Preview ​

Once installed, AuthzKit Tenant Guard works with a simple wrapper:

typescript
import { withTenantGuard } from '@authzkit/prisma-tenant-guard';

// One line for complete tenant protection
const tenantDb = withTenantGuard(prisma, tenantId);

// All operations now automatically secured
await tenantDb.post.create({
  data: {
    title: "Safe Post",
    tags: { connect: [{ id: tagId }] } // ✅ Validates tenant boundary
  }
});

Result: Cross-tenant violations become impossible, not just unlikely.

Production Ready ​

AuthzKit Tenant Guard is battle-tested and production-ready:

  • ✅ 100% attack prevention rate across all tested scenarios
  • ✅ Zero performance overhead in production workloads
  • ✅ Complete TypeScript integration with generated metadata
  • ✅ Comprehensive error reporting with exact violation paths
  • ✅ Multi-mode operation for development, testing, and production

Next Steps ​

"How do I ensure that all child objects being connected/created/deleted also belong to the correct tenant?"

Answer: You don't have to. AuthzKit ensures it automatically.