Attendance Tenant Context
Summary
Tenant context is ambient per request and is used by commands, audit attribution, and EF Core query filters.
Audience
Backend developers, security engineers, architects, and QA engineers.
Confirmed boundary
ITenantContext exposes tenant identity, tenant key, caller identity, employee context, and a privileged-role indicator. The HTTP implementation resolves trusted request identity context established by authentication and gateway forwarding. Commands call RequireTenantId for tenant-sensitive mutations; missing context becomes a controlled request failure at the service boundary.
AttendanceDbContext applies global query filters across attendance, punches, reopen requests, profiles, snapshots, Time Office models, audit, and timeline data. Normal queries match the current tenant. A recognized privileged context can broaden filters for cross-tenant administration; presentation authorization remains responsible for governing that access. Audit and timeline writers use the same ambient context.
Tenant filtering does not prove universal isolation by itself. Raw SQL, design-time/backfill contexts, newly added entities, explicit filter bypass, and external dependencies require separate review. Some repository methods accept tenant parameters while also relying on global filters. Tests must cover missing, normal, mismatched, and authorized cross-tenant contexts without relying only on endpoint authorization.
Source References
microservices/src/attendance-service/Application/Common/Abstractions.csmicroservices/src/attendance-service/Infrastructure/Persistence.csmicroservices/src/attendance-service/Infrastructure/AttendanceDbContext.csmicroservices/src/attendance-service/Application/Services/AttendanceCommands.cs
Related Articles
See Also
Keywords
- Attendance Service
- Attendance Tenant Context
Revision Information
- Status: Draft
- Last reviewed: 2026-07-15
- Review cycle: Quarterly