Leave Database Tenant Isolation
Summary
Eleven Leave business, projection, foundation, and history objects use a privileged-or-current-tenant global query filter; OutboxMessages is deliberately unfiltered for operational polling.
Audience
Backend developers, security/architecture reviewers, QA, DevOps, and support.
Concept
| Object group | Filtered | Source |
|---|---|---|
| Requests, balances, types, policies | Yes | microservices/src/leave-service/Infrastructure/LeaveDbContext.cs |
| Holidays, weekly offs | Yes | microservices/src/leave-service/Infrastructure/LeaveDbContext.cs |
| Profiles, carry-forward, encashment | Yes | microservices/src/leave-service/Infrastructure/LeaveDbContext.cs |
| Audit and timeline | Yes | microservices/src/leave-service/Infrastructure/LeaveDbContext.cs |
| Outbox | No | microservices/src/leave-service/Infrastructure/LeaveDbContext.cs |
Tenant-scoped unique indexes protect balances, Leave types, and policies. Other tenant indexes are not unique. The Employee consumer uses IgnoreQueryFilters only with an explicit tenant plus employee predicate, and development seeding also bypasses filters while explicitly matching tenant.
Global filters reduce accidental cross-tenant reads but do not establish universal security assurance. Raw SQL, migrations, filter bypasses, operational outbox access, missing tenant contexts, and privileged contexts require dedicated review and tests. Outbox tenant context uses a shared operational contract and is not the same typed field as Leave business-object tenant identifiers.
Source References
- microservices/src/leave-service/Infrastructure/LeaveDbContext.cs
- microservices/src/leave-service/Infrastructure/Persistence.cs
- microservices/src/leave-service/Messaging/EmployeeProfileConsumer.cs
- microservices/src/leave-service/Infrastructure/DevelopmentSeeder.cs
Related Articles
See Also
Keywords
- Tenant isolation
- Global query filter
- Filter bypass
Revision Information
- Status: Draft
- Last reviewed: 2026-07-15
- Review cycle: Quarterly