Mongoose and Node.js multi tenant architecture

Question

I am building an app that uses a multi tenant architecture as follows

User architecture

tenant_name: Name of the user
tenant_id: ObjectID

Multi tenant DB

mongoose schema

widget: Data for widget
Area: location for widget
Tenant_identifier: ObjectID from user architecture

API

I have implemented the login using webtokens and i am able to identify the logged in user etc. What is the best implementation of the API such that it returns only the records in multi tenant DB based on the tenant_id.

Can i write an access layer that filters the data in the API server or should i pass the objectID in the findBy routine of mongoose. I am looking for some design patterns for implementation.

I am using DaftMonks Generator as a starting point https://github.com/DaftMonk/generator-angular-fullstack

Thanks

score 0 · Answer 1 · answered Jun 24 '15 at 20:45

0

You should add the ObjectId to the queries and not filter the data after you retrieved it from the database.

Using the ObjectId as extra query condition (which is implicitly AND'ed with any other conditions that you query for) will not only limit the amount of data that the database will have to return, but with proper indexes in place it will also be pretty fast.

answered Jun 24 '15 at 20:45

robertklep

198,204
35
394
381

Ok, is the objectId filter used in the multi-tenant-db.find call or as a hook in pre find? – Uma Maheshwaraa Jun 24 '15 at 22:26
@UmaMaheshwaraa I don't see how you could use it in a hook (because hooks are applied system-wide). So yeah, you'd use it on `.find*` calls. – robertklep Jun 25 '15 at 05:58
Hmm.. i thought there should be a better way in a middleware or another layer. How would i architect admin and super admin roles who have the privilege to view all ids.. – Uma Maheshwaraa Jun 25 '15 at 13:53
@UmaMaheshwaraa perhaps you can use [`mongoose-access-plugin`](https://www.npmjs.com/package/mongoose-access-plugin)? – robertklep Jun 25 '15 at 14:06
that seems an interesting way to do access control. will take a look at that. – Uma Maheshwaraa Jun 25 '15 at 16:32

Mongoose and Node.js multi tenant architecture

1 Answers1