Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteFoxyInvoice describes a shared application and database for multiple companies, with tenant identity carried through authentication, automatic read filters, write-time stamping and cross-tenant integration tests. The design aims to prevent a company from seeing another company’s records, while acknowledging a practical risk: a developer can write a query that forgets tenant scope.
Where the tenant boundary sits
In a shared-system design, multiple companies use the same running application and database. The boundary is logical: each request must be associated with a tenant, and data access must remain within that tenant. As chapter author Lith SEO puts it, “The realistic threat is your own future self at 2 a.m. writing a query that forgets the tenant filter.” This is a description of FoxyInvoice’s approach, not an independent security audit or a general guarantee for shared databases.
As an Amazon Associate I earn from qualifying purchases.
How FoxyInvoice carries tenant identity through a request
Login establishes the context
The chapter says users can sign in with email and password, with passwords handled using Argon2id, or use Google single sign-on. After a successful login, the system issues a short-lived JWT containing the user ID, tenant ID and permission claims, alongside a rotating refresh token. The browser sends the JWT with API calls, and the server verifies its signature.
Reads are scoped automatically
FoxyInvoice uses EF Core global query filters to constrain queries for tenant-scoped entities to the active tenant. The author also describes a per-tenant model-cache key, intended to keep cached query filters correct when requests for different tenants interleave.
#1 Best Overall
Writes take their tenant from the caller
A save interceptor stamps newly created rows with the caller’s tenant. Under the described behavior, a submitted tenant ID cannot be used to select a different workspace for a new record. This addresses a different failure point from read filtering: the application must not trust a client-supplied tenant identifier when deciding where a write belongs.
How the tests check cross-tenant isolation
The chapter describes integration tests that sign in as two tenants, create overlapping data, and verify that neither tenant can see the other’s records. It says these tests run in continuous integration on every push. The value of this pattern is that it exercises the boundary through authenticated requests and tenant-specific data, rather than relying only on a developer’s inspection of individual queries.
These tests provide evidence for the scenarios they cover; the chapter does not publish test artifacts or establish that every possible access path has been independently validated.
Where automatic filters are bypassed
Some background jobs deliberately use IgnoreQueryFilters(). That is an escape hatch, not a safe substitute for tenant scoping: a job using it must handle tenant scope explicitly. Because it disables the automatic read constraint, each such use deserves review for how the job selects and limits the records it processes.
Permissions and document sharing
Server-side permission checks decide access
FoxyInvoice maps roles to permission strings. The chapter identifies server-side HasPermission checks as decisive. Route guards and hiding interface elements can improve the user experience, but they do not replace authorization at the API boundary.
Shared documents use a separate token
The described document-sharing mechanism uses an unguessable 32-byte URL token scoped to one document; the author says tokens can expire and be revoked. This is a separate access path from ordinary tenant-scoped browsing, so its scope and lifecycle matter independently.
Rank #4
Operational controls beyond tenant filtering
The chapter also reports practices that support security and data handling around the core isolation design:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Audit records include before-and-after JSON snapshots.
- Nightly
pg_dumpbackups are gzip-compressed, checked for size and copied off-host. - Payment methods are held by Stripe; FoxyInvoice stores identifiers rather than the payment methods themselves.
- An export workflow is available.
- When a user is disabled, access is cut off immediately; hard deletion follows after a 30-day grace period.
- A gitleaks gate checks the repository for secrets.
What the account establishes—and what it does not
This is the chapter author’s account of FoxyInvoice’s implementation. It describes multiple layers: tenant context in authentication, scoped reads, tenant-stamped writes, integration tests, API permission checks and controls for operational data handling. It does not establish an independent audit, penetration test, certification or proof that every control is correctly implemented. The author also notes that areas such as account-takeover hardening and broader defense in depth remain to mature.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
