Tenant Tenant protocol schemas
Tenant Schema (Multi-Tenant Architecture)
Defines the tenant/tenancy model for ObjectStack SaaS deployments.
Supports different levels of data isolation to meet varying security,
performance, and compliance requirements.
Isolation Levels:
shared_schema: All tenants share the same database and schema (row-level isolation)
isolated_schema: Tenants have separate schemas within a shared database
isolated_db: Each tenant has a completely separate database
Source: packages/spec/src/system/tenant.zod.ts
import { DatabaseLevelIsolationStrategySchema, DatabaseProviderSchema, QuotaEnforcementResultSchema, RowLevelIsolationStrategySchema, SchemaLevelIsolationStrategySchema, TenantSchema, TenantConnectionConfigSchema, TenantIsolationConfigSchema, TenantIsolationLevel, TenantQuotaSchema, TenantSecurityPolicySchema, TenantUsageSchema } from '@objectstack/spec/system' ; import type { DatabaseLevelIsolationStrategy, DatabaseProvider, QuotaEnforcementResult, RowLevelIsolationStrategy, SchemaLevelIsolationStrategy, Tenant, TenantConnectionConfig, TenantIsolationConfig, TenantIsolationLevel, TenantQuota, TenantSecurityPolicy, TenantUsage } from '@objectstack/spec/system' ; // Validate data const result = DatabaseLevelIsolationStrategySchema. parse (data); Property Type Required Description strategy 'isolated_db'✅ Database-level isolation strategy database { namingPattern: string; serverStrategy: Enum<'shared' | 'sharded' | 'dedicated'>; separateCredentials: boolean; autoCreateDatabase: boolean }optional Database configuration connectionPool { poolSize: integer; maxActivePools: integer; idleTimeout: integer; usePooler: boolean }optional Connection pool configuration backup { strategy: Enum<'individual' | 'consolidated' | 'on_demand'>; frequencyHours: integer; retentionDays: integer }optional Backup configuration encryption { perTenantKeys: boolean; algorithm: string; keyManagement?: Enum<'aws_kms' | 'azure_key_vault' | 'gcp_kms' | 'hashicorp_vault' | 'custom'> }optional Encryption configuration
Database provider for tenant data
Quota enforcement check result
Property Type Required Description allowed boolean✅ Whether the operation is within quota exceededQuota stringoptional Name of the exceeded quota currentUsage numberoptional Current usage value limit numberoptional Quota limit message stringoptional Human-readable quota message
Property Type Required Description strategy 'shared_schema'✅ Row-level isolation strategy database { enableRLS: boolean; contextMethod: Enum<'session_variable' | 'search_path' | 'application_name'>; contextVariable: string; applicationValidation: boolean }optional Database configuration performance { usePartialIndexes: boolean; usePartitioning: boolean; poolSizePerTenant?: integer }optional Performance settings
Property Type Required Description strategy 'isolated_schema'✅ Schema-level isolation strategy schema { namingPattern: string; includePublicSchema: boolean; sharedSchema: string; autoCreateSchema: boolean }optional Schema configuration migrations { strategy: Enum<'parallel' | 'sequential' | 'on_demand'>; maxConcurrent: integer; rollbackOnError: boolean }optional Migration configuration performance { poolPerSchema: boolean; schemaCacheTTL: integer }optional Performance settings
Property Type Required Description id string✅ Unique tenant identifier name string✅ Tenant display name isolationLevel Enum<'shared_schema' | 'isolated_schema' | 'isolated_db'>✅ databaseProvider Enum<'turso' | 'postgres' | 'memory'>optional Database provider connectionConfig { url: string; authToken?: string; group?: string }optional Database connection config provisioningStatus Enum<'provisioning' | 'active' | 'suspended' | 'failed' | 'destroying'>optional Current provisioning lifecycle status plan Enum<'free' | 'pro' | 'enterprise'>optional Subscription plan customizations Record<string, any>optional Custom configuration values quotas { maxUsers?: integer; maxStorage?: integer; apiRateLimit?: integer; maxObjects?: integer; … }optional
Tenant database connection configuration
Property Type Required Description url string✅ Database connection URL authToken stringoptional Database auth token (encrypted at rest) group stringoptional Turso database group name
This schema accepts one of the following structures:
Property Type Required Description strategy 'shared_schema'✅ Row-level isolation strategy database { enableRLS: boolean; contextMethod: Enum<'session_variable' | 'search_path' | 'application_name'>; contextVariable: string; applicationValidation: boolean }optional Database configuration performance { usePartialIndexes: boolean; usePartitioning: boolean; poolSizePerTenant?: integer }optional Performance settings
Property Type Required Description strategy 'isolated_schema'✅ Schema-level isolation strategy schema { namingPattern: string; includePublicSchema: boolean; sharedSchema: string; autoCreateSchema: boolean }optional Schema configuration migrations { strategy: Enum<'parallel' | 'sequential' | 'on_demand'>; maxConcurrent: integer; rollbackOnError: boolean }optional Migration configuration performance { poolPerSchema: boolean; schemaCacheTTL: integer }optional Performance settings
Property Type Required Description strategy 'isolated_db'✅ Database-level isolation strategy database { namingPattern: string; serverStrategy: Enum<'shared' | 'sharded' | 'dedicated'>; separateCredentials: boolean; autoCreateDatabase: boolean }optional Database configuration connectionPool { poolSize: integer; maxActivePools: integer; idleTimeout: integer; usePooler: boolean }optional Connection pool configuration backup { strategy: Enum<'individual' | 'consolidated' | 'on_demand'>; frequencyHours: integer; retentionDays: integer }optional Backup configuration encryption { perTenantKeys: boolean; algorithm: string; keyManagement?: Enum<'aws_kms' | 'azure_key_vault' | 'gcp_kms' | 'hashicorp_vault' | 'custom'> }optional Encryption configuration
shared_schemaisolated_schemaisolated_db
Property Type Required Description maxUsers integeroptional Maximum number of users maxStorage integeroptional Maximum storage in bytes apiRateLimit integeroptional API requests per minute maxObjects integeroptional Maximum number of custom objects maxRecordsPerObject integeroptional Maximum records per object maxDeploymentsPerDay integeroptional Maximum deployments per day maxStorageBytes integeroptional Maximum storage in bytes
Property Type Required Description encryption { atRest: boolean; inTransit: boolean; fieldLevel: boolean }optional Encryption requirements accessControl { requireMFA: boolean; requireSSO: boolean; ipWhitelist?: string[]; sessionTimeout: integer }optional Access control requirements compliance { standards?: Enum<'sox' | 'hipaa' | 'gdpr' | 'pci_dss' | 'iso_27001' | 'fedramp'>[]; requireAuditLog: boolean; auditRetentionDays: integer; dataResidency?: object }optional Compliance requirements
Current tenant resource usage
Property Type Required Description currentObjectCount integer✅ Current number of custom objects currentRecordCount integer✅ Total records across all objects currentStorageBytes integer✅ Current storage usage in bytes deploymentsToday integer✅ Deployments executed today currentUsers integer✅ Current number of active users apiRequestsThisMinute integer✅ API requests in the current minute lastUpdatedAt stringoptional Last usage update time
ObjectStack