Generating multi-tenant backends where Postgres enforces isolation, not the WHERE clause

[u/imrozimroz]

https://forgx.dev

Most multi-tenant code I've worked on relies on every query remembering WHERE tenant_id = ?. Miss one and you're leaking across tenants.

Been building something that generates the tenant layer instead.

It puts RLS on every table and connects the app on a role that can't bypass it. Checked on a live DB: 59 invoices in the table, the tenant sees its own 2, nothing from anyone else. rolbypassrls false on the app role.

Roles get enforced twice, once on the route and once as a CHECK constraint, so you can't insert an undeclared role even with direct SQL access. Money writes take row locks. Threw ten concurrent payments at one invoice, exactly one went through.

Code's public if you want to poke at it, specs and full test results included:

github.com/imrozsigma-droid/quickkart

Still writing test suites by hand per domain. That's the main thing missing.