Strict Tenant Data Isolation in Laravel using Global Scopes
How to enforce automatic multi-tenant data isolation at the ORM layer to prevent cross-tenant data leaks in enterprise SaaS applications.
Strict Tenant Data Isolation in Laravel using Global Scopes
Laravel Multi-Tenancy Masterclass
Multi-Tenant Data Isolation in Laravel
In multi-tenant SaaS platforms, the absolute isolation of tenant data is paramount. A single leakage of financial or client data can destroy business trust. Let's explore how to implement an automated and bulletproof tenant isolation layer using Laravel Global Scopes.
The Core Concept: Single Database Multi-Tenancy
In a shared-database multi-tenant structure, every tenant-specific table (e.g., invoices, clients) contains a tenant_id column. Rather than manually appending ->where('tenant_id', $currentTenantId) to every eloquent query, we can delegate this responsibility to a Laravel Global Scope.
1. Creating the Tenant Global Scope
The Global Scope intercepts all eloquent builders queries automatically and constrains the search result to the authenticated tenant.
namespace AppModelsScopes;
use IlluminateDatabaseEloquentBuilder;
use IlluminateDatabaseEloquentModel;
use IlluminateDatabaseEloquentScope;
class TenantScope implements Scope
{
public function apply(Builder $builder, Model $model)
{
class=class="text-emerald-500 dark:text-emerald-400 font-medium">"text-slate-500 italic">// constrains queries only if a tenant is resolved in session/auth
if (auth()->check() && auth()->user()->tenant_id) {
$builder->where($model->getTable() . '.tenant_id', auth()->user()->tenant_id);
}
}
}2. Setting up a Reusable Trait
To easily apply this scope to any tenant-related model, define a trait that registers the scope and handles automatic tenant_id insertion during record creation.
namespace AppModelsTraits;
use AppModelsScopesTenantScope;
trait BelongsToTenant
{
public static function bootBelongsToTenant()
{
static::addGlobalScope(new TenantScope);
class=class="text-emerald-500 dark:text-emerald-400 font-medium">"text-slate-500 italic">// Auto-assign tenant_id when creating models
static::creating(function ($model) {
if (auth()->check() && auth()->user()->tenant_id) {
$model->tenant_id = auth()->user()->tenant_id;
}
});
}
}Now, applying this trait to your Invoice model automatically restricts read and write operations:
namespace AppModels;
use AppModelsTraitsBelongsToTenant;
use IlluminateDatabaseEloquentModel;
class Invoice extends Model
{
use BelongsToTenant; class=class="text-emerald-500 dark:text-emerald-400 font-medium">"text-slate-500 italic">// Everything is isolated automatically now!
}3. Bypassing Isolation for System Admins
When building a Master Admin dashboard, you will need to view all invoices. You can bypass the tenant scope using the withoutGlobalScope method:
class=class="text-emerald-500 dark:text-emerald-400 font-medium">"text-slate-500 italic">// Bypasses tenant scope and fetches invoices across all tenants
$allInvoices = Invoice::withoutGlobalScope(TenantScope::class)->get();By utilizing scopes, you prevent data cross-contamination completely at the framework level, ensuring full enterprise-grade compliance.