ifds-oss/tenant-guard

Defence-in-depth multi-tenancy for Laravel applications that share a single database and schema.

v1.0.0 2026-08-30 19:42 UTC

Requires

• php: ^8.2
• illuminate/contracts: ^10.0|^11.0|^12.0|^13.0
• illuminate/database: ^10.0|^11.0|^12.0|^13.0
• illuminate/http: ^10.0|^11.0|^12.0|^13.0
• illuminate/queue: ^10.0|^11.0|^12.0|^13.0
• illuminate/support: ^10.0|^11.0|^12.0|^13.0

Requires (Dev)

• mockery/mockery: ^1.6
• orchestra/testbench: ^8.20|^9.0|^10.0|^11.0
• phpunit/phpunit: ^10.5|^11.0|^12.0|^13.0
• spatie/laravel-multitenancy: ^3.0|^4.0
• stancl/tenancy: ^3.8

MIT

• ifds

• security
• laravel
• saas
• tenancy
• multi-tenancy
• shared-database

Published on Packagist.org on 2026-08-30 19:44 UTC

README

Defence-in-depth multi-tenancy for Laravel applications that share one database and one schema.

In a shared-schema SaaS, every tenant's rows live in the same tables, separated only by a tenant_id column. It is the cheapest tenancy model to run and the easiest one to leak. One forgotten where() is a cross-tenant data breach.

Tenant Guard's answer is not a single clever scope — it is five independent layers, each of which fails closed on its own:

1. Query Scope — every Eloquent read is constrained automatically.
2. Write Guard — cross-tenant creates, updates and deletes are refused, and the tenant key is immutable.
3. SQL Sentinel — catches raw SQL and DB::table() calls before they execute.
4. Propagation — the tenant follows the request into queued jobs and, optionally, the cache.
5. Static Audit — a command that flags models and tables missing tenant protection.

It sits on top of connection switchers like stancl/tenancy and spatie/laravel-multitenancy rather than replacing them — see the interoperability section of the usage guide.

Installation

composer require ifds-oss/tenant-guard
php artisan tenant-guard:install
php artisan migrate

use Ifds\TenantGuard\Concerns\BelongsToTenant;

class Post extends Model
{
    use BelongsToTenant;
}

Route::middleware('tenant')->group(function () {
    Route::get('/posts', [PostController::class, 'index']);
});

That is the whole integration. The controller needs no where() clause — Post::all() only ever returns the current tenant's rows.

Documentation

The full guide — every layer, the resolver chain, the API, events, testing helpers, gotchas and architecture — lives in USAGE.md.

See CHANGELOG.md for release notes.

License

MIT. See LICENSE.