Multi-Tenancy

protected void ApplyTenantFilters(ModelBuilder modelBuilder)
{
    foreach (var entityType in modelBuilder.Model.GetEntityTypes())
    {
        var tenantIdProperty = entityType.FindProperty("TenantId");
        var tenantIdClrType = tenantIdProperty?.ClrType;

        if (tenantIdClrType == typeof(Guid) || tenantIdClrType == typeof(Guid?))
        {
            var method = typeof(BaseDbContext)
                .GetMethod(
                    nameof(ApplyTenantFilterForEntity),
                    System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance
                )!
                .MakeGenericMethod(entityType.ClrType);

            method.Invoke(this, new object[] { modelBuilder, tenantIdClrType });
        }
    }
}

private void ApplyTenantFilterForEntity<TEntity>(ModelBuilder modelBuilder, Type tenantIdClrType)
    where TEntity : class
{
    var parameter = Expression.Parameter(typeof(TEntity), "e");
    var tenantId = CreateTenantIdExpression(parameter, tenantIdClrType);
    var currentTenantId = Expression.Property(
        Expression.Constant(this),
        typeof(BaseDbContext).GetProperty(
            nameof(CurrentTenantId),
            System.Reflection.BindingFlags.Instance | System.Reflection.BindingFlags.NonPublic
        )!
    );

    // e.TenantId == null || e.TenantId == this.CurrentTenantId
    var tenantFilterBody = Expression.OrElse(
        Expression.Equal(tenantId, Expression.Constant(null, typeof(Guid?))),
        Expression.Equal(tenantId, currentTenantId)
    );

    var entityBuilder = modelBuilder.Entity<TEntity>();

    foreach (var existingFilter in entityBuilder.Metadata.GetDeclaredQueryFilters())
    {
        var existingExpression = existingFilter.Expression;
        if (existingExpression is null) continue;

        var existingBody = new ParameterReplaceVisitor(
            existingExpression.Parameters[0],
            parameter
        ).Visit(existingExpression.Body)!;

        tenantFilterBody = Expression.AndAlso(existingBody, tenantFilterBody);
    }

    entityBuilder.HasQueryFilter(
        Expression.Lambda<Func<TEntity, bool>>(tenantFilterBody, parameter)
    );
}

public Guid? ContextTenantId
{
    get
    {
        if (!HasPermission("tenants.drill_down")) return null;

        var header = _httpContextAccessor.HttpContext?.Request.Headers["X-Tenant-Context"];
        var contextTenantStr = header?.ToString();
        if (string.IsNullOrEmpty(contextTenantStr)) return null;

        var decryptedId = _idEncryptionService.TryDecrypt(contextTenantStr) ?? Guid.Empty;
        return decryptedId != Guid.Empty ? decryptedId : null;
    }
}

public Guid? TenantId => ContextTenantId.HasValue ? ContextTenantId.Value : _claimTenantId;

var tenantContextHeader = context.Request.Headers["X-Tenant-Context"].FirstOrDefault();
if (!string.IsNullOrEmpty(tenantContextHeader))
{
    if (!currentUser.HasPermission("tenants.drill_down"))
    {
        context.Response.StatusCode = 403;
        await context.Response.WriteAsJsonAsync(new {
            error = "TENANT_CONTEXT_FORBIDDEN",
            message = "You do not have permission to switch tenant context. Missing: tenants.drill_down"
        });
        return;
    }
}

public class Tenant : AuditableEntity<Guid>
{
    [Required] [MaxLength(200)]
    public string Name { get; set; } = null!;

    [Required] [MaxLength(50)]
    public string Code { get; set; } = null!;

    public Guid? ParentTenantId { get; set; }     // Self-ref FK -> tree

    public int HierarchyLevel { get; set; }        // 0 = root, 1 = child, 2 = grandchild...

    [MaxLength(500)]
    public string HierarchyPath { get; set; } = "/"; // Materialized path: "/root-id/child-id/"

    // Navigation
    public virtual Tenant? ParentTenant { get; set; }
    public virtual ICollection<Tenant> ChildTenants { get; set; } = [];
    public virtual TenantSettings? Settings { get; set; }
}

// Descendant Verification (StartsWith path matching utilizes indexes)
public async Task<bool> IsDescendantOrSameAsync(Guid parentTenantId, Guid targetTenantId, CancellationToken ct = default)
{
    if (parentTenantId == targetTenantId) return true;

    var targetPath = await GetHierarchyPathAsync(targetTenantId, ct);
    if (string.IsNullOrEmpty(targetPath)) return false;

    return targetPath.Contains($"/{parentTenantId}/");
}

// Sub-tree Retrieval using StartsWith (LIKE 'path%')
public async Task<IReadOnlyList<Guid>> GetDescendantIdsAsync(Guid parentTenantId, CancellationToken ct = default)
{
    var parentPath = await GetHierarchyPathAsync(parentTenantId, ct);
    if (string.IsNullOrEmpty(parentPath)) return Array.Empty<Guid>();

    var descendants = await _tenantRepository.GetDescendantsAsync(parentPath, ct);
    return descendants.Select(t => t.Id).ToList();
}

// Provisioning Super Admin & Default Roles within an atomic database transaction
var superAdminRole = Role.Create("${tenant.Code}_SUPER_ADMIN", "Super Administrator", tenant.Id);
superAdminRole.IsSystem = true;
superAdminRole.IsDeletable = false;
superAdminRole.IsTenantSuperAdmin = true;
superAdminRole.IsPermissionLocked = false; // Unlocked for scaffolding

var defaultRole = Role.Create("${tenant.Code}_DEFAULT", "Default User Role", tenant.Id);
defaultRole.IsSystem = true;
defaultRole.IsDeletable = false;
defaultRole.IsDefaultRole = true;

await _roleRepository.AddAsync(superAdminRole, ct);
await _roleRepository.AddAsync(defaultRole, ct);

// Lock transition phase:
// 1. AssignEditionCommand executes post-creation, raising SubscriptionChangedEvent.
// 2. SyncSuperAdminRolePermissionsAsync copies edition permissions to SUPER_ADMIN.
// 3. SUPER_ADMIN is set to IsPermissionLocked = true, freezing permissions.

// 1. Descendant check gate
if (tenant.ChildTenants?.Count > 0 && !request.CascadeChildren)
{
    var childCount = await _tenantRepository.GetDescendantCountAsync(tenant.Id, ct);
    return Error.Validation(
        ErrorCodes.ValidationFailed,
        _l["tenant.cannotDeleteWithDescendants", new { count = childCount }]
    );
}

// 2. Plan feature check & permissions validation
var cascadeEnabled = await _featureChecker.IsEnabledAsync(_currentUser.TenantId.Value, "Identity.CascadeDelete.Enabled", ct);
if (!cascadeEnabled) return Error.Forbidden(ErrorCodes.Forbidden, _l["feature.notAvailable"]);

if (!_currentUser.HasPermission("tenants.cascade_delete")) return Error.Forbidden(ErrorCodes.Forbidden, _l["permission.missing"]);

// 3. Bottom-up deletion ordering (deepest children soft-deleted first)
var descendantIds = await _tenantRepository.GetDescendantIdsAsync(tenant.Id, ct);
foreach (var descendantId in descendantIds.Reverse())
{
    var descendant = await _tenantRepository.GetByIdAsync(descendantId, ct);
    if (descendant != null && !descendant.IsDeleted)
    {
        _tenantRepository.Delete(descendant);
    }
}

// 4. Bulk soft deletes and junction cleanups
await _adminRepository.BulkSoftDeleteByTenantIdsAsync(targetTenantIds, ct);
await _roleRepository.BulkSoftDeleteByTenantIdsAsync(targetTenantIds, ct);

foreach (var tenantId in targetTenantIds)
{
    await _tenantPermissionRepository.RemoveAllDirectAsync(tenantId, ct);
    await _tenantDomainRepository.SoftDeleteAllForTenantAsync(tenantId, ct);
}

// 5. Auditing & Quota Reconciliation
await _auditService.LogEntityChangeAsync(
    targetTenantIds.Count > 1 ? AuditEventTypes.BulkTenantCascadeDelete : AuditEventTypes.Delete,
    "Tenant", tenant.Id.ToString(), auditDetails, null, null, ct
);

if (tenant.ParentTenantId.HasValue)
    await _quotaService.OnResourceDeletedAsync(tenant.ParentTenantId.Value, "subtenant", ct);

const hostname = window.location.hostname;
const isPlatform = hostname === "localhost" || hostname === process.env.NEXT_PUBLIC_APP_URL;

if (isPlatform) {
  loadPlatformBranding();
} else {
  const resolved = await resolveTenantApi(hostname);
  loadTenantBranding(resolved);
}

public async Task<Result<TenantResolutionResponse>> Handle(ResolveTenantByDomainQuery request, CancellationToken ct)
{
    // Query verified domain from TenantDomain table
    var domain = await _tenantDomainRepository.GetByDomainAsync(request.Host, ct);
    if (domain == null || !domain.IsVerified)
    {
        // Dev Mode Fallback: query by ?code= parameter
        return await ResolveByCodeAsync(request.Code, ct);
    }
    
    var tenant = await _tenantRepository.GetByIdAsync(domain.TenantId, ct);
    var settings = tenant.Settings;
    
    // Deep-merge login branding override on top of default platform settings
    var branding = settings?.IsSafeMode == true ? null 
        : (settings?.LoginBrandingJson ?? sys?.LoginBrandingJson);
}

// Verify custom domain using DnsClient.NET TXT record checking
var domain = await _tenantDomainRepository.GetByIdAsync(request.DomainId, ct);
var expectedHost = $"\{_tenancySettings.VerificationPrefix\}.\{domain.Domain\}";
var result = await lookup.QueryAsync(expectedHost, QueryType.TXT, ct);

// Checks if TXT record includes the verification token
var verified = result.Answers.TxtRecords().Any(r => r.Text.Contains(domain.VerificationToken));
if (verified)
{
    domain.IsVerified = true;
    await _unitOfWork.SaveChangesAsync(ct);
}

{
  "Tenancy": {
    "PlatformDomain": "scripe.com",       // Auto-subdomains: {code}.scripe.com
    "CnameTarget": "app.scripe.com",      // DNS instruction: CNAME -> this
    "VerificationPrefix": "_scr-verify",  // TXT record: _scr-verify.{domain}
    "TokenPrefix": "scr_"                 // Token format: scr_base64...
  }
}

public sealed class TenancySettings
{
    public const string SectionName = "Tenancy";

    public string PlatformDomain { get; init; } = "scripe.com";
    public string CnameTarget { get; init; } = "app.scripe.com";
    public string VerificationPrefix { get; init; } = "_scr-verify";
    public string TokenPrefix { get; init; } = "scr_";
}