Skip to content

[Full Stack] Implement Data Isolation by User (Multi-Tenancy) #33

@Sakemo

Description

@Sakemo

Description:
This is the final and most critical step for multi-user support. Authentication alone is not enough; we must ensure that a user's data (their products, sales, etc.) is completely invisible and inaccessible to other users.

Tasks (Backend):

Entity Relationships: Add a @ManyToOne relationship to the User entity in all primary business entities: Product, Sale, Customer, Expense, Category, Provider.

Service Layer Refactoring: Modify all service methods (findAll, findById, create, update, delete) to always include a filter for the currently authenticated user's ID. The user can be retrieved from the SecurityContextHolder.

    Example: productRepository.findByIdAndUserId(productId, userId).

    When creating a new resource (e.g., createProduct), the authenticated User must be associated with it before saving.

Database Update: Ensure the database schema is updated (via ddl-auto: update in dev or a migration script) to add the new user_id foreign key columns.

Acceptance Criteria:

Test Scenario:

User A registers and logs in.

User A creates 3 products and 1 customer.

User A logs out.

User B registers and logs in.

User B navigates to the products page. They must see 0 products.

User B navigates to the customers page. They must see 0 customers.

An attempt by User A to directly access a resource owned by User B via the API (if the ID is known) must result in a 404 Not Found.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions