Stop Data Leaks: Tenant Scopes in Laravel 🛡️

The Cross-Tenant Catastrophe

When engineering a multi-tenant B2B SaaS platform at Smart Tech Devs, thousands of different companies share the exact same database. Your invoices table holds the financial records for Apple, Microsoft, and Acme Corp simultaneously, separated only by a tenant_id column.

The standard developer approach is to manually append where('tenant_id', $user->tenant_id) to every single Eloquent query. This is an architectural ticking time bomb. If a junior developer writes an API endpoint and simply forgets to add that one specific where clause, Invoice::all() will return Apple's invoices to an employee at Acme Corp. You have just triggered a catastrophic, company-ending data breach. To build zero-trust architectures, you cannot rely on human memory. You must mathematically enforce boundaries using Global Scopes.

The Solution: Architectural Guardrails

Laravel's Global Scopes allow you to define a constraint that is automatically applied to every single query executed by a specific Eloquent model. The developer doesn't have to remember to add it; the framework injects it seamlessly at the lowest level of the query builder.

Step 1: Architecting the Scope

First, we create a dedicated Scope class that extracts the current user's Tenant ID from the session or API token and applies it to the query.

namespace App\Models\Scopes;

use Illuminate\Database\Eloquent\Builder;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Scope;
use Illuminate\Support\Facades\Auth;

class TenantScope implements Scope
{
    public function apply(Builder $builder, Model $model)
    {
        // If a user is authenticated, force the query to ONLY search within their tenant
        if (Auth::check()) {
            $builder->where($model->getTable() . '.tenant_id', Auth::user()->tenant_id);
        }
    }
}

Step 2: The Self-Applying Trait

Instead of manually registering this scope on 50 different models, we create a reusable Trait. This Trait automatically applies the scope and seamlessly injects the tenant_id when creating new records.

namespace App\Models\Traits;

use App\Models\Scopes\TenantScope;
use Illuminate\Support\Facades\Auth;

trait BelongsToTenant
{
    protected static function bootBelongsToTenant()
    {
        // 1. Apply the read-boundary globally
        static::addGlobalScope(new TenantScope);

        // 2. Automatically inject the tenant_id on creation (write-boundary)
        static::creating(function ($model) {
            if (Auth::check() && ! $model->tenant_id) {
                $model->tenant_id = Auth::user()->tenant_id;
            }
        });
    }
}

Step 3: Bulletproof Models

Now, your developers simply add one line to the Model. If a junior developer writes Invoice::all(), Laravel intercepts the query, translates it to SELECT * FROM invoices WHERE tenant_id = 5, and executes it securely.

namespace App\Models;

use Illuminate\Database\Eloquent\Model;
use App\Models\Traits\BelongsToTenant;

class Invoice extends Model
{
    // This single line makes data breaches mathematically impossible.
    use BelongsToTenant;
}

The Engineering ROI

By enforcing Global Scopes, you shift data security from a human responsibility to a framework guarantee. You completely eradicate the risk of cross-tenant data bleed in your APIs, simplify your controller logic by stripping redundant where() clauses, and establish an ironclad foundation for scaling enterprise multi-tenancy securely.