// @bun
// src/components/docs/safety/SafetyTenantIsolationPage.tsx
import { jsx, jsxs } from "react/jsx-runtime";
function SafetyTenantIsolationPage() {
  return /* @__PURE__ */ jsxs("div", {
    className: "space-y-8",
    children: [
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h1", {
            className: "text-4xl font-bold",
            children: "Tenant Isolation"
          }),
          /* @__PURE__ */ jsx("p", {
            className: "text-muted-foreground text-lg",
            children: 'Preventing cross-tenant data leaks is the #1 security priority for any SaaS. ContractSpec employs "Defense in Depth" to ensure safety.'
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Layer 1: RLS Middleware"
          }),
          /* @__PURE__ */ jsxs("p", {
            children: [
              "The primary defense is the Prisma middleware that rewrites queries to include ",
              /* @__PURE__ */ jsx("code", {
                children: "WHERE tenantId = ?"
              }),
              ". This protects against developer error (forgetting to filter)."
            ]
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Layer 2: Isolation Validator"
          }),
          /* @__PURE__ */ jsxs("p", {
            children: [
              "For high-security environments, you can use the",
              " ",
              /* @__PURE__ */ jsx("code", {
                children: "IsolationValidator"
              }),
              " in your test suite to verify that every query generated by your operations actually includes the tenant ID."
            ]
          }),
          /* @__PURE__ */ jsx("pre", {
            className: "bg-muted rounded-lg border p-4 text-sm",
            children: `import { IsolationValidator } from '@contractspec/lib.multi-tenancy/isolation';

test('findUser query is isolated', () => {
  const isValid = IsolationValidator.validateQuery(
    'User',
    'findFirst',
    args,
    'tenant-123'
  );
  expect(isValid).toBe(true);
});`
          })
        ]
      }),
      /* @__PURE__ */ jsxs("div", {
        className: "space-y-4",
        children: [
          /* @__PURE__ */ jsx("h2", {
            className: "text-2xl font-bold",
            children: "Layer 3: Policy Engine"
          }),
          /* @__PURE__ */ jsx("p", {
            children: "The Policy Decision Point (PDP) verifies that the authenticated user actually belongs to the requested tenant before any operation logic runs."
          })
        ]
      })
    ]
  });
}
export {
  SafetyTenantIsolationPage
};
