// @bun
import{jsx as e,jsxs as t}from"react/jsx-runtime";function a(){return t("div",{className:"space-y-8",children:[t("div",{className:"space-y-4",children:[e("h1",{className:"font-bold text-4xl",children:"Tenant Isolation"}),e("p",{className:"text-lg text-muted-foreground",children:'Preventing cross-tenant data leaks is the #1 security priority for any SaaS. ContractSpec employs "Defense in Depth" to ensure safety.'})]}),t("div",{className:"space-y-4",children:[e("h2",{className:"font-bold text-2xl",children:"Layer 1: RLS Middleware"}),t("p",{children:["The primary defense is the Prisma middleware that rewrites queries to include ",e("code",{children:"WHERE tenantId = ?"}),". This protects against developer error (forgetting to filter)."]})]}),t("div",{className:"space-y-4",children:[e("h2",{className:"font-bold text-2xl",children:"Layer 2: Isolation Validator"}),t("p",{children:["For high-security environments, you can use the"," ",e("code",{children:"IsolationValidator"})," in your test suite to verify that every query generated by your operations actually includes the tenant ID."]}),e("pre",{className:"rounded-lg border bg-muted p-4 text-sm",children:`import { IsolationValidator } from '@contractspec/lib.multi-tenancy/isolation';

test('findUser query is isolated', () => {
  const isValid = IsolationValidator.validateQuery(
    'User',
    'findFirst',
    args,
    'tenant-123'
  );
  expect(isValid).toBe(true);
});`})]}),t("div",{className:"space-y-4",children:[e("h2",{className:"font-bold text-2xl",children:"Layer 3: Policy Engine"}),e("p",{children:"The Policy Decision Point (PDP) verifies that the authenticated user actually belongs to the requested tenant before any operation logic runs."})]})]})}export{a as SafetyTenantIsolationPage};
