var n=Object.defineProperty;var r=(e)=>e;function s(e,a){this[e]=r.bind(null,a)}var l=(e,a)=>{for(var i in a)n(e,i,{get:a[i],enumerable:!0,configurable:!0,set:s.bind(a,i)})};var d=(e,a)=>()=>(e&&(a=e(e=0)),a);import{jsx as t,jsxs as o}from"react/jsx-runtime";function p(){return o("div",{className:"space-y-8",children:[o("div",{className:"space-y-4",children:[t("h1",{className:"font-bold text-4xl",children:"Tenant Isolation"}),t("p",{className:"text-lg text-muted-foreground",children:'Preventing cross-tenant data leaks is the #1 security priority for any SaaS. ContractSpec employs "Defense in Depth" to ensure safety.'})]}),o("div",{className:"space-y-4",children:[t("h2",{className:"font-bold text-2xl",children:"Layer 1: RLS Middleware"}),o("p",{children:["The primary defense is the Prisma middleware that rewrites queries to include ",t("code",{children:"WHERE tenantId = ?"}),". This protects against developer error (forgetting to filter)."]})]}),o("div",{className:"space-y-4",children:[t("h2",{className:"font-bold text-2xl",children:"Layer 2: Isolation Validator"}),o("p",{children:["For high-security environments, you can use the"," ",t("code",{children:"IsolationValidator"})," in your test suite to verify that every query generated by your operations actually includes the tenant ID."]}),t("pre",{className:"rounded-lg border bg-muted p-4 text-sm",children:`import { IsolationValidator } from '@contractspec/lib.multi-tenancy/isolation';

test('findUser query is isolated', () => {
  const isValid = IsolationValidator.validateQuery(
    'User',
    'findFirst',
    args,
    'tenant-123'
  );
  expect(isValid).toBe(true);
});`})]}),o("div",{className:"space-y-4",children:[t("h2",{className:"font-bold text-2xl",children:"Layer 3: Policy Engine"}),t("p",{children:"The Policy Decision Point (PDP) verifies that the authenticated user actually belongs to the requested tenant before any operation logic runs."})]})]})}export{p as SafetyTenantIsolationPage};
