SaaS 架构设计与技术选型

// lib/db/tenant.ts
import { eq } from 'drizzle-orm'
import { db } from './index'
import { projects } from './schema'
import { getCurrentTenantId } from '@/lib/auth'
 
// 核心原则：绝不暴露不带 tenant_id 的查询
export async function withTenant<T>(
  queryFn: (tenantId: string) => Promise<T>
): Promise<T> {
  const tenantId = await getCurrentTenantId()
  if (!tenantId) throw new Error('Tenant context required')
  return queryFn(tenantId)
}
 
// 使用示例：所有业务查询都必须走 withTenant
export async function getProjects() {
  return withTenant((tenantId) =>
    db.select().from(projects).where(eq(projects.tenantId, tenantId))
  )
}
 
export async function createProject(name: string) {
  return withTenant((tenantId) =>
    db.insert(projects).values({ name, tenantId }).returning()
  )
}

-- 1. 启用 RLS
ALTER TABLE projects ENABLE ROW LEVEL SECURITY;
 
-- 2. 创建策略：只能访问当前租户的数据
-- current_setting('app.tenant_id') 由应用层在每个请求开始时设置
CREATE POLICY tenant_isolation ON projects
  USING (tenant_id = current_setting('app.tenant_id')::uuid);
 
-- 3. 对 INSERT 同样限制，防止插入到其他租户
CREATE POLICY tenant_insert ON projects
  FOR INSERT WITH CHECK (tenant_id = current_setting('app.tenant_id')::uuid);

// lib/db/rls.ts
import { sql } from 'drizzle-orm'
import { db } from './index'
 
export async function withRLS<T>(tenantId: string, fn: () => Promise<T>) {
  // set_config 第三个参数 true = 仅当前事务有效，请求结束自动清除
  await db.execute(sql`SELECT set_config('app.tenant_id', ${tenantId}, true)`)
  return fn()
}
 
// 在 Server Action 中使用
export async function getProjects() {
  const tenantId = await getCurrentTenantId()
  return withRLS(tenantId, () =>
    db.select().from(projects)  // 不需要 WHERE——RLS 自动过滤！
  )
}

// middleware.ts
import { NextRequest, NextResponse } from 'next/server'
 
export function middleware(request: NextRequest) {
  const hostname = request.headers.get('host') || ''
  const baseDomain = process.env.NEXT_PUBLIC_ROOT_DOMAIN! // 'example.com'
 
  // 提取子域名：workspace.example.com → 'workspace'
  const subdomain = hostname.replace(`.${baseDomain}`, '').split('.')[0]
 
  // 排除主域名和特殊子域名
  const isSubdomain =
    subdomain && subdomain !== 'www' && hostname !== baseDomain
 
  if (isSubdomain) {
    // 将 tenant slug 写入请求头，后续 Server Component 可通过 headers() 读取
    const headers = new Headers(request.headers)
    headers.set('x-tenant-slug', subdomain)
    return NextResponse.next({ request: { headers } })
  }
 
  return NextResponse.next()
}
 
export const config = { matcher: ['/((?!api|_next/static|favicon.ico).*)'] }

// lib/auth/tenant.ts
import { headers } from 'next/headers'
import { db } from '@/lib/db'
import { tenants } from '@/lib/db/schema'
import { eq } from 'drizzle-orm'
import { cache } from 'react'
 
// cache() 保证同一个请求内只查一次数据库
export const getCurrentTenant = cache(async () => {
  const headerList = await headers()
  const slug = headerList.get('x-tenant-slug')
  if (!slug) return null
  const [tenant] = await db.select().from(tenants).where(eq(tenants.slug, slug))
  return tenant ?? null
})

// lib/db/schema.ts
import { pgTable, uuid, text, timestamp, pgEnum } from 'drizzle-orm/pg-core'
import { relations } from 'drizzle-orm'
 
export const roleEnum = pgEnum('role', ['owner', 'admin', 'member', 'viewer'])
export const planEnum = pgEnum('plan', ['free', 'pro', 'enterprise'])
 
export const users = pgTable('users', {
  id: uuid('id').primaryKey().defaultRandom(),
  email: text('email').notNull().unique(),
  name: text('name'),
  avatarUrl: text('avatar_url'),
  createdAt: timestamp('created_at').defaultNow().notNull(),
})
 
export const tenants = pgTable('tenants', {
  id: uuid('id').primaryKey().defaultRandom(),
  name: text('name').notNull(),
  slug: text('slug').notNull().unique(),  // 子域名标识
  plan: planEnum('plan').default('free').notNull(),
  stripeCustomerId: text('stripe_customer_id'),
  createdAt: timestamp('created_at').defaultNow().notNull(),
})
 
export const memberships = pgTable('memberships', {
  id: uuid('id').primaryKey().defaultRandom(),
  userId: uuid('user_id').references(() => users.id, { onDelete: 'cascade' }).notNull(),
  tenantId: uuid('tenant_id').references(() => tenants.id, { onDelete: 'cascade' }).notNull(),
  role: roleEnum('role').default('member').notNull(),
  createdAt: timestamp('created_at').defaultNow().notNull(),
})
 
// 关系定义——让 Drizzle 的 query API 支持 JOIN
export const usersRelations = relations(users, ({ many }) => ({
  memberships: many(memberships),
}))
 
export const tenantsRelations = relations(tenants, ({ many }) => ({
  memberships: many(memberships),
}))
 
export const membershipsRelations = relations(memberships, ({ one }) => ({
  user: one(users, { fields: [memberships.userId], references: [users.id] }),
  tenant: one(tenants, { fields: [memberships.tenantId], references: [tenants.id] }),
}))