drizzle-tenant-queries

name	drizzle-tenant-queries
description	Use this skill when you write or review any Drizzle DB read/write and must enforce strict `workspace_id` tenant isolation.

Drizzle Tenant Query Skill

Use this skill whenever you write or review Drizzle ORM queries. Goal: absolute tenant isolation and correctness for money/time data.

Golden rules

• Every query must include workspace_id. No exceptions.
• Derive workspaceId server-side via your tenant/workspace guard (Server Actions / Server Components); never trust client params.
• In Route Handlers, use a guard appropriate for handlers (non-React cached).
• Use UUIDs for public IDs; avoid exposing sequential IDs.
• Money stored as integer cents + currency code. Time stored UTC.

Query patterns

• db.query.table.findMany({ where: eq(table.workspaceId, workspaceId), ... })
• For joins, include workspace filter on primary table and any joined tables that are tenant-scoped.
• For updates/deletes, always include workspace filter in where with the entity ID.

Example (list projects with client):

const rows = await db.query.projects.findMany({
  where: eq(projects.workspaceId, workspaceId),
  with: { client: true },
});

Example (update invoice guarded):

await db
  .update(invoices)
  .set({ status: "draft" })
  .where(
    and(eq(invoices.id, invoiceId), eq(invoices.workspaceId, workspaceId))
  );

Snapshot & invoices

• When finalizing invoices, create snapshot row tied to invoice_id and workspace_id.
• PDFs for finalized invoices must read from snapshot.

Caching & reuse

• Wrap read helpers in cache() when reused within a request.
• Prefer small helpers per entity: getClientsByWorkspace, getProjectsByWorkspace, getInvoiceWithItems (scoped).

Tenant-safe caching rules:

• Request-level cache() is safe when the function arguments include workspaceId.
• Cross-request caching (e.g., Next.js next/cache) must include workspace identity in keys/tags.
• Never use “global” cache keys/tags for tenant-private tables.

See also: nextjs-cost-performance skill

Query performance patterns (still tenant-safe)

• Avoid N+1 in rendering: batch by IDs with inArray(...) or use Drizzle relations (with).
• Select only needed columns (reduces serialization and bandwidth).
• Prefer Promise.all for independent reads.
• Consider indexes for hot filters (workspace_id, foreign keys, timestamps) via migrations.

Edge cases

• Prevent cross-tenant joins by scoping both sides.
• Avoid nullable money fields; prefer 0 default + currency code.
• Timezone: store UTC; convert at display.

Testing

• Write isolation tests: querying entity from another workspace should return 0.
• Validate migrations with your migration toolchain (e.g., drizzle-kit).

References

• Schema: your DB schema module(s)
• Tenant/workspace helper: your server-side tenant guard module
• Product spec: your PRD/spec doc (if present)