// Provides patterns and guidance for implementing user-scoped data filtering and multi-tenancy in web applications. Use this skill when you need to: (1) Restrict data access based on user identity, (2) Implement ownership checks for database operations, (3) Build multi-tenant applications with organization-level data scoping, (4) Implement admin bypass for viewing all data, (5) Create audit trails for data access. This skill focuses on Python, FastAPI, and SQLAlchemy.
| name | user-scoped-data-filtering |
| description | Provides patterns and guidance for implementing user-scoped data filtering and multi-tenancy in web applications. Use this skill when you need to: (1) Restrict data access based on user identity, (2) Implement ownership checks for database operations, (3) Build multi-tenant applications with organization-level data scoping, (4) Implement admin bypass for viewing all data, (5) Create audit trails for data access. This skill focuses on Python, FastAPI, and SQLAlchemy. |
This skill provides patterns and best practices for implementing robust user-scoped data filtering and multi-tenancy in your application. The focus is on a Python-based stack using FastAPI for the web framework and SQLAlchemy for the ORM.
Implementing proper data scoping is critical for security and privacy in multi-user applications. This skill breaks down the process into several key areas, each with its own reference guide.
User Context Extraction: The first step is to reliably identify the current user. This is typically done by extracting user information from an authentication token (e.g., JWT).
references/user-context.md.Scoped Database Queries: Once you have the user's identity, you must filter all database queries to only return data they are authorized to see.
references/scoped-queries.md.Ownership Verification: For write operations (updates and deletes), you must verify that the user owns the resource they are trying to modify. This is often implemented using decorators or dependencies.
references/ownership-verification.md.Multi-Tenancy: In many applications, data is scoped not just by user, but by a higher-level entity like an organization or a team.
references/multi-tenancy.md.Admin Bypass: Administrative users often need to bypass these scoping rules to view and manage data across all users and organizations.
references/admin-bypass.md.Audit Trail: It's important to log who is accessing and modifying data, especially when admin bypass is used.
references/audit-trail.md.Start by reviewing references/user-context.md to set up your user identification dependency. Then, move on to references/scoped-queries.md to apply filtering to your data access layer. Implement the other patterns as needed for your application's requirements.