Platform Control Plane
db
Typed Prisma client wrapper — extension-aware, RLS-friendly, with per-tenant connection pinning when the deployment splits writes from reads.
Query · packages/platform/db
RLSenforcedapps/web/app/posts/page.tsx
// Tenant context resolved by @nebutra/tenant middleware
const ctx = getCurrentTenant();
const posts = await prisma.post.findMany({
where: {
tenantId: ctx.tenant.id,
published: true,
},
orderBy: { publishedAt: "desc" },
take: 5,
});
// → Prisma client wrapped with withRls(prisma, ctx.tenant.id)
// → PostgreSQL enforces RLS via SET LOCAL app.tenant_id
Query results
tenant-scoped via row-level security
| id | title | tenant_id | published_at |
|---|---|---|---|
| pst_01HF…a3k | Launching multi-tenant RLS | tenant_a | 2026-05-21 |
| pst_01HF…b7m | Migrating off shared schemas | tenant_a | 2026-05-18 |
| pst_01HF…c2q | Internal roadmap (draft) | tenant_b | 2026-05-17 |
| pst_01HF…d9s | Customer-only changelog | tenant_c | 2026-05-15 |
| pst_01HF…e4w | RFC: schema-per-tenant | tenant_b | 2026-05-12 |
RLS hides rows belonging to other tenants — they never leave the database.
Visible rows
847
in tenant_a
Hidden by RLS
12,401
other tenants
More in nebutra.com
- alertingAlert rules + delivery on top of @nebutra/metering. Threshold/anomaly detection, route to PagerDuty, Discord, or in-product banners.
- analyticsFirst-party product analytics on ClickHouse — event ingest, funnel queries, no third-party loader on the marketing site.
- browser-utilsSmall browser helpers every app needs: storage that survives private mode and blocked site data, and fetch with a timeout.
- capability-kitComposable capability primitives — pricing tier ↔ feature flag ↔ quota ↔ UI gating wired into one declarative manifest.
- configTyped environment + runtime config — Zod schemas at boot, no scattered process.env reads, fail-fast on missing keys.
- errorsTyped application error taxonomy — UserError, AuthError, RateLimitError. Maps cleanly to HTTP, to logs, to Sentry, to the in-product toast.