Be careful when filtering data in a mutli-tenancy project!

[micraux]

Hello,

I struggled on this for the last 30 minutes so I share, just in case.

I use the Multi-tenancy feature in my current project: Companies (tenants) selling Products to Clients.

Each Company has its own Clients, but Products are the same for all Companies:

// ClientResource
protected static bool $isScopedToTenant = true;

// ProductResource
protected static bool $isScopedToTenant = false;

In my ListClients and ListProducts pages, I want to have a filter showing the ACTIVE records with count.

I followed the documentation and couldn't understand why the count was correct for the Products but not for the Clients.

After a while, I discovered that the ->badge() query isn't scoped to tenants.

So I had to add an extra ->where() for the Clients:

// ListProducts
public function getTabs(): array
{
    return [
        'active' => Tab::make()
            ->modifyQueryUsing(fn (Builder $query) => $query->where('is_active' , true))
            ->badge(Products:query()
                ->where('is_active', true)
                ->count()
            ),
    ];
}

// ListClients
public function getTabs(): array
{
    return [
        'active' => Tab::make()
            ->modifyQueryUsing(fn (Builder $query) => $query->where('is_active' , true))
            ->badge(Client::query()                              //      /  Add this to retrieve \
                ->where('company_id', Filament::getTenant()->id) // <-- |  only Clients belonging |
                ->where('is_active', true)                       //      \   to current Tenant.  /
                ->count()
            ),
    ];
}

Hope this will help someone!

[michelbarutot]

Hello! Thanks for sharing your showcase.

Just for clarifying: on filament docs: https://filamentphp.com/docs/3.x/panels/tenancy#tenancy-security it's clear that filament does not will scope everything. Filament will basicly scope resources and assing the correct tenant_id to created models, almost almost everything else you will have to scope manually.