qa-multi-tenancy
Tenant-isolation testing for B2B SaaS: row-level security, cross-tenant leak detection, tenant-id propagation tracing, isolation-model references (silo / pool / bridge), and adversarial review of tenant-leak risk.
Install this plugin
/plugin install qa-multi-tenancy@testland-qaPart of role bundle: qa-role-security
qa-multi-tenancy
Tenant-isolation testing for B2B SaaS: row-level security, cross-tenant leak detection, tenant-id propagation tracing, isolation-model references (silo / pool / bridge), and adversarial review of tenant-leak risk.
Components
| Type | Name | Description |
|---|---|---|
| Skill | cross-tenant-data-leak-tests | Workflow-driven skill that emits the runtime CI gate of cross-tenant leak tests - the actual battery a multi-tenant codebase must pass on... |
| Skill | multi-engine-row-level-security-reference | Pure-reference catalog of row/tenant isolation mechanisms for non-Postgres engines: MySQL and MariaDB (no native RLS - views with SQL SEC... |
| Skill | row-level-security-postgres-reference | Pure-reference catalog of Postgres Row-Level Security (RLS) for tenant isolation. |
| Skill | tenant-isolation-models-reference | Pure-reference catalog of tenant-isolation models for B2B SaaS. |
| Skill | tenant-leak-test-author | Workflow-driven skill that builds a tenant-leak test plan from an inventory of tenant-bearing surfaces (database tables, APIs, object sto... |
| Skill | tenant-onboarding-test-author | Workflow-driven skill that authors a test suite for tenant provisioning and offboarding: account creation, isolation at creation (no cros... |
| Agent | tenant-id-propagation-tracer | Read-only specialist that traces how tenant_id flows through a single code path - from the request entry (HTTP handler, queue listener, s... |
| Agent | tenant-leak-critic | Adversarial agent that reviews a PR or set of changed files for tenant-leak risk. |
Install
/plugin marketplace add testland/qa
/plugin install qa-multi-tenancy@testland-qaSkills
cross-tenant-data-leak-tests
Workflow-driven skill that emits the runtime CI gate of cross-tenant leak tests - the actual battery a multi-tenant codebase must pass on every PR. Defines the canonical test patterns (read-other-tenant-by-id, list-leak, spoofed-tenant-id-in-body, JWT-replay, FK-cross-tenant, unique-collision side channel, object-storage IDOR, search-index-direct-query, async-job-context-reload, cache-key-collision), the expected response codes per pattern (404 vs 403 disclosure trade-off), the Postgres-RLS-direct test patterns, and the CI integration (run with non-superuser non-BYPASSRLS role, fail the build on any leak). Use when implementing the actual leak-test suite (after tenant-leak-test-author produces the plan), when adding the CI gate to an existing project, or when investigating a leak finding.
multi-engine-row-level-security-reference
Pure-reference catalog of row/tenant isolation mechanisms across four database engines: MySQL and MariaDB (no native RLS - views with SQL SECURITY INVOKER plus app-layer enforcement), CockroachDB (native RLS via ALTER TABLE ENABLE ROW LEVEL SECURITY and CREATE POLICY, matching Postgres semantics), Vitess (keyspace sharding + vindexes route tenant writes to dedicated shards without a policy layer), and SQL Server (CREATE SECURITY POLICY with inline table-valued function filter/block predicates). Covers the isolation mechanism, tenant-context pattern, bypass risks, and test patterns for each engine. Use when designing or auditing tenant isolation on MySQL, MariaDB, CockroachDB, Vitess, or SQL Server.
row-level-security-postgres-reference
Pure-reference catalog of Postgres Row-Level Security (RLS) for tenant isolation. Covers enabling RLS (ALTER TABLE ... ENABLE ROW LEVEL SECURITY, default-deny semantics), CREATE POLICY syntax (USING vs WITH CHECK clauses, FOR SELECT/INSERT/UPDATE/DELETE/ALL, permissive vs restrictive, TO role_name), bypassing RLS (superuser / BYPASSRLS / table owner / FORCE ROW LEVEL SECURITY), tenant context patterns (current_user, current_setting, JWT claims via Supabase auth.uid() / auth.jwt()), performance discipline (wrapping auth functions in SELECT, index on policy-referenced columns), and anti-patterns. Use as the RLS-pattern reference for Postgres-backed tenant isolation. Consumed by tenant-leak-test-author, cross-tenant-data-leak-tests.
tenant-isolation-models-reference
Pure-reference catalog of tenant-isolation models for B2B SaaS. Defines the isolation continuum from full-isolation (separate compute + data + network per tenant) to fully-shared (one deployment, tenant_id discriminator), names the canonical models (Microsoft's automated-single-tenant / fully-multitenant / vertically-partitioned / horizontally-partitioned; AWS Well-Architected's silo / pool / bridge framing; deployment-stamps / supertenants terminology), enumerates the trade-offs (cost, blast radius, noisy neighbor, compliance, scale limits), and lists the test surfaces each model creates (cross-tenant data leak, tenant-id propagation, deployment-routing). Use as the model-selection reference when designing or auditing tenant isolation. Consumed by tenant-leak-test-author, cross-tenant-data-leak-tests.
tenant-leak-test-author
Workflow-driven skill that builds a tenant-leak test plan from an inventory of tenant-bearing surfaces (database tables, APIs, object storage, search indices, async messages) and the isolation model in use. Walks through identifying tenant-bearing surfaces, enumerating the attack patterns per OWASP WSTG-ATHZ-02 (horizontal escalation, vertical escalation, IDOR / BOLA), generating test cases that exercise each pattern against each surface, and emitting the test suite skeleton (pytest / Jest / JUnit / Go test) with explicit cross-tenant probes. Use when designing a multi-tenant test suite for a new feature, when auditing test coverage for an existing tenant boundary, or when reviewing PRs that add tenant-bearing surfaces. Distinct from cross-tenant-data-leak-tests which is the runtime gate; this skill produces the plan.
tenant-onboarding-test-author
Workflow-driven skill that authors a test suite for tenant provisioning and offboarding: account creation, isolation at creation (no cross-tenant bleed from a new tenant's first API call), default resource quotas, billing record linkage, seed and default data correctness, idempotent re-provisioning, and teardown with full data deletion. Walks through mapping provisioning surfaces, generating test cases per surface, emitting the test suite skeleton (pytest / Jest / JUnit / Go test), and producing a coverage matrix. Use when a new tenant onboarding flow is introduced or changed, when the offboarding pipeline is modified, or when auditing provisioning coverage before a compliance review. Distinct from tenant-leak-test-author (runtime cross-tenant access) and cross-tenant-data-leak-tests (CI gate): this skill covers the provisioning lifecycle, not steady-state access control.
Agents
tenant-id-propagation-tracer
Read-only specialist that traces how tenant_id flows through a single code path - from the request entry (HTTP handler, queue listener, scheduled job) to every DB query, external call, log line, and emitted message. Identifies where tenant_id is derived (session, JWT claim, URL path, body payload), where it is propagated (function arguments, context objects, async message attributes), and where it is dropped or sourced from untrusted input. Use proactively when reviewing a PR that adds or modifies a tenant-bearing surface, or when investigating a leak finding. Returns a propagation trace + flagged hazards. Preloads tenant-isolation-models-reference + row-level-security-postgres-reference.
tenant-leak-critic
Adversarial agent that reviews a PR or set of changed files for tenant-leak risk. Inspects the diff for: new tenant-bearing surfaces without isolation tests, tenant_id derived from untrusted input, missing tenant filters in DB queries, async messages without tenant context, cache keys without tenant prefix, log lines disclosing cross-tenant identifiers, RLS policies missing FORCE ROW LEVEL SECURITY, and gaps in the coverage matrix produced by tenant-leak-test-author. Use proactively before merging any PR that touches tenant-bearing code. Returns a verdict (pass / block) + per-finding action list. Preloads tenant-isolation-models-reference + row-level-security-postgres-reference + tenant-leak-test-author + cross-tenant-data-leak-tests.