qa-multi-tenancy
Tenant-isolation testing for B2B SaaS: row-level security, cross-tenant leak detection, tenant-id propagation tracing, isolation-model references (silo / pool / bridge), and adversarial review of tenant-leak risk.
Install this plugin
/plugin install qa-multi-tenancy@testland-qaPart of role bundle: qa-role-security
qa-multi-tenancy
Tenant-isolation testing for B2B SaaS: cross-tenant leak-test planning + the runtime CI gate (isolation-model references silo / pool / bridge included), row-level security across Postgres and other engines, tenant provisioning/offboarding tests, and adversarial review of tenant-leak risk with tenant-id propagation tracing.
Components
| Type | Name | Description |
|---|---|---|
| Skill | cross-tenant-data-leak-tests | Plans and implements the cross-tenant leak-test suite - surface inventory, OWASP WSTG-ATHZ-02 coverage matrix, the canonical test battery, and the CI gate; isolation models (silo / pool / bridge) in references/isolation-models.md |
| Skill | rls-reference | Pure-reference catalog of row-level security for tenant isolation - Postgres-first (CREATE POLICY, FORCE ROW LEVEL SECURITY, bypass rules, tenant context, performance); MySQL / MariaDB, CockroachDB, Vitess, and SQL Server in references/other-engines.md |
| Skill | tenant-onboarding-test-author | Workflow-driven skill that authors a test suite for tenant provisioning and offboarding: account creation, isolation at creation, quotas, billing linkage, idempotent re-provisioning, teardown with full data deletion |
| Agent | tenant-leak-critic | Adversarial agent that reviews a PR or set of changed files for tenant-leak risk, including a tenant-id propagation-tracing step per changed entry point. |
Install
/plugin marketplace add testland/qa
/plugin install qa-multi-tenancy@testland-qaSkills
cross-tenant-data-leak-tests
Workflow-driven skill that plans and implements the cross-tenant leak-test suite - from surface inventory to the runtime CI gate a multi-tenant codebase must pass on every PR. The planning section inventories tenant-bearing surfaces (tables, APIs, object storage, search, queues, caches), classifies each by isolation model (silo / pool / bridge, per references/isolation-models.md), and derives the OWASP WSTG-ATHZ-02 coverage matrix. The battery defines the canonical test patterns (read-other-tenant-by-id, list-leak, spoofed-tenant-id-in-body, JWT-replay, FK-cross-tenant, unique-collision side channel, object-storage IDOR, search-index-direct-query, async-job-context-reload, cache-key-collision), the 404-vs-403 disclosure trade-off, the Postgres-RLS-direct patterns, and the CI integration (non-superuser non-BYPASSRLS role, fail the build on any leak). Use when designing or implementing a tenant-isolation test suite, adding the CI gate to an existing project, or investigating a leak finding.
rls-reference
Pure-reference catalog of row-level security for tenant isolation, Postgres-first. Covers enabling RLS (ALTER TABLE ... ENABLE ROW LEVEL SECURITY, default-deny semantics), CREATE POLICY syntax (USING vs WITH CHECK clauses, FOR SELECT/INSERT/UPDATE/DELETE/ALL, permissive vs restrictive, TO role_name), bypassing RLS (superuser / BYPASSRLS / table owner / FORCE ROW LEVEL SECURITY), tenant context patterns (current_user, current_setting, JWT claims via Supabase auth.uid() / auth.jwt()), and performance discipline (wrapping auth functions in SELECT, index on policy-referenced columns). Row/tenant isolation on the non-Postgres engines - MySQL / MariaDB invoker views, CockroachDB native RLS, Vitess vindex sharding, SQL Server security policies - lives in references/other-engines.md. Use as the RLS-pattern reference for tenant isolation on any of these engines. Consumed by cross-tenant-data-leak-tests.
tenant-onboarding-test-author
Workflow-driven skill that authors a test suite for tenant provisioning and offboarding: account creation, isolation at creation (no cross-tenant bleed from a new tenant's first API call), default resource quotas, billing record linkage, seed and default data correctness, idempotent re-provisioning, and teardown with full data deletion. Walks through mapping provisioning surfaces, generating test cases per surface, emitting the test suite skeleton (pytest / Jest / JUnit / Go test), and producing a coverage matrix. Use when a new tenant onboarding flow is introduced or changed, when the offboarding pipeline is modified, or when auditing provisioning coverage before a compliance review. Distinct from cross-tenant-data-leak-tests (leak-test planning + runtime CI gate): this skill covers the provisioning lifecycle, not steady-state access control.