# Tenant Boundary Lab

By Chason Arthur
Revision 145.021
Published/updated 2026-11-04

## Start without installing dependencies

Extract this complete ZIP into a new folder. With Python 3 installed, run `python preview.py` from the extracted root. Open http://127.0.0.1:4210/. Stop with Ctrl+C. The prebuilt site is self-contained and makes no automatic external requests. Written reference links are optional. Do not open the files directly with file:// because workers and Wasm need HTTP.

## Run the native exercise

```sh
npm ci
npm test
node src/tenant/server.mjs
```

After starting the adapter, POST /fixture-session with {"account":"editor"}, "viewer" or "expired". Retain the lab_session cookie and request GET /documents or GET /documents/22. PATCH /documents/11 accepts only {"title":"…"}. These are fictional switchable accounts, not a production sign-in system. Ctrl+C stops the service and destroys its memory database.

## Expected result

The safe cross-company read returns 404 with no foreign rows. A viewer’s edit returns 403; an expired session returns 401. A list query without a tenant filter still returns only Orchard’s row under RLS.

## Scope

Invented sessions feed actual PostgreSQL row policies in your browser. The download adds a local HTTP adapter with opaque fixture sessions. Neither version is a production identity provider or a test of every database-privilege configuration.

## Change and rebuild

Node/browser packages: `npm ci`, `npm run rebuild`, then `python preview.py`. Go: edit src/go, run its tests and `python rebuild_wasm.py` before refreshing source. Python: edit src/python/engine.py and run `python refresh_source.py`. Rebuild keeps the local preview and source viewer aligned. FILE_MANIFEST.json describes the initial extracted package, not later edits. The source-map and source viewer manifest record the exact teaching files. Update edition/date metadata before publishing an edited version.

## Extension

Add a second permitted company membership and an explicit company-switch action. Verify membership on the server, set the database context transactionally, and test that a reused connection never retains the previous request’s tenant.

Original teaching code and lessons are MIT-licensed. See THIRD_PARTY_NOTICES.md and licenses/. The package starts no production API, model, payment, email or cloud service.