@basaltkit/cache 1.2.1 → 1.3.0

package/README.md

@@ -211,6 +211,7 @@ const cacheB = new Cache(new RedisCacheDriver(redis))
 |---|---|---|---|---|
 | `prefix` | `string` | No | `'basalt'` | Root prefix for all keys. |
 | `scope` | `(() => string \| undefined) \| null` | No | reads `ctx().tenant.id` → `tenant:<id>` | Dynamic prefix segment, resolved on each operation. `null` disables tenant isolation. |
+| `onMissingScope` | `'global' \| 'error'` | No | `'error'` when `tenancyPlugin` is registered, else `'global'` | What an operation does when the scope resolves to `undefined` (e.g. a background job outside request context). In multi-tenant apps the default fails CLOSED (`MissingCacheScopeError`) instead of silently sharing one namespace across tenants; single-tenant apps keep the global namespace. Explicit values always win. |
 
 ### `cachePlugin(options?: CachePluginOptions)`
 

package/dist/index.js

@@ -1,4 +1,4 @@
-import { BasaltError, createToken, definePlugin, parseDuration, tryCtx, } from '@basaltkit/core';
+import { BasaltError, createToken, definePlugin, ensureMetadata, parseDuration, tryCtx, } from '@basaltkit/core';
 import { MemoryCacheDriver } from './drivers/memory.js';
 import { RedisCacheDriver } from './drivers/redis.js';
 export { MemoryCacheDriver } from './drivers/memory.js';
@@ -169,7 +169,16 @@ export function cachePlugin(options = {}) {
                         : options.driver === 'redis'
                             ? RedisCacheDriver.fromUrl(options.url)
                             : new MemoryCacheDriver();
-                return new Cache(driver, options);
+                // Fail closed by default in multi-tenant apps: when @basaltkit/tenancy
+                // is registered (its 'tenancy:active' metadata marker), an operation
+                // with no resolvable tenant scope throws instead of silently sharing
+                // one global namespace across tenants. Single-tenant apps (no tenancy)
+                // are untouched, and an explicit `onMissingScope`/custom `scope` wins.
+                const tenancyActive = ensureMetadata(container).get('tenancy:active').length > 0;
+                const resolved = options.onMissingScope === undefined && options.scope === undefined && tenancyActive
+                    ? { ...options, onMissingScope: 'error' }
+                    : options;
+                return new Cache(driver, resolved);
             });
         },
         async shutdown() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/cache",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Basalt cache layer: Redis and Memory drivers, tags, TTL, stampede protection and automatic per-tenant isolation.",
   "license": "MIT",
   "type": "module",
@@ -15,7 +15,7 @@
   ],
   "dependencies": {
     "ioredis": "^6.0.0",
-    "@basaltkit/core": "^1.1.2"
+    "@basaltkit/core": "^1.3.0"
   },
   "devDependencies": {
     "@types/node": "^26.3.0",