@mastra/mongodb 1.12.0-alpha.0 → 1.12.0-alpha.2

package/CHANGELOG.md

@@ -1,5 +1,132 @@
 # @mastra/mongodb
 
+## 1.12.0-alpha.2
+
+### Patch Changes
+
+- Added optional tenancy arguments to `getDataset`, `updateDataset`, and `deleteDataset`. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  You can now pass `organizationId` and `projectId` to scope dataset reads, updates, and deletes to a specific tenant. Reads and updates against a dataset in a different tenant throw `DATASET_NOT_FOUND` (surfaced as a 404 over HTTP). Deletes silently no-op on a tenancy mismatch — matching the existing "delete non-existent id is a no-op" semantics so cross-tenant existence is never leaked via error timing or status.
+
+  **Example**
+
+  ```ts
+  // Before
+  await client.getDataset('abc123');
+  await client.deleteDataset('abc123');
+  await client.updateDataset({ id: 'abc123', name: 'renamed' });
+
+  // After — scope to a tenant
+  await client.getDataset('abc123', { organizationId: 'org_a', projectId: 'proj_1' });
+  await client.deleteDataset('abc123', { organizationId: 'org_a' });
+  await client.updateDataset({ id: 'abc123', name: 'renamed', organizationId: 'org_a' });
+  ```
+
+- Pushed remaining dataset read filters and pagination down to storage. ([#18710](https://github.com/mastra-ai/mastra/pull/18710))
+
+  `DatasetsManager.list({ filters })` now accepts `targetType`, `targetIds` (overlap/union semantics), and `name` (substring, case-insensitive) in addition to the existing tenancy and candidate filters. Filtering is pushed down to the storage layer so callers no longer have to post-filter results.
+
+  Storage adapters must also be upgraded to the versions listed below to honor the new filters. If a caller is on this version of `@mastra/core` but on an older storage adapter, the new `targetType`/`targetIds`/`name` filter keys are silently ignored by the adapter — no runtime error, but the filter has no effect and every dataset in the tenancy is returned.
+
+  `Dataset.listItems({ version, search, page, perPage })` now applies `search` and pagination at the storage layer when `version` is provided alongside any of those. Previously they were silently dropped whenever `version` was set. The return shape is unchanged: passing only `version` still returns a bare `DatasetItem[]` snapshot; passing `search`, `page`, or `perPage` (with or without `version`) returns the paginated `{ items, pagination }` shape. The bare-array branch is marked `@deprecated`; prefer passing `page` / `perPage` to always receive the paginated shape.
+
+- Tenancy-scope experiments `getById` and `delete*` on `ExperimentsStorage`. ([#18770](https://github.com/mastra-ai/mastra/pull/18770))
+
+  `ExperimentsStorage.getExperimentById`, `getExperimentResultById`, `deleteExperiment`, and `deleteExperimentResults` used to key on the primary id alone, so any caller who knew the id could read or delete the row regardless of tenant. All four now accept an optional `filters: { organizationId?, projectId? }` argument that is enforced on every adapter (inmemory, libsql, pg, mysql, mongodb, spanner):
+  - On tenancy mismatch, `get*` returns `null` at the storage layer.
+  - On tenancy mismatch, `delete*` is a silent no-op.
+  - The tenancy predicate is folded into the destructive DML itself (scoped `WHERE` on the DELETE, an atomic gate + delete inside a transaction, or a scoped subquery for the results cascade). A concurrent tenant swap of the same id between a pre-check and the DELETE cannot let a scoped delete hit another tenant's row.
+
+  Both behaviors match how a missing id already responds, so existence does not leak through error timing or messages.
+
+  The same atomic-DML pattern is also applied to `DatasetsStorage.deleteDataset` across all 5 store adapters, closing a TOCTOU window between the pre-check and the parent DELETE that was introduced when tenancy filters were originally added.
+
+  `Dataset.getExperiment` and the shared experiment-ownership gate on `Dataset` now forward the dataset's tenancy scope to storage, so experiment reads and downstream mutations (list results, update result, delete experiment) reached through a dataset handle are automatically scoped to the owning tenant.
+
+  Legacy calls that omit `filters` are unchanged, so this is fully backwards-compatible.
+
+  ```ts
+  // Before: any caller who knew the id could read/delete across tenants.
+  await store.experiments.getExperimentById({ id: experimentId });
+  await store.experiments.deleteExperiment({ id: experimentId });
+
+  // After: pass the caller's scope; wrong tenant gets null / silent no-op.
+  await store.experiments.getExperimentById({
+    id: experimentId,
+    filters: { organizationId, projectId },
+  });
+  await store.experiments.deleteExperiment({
+    id: experimentId,
+    filters: { organizationId, projectId },
+  });
+  ```
+
+- Fixed a cross-tenant data-access issue on datasets by scoping `DatasetsManager.get` and `DatasetsManager.delete` to tenancy filters. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  Previously `get({ id })` and `delete({ id })` looked up a dataset by its primary key alone. Any caller who knew a dataset id could read or delete it regardless of which `organizationId` / `projectId` it belonged to. This is now closed at the storage layer via a scoped SQL predicate (option (a) — no fetch-then-assert).
+
+  **What changed**
+  - `DatasetsManager.get` and `DatasetsManager.delete` accept optional `organizationId` and `projectId`.
+  - The tenancy is stashed on the returned `Dataset` handle and forwarded to every downstream storage call (`getDetails`, `update`, `addItem`, item batch ops, `startExperimentAsync`).
+  - The abstract storage contract (`getDatasetById`, `deleteDataset`) gained an optional `filters?: DatasetTenancyFilters` arg.
+  - Item-mutation inputs (`AddDatasetItemInput`, `UpdateDatasetItemInput`, `BatchInsertItemsInput`, `BatchDeleteItemsInput`) and `UpdateDatasetInput` accept optional `filters` for the internal existence check.
+
+  **Behavior**
+  - Omitting tenancy preserves the existing behavior (no predicate added) — fully backwards compatible.
+  - On tenancy mismatch, `get` throws NOT_FOUND (returns null at the storage layer) and `delete` is a silent no-op — matching how a missing id already behaves, so existence does not leak through error timing or messages.
+
+  **Example**
+
+  ```ts
+  // Before
+  const ds = await mastra.datasets.get({ id });
+  await mastra.datasets.delete({ id });
+
+  // After — scope to a tenant
+  const ds = await mastra.datasets.get({ id, organizationId, projectId });
+  await mastra.datasets.delete({ id, organizationId, projectId });
+  ```
+
+- Added optional `organizationId` and `projectId` fields to scores for multi-tenant isolation. Scores can now be saved with tenancy metadata and the `listScoresBy*` methods accept a `filters` option to scope results by organization and project. ([#18331](https://github.com/mastra-ai/mastra/pull/18331))
+
+  ```ts
+  await storage.saveScore({ ...score, organizationId: 'org-a', projectId: 'proj-1' });
+
+  const result = await storage.listScoresByScorerId({
+    scorerId,
+    filters: { organizationId: 'org-a', projectId: 'proj-1' },
+  });
+  ```
+
+  `projectId` identifies the project scope, separate from `resourceId` which continues to mean the agent memory resource.
+
+- Scoped `getDatasetById` and `deleteDataset` to tenancy filters when the caller passes `organizationId` / `projectId`. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  The adapters now push the tenancy predicate into the SQL/query when the new optional `filters` argument is present. Legacy calls that omit tenancy are unchanged. On mismatch, `getDatasetById` returns `null` and `deleteDataset` is a silent no-op — the cascade delete (dataset items and versions) is gated by a scoped parent pre-check, so cross-tenant data is never touched.
+
+- Added optional `organizationId` and `projectId` query parameters to the dataset routes. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  `GET /datasets/:datasetId`, `PATCH /datasets/:datasetId`, and `DELETE /datasets/:datasetId` now accept optional tenancy query parameters. When provided, they are forwarded to `mastra.datasets.get` / `.delete` and the operation returns 404 if the dataset does not belong to the requested tenant. Requests that omit the query parameters keep their existing behavior.
+
+  **Example**
+
+  ```
+  GET /datasets/abc123?organizationId=org_a&projectId=proj_1
+  DELETE /datasets/abc123?organizationId=org_a
+  ```
+
+- Updated dependencies [[`9250acd`](https://github.com/mastra-ai/mastra/commit/9250acd1357f0f1f33d0dcca16f9655084c58eca), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748), [`c64c2a8`](https://github.com/mastra-ai/mastra/commit/c64c2a8503a50252f9ca6b8e8c54cadee31b92a2), [`06e2680`](https://github.com/mastra-ai/mastra/commit/06e26806b51d2cbd858afdc66daa2b86ff3ba64a), [`1240f05`](https://github.com/mastra-ai/mastra/commit/1240f051c8e5371f1c014448bf37b1a1b9a05e47), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748)]:
+  - @mastra/core@1.49.0-alpha.5
+
+## 1.12.0-alpha.1
+
+### Patch Changes
+
+- Fixed `createExperiment` in the MongoDB store persisting `agentVersion` as `null` regardless of the input. `listExperiments` already accepts an `agentVersion` filter, but rows created by this backend would never match it. New experiments now round-trip `agentVersion` end-to-end. ([#18769](https://github.com/mastra-ai/mastra/pull/18769))
+
+- Updated dependencies [[`6a61846`](https://github.com/mastra-ai/mastra/commit/6a61846eeda29fb714549b70f1bee2bf6b141c44)]:
+  - @mastra/core@1.49.0-alpha.4
+
 ## 1.12.0-alpha.0
 
 ### Minor Changes

package/dist/docs/SKILL.md

@@ -3,7 +3,7 @@ name: mastra-mongodb
 description: Documentation for @mastra/mongodb. Use when working with @mastra/mongodb APIs, configuration, or implementation.
 metadata:
   package: "@mastra/mongodb"
-  version: "1.12.0-alpha.0"
+  version: "1.12.0-alpha.2"
 ---
 
 ## When to use

package/dist/docs/assets/SOURCE_MAP.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.12.0-alpha.0",
+  "version": "1.12.0-alpha.2",
   "package": "@mastra/mongodb",
   "exports": {},
   "modules": {}

package/dist/index.cjs

@@ -15,7 +15,7 @@ var skills = require('@mastra/core/storage/domains/skills');
 
 // package.json
 var package_default = {
-  version: "1.12.0-alpha.0"};
+  version: "1.12.0-alpha.2"};
 var MongoDBFilterTranslator = class extends filter.BaseFilterTranslator {
   getSupportedOperators() {
     return {
@@ -2151,6 +2151,16 @@ var MongoDBBlobStore = class _MongoDBBlobStore extends storage.BlobStore {
     };
   }
 };
+function formatDateForMongoDB(date) {
+  return typeof date === "string" ? new Date(date) : date;
+}
+function applyTenancyFilter(filter, filters) {
+  if (!filters) return;
+  if (filters.organizationId !== void 0) filter.organizationId = filters.organizationId;
+  if (filters.projectId !== void 0) filter.projectId = filters.projectId;
+}
+
+// src/storage/domains/datasets/index.ts
 var MANAGED_COLLECTIONS = [storage.TABLE_DATASETS, storage.TABLE_DATASET_ITEMS, storage.TABLE_DATASET_VERSIONS];
 var MongoDBDatasetsStorage = class extends storage.DatasetsStorage {
   #connector;
@@ -2345,10 +2355,15 @@ var MongoDBDatasetsStorage = class extends storage.DatasetsStorage {
       );
     }
   }
-  async getDatasetById({ id }) {
+  async getDatasetById({
+    id,
+    filters
+  }) {
     try {
       const collection = await this.getCollection(storage.TABLE_DATASETS);
-      const row = await collection.findOne({ id });
+      const query = { id };
+      applyTenancyFilter(query, filters);
+      const row = await collection.findOne(query);
       return row ? this.transformDatasetRow(row) : null;
     } catch (error$1) {
       throw new error.MastraError(
@@ -2363,7 +2378,7 @@ var MongoDBDatasetsStorage = class extends storage.DatasetsStorage {
   }
   async _doUpdateDataset(args) {
     try {
-      const existing = await this.getDatasetById({ id: args.id });
+      const existing = await this.getDatasetById({ id: args.id, filters: args.filters });
       if (!existing) {
         throw new error.MastraError({
           id: storage.createStorageErrorId("MONGODB", "UPDATE_DATASET", "NOT_FOUND"),
@@ -2400,8 +2415,13 @@ var MongoDBDatasetsStorage = class extends storage.DatasetsStorage {
       );
     }
   }
-  async deleteDataset({ id }) {
+  async deleteDataset({ id, filters }) {
     try {
+      const datasetsCollectionForGate = await this.getCollection(storage.TABLE_DATASETS);
+      const gateQuery = { id };
+      applyTenancyFilter(gateQuery, filters);
+      const gateHit = await datasetsCollectionForGate.findOne(gateQuery, { projection: { id: 1 } });
+      if (!gateHit) return;
       try {
         const experimentsCollection = await this.getCollection(storage.TABLE_EXPERIMENTS);
         const experimentIds = await experimentsCollection.find({ datasetId: id }, { projection: { id: 1 } }).toArray();
@@ -2421,7 +2441,9 @@ var MongoDBDatasetsStorage = class extends storage.DatasetsStorage {
       const datasetsCollection = await this.getCollection(storage.TABLE_DATASETS);
       await versionsCollection.deleteMany({ datasetId: id });
       await itemsCollection.deleteMany({ datasetId: id });
-      await datasetsCollection.deleteOne({ id });
+      const parentDeleteQuery = { id };
+      applyTenancyFilter(parentDeleteQuery, filters);
+      await datasetsCollection.deleteOne(parentDeleteQuery);
     } catch (error$1) {
       if (error$1 instanceof error.MastraError) throw error$1;
       throw new error.MastraError(
@@ -2443,6 +2465,14 @@ var MongoDBDatasetsStorage = class extends storage.DatasetsStorage {
       if (args.filters?.projectId !== void 0) filter.projectId = args.filters.projectId;
       if (args.filters?.candidateKey !== void 0) filter.candidateKey = args.filters.candidateKey;
       if (args.filters?.candidateId !== void 0) filter.candidateId = args.filters.candidateId;
+      if (args.filters?.targetType !== void 0) filter.targetType = args.filters.targetType;
+      if (args.filters?.targetIds !== void 0 && args.filters.targetIds.length > 0) {
+        filter.targetIds = { $in: args.filters.targetIds };
+      }
+      if (args.filters?.name !== void 0 && args.filters.name.length > 0) {
+        const escapedName = args.filters.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        filter.name = { $regex: escapedName, $options: "i" };
+      }
       const total = await collection.countDocuments(filter);
       if (total === 0) {
         return { datasets: [], pagination: { total: 0, page, perPage: perPageInput, hasMore: false } };
@@ -3362,7 +3392,7 @@ var MongoDBExperimentsStorage = class _MongoDBExperimentsStorage extends storage
       succeededCount: 0,
       failedCount: 0,
       skippedCount: 0,
-      agentVersion: null,
+      agentVersion: input.agentVersion ?? null,
       startedAt: null,
       completedAt: null,
       createdAt: now,
@@ -3387,7 +3417,7 @@ var MongoDBExperimentsStorage = class _MongoDBExperimentsStorage extends storage
         succeededCount: 0,
         failedCount: 0,
         skippedCount: 0,
-        agentVersion: null,
+        agentVersion: input.agentVersion ?? null,
         startedAt: null,
         completedAt: null,
         createdAt: now,
@@ -3443,10 +3473,15 @@ var MongoDBExperimentsStorage = class _MongoDBExperimentsStorage extends storage
       );
     }
   }
-  async getExperimentById({ id }) {
+  async getExperimentById({
+    id,
+    filters
+  }) {
     try {
       const collection = await this.getCollection(storage.TABLE_EXPERIMENTS);
-      const doc = await collection.findOne({ id });
+      const query = { id };
+      applyTenancyFilter(query, filters);
+      const doc = await collection.findOne(query);
       if (!doc) return null;
       return transformExperimentRow(doc);
     } catch (error$1) {
@@ -3521,12 +3556,20 @@ var MongoDBExperimentsStorage = class _MongoDBExperimentsStorage extends storage
       );
     }
   }
-  async deleteExperiment({ id }) {
+  async deleteExperiment({ id, filters }) {
     try {
-      const resultsCollection = await this.getCollection(storage.TABLE_EXPERIMENT_RESULTS);
-      await resultsCollection.deleteMany({ experimentId: id });
       const experimentsCollection = await this.getCollection(storage.TABLE_EXPERIMENTS);
-      await experimentsCollection.deleteOne({ id });
+      const gateQuery = { id };
+      applyTenancyFilter(gateQuery, filters);
+      const existing = await experimentsCollection.findOne(gateQuery);
+      if (!existing) return;
+      const resultsCollection = await this.getCollection(storage.TABLE_EXPERIMENT_RESULTS);
+      const resultsQuery = { experimentId: id };
+      applyTenancyFilter(resultsQuery, filters);
+      await resultsCollection.deleteMany(resultsQuery);
+      const parentDeleteQuery = { id };
+      applyTenancyFilter(parentDeleteQuery, filters);
+      await experimentsCollection.deleteOne(parentDeleteQuery);
     } catch (error$1) {
       throw new error.MastraError(
         {
@@ -3645,10 +3688,15 @@ var MongoDBExperimentsStorage = class _MongoDBExperimentsStorage extends storage
       );
     }
   }
-  async getExperimentResultById({ id }) {
+  async getExperimentResultById({
+    id,
+    filters
+  }) {
     try {
       const collection = await this.getCollection(storage.TABLE_EXPERIMENT_RESULTS);
-      const doc = await collection.findOne({ id });
+      const query = { id };
+      applyTenancyFilter(query, filters);
+      const doc = await collection.findOne(query);
       if (!doc) return null;
       return transformExperimentResultRow(doc);
     } catch (error$1) {
@@ -3715,10 +3763,22 @@ var MongoDBExperimentsStorage = class _MongoDBExperimentsStorage extends storage
       );
     }
   }
-  async deleteExperimentResults({ experimentId }) {
+  async deleteExperimentResults({
+    experimentId,
+    filters
+  }) {
     try {
+      if (filters?.organizationId !== void 0 || filters?.projectId !== void 0) {
+        const experimentsCollection = await this.getCollection(storage.TABLE_EXPERIMENTS);
+        const gateQuery = { id: experimentId };
+        applyTenancyFilter(gateQuery, filters);
+        const parent = await experimentsCollection.findOne(gateQuery);
+        if (!parent) return;
+      }
       const collection = await this.getCollection(storage.TABLE_EXPERIMENT_RESULTS);
-      await collection.deleteMany({ experimentId });
+      const deleteQuery = { experimentId };
+      applyTenancyFilter(deleteQuery, filters);
+      await collection.deleteMany(deleteQuery);
     } catch (error$1) {
       throw new error.MastraError(
         {
@@ -4880,11 +4940,6 @@ var MongoDBMCPServersStorage = class _MongoDBMCPServersStorage extends storage.M
     return result;
   }
 };
-function formatDateForMongoDB(date) {
-  return typeof date === "string" ? new Date(date) : date;
-}
-
-// src/storage/domains/memory/index.ts
 var OM_TABLE = "mastra_observational_memory";
 var MemoryStorageMongoDB = class _MemoryStorageMongoDB extends storage.MemoryStorage {
   supportsObservationalMemory = true;
@@ -9269,6 +9324,14 @@ function transformScoreRow(row) {
     convertTimestamps: true
   });
 }
+function applyTenancyFilters(query, filters) {
+  if (filters?.organizationId !== void 0) {
+    query.organizationId = filters.organizationId;
+  }
+  if (filters?.projectId !== void 0) {
+    query.projectId = filters.projectId;
+  }
+}
 var ScoresStorageMongoDB = class _ScoresStorageMongoDB extends storage.ScoresStorage {
   #connector;
   #skipDefaultIndexes;
@@ -9437,7 +9500,8 @@ var ScoresStorageMongoDB = class _ScoresStorageMongoDB extends storage.ScoresSto
     pagination,
     entityId,
     entityType,
-    source
+    source,
+    filters
   }) {
     try {
       const { page, perPage: perPageInput } = pagination;
@@ -9453,6 +9517,7 @@ var ScoresStorageMongoDB = class _ScoresStorageMongoDB extends storage.ScoresSto
       if (source) {
         query.source = source;
       }
+      applyTenancyFilters(query, filters);
       const collection = await this.getCollection(storage.TABLE_SCORERS);
       const total = await collection.countDocuments(query);
       if (total === 0) {
@@ -9496,14 +9561,17 @@ var ScoresStorageMongoDB = class _ScoresStorageMongoDB extends storage.ScoresSto
   }
   async listScoresByRunId({
     runId,
-    pagination
+    pagination,
+    filters
   }) {
     try {
       const { page, perPage: perPageInput } = pagination;
       const perPage = storage.normalizePerPage(perPageInput, 100);
       const { offset: start, perPage: perPageForResponse } = storage.calculatePagination(page, perPageInput, perPage);
+      const query = { runId };
+      applyTenancyFilters(query, filters);
       const collection = await this.getCollection(storage.TABLE_SCORERS);
-      const total = await collection.countDocuments({ runId });
+      const total = await collection.countDocuments(query);
       if (total === 0) {
         return {
           scores: [],
@@ -9516,7 +9584,7 @@ var ScoresStorageMongoDB = class _ScoresStorageMongoDB extends storage.ScoresSto
         };
       }
       const end = perPageInput === false ? total : start + perPage;
-      let cursor = collection.find({ runId }).sort({ createdAt: -1 }).skip(start);
+      let cursor = collection.find(query).sort({ createdAt: -1 }).skip(start);
       if (perPageInput !== false) {
         cursor = cursor.limit(perPage);
       }
@@ -9546,14 +9614,17 @@ var ScoresStorageMongoDB = class _ScoresStorageMongoDB extends storage.ScoresSto
   async listScoresByEntityId({
     entityId,
     entityType,
-    pagination
+    pagination,
+    filters
   }) {
     try {
       const { page, perPage: perPageInput } = pagination;
       const perPage = storage.normalizePerPage(perPageInput, 100);
       const { offset: start, perPage: perPageForResponse } = storage.calculatePagination(page, perPageInput, perPage);
+      const query = { entityId, entityType };
+      applyTenancyFilters(query, filters);
       const collection = await this.getCollection(storage.TABLE_SCORERS);
-      const total = await collection.countDocuments({ entityId, entityType });
+      const total = await collection.countDocuments(query);
       if (total === 0) {
         return {
           scores: [],
@@ -9566,7 +9637,7 @@ var ScoresStorageMongoDB = class _ScoresStorageMongoDB extends storage.ScoresSto
         };
       }
       const end = perPageInput === false ? total : start + perPage;
-      let cursor = collection.find({ entityId, entityType }).sort({ createdAt: -1 }).skip(start);
+      let cursor = collection.find(query).sort({ createdAt: -1 }).skip(start);
       if (perPageInput !== false) {
         cursor = cursor.limit(perPage);
       }
@@ -9596,13 +9667,15 @@ var ScoresStorageMongoDB = class _ScoresStorageMongoDB extends storage.ScoresSto
   async listScoresBySpan({
     traceId,
     spanId,
-    pagination
+    pagination,
+    filters
   }) {
     try {
       const { page, perPage: perPageInput } = pagination;
       const perPage = storage.normalizePerPage(perPageInput, 100);
       const { offset: start, perPage: perPageForResponse } = storage.calculatePagination(page, perPageInput, perPage);
       const query = { traceId, spanId };
+      applyTenancyFilters(query, filters);
       const collection = await this.getCollection(storage.TABLE_SCORERS);
       const total = await collection.countDocuments(query);
       if (total === 0) {