@stratum-hq/create 0.3.1 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @stratum-hq/create
 
+## 0.4.0
+
+### Minor Changes
+
+- 1669fd7: Harden defaults in generated projects, CLI checks, React hooks and test helpers (GHSA-rrrp-gww6-44gr). Behavior changes: `StratumProvider`'s `apiKey` is optional and generated React code uses a server-side proxy instead; `TenantThemeProvider` ignores `customCss` that is not plain declarations; `assertConfigInheritance` now takes a Stratum instance instead of a pg pool.
+
+### Patch Changes
+
+- 9de2ddb: Remove unused code from the generator. No change in generated output.
+- dca0826: Harden tenant isolation in the schema-per-tenant and database-per-tenant strategies and the Prisma and Drizzle adapters (GHSA-jhhc-cm2c-jh27). Behavior change: the schema-per-tenant `search_path` is now the tenant schema alone, without `public`; queries that call extension functions or types from another schema must schema-qualify them or opt that schema in with the new `extraSearchPath` option.
+
 ## 0.3.1
 
 ### Patch Changes

package/dist/index.js

@@ -37,19 +37,14 @@ var ALL_STRATEGIES = ["rls", "schema", "database", "collection", "table-prefix"]
 var ALL_ORMS = ["prisma", "drizzle", "sequelize", "knex", "mongoose", "pg"];
 function isValidPreset(preset) {
   const config = VALID_COMBINATIONS[preset.database];
-  if (!config)
-    return false;
-  if (!config.strategies.includes(preset.strategy))
-    return false;
-  if (!config.orms.includes(preset.orm))
-    return false;
-  if (!config.frameworks.includes(preset.framework))
-    return false;
+  if (!config) return false;
+  if (!config.strategies.includes(preset.strategy)) return false;
+  if (!config.orms.includes(preset.orm)) return false;
+  if (!config.frameworks.includes(preset.framework)) return false;
   return true;
 }
 function parsePresetString(s) {
-  if (!s || typeof s !== "string")
-    return null;
+  if (!s || typeof s !== "string") return null;
   const parts = s.toLowerCase().split("-");
   let database;
   let strategy;
@@ -65,14 +60,10 @@ function parsePresetString(s) {
   } else {
     return null;
   }
-  if (!ALL_DATABASES.includes(database))
-    return null;
-  if (!ALL_STRATEGIES.includes(strategy))
-    return null;
-  if (!ALL_ORMS.includes(orm))
-    return null;
-  if (!ALL_FRAMEWORKS.includes(framework))
-    return null;
+  if (!ALL_DATABASES.includes(database)) return null;
+  if (!ALL_STRATEGIES.includes(strategy)) return null;
+  if (!ALL_ORMS.includes(orm)) return null;
+  if (!ALL_FRAMEWORKS.includes(framework)) return null;
   return {
     database,
     strategy,
@@ -182,6 +173,36 @@ volumes:
 }
 
 // src/generators/init-sql.ts
+function postgresAppRole(dbName) {
+  return `${dbName}_app`;
+}
+var POSTGRES_APP_PASSWORD = "dev_app_password";
+function postgresAppRoleSql(dbName, strategy) {
+  const role = postgresAppRole(dbName);
+  let strategyGrant = "";
+  if (strategy === "schema") {
+    strategyGrant = `
+-- schema-per-tenant: the app creates one schema per tenant
+GRANT CREATE ON DATABASE ${dbName} TO ${role};
+`;
+  } else if (strategy === "database") {
+    strategyGrant = `
+-- database-per-tenant: the app creates one database per tenant
+ALTER ROLE ${role} CREATEDB;
+`;
+  }
+  return `
+-- Application role. The app connects as ${role} (DATABASE_URL), never as the
+-- bootstrap superuser (DATABASE_ADMIN_URL): a superuser or BYPASSRLS role
+-- ignores every row-level security policy, FORCE included. Use the superuser
+-- only for bootstrap and migrations.
+CREATE ROLE ${role} WITH LOGIN PASSWORD '${POSTGRES_APP_PASSWORD}' NOSUPERUSER NOBYPASSRLS NOCREATEROLE;
+GRANT CONNECT ON DATABASE ${dbName} TO ${role};
+GRANT USAGE, CREATE ON SCHEMA public TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${role};
+${strategyGrant}`;
+}
 function generatePresetInitSql(projectName, preset) {
   const dbName = projectName.replace(/[^a-z0-9]/gi, "_").toLowerCase();
   switch (preset.database) {
@@ -201,10 +222,13 @@ function generatePostgresInit(projectName, dbName, strategy) {
 -- Add RLS policies to each tenant-scoped table:
 --
 --   ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;
+--   ALTER TABLE your_table FORCE ROW LEVEL SECURITY;
 --   CREATE POLICY tenant_isolation ON your_table
---     USING (tenant_id = current_setting('app.current_tenant')::uuid);
+--     USING (tenant_id = current_setting('app.current_tenant_id')::uuid);
 --
--- The Stratum db-adapters package sets app.current_tenant automatically.
+-- FORCE makes the policy apply to the table owner too; without it, a table
+-- created by the application role is not isolated for that role.
+-- The Stratum db-adapters package sets app.current_tenant_id automatically.
 `;
   }
   return `-- Initialize ${projectName} database
@@ -215,7 +239,7 @@ CREATE EXTENSION IF NOT EXISTS "ltree";
 -- The ltree extension enables hierarchical tenant trees
 -- uuid-ossp provides uuid_generate_v4() for tenant IDs
 COMMENT ON DATABASE ${dbName} IS 'Multi-tenant database for ${projectName}';
-${rlsBlock}`;
+${postgresAppRoleSql(dbName, strategy)}${rlsBlock}`;
 }
 function generateMysqlInit(projectName, dbName) {
   return `-- Initialize ${projectName} database
@@ -252,7 +276,6 @@ function generateDbSetup(preset) {
 }
 function generatePrismaSetup(preset) {
   const provider = preset.database === "mysql" ? "mysql" : "postgresql";
-  const envUrl = preset.database === "mysql" ? "mysql://user:password@localhost:3306/dbname" : "postgres://user:password@localhost:5432/dbname";
   return [
     {
       filename: "prisma/schema.prisma",
@@ -344,9 +367,10 @@ export function createTenantDb(getTenantId: () => string) {
   return drizzleWithTenant(db, getTenantId, pool);
 }
 
-// Usage:
+// Usage: run tenant queries inside transaction() so the tenant context and
+// the query share one connection.
 // const tenantDb = createTenantDb(() => currentTenantId);
-// const rows = await tenantDb.select().from(orders);
+// const rows = await tenantDb.transaction((tx) => tx.select().from(orders));
 
 export { pool };
 `
@@ -561,11 +585,13 @@ const port = Number(process.env.PORT) || 3000;
 
 app.use(express.json());
 
-// Tenant extraction middleware
+// Tenant extraction middleware. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 app.use((req, _res, next) => {
-  const tenantId =
-    req.headers["x-tenant-id"] as string ||
-    req.hostname.split(".")[0];
+  const tenantId = req.hostname.split(".")[0];
   (req as any).tenantId = tenantId;
   next();
 });
@@ -595,12 +621,14 @@ function generateFastifyMiddleware(projectName) {
 const fastify = Fastify({ logger: true });
 const port = Number(process.env.PORT) || 3000;
 
-// Tenant extraction plugin
+// Tenant extraction hook. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 fastify.decorateRequest("tenantId", "");
 fastify.addHook("onRequest", async (request) => {
-  const tenantId =
-    (request.headers["x-tenant-id"] as string) ||
-    (request.hostname?.split(".")[0] ?? "");
+  const tenantId = request.hostname?.split(".")[0] ?? "";
   (request as any).tenantId = tenantId;
 });
 
@@ -631,14 +659,15 @@ function generateNextjsMiddleware(projectName) {
 import { NextRequest, NextResponse } from "next/server";
 
 export function middleware(request: NextRequest) {
+  // The tenant comes from the subdomain the request was routed to. Any
+  // x-tenant-id the client sent is removed first, so server code that reads
+  // x-tenant-id only ever sees the value set here. Once you add
+  // authentication, check that the signed-in user belongs to this tenant.
   const hostname = request.headers.get("host") || "";
-  const subdomain = hostname.split(".")[0];
-  const headerTenantId = request.headers.get("x-tenant-id");
-  const pathTenantId = request.nextUrl.pathname.match(/^\\/tenant\\/([^/]+)/)?.[1];
-
-  const tenantId = headerTenantId || pathTenantId || subdomain;
+  const tenantId = hostname.split(".")[0];
 
   const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
   if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
     requestHeaders.set("x-tenant-id", tenantId);
   }
@@ -661,7 +690,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Access tenant context via <code>x-tenant-id</code> header</li>
+        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -680,11 +709,13 @@ import { serve } from "@hono/node-server";
 
 const app = new Hono();
 
-// Tenant extraction middleware
+// Tenant extraction middleware. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 app.use("*", async (c, next) => {
-  const tenantId =
-    c.req.header("x-tenant-id") ||
-    new URL(c.req.url).hostname.split(".")[0];
+  const tenantId = new URL(c.req.url).hostname.split(".")[0];
   c.set("tenantId", tenantId);
   await next();
 });
@@ -763,9 +794,11 @@ export class AppController {
 export class TenantGuard implements CanActivate {
   canActivate(context: ExecutionContext): boolean {
     const request = context.switchToHttp().getRequest();
-    const tenantId =
-      request.headers["x-tenant-id"] ||
-      request.hostname?.split(".")[0];
+    // The tenant comes from the subdomain the request was routed to. Do not
+    // take it from a client-supplied header such as x-tenant-id: any caller
+    // can set one and pick another tenant. Once you add authentication, check
+    // that the signed-in user belongs to this tenant here.
+    const tenantId = request.hostname?.split(".")[0];
     request.tenantId = tenantId || null;
     return true;
   }
@@ -994,12 +1027,9 @@ See the [Stratum docs](https://github.com/stratum-hq/Stratum) for full reference
 `;
 }
 function getDevCommand(preset) {
-  if (preset.framework === "nextjs")
-    return "npm run dev";
-  if (preset.framework === "nestjs")
-    return "node --env-file=.env src/main.ts";
-  if (preset.framework === "none")
-    return "node --env-file=.env src/index.ts";
+  if (preset.framework === "nextjs") return "npm run dev";
+  if (preset.framework === "nestjs") return "node --env-file=.env src/main.ts";
+  if (preset.framework === "none") return "node --env-file=.env src/index.ts";
   return "node --env-file=.env src/index.ts";
 }
 function getDbStartInfo(preset) {
@@ -1074,9 +1104,14 @@ function generatePresetEnv(projectName, preset) {
   const dbName = projectName.replace(/[^a-z0-9]/gi, "_").toLowerCase();
   const jwtSecret = crypto.randomBytes(32).toString("base64url");
   let dbUrl;
+  let adminUrlLine = "";
   switch (preset.database) {
     case "postgres":
-      dbUrl = `postgres://${dbName}:dev_password@localhost:5432/${dbName}`;
+      dbUrl = `postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}`;
+      adminUrlLine = `
+# Superuser: bootstrap and migrations only. It bypasses row-level security.
+DATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+`;
       break;
     case "mongodb":
       dbUrl = `mongodb://${dbName}:dev_password@localhost:27017/${dbName}?authSource=admin`;
@@ -1091,7 +1126,7 @@ function generatePresetEnv(projectName, preset) {
 
 # Database
 ${urlKey}=${dbUrl}
-
+${adminUrlLine}
 # Authentication
 JWT_SECRET=${jwtSecret}
 
@@ -1322,7 +1357,7 @@ CREATE EXTENSION IF NOT EXISTS "ltree";
 -- The ltree extension enables hierarchical tenant trees
 -- uuid-ossp provides uuid_generate_v4() for tenant IDs
 COMMENT ON DATABASE ${dbName} IS 'Multi-tenant database for ${projectName}';
-`;
+${postgresAppRoleSql(dbName)}`;
 }
 function generateEnv(projectName) {
   const dbName = projectName.replace(/[^a-z0-9]/gi, "_").toLowerCase();
@@ -1330,8 +1365,12 @@ function generateEnv(projectName) {
   return `# Environment variables for ${projectName}
 # Copy to .env and fill in values
 
-# Database
-DATABASE_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+# Database. The app connects as the non-superuser role created in init.sql,
+# so row-level security applies to it.
+DATABASE_URL=postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}
+
+# Superuser: bootstrap and migrations only. It bypasses row-level security.
+DATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
 
 # Authentication
 JWT_SECRET=${jwtSecret}
@@ -1419,7 +1458,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Access tenant context via <code>x-tenant-id</code> header</li>
+        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -1428,18 +1467,19 @@ export default function Home() {
 `;
 }
 function generateNextjsMiddleware2() {
-  return `// middleware.ts \u2014 tenant resolution via subdomain or header
+  return `// middleware.ts \u2014 tenant resolution via subdomain
 import { NextRequest, NextResponse } from "next/server";
 
 export function middleware(request: NextRequest) {
+  // The tenant comes from the subdomain the request was routed to. Any
+  // x-tenant-id the client sent is removed first, so server code that reads
+  // x-tenant-id only ever sees the value set here. Once you add
+  // authentication, check that the signed-in user belongs to this tenant.
   const hostname = request.headers.get("host") || "";
-  const subdomain = hostname.split(".")[0];
-  const headerTenantId = request.headers.get("x-tenant-id");
-  const pathTenantId = request.nextUrl.pathname.match(/^\\/tenant\\/([^/]+)/)?.[1];
-
-  const tenantId = headerTenantId || pathTenantId || subdomain;
+  const tenantId = hostname.split(".")[0];
 
   const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
   if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
     requestHeaders.set("x-tenant-id", tenantId);
   }
@@ -1500,7 +1540,7 @@ ${projectName}/
 
 This project uses Stratum for hierarchical multi-tenancy:
 
-- **Tenant resolution** \u2014 via JWT claim, subdomain, or \`x-tenant-id\` header
+- **Tenant resolution** \u2014 via subdomain (see \`middleware.ts\`); bind it to the signed-in user once you add authentication
 - **Config inheritance** \u2014 settings flow down the tenant tree with override support
 - **Permission ABAC** \u2014 role-based permissions with tenant-scoped enforcement
 

package/dist/matrix.js

@@ -28,19 +28,14 @@ var ALL_STRATEGIES = ["rls", "schema", "database", "collection", "table-prefix"]
 var ALL_ORMS = ["prisma", "drizzle", "sequelize", "knex", "mongoose", "pg"];
 function isValidPreset(preset) {
   const config = VALID_COMBINATIONS[preset.database];
-  if (!config)
-    return false;
-  if (!config.strategies.includes(preset.strategy))
-    return false;
-  if (!config.orms.includes(preset.orm))
-    return false;
-  if (!config.frameworks.includes(preset.framework))
-    return false;
+  if (!config) return false;
+  if (!config.strategies.includes(preset.strategy)) return false;
+  if (!config.orms.includes(preset.orm)) return false;
+  if (!config.frameworks.includes(preset.framework)) return false;
   return true;
 }
 function parsePresetString(s) {
-  if (!s || typeof s !== "string")
-    return null;
+  if (!s || typeof s !== "string") return null;
   const parts = s.toLowerCase().split("-");
   let database;
   let strategy;
@@ -56,14 +51,10 @@ function parsePresetString(s) {
   } else {
     return null;
   }
-  if (!ALL_DATABASES.includes(database))
-    return null;
-  if (!ALL_STRATEGIES.includes(strategy))
-    return null;
-  if (!ALL_ORMS.includes(orm))
-    return null;
-  if (!ALL_FRAMEWORKS.includes(framework))
-    return null;
+  if (!ALL_DATABASES.includes(database)) return null;
+  if (!ALL_STRATEGIES.includes(strategy)) return null;
+  if (!ALL_ORMS.includes(orm)) return null;
+  if (!ALL_FRAMEWORKS.includes(framework)) return null;
   return {
     database,
     strategy,
@@ -87,16 +78,11 @@ function getValidOptions(partial) {
   const frameworkSet = /* @__PURE__ */ new Set();
   for (const db of databases) {
     const config = VALID_COMBINATIONS[db];
-    if (partial.strategy && !config.strategies.includes(partial.strategy))
-      continue;
-    if (partial.orm && !config.orms.includes(partial.orm))
-      continue;
-    for (const s of config.strategies)
-      strategySet.add(s);
-    for (const o of config.orms)
-      ormSet.add(o);
-    for (const f of config.frameworks)
-      frameworkSet.add(f);
+    if (partial.strategy && !config.strategies.includes(partial.strategy)) continue;
+    if (partial.orm && !config.orms.includes(partial.orm)) continue;
+    for (const s of config.strategies) strategySet.add(s);
+    for (const o of config.orms) ormSet.add(o);
+    for (const f of config.frameworks) frameworkSet.add(f);
   }
   strategies = [...strategySet];
   orms = [...ormSet];
@@ -113,10 +99,8 @@ function getValidOptions(partial) {
   if (partial.strategy || partial.orm) {
     databases = databases.filter((db) => {
       const config = VALID_COMBINATIONS[db];
-      if (partial.strategy && !config.strategies.includes(partial.strategy))
-        return false;
-      if (partial.orm && !config.orms.includes(partial.orm))
-        return false;
+      if (partial.strategy && !config.strategies.includes(partial.strategy)) return false;
+      if (partial.orm && !config.orms.includes(partial.orm)) return false;
       return true;
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratum-hq/create",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Create a new Stratum multi-tenancy project",
   "keywords": [
     "multi-tenancy",
@@ -30,8 +30,8 @@
     "test": "vitest run"
   },
   "devDependencies": {
-    "esbuild": "^0.20.0",
-    "vitest": "^1.6.0",
+    "esbuild": "^0.28.2",
+    "vitest": "^4.1.11",
     "typescript": "^5.3.0"
   },
   "publishConfig": {

package/src/generators/db-setup.ts

@@ -24,9 +24,6 @@ export function generateDbSetup(preset: StackPreset): DbSetupFile[] {
 
 function generatePrismaSetup(preset: StackPreset): DbSetupFile[] {
   const provider = preset.database === "mysql" ? "mysql" : "postgresql";
-  const envUrl = preset.database === "mysql"
-    ? "mysql://user:password@localhost:3306/dbname"
-    : "postgres://user:password@localhost:5432/dbname";
 
   return [
     {
@@ -121,9 +118,10 @@ export function createTenantDb(getTenantId: () => string) {
   return drizzleWithTenant(db, getTenantId, pool);
 }
 
-// Usage:
+// Usage: run tenant queries inside transaction() so the tenant context and
+// the query share one connection.
 // const tenantDb = createTenantDb(() => currentTenantId);
-// const rows = await tenantDb.select().from(orders);
+// const rows = await tenantDb.transaction((tx) => tx.select().from(orders));
 
 export { pool };
 `,

package/src/generators/init-sql.ts

@@ -1,5 +1,46 @@
 import type { StackPreset } from "../matrix.js";
 
+/** Name of the non-superuser role a generated app connects as. */
+export function postgresAppRole(dbName: string): string {
+  return `${dbName}_app`;
+}
+
+/** Local development password for the generated application role. */
+export const POSTGRES_APP_PASSWORD = "dev_app_password";
+
+/**
+ * SQL that creates the role the application connects as. POSTGRES_USER is a
+ * superuser, and a superuser (or any BYPASSRLS role) ignores every row-level
+ * security policy, FORCE included. So the app gets its own role, and the
+ * superuser is kept for bootstrap and migrations.
+ */
+export function postgresAppRoleSql(dbName: string, strategy?: string): string {
+  const role = postgresAppRole(dbName);
+  let strategyGrant = "";
+  if (strategy === "schema") {
+    strategyGrant = `
+-- schema-per-tenant: the app creates one schema per tenant
+GRANT CREATE ON DATABASE ${dbName} TO ${role};
+`;
+  } else if (strategy === "database") {
+    strategyGrant = `
+-- database-per-tenant: the app creates one database per tenant
+ALTER ROLE ${role} CREATEDB;
+`;
+  }
+  return `
+-- Application role. The app connects as ${role} (DATABASE_URL), never as the
+-- bootstrap superuser (DATABASE_ADMIN_URL): a superuser or BYPASSRLS role
+-- ignores every row-level security policy, FORCE included. Use the superuser
+-- only for bootstrap and migrations.
+CREATE ROLE ${role} WITH LOGIN PASSWORD '${POSTGRES_APP_PASSWORD}' NOSUPERUSER NOBYPASSRLS NOCREATEROLE;
+GRANT CONNECT ON DATABASE ${dbName} TO ${role};
+GRANT USAGE, CREATE ON SCHEMA public TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${role};
+${strategyGrant}`;
+}
+
 export function generatePresetInitSql(projectName: string, preset: StackPreset): string | null {
   const dbName = projectName.replace(/[^a-z0-9]/gi, "_").toLowerCase();
 
@@ -22,10 +63,13 @@ function generatePostgresInit(projectName: string, dbName: string, strategy: str
 -- Add RLS policies to each tenant-scoped table:
 --
 --   ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;
+--   ALTER TABLE your_table FORCE ROW LEVEL SECURITY;
 --   CREATE POLICY tenant_isolation ON your_table
---     USING (tenant_id = current_setting('app.current_tenant')::uuid);
+--     USING (tenant_id = current_setting('app.current_tenant_id')::uuid);
 --
--- The Stratum db-adapters package sets app.current_tenant automatically.
+-- FORCE makes the policy apply to the table owner too; without it, a table
+-- created by the application role is not isolated for that role.
+-- The Stratum db-adapters package sets app.current_tenant_id automatically.
 `;
   }
 
@@ -37,7 +81,7 @@ CREATE EXTENSION IF NOT EXISTS "ltree";
 -- The ltree extension enables hierarchical tenant trees
 -- uuid-ossp provides uuid_generate_v4() for tenant IDs
 COMMENT ON DATABASE ${dbName} IS 'Multi-tenant database for ${projectName}';
-${rlsBlock}`;
+${postgresAppRoleSql(dbName, strategy)}${rlsBlock}`;
 }
 
 function generateMysqlInit(projectName: string, dbName: string): string {

package/src/generators/middleware.ts

@@ -33,11 +33,13 @@ const port = Number(process.env.PORT) || 3000;
 
 app.use(express.json());
 
-// Tenant extraction middleware
+// Tenant extraction middleware. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 app.use((req, _res, next) => {
-  const tenantId =
-    req.headers["x-tenant-id"] as string ||
-    req.hostname.split(".")[0];
+  const tenantId = req.hostname.split(".")[0];
   (req as any).tenantId = tenantId;
   next();
 });
@@ -68,12 +70,14 @@ function generateFastifyMiddleware(projectName: string): MiddlewareFile[] {
 const fastify = Fastify({ logger: true });
 const port = Number(process.env.PORT) || 3000;
 
-// Tenant extraction plugin
+// Tenant extraction hook. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 fastify.decorateRequest("tenantId", "");
 fastify.addHook("onRequest", async (request) => {
-  const tenantId =
-    (request.headers["x-tenant-id"] as string) ||
-    (request.hostname?.split(".")[0] ?? "");
+  const tenantId = request.hostname?.split(".")[0] ?? "";
   (request as any).tenantId = tenantId;
 });
 
@@ -105,14 +109,15 @@ function generateNextjsMiddleware(projectName: string): MiddlewareFile[] {
 import { NextRequest, NextResponse } from "next/server";
 
 export function middleware(request: NextRequest) {
+  // The tenant comes from the subdomain the request was routed to. Any
+  // x-tenant-id the client sent is removed first, so server code that reads
+  // x-tenant-id only ever sees the value set here. Once you add
+  // authentication, check that the signed-in user belongs to this tenant.
   const hostname = request.headers.get("host") || "";
-  const subdomain = hostname.split(".")[0];
-  const headerTenantId = request.headers.get("x-tenant-id");
-  const pathTenantId = request.nextUrl.pathname.match(/^\\/tenant\\/([^/]+)/)?.[1];
-
-  const tenantId = headerTenantId || pathTenantId || subdomain;
+  const tenantId = hostname.split(".")[0];
 
   const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
   if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
     requestHeaders.set("x-tenant-id", tenantId);
   }
@@ -135,7 +140,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Access tenant context via <code>x-tenant-id</code> header</li>
+        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -155,11 +160,13 @@ import { serve } from "@hono/node-server";
 
 const app = new Hono();
 
-// Tenant extraction middleware
+// Tenant extraction middleware. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 app.use("*", async (c, next) => {
-  const tenantId =
-    c.req.header("x-tenant-id") ||
-    new URL(c.req.url).hostname.split(".")[0];
+  const tenantId = new URL(c.req.url).hostname.split(".")[0];
   c.set("tenantId", tenantId);
   await next();
 });
@@ -239,9 +246,11 @@ export class AppController {
 export class TenantGuard implements CanActivate {
   canActivate(context: ExecutionContext): boolean {
     const request = context.switchToHttp().getRequest();
-    const tenantId =
-      request.headers["x-tenant-id"] ||
-      request.hostname?.split(".")[0];
+    // The tenant comes from the subdomain the request was routed to. Do not
+    // take it from a client-supplied header such as x-tenant-id: any caller
+    // can set one and pick another tenant. Once you add authentication, check
+    // that the signed-in user belongs to this tenant here.
+    const tenantId = request.hostname?.split(".")[0];
     request.tenantId = tenantId || null;
     return true;
   }

package/src/index.ts

@@ -5,8 +5,9 @@ import * as path from "path";
 import crypto from "node:crypto";
 import { execSync } from "child_process";
 import { fileURLToPath } from "url";
-import { parsePresetString, isValidPreset, formatPresetString } from "./matrix.js";
+import { parsePresetString, isValidPreset } from "./matrix.js";
 import { createPresetProject } from "./preset-project.js";
+import { postgresAppRole, postgresAppRoleSql, POSTGRES_APP_PASSWORD } from "./generators/init-sql.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -194,7 +195,7 @@ CREATE EXTENSION IF NOT EXISTS "ltree";
 -- The ltree extension enables hierarchical tenant trees
 -- uuid-ossp provides uuid_generate_v4() for tenant IDs
 COMMENT ON DATABASE ${dbName} IS 'Multi-tenant database for ${projectName}';
-`;
+${postgresAppRoleSql(dbName)}`;
 }
 
 function generateEnv(projectName: string): string {
@@ -203,8 +204,12 @@ function generateEnv(projectName: string): string {
   return `# Environment variables for ${projectName}
 # Copy to .env and fill in values
 
-# Database
-DATABASE_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+# Database. The app connects as the non-superuser role created in init.sql,
+# so row-level security applies to it.
+DATABASE_URL=postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}
+
+# Superuser: bootstrap and migrations only. It bypasses row-level security.
+DATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
 
 # Authentication
 JWT_SECRET=${jwtSecret}
@@ -295,7 +300,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Access tenant context via <code>x-tenant-id</code> header</li>
+        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -305,18 +310,19 @@ export default function Home() {
 }
 
 function generateNextjsMiddleware(): string {
-  return `// middleware.ts — tenant resolution via subdomain or header
+  return `// middleware.ts — tenant resolution via subdomain
 import { NextRequest, NextResponse } from "next/server";
 
 export function middleware(request: NextRequest) {
+  // The tenant comes from the subdomain the request was routed to. Any
+  // x-tenant-id the client sent is removed first, so server code that reads
+  // x-tenant-id only ever sees the value set here. Once you add
+  // authentication, check that the signed-in user belongs to this tenant.
   const hostname = request.headers.get("host") || "";
-  const subdomain = hostname.split(".")[0];
-  const headerTenantId = request.headers.get("x-tenant-id");
-  const pathTenantId = request.nextUrl.pathname.match(/^\\/tenant\\/([^/]+)/)?.[1];
-
-  const tenantId = headerTenantId || pathTenantId || subdomain;
+  const tenantId = hostname.split(".")[0];
 
   const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
   if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
     requestHeaders.set("x-tenant-id", tenantId);
   }
@@ -380,7 +386,7 @@ ${projectName}/
 
 This project uses Stratum for hierarchical multi-tenancy:
 
-- **Tenant resolution** — via JWT claim, subdomain, or \`x-tenant-id\` header
+- **Tenant resolution** — via subdomain (see \`middleware.ts\`); bind it to the signed-in user once you add authentication
 - **Config inheritance** — settings flow down the tenant tree with override support
 - **Permission ABAC** — role-based permissions with tenant-scoped enforcement
 

package/src/preset-project.ts

@@ -4,7 +4,7 @@ import crypto from "node:crypto";
 import { execSync } from "child_process";
 import type { StackPreset } from "./matrix.js";
 import { generatePresetDockerCompose } from "./generators/docker-compose.js";
-import { generatePresetInitSql } from "./generators/init-sql.js";
+import { generatePresetInitSql, postgresAppRole, POSTGRES_APP_PASSWORD } from "./generators/init-sql.js";
 import { generateDbSetup } from "./generators/db-setup.js";
 import { generateMiddleware } from "./generators/middleware.js";
 import { generatePresetPackageJson } from "./generators/package-json.js";
@@ -24,9 +24,14 @@ function generatePresetEnv(projectName: string, preset: StackPreset): string {
   const jwtSecret = crypto.randomBytes(32).toString("base64url");
 
   let dbUrl: string;
+  let adminUrlLine = "";
   switch (preset.database) {
     case "postgres":
-      dbUrl = `postgres://${dbName}:dev_password@localhost:5432/${dbName}`;
+      // The app connects as the non-superuser role created in init.sql, so
+      // row-level security applies to it. The superuser URL is for bootstrap
+      // and migrations only.
+      dbUrl = `postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}`;
+      adminUrlLine = `\n# Superuser: bootstrap and migrations only. It bypasses row-level security.\nDATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}\n`;
       break;
     case "mongodb":
       dbUrl = `mongodb://${dbName}:dev_password@localhost:27017/${dbName}?authSource=admin`;
@@ -43,7 +48,7 @@ function generatePresetEnv(projectName: string, preset: StackPreset): string {
 
 # Database
 ${urlKey}=${dbUrl}
-
+${adminUrlLine}
 # Authentication
 JWT_SECRET=${jwtSecret}