Making the authentication process tenant-based

At this point, we have a setup that respects the tenant permissions when selecting data from the database. Our current setup differentiates tenants by a path in the URL and the login page is shown for valid tenants only.

But something’s bugging me: I can visit the login of the activenode tenant at http://localhost:3000/activenode/ to sign in with my credentials, even though the account I’m signing in with only has permissions set on packt and oddmonkey, not activenode. When I sign in and I’m forwarded to /activenode/tickets, I will see Unknown as the tenant name in the header as I have no permission for it.

And here’s another thing: even if I sign in on the path of a tenant that I have permission for, I can freely jump around to other tenants by changing the URL because the middleware only checks for a valid session.

Both are not a security concern as our RLS policies will shield the data, but it’...