infrastructure-tenant-pool

Multi-tenant database pool management with per-tenant isolation

What it is for

Multi-tenant database pool management with per-tenant isolation.

This crate provides infrastructure for managing database connection pools in a multi-tenant environment where each tenant has their own database.

# Features

• `TenantPoolManager`: Manages a cache of database pools, one per tenant.

Pools are lazily created on first access and automatically evicted when idle.

• `TenantProvisioningService`: Creates and destroys tenant databases,

runs migrations, and updates tenant records.

• Axum Middleware (optional): Extracts tenant ID from requests and injects

the appropriate database pool into handlers.

# Architecture

┌─────────────────────────────────────────────────────────────┐
│                      Control Plane DB                        │
│  ┌─────────────────────────────────────────────────────────┐ │
│  │ tenants (id, slug, database_url, status, isolation)     │ │
│  │ users, tenant_members, sessions                         │ │
│  └─────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────┘
│
TenantPoolManager
(reads database_url)
│
┌───────────────────┼───────────────────┐
▼                   ▼                   ▼
┌──────────┐        ┌──────────┐        ┌──────────┐
│ Tenant A │        │ Tenant B │        │ Tenant C │
│ Database │        │ Database │        │ Database │
└──────────┘        └──────────┘        └──────────┘

# Example

use infrastructure_tenant_pool::{TenantPoolManager, PoolManagerConfig};
use sqlx::PgPool;

// Create the control plane pool
let control_pool = PgPool::connect("postgresql://localhost/control").await?;

// Create the pool manager
let config = PoolManagerConfig::default();
let manager = TenantPoolManager::new(control_pool, config);

// Get a pool for a specific tenant
let tenant_id = uuid::Uuid::parse_str("...")?;
let tenant_pool = manager.get_pool(tenant_id).await?;

// Use the pool for queries
let rows = sqlx::query("SELECT * FROM items")
.fetch_all(&tenant_pool)
.await?;

# Axum Integration

When the axum-middleware feature is enabled (default), you can use the tenant middleware in your Axum application:

use axum::{Router, routing::get};
use infrastructure_tenant_pool::{TenantPoolManager, tenant_middleware, TenantCtx};

async fn list_items(TenantCtx(ctx): TenantCtx) -> impl IntoResponse {
// ctx.pool is the tenant's database pool
// ctx.tenant is the Tenant record
let items = sqlx::query_as!(Item, "SELECT * FROM items")
.fetch_all(&ctx.pool)
.await?;
Json(items)
}

let app = Router::new()
.route("/items", get(list_items))
.layer(axum::middleware::from_fn_with_state(
pool_manager.clone(),
tenant_middleware,
));

Capabilities

provisioning (other)

Tenant database provisioning service.

ProvisionRequest

Tenant database provisioning service.

ProvisionResult

Tenant database provisioning service.

TenantProvisioningService

Tenant database provisioning service.

How to use it

From this crate's own rustdoc:

# Example

From this crate's own rustdoc:

# Axum Integration

When the `axum-middleware` feature is enabled (default), you can use the
tenant middleware in your Axum application:

Module structure

infrastructure_tenant_pool

• prelude
• provisioning

flowchart TD
  n_infrastructure_tenant_pool["infrastructure_tenant_pool"]
  n_infrastructure_tenant_pool --> n_prelude["prelude"]
  n_infrastructure_tenant_pool --> n_provisioning["provisioning"]

Public surface

`provisioning`

Re-exports. Exported here, defined elsewhere.

Boundary

Reaches into foundation, identity.

Shares tier infrastructure with 82 other crates: infrastructure-acquire, infrastructure-adapters-google-calendar, infrastructure-adapters-google-gmail, infrastructure-adapters-google-places, infrastructure-adapters-google-trends, infrastructure-adapters-shodan, infrastructure-adapters-yelp, infrastructure-agent, … (82 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier flow. Which tiers this crate's own edges cross.

flowchart LR
  n_infrastructure["infrastructure"] --> n_foundation["foundation"]
  n_infrastructure["infrastructure"] --> n_identity["identity"]

Dependencies

Runtime, in this workspace.

Runtime, from outside the workspace.

Development, from outside the workspace.

Build. None.

Depended on by. 12 workspace crates.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  n_application_communication["application-communication"] -->|uses| SELF
  n_application_dlp["application-dlp"] -->|uses| SELF
  n_application_legal_documents["application-legal-documents"] -->|uses| SELF
  n_application_legal_evidence["application-legal-evidence"] -->|uses| SELF
  n_application_legal_knowledge["application-legal-knowledge"] -->|uses| SELF
  n_application_legal_matter["application-legal-matter"] -->|uses| SELF
  n_application_legal_procedure["application-legal-procedure"] -->|uses| SELF
  n_application_party_api["application-party-api"] -->|uses| SELF
  n_application_tenant["application-tenant"] -->|uses| SELF
  n_operations_privacy_scan_runner["operations-privacy-scan-runner"] -->|uses| SELF
  n_operations_test_results_ingest["operations-test-results-ingest"] -->|uses| SELF
  n_platform_privacy_scan_api["platform-privacy-scan-api"] -->|uses| SELF
  SELF["infrastructure-tenant-pool"]
  SELF -->|runtime| n_foundation_audit_log["foundation-audit-log"]
  SELF -->|runtime| n_foundation_basemodels["foundation-basemodels"]
  SELF -->|runtime| n_identity_tenant["identity-tenant"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

flowchart LR
  n_axum["axum"] --> n_dep_axum["dep:axum"]
  n_axum_middleware["axum-middleware"] --> n_axum["axum"]
  n_axum_middleware["axum-middleware"] --> n_tower["tower"]
  n_axum_middleware["axum-middleware"] --> n_http["http"]
  n_default["default"] --> n_axum_middleware["axum-middleware"]
  n_http["http"] --> n_dep_http["dep:http"]
  n_tower["tower"] --> n_dep_tower["dep:tower"]

Targets

Error model

No public error type was detected: no public item declares a type named *Error, and no public signature returns one.

Operational characteristics

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.

Related capabilities

12 workspace crates depend on this one: application-communication, application-dlp, application-legal-documents, application-legal-evidence, application-legal-knowledge, application-legal-matter, application-legal-procedure, application-party-api, application-tenant, operations-privacy-scan-runner, operations-test-results-ingest, platform-privacy-scan-api.

Verification

Evidence by module. How often each public module is named by something executable.

What the tests establish, by name:

• tenant_pool_binds_guc_and_rls_filters_cross_tenant_rows — tests/pg_tenant_guc.rs
• an_invalid_identifier_is_refused_before_any_sql_is_built — tests/provisioning_topology.rs
• create_database_keeps_the_template0_and_locale_contract — tests/provisioning_topology.rs
• create_database_names_an_explicit_owner — tests/provisioning_topology.rs
• hardening_refuses_invalid_identifiers_too — tests/provisioning_topology.rs
• hardening_revokes_public_connect — tests/provisioning_topology.rs
• the_runtime_grant_precedes_the_public_revoke — tests/provisioning_topology.rs
• test_config_builder — src/config.rs
• test_default_config — src/config.rs
• test_generate_db_name — src/config.rs
• test_provisioning_config — src/config.rs
• default_config_is_safe — src/fleet_migrator.rs
• lock_class_fallback_is_deterministic_per_uuid — src/fleet_migrator.rs
• lock_class_prefers_dense_key — src/fleet_migrator.rs
• sandbox_rejects_escape — src/fleet_migrator.rs
• test_config_exports — src/lib.rs
• test_error_display — src/lib.rs
• test_provisioning_config_exports — src/lib.rs
• ambiguous_membership_without_a_header_is_refused_not_guessed — src/middleware.rs
• any_permits_any_tenant_but_must_be_chosen_deliberately — src/middleware.rs
• header_naming_a_permitted_tenant_is_allowed — src/middleware.rs
• header_naming_an_unpermitted_tenant_is_denied — src/middleware.rs
• malformed_header_is_rejected_before_any_authorization_decision — src/middleware.rs
• no_membership_at_all_is_refused — src/middleware.rs
• sole_membership_needs_no_header — src/middleware.rs
• test_extract_tenant_id_empty_value — src/middleware.rs
• test_extract_tenant_id_invalid_uuid — src/middleware.rs
• test_extract_tenant_id_missing_header — src/middleware.rs
• test_extract_tenant_id_valid — src/middleware.rs
• test_middleware_error_status_codes — src/middleware.rs
• _… 20 more_

Documentation coverage

pie showData
    title Public items with rustdoc
    "Documented" : 12
    "No rustdoc detected" : 0

Metrics

pie showData
    title Public API by kind
    "function" : 2
    "method" : 7
    "struct" : 3

pie showData
    title Rust source composition
    "Code" : 1971
    "Blank or comment" : 1098

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.