User API Middleware
Component Detail
Infrastructure
medium complexity
backend
2
Dependencies
0
Dependents
5
Entities
0
Integrations
Description
Next.js API route middleware enforcing multi-tenancy on all /api/v1/users endpoints. Extracts authenticated admin context from JWT, scopes every database query to the admin's organization_id, and blocks cross-tenant access regardless of query parameters. Issues elevated-privilege tokens for global admin flows with explicit audit logging.
user-api-middleware
Responsibilities
- Extract and validate admin JWT on every users API request
- Inject organization_id scope into all downstream service calls
- Detect and block cross-tenant query parameter manipulation
- Route global admin requests to elevated-privilege handler with audit logging
Interfaces
withOrgScope(handler: ApiHandler): ApiHandler
withGlobalAdminAudit(handler: ApiHandler): ApiHandler
extractAdminContext(req: NextRequest): AdminContext
Relationships
Dependencies (2)
Components this component depends on
Related Data Entities (5)
Data entities managed by this component