Spring Boot SaaS Audit Suite

I have completed the multi-tenant architecture audit for the /app directory. I identified a

schema-per-tenant model with high confidence based on the TenantIdentifierResolver implementation.

Multi-Tenant Audit Report — backend-service @ 2023-10-24

Scope: src/main/java/**, src/main/resources/**. Tenancy model: Schema-per-tenant (High confidence).

Summary — P0: 1 | P1: 2 | P2: 0 | Can't-tell: 1

Findings

[P0] MT-02 — Session-level SET with Connection Pooler

• Evidence: src/main/java/com/saas/config/TenantSchemaInterceptor.java:42

statement.execute("SET search_path TO " + tenantId);

Why it matters: Using SET instead of SET LOCAL inside a transaction while using PgBouncer can leak the schema context to the next tenant using the same physical connection.

How to verify: Deploy to a staging env with PgBouncer in transaction mode and trace schema resolution across concurrent requests.

Suggested fix: Wrap in a transaction and use SET LOCAL search_path TO... or use a dedicated MultiTenantConnectionProvider.

[P1] MT-06 — Async path without tenant propagation

• Evidence: src/main/java/com/saas/service/ReportService.java:112

Why it matters: The @Async method generateExport() triggers without capturing the TenantContext. The background thread will default to the 'public' schema or fail.

• Suggested fix: Use a TaskDecorator to copy the ThreadLocal context to the new thread.

[P1] MT-04 — Cache keys without tenant prefix

• Evidence: src/main/java/com/saas/repository/ProductRepo.java:15

Why it matters: @Cacheable(value = "products") lacks a tenant discriminator. Tenant A may see Tenant B's cached products.

• Suggested fix: Update the cache key to include tenantId: key = "#root.target.tenantId + #id".

Next steps

1. Patch the SET LOCAL P0 finding immediately to prevent cross-contamination in production.
2. Implement a TaskDecorator for the ThreadPoolTaskExecutor to fix the async leaks.
3. Update the RedisCacheManager configuration to globally prefix keys with the tenant identifier.