Mongoose

tenancyjs-adapter-mongoose scopes MongoDB access per tenant. This page shows it wired end to end with Express; using a different framework? Swap only the integration (see the swap note).

Install

Three pieces: the core, this adapter (your ORM), and an integration (your framework).

npm install tenancyjs-core tenancyjs-adapter-mongoose tenancyjs-integration-express mongoose

Wire it into your app

import { TenancyManager } from "tenancyjs-core";
import { createMongooseTenancy } from "tenancyjs-adapter-mongoose";
import { createConnection } from "mongoose";
import { OrderModel } from "./models";

export interface Tenant {
  readonly id: string;
}

export const manager = new TenancyManager<Tenant>();

const connection = await createConnection(process.env.MONGODB_URL!).asPromise();

export const tenancy = createMongooseTenancy({
  manager,
  connection,
  tenantModels: [{ model: OrderModel }],
});

await tenancy.validate(); // verify the setup before serving

import express from "express";
import { createExpressTenancyMiddleware } from "tenancyjs-integration-express";
import { manager, tenancy } from "./tenancy";
import { OrderModel } from "./models";

const app = express();

app.use(createExpressTenancyMiddleware({ manager, resolver }));

app.get("/orders", async (_req, res) => {
  const orders = await tenancy.run((client) =>
    client.model(OrderModel).find({ status: "open" }),
  );
  res.json(orders); // only the current tenant's orders
});

That's the whole thing: the adapter injects the tenant filter on reads and the tenant field on writes, rejects $-operator and dotted keys, and runs everything inside a session-bound transaction. Outside a tenant scope, it fails closed.

Use a different framework

The adapter half stays identical - only swap the integration import for your framework:

Strategy support

Mongoose supports adapter-enforced row-level isolation and database-per-tenant routing. MongoDB has no SQL schema-per-tenant equivalent.

const tenancy = createMongooseTenancy({
  manager,
  connection: landlordConnection,
  strategy: "databasePerTenant",
  tenantModels: [{ model: OrderModel }],
  database: (tenant) => ({
    key: tenant.databaseKey,
    create: () => createTenantConnection(tenant.databaseSecretRef),
  }),
});

Every tenant connection must register the configured model name and reach a replica set. Shared credentials provide routing separation; use credentials restricted to one MongoDB database for server-side authorization. Call close() during shutdown.

Full query freedom: unrestricted()

In row-level mode the facade is the only guard - there is no database backstop (see the warning above)

• so it rejects native handles, $-operators, and dotted keys; it can't let through what it can't prove is tenant-safe (see Limitations). Database-per-tenant is different: the leased connection is the tenant's own database, so any operation is isolated by construction. There, the client gives you an escape hatch that returns the leased Connection - aggregation, populate, and the native collection:

const report = await tenancy.run(async (client) => {
  // The raw, tenant-scoped Connection - aggregation, populate, native collection.
  const connection = client.unrestricted();

  return connection
    .model(OrderModel.modelName)
    .aggregate([
      { $match: { total: { $gt: 1000 } } },
      { $group: { _id: "$customerId", total: { $sum: "$total" } } },
    ]);
});