Hey

I’ve read through the posts on using AshAuthentication and multitenancy and couldn’t find an appropriate fit for this.

The title of this post may need massaging if this cannot be written off immediately.

Scenario

Using a clean (generated) slate, I’ve created a new resource Organization which uses the :attribute strategy whereas the User and Token resources have been adapted to use the :context strategy. This is further explained below and also published as a preproduction on GitHub.

Running the registration actions on User with the correct tenant set in AshAdmin, I get an error from Myapp.Accounts.Token.store_confirmation_changes saying:

Queries against the Myapp.Accounts.Token resource require a tenant to be specified

I get the same result from running the code in an iex session (please see the README of the reproduction).

The changes from the generated code are set out in this commit:

https://github.com/carlgleisner/ash_auth_multitenancy_repro/commit/7fab8b50aed38a95ce58e39948508eea01aa1cdd

This is all set out in the README of reproduction repo, but I paste the pertinent sections of the resources below.

Asking humbly, is there something manifestly wrong with this setup?

Thankful for any input

The resources

User and Token

multitenancy do
  strategy :context
end

Organization

postgres do
  table "organizations"
  repo Myapp.Repo

  manage_tenant do
    template ["org_", :subdomain]
    create? true
    update? false
  end
end

multitenancy do
  strategy :attribute
  attribute :subdomain
  global? true
end

To juggle resources using different multitenancy strategies, the Ash.ToTenant protocol introspects the resources and returns either the org_subdomain form or the attrubute subdomain.

defimpl Ash.ToTenant do
  def to_tenant(%{subdomain: subdomain}, resource) do
    if Ash.Resource.Info.data_layer(resource) == AshPostgres.DataLayer &&
          Ash.Resource.Info.multitenancy_strategy(resource) == :context do
      "org_#{subdomain}"
    else
      subdomain
    end
  end
end

Perhaps it is worth noting that the :subdomain attribute on Organization is of the type :ci_string.

attribute :subdomain, :ci_string do
  public? true
  allow_nil? false
end