Why should you care?

ShopNest SaaS offers white-label stores — every Product query must filter TenantId or Store A sees Store B catalog.

See it live — copy this example

Paste into a .NET project with EF Core packages, then run with LocalDB/SQL Server (dotnet ef / dotnet run).

public interface ITenantContext { int TenantId { get; } }

public class Product { public int Id { get; set; } public int TenantId { get; set; } public string Name { get; set; } = ""; }

protected override void OnModelCreating(ModelBuilder b)
{
    b.Entity<Product>().HasQueryFilter(p => p.TenantId == _tenant.TenantId);
}

// Insert sets tenant:
db.Products.Add(new Product { TenantId = _tenant.TenantId, Name = "Shirt" });

What happened?

• HasQueryFilter appends TenantId predicate to every Product query automatically.
• ITenantContext from HTTP header resolves current tenant per request.

Practice next

1. Add TenantId to all tenant-scoped entities.
2. Register ITenantContext Scoped from subdomain or JWT claim.
3. Apply HasQueryFilter in OnModelCreating using injected tenant service.
4. build separate database per tenant with connection resolver.
5. Add composite index on TenantId + Sku for tenant catalog.

Remember

TenantId column isolates SaaS data. HasQueryFilter enforces tenant on queries. Set TenantId on every insert.

ShopNest white-label SaaS

Each merchant subdomain sets ITenantContext; EF filters all catalog queries by TenantId.

Outcome: Tenant A never queries Tenant B products — filter enforced at ORM layer.