Hostinvo is multi-tenant on a shared schema. Every tenant-owned table carries a tenant_id column, and a global Eloquent scope constrains queries to the tenant resolved for the current request. There is no per-tenant database to provision.
How a tenant is resolved
- The ResolveTenant middleware runs after authentication on every admin and client route.
- For a normal user the tenant comes from the user's tenant_id and is written to the session.
- For a super_admin the tenant comes from the active tenant context, which is how platform owners switch into a workspace.
- If the session already carries a different tenant_id than the user, the session is invalidated and the request is rejected — this prevents a session surviving across workspaces.
Scoping in queries
Tenant-aware models apply the scope automatically, so ordinary queries cannot read across tenants. Deliberately crossing the boundary — platform-owner reporting, for instance — requires withoutGlobalScopes(), which makes those call sites easy to find and review.
Platform-owner context
A super_admin has no tenant_id of their own. They browse the platform surface until they switch into a tenant, at which point the session is scoped to that tenant and the workspace behaves as that tenant's staff would see it. Leaving the context clears the scope again.