chem-lab

Production-grade monorepo for the chem-lab SaaS.

Getting started (backend)

From the repo root:

pnpm install
pnpm --filter @chem-lab/api dev

To start the backing services for the API (Postgres + Redis):

cd apps/api
docker compose up -d

Copy the environment template before running the API:

cp apps/api/.env.example apps/api/.env

Tenant isolation and request context

The API uses AsyncLocalStorage to keep a per-request context with userId, orgId (aka activeOrgId), and isSystemAdmin. Prisma middleware enforces tenant isolation for tenant-scoped models (Project, SceneVersion) using that context.

Security invariants

• Tenant-scoped queries must include an activeOrgId in the request context.
• Prisma automatically injects orgId into tenant create operations and into where filters for findMany, findFirst, updateMany, deleteMany, and count.
• findUnique, update, and delete are rejected for tenant models unless a compound key that includes orgId is provided.
• isSystemAdmin bypasses tenant filtering for administrative workflows.

Setting activeOrgId in session Set req.session.activeOrgId during authentication or org-switch endpoints, for example after login or when the user selects an organization. The request context interceptor reads it into AsyncLocalStorage so Prisma can enforce scoping.