GatherGrove

The decision

Tenant isolation between clubs was enforced at the edge instead of inside EF Core. The usual answer for a multi-tenant app is a global query filter, HasQueryFilter, that scopes every query to the caller’s tenant automatically. A filter that silently fails to apply, because a query used raw SQL or bypassed the entity, leaks data with no signal to catch it.

Instead, a single globally registered MVC action filter, ClubIdValidationFilter, ran ahead of every one of the 65 controllers’ handlers and logged a cross-tenant attempt as a security event rather than letting it fall through to an empty result set. It compared the route’s {clubId} against the caller’s JWT claim, and authorization policies plus composite (ClubId, …) unique constraints backed it up as defense in depth.

The tradeoff: the filter’s protection stopped at the route, so a query that filtered incorrectly inside its own handler, the one case HasQueryFilter would have caught automatically, could still leak. What it bought instead was a check that ran before any of the 65 handlers executed and turned a cross-tenant attempt into a logged security event rather than a silent empty response.

Architecture

A .NET 9 API in four backend projects with inward-pointing dependencies served three clients: a Next.js 15 web app on Cloudflare Workers, a React Native mobile app, and background jobs. The API talked to PostgreSQL, Redis, Stripe Connect, and Resend, and streamed live updates over three SignalR hubs.

The database itself changed mid-project: a live cutover from SQL Server, which GatherGrove had run on for its first nine months, to PostgreSQL on 2026-02-17. The type mismatches surfaced in a day. Threading DateTimeKind.Utc through six services, so that PostgreSQL’s timestamptz (which rejects a DateTime with an Unspecified Kind that SQL Server had accepted silently) agreed with the code that talked to it, took five weeks.