Identity
`@multitenant/identity` — AES-256-GCM session cookies and tenant access checks.
Node-only. Builds on @multitenant/core types (EncodedSession, Identity, canAccessTenant, assertAccess): parse Cookie headers, emit Set-Cookie, and optionally verify the session’s tenant matches the host-resolved tenant.
Resolution order in production is usually: host → ResolvedTenant (core) → session (this package) → assertAccess / compare session.currentTenantKey to resolved.tenantKey.
Install
npm install @multitenant/identitySession cookie flow
import type { EncodedSession } from '@multitenant/core';
import {
getSessionFromCookieHeader,
buildSessionSetCookieHeader,
} from '@multitenant/identity';
const SECRET = process.env.MULTITENANT_SESSION_SECRET!;
// Incoming request
export function readSession(cookieHeader: string | null): EncodedSession | null {
return getSessionFromCookieHeader(cookieHeader, SECRET);
}
// After login / tenant switch — attach to Response
export function loginSetCookie(session: EncodedSession): string {
return buildSessionSetCookieHeader(session, SECRET, {
path: '/',
sameSite: 'lax',
secure: process.env.NODE_ENV === 'production',
maxAgeSeconds: 60 * 60 * 24 * 7,
});
}Default cookie name is multitenant_session; override with cookieName in options.
Align session with host-resolved tenant
import type { EncodedSession, ResolvedTenant } from '@multitenant/core';
import { assertAccess } from '@multitenant/identity';
export function guardRoute(resolved: ResolvedTenant, session: EncodedSession | null) {
assertAccess(session, { tenantKey: resolved.tenantKey });
if (session && session.currentTenantKey !== resolved.tenantKey) {
throw new Error('Session tenant does not match host tenant');
}
}Use canAccessTenant(session, { tenantKey, requiredRoles }) when you need a boolean instead of throwing.
See also
@multitenant/core—ResolvedTenant,EncodedSession, errors- Errors —
MultitenantErrorvs generic auth failures - Database — ALS scope after you have
resolved