Fictional example. A SaaS application serves multiple companies. A token carries user and tenant identifiers, while the gateway validates its signature and expiry. Report numbers are allocated independently inside each company, so tenants A and B can both have report 42.
The GET /reports/42 endpoint first looks in a shared cache under report:42. Only on a miss does it query the database with a tenant filter. A user from tenant A opens their report and warms the cache. Shortly afterwards, an authorised user from tenant B requests their own report 42 and receives the cached response. The team says, “But the gateway checked authorisation.”
Where did tenant isolation break? How will you change authorisation, the cache key and tests so the fix covers the whole path rather than this endpoint alone?
Guiding questions
- Does a valid token prove access to a particular report?
- Which values identify a report uniquely across the system?
- Is access checked on a cache hit as well as a miss?
- How will two tenants with the same local report number expose a regression?