Guide to Laravel Multi-Tenancy Architecture for SaaS Apps in 2026

·2 views

A technical guide published on DEV Community outlines the key architectural decisions involved in building multi-tenant SaaS applications using Laravel. Developers must choose between three main approaches: a single shared database, separate per-tenant databases, or a hybrid model combining both. The hybrid pattern is emerging as the preferred approach in 2026, using a shared global database for billing and authentication alongside isolated per-tenant databases for application data. The guide covers implementation using Spatie's laravel-multitenancy package, complete with reusable code examples. It also highlights common pitfalls, such as missing tenant ID scopes that can lead to data leaks, and offers a checklist to help teams build secure, scalable tenancy from the start.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Supabase RLS Policy Flaw Can Expose Entire Users Table to Anonymous Requests

A subtle but critical misconfiguration in Supabase Row-Level Security (RLS) policies can inadvertently expose all user profile data to unauthenticated requests. Because PostgreSQL evaluates null comparisons and boolean logic in a way that makes an unguarded policy resolve to true for anonymous callers, the anon key — which is intentionally public and ships in client bundles — can bypass intended access controls. A developer discovered this in a real app where profile data including names, timezones, and availability schedules was fully accessible via a simple curl request, despite the app redirecting signed-out users to a login page in the browser. The fix involved adding an explicit auth.uid() is not null guard to the RLS policy, ensuring anonymous sessions are blocked at the database level rather than relying on client-side redirects. For cases where anonymous users need aggregate data, the recommended approach is a security definer function that returns only computed numbers, keeping raw rows inaccessible to unauthenticated callers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Codename One Adds Apple Watch and Wear OS Support From a Single Codebase

Open-source framework Codename One has introduced watch app support for both Apple Watch and Wear OS through a single Java or Kotlin codebase via pull request #5487. On Apple platforms, setting a watchMain entry point automatically adds a companion watch target to the existing phone build. For Wear OS, enabling the watchStandalone flag replaces the phone build with a standalone Wear OS application, though a companion Wear APK alongside the phone app is not yet supported. The update also introduces a unified phone-to-watch communication API that maps to WCSession on Apple and the Wearable Data Layer on Android, offering both persistent data sync and real-time messaging. While the phone and watch can share source files, resources, and themes, they maintain completely separate runtime state, storage, and SQLite databases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Seven Core Design Patterns Powering Modern Agentic AI Systems

A software developer writing for DEV Community outlines seven recurring architectural patterns that underpin most agentic AI systems, arguing these structures do the real work beneath the industry hype. Key patterns include ReAct, where a model reasons and acts iteratively based on live observations, and Plan-and-Execute, which separates planning from action to allow human inspection before anything runs. The Reflection pattern improves output quality by having a model critique and revise its own drafts in a loop, while Tool Use emphasizes clean API design so models can compose actions effectively. Multi-agent orchestration splits large tasks among specialized workers coordinated by a central agent. The author stresses that understanding and naming these patterns helps developers recognize them across popular frameworks like LangChain and Claude Code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitHub Copilot Agent Skills Let Developers Package Domain Expertise for AI Reuse

Agent Skills are structured instruction sets that AI coding assistants like GitHub Copilot can load on demand to perform tasks more reliably within a specific project or workflow. Instead of relying on a model's general training knowledge, developers write SKILL.md files containing domain-specific context, API patterns, and step-by-step procedures. Agents load skills in three stages—discovery, activation, and execution—pulling full instructions into context only when a task matches a skill's description, keeping the overall context footprint small. Skills can be stored either at the project level in repository folders or as personal skills in a home directory for cross-project reuse. The architecture is designed to be provider-agnostic, meaning it can extend beyond GitHub Copilot to any compatible AI platform or agent framework.

0 comments Read more at DEV Community