TeaQL Enforces Multi-Tenant Query Policies at Runtime to Prevent Data Leaks

·1 views

TeaQL, a query framework for multi-tenant business systems, addresses the risk of developers forgetting to add tenant-specific filters by enforcing access rules at a centralized runtime boundary rather than in individual queries. The framework introduces a UserContext hook called enforceRequestPolicy, which intercepts every search request before it reaches the database, automatically appending customer and team restrictions. This approach ensures that even a query written without explicit tenant filters will still respect boundaries such as customer data isolation, recruiter team visibility, and regional data residency rules. Both the Java and Rust implementations of TeaQL support this pattern, with platform-scoped policy hooks that run after any entity-level checks. The centralized design also allows platforms to block dangerous request shapes, cap page sizes, and prevent raw SQL from bypassing tenant controls.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds AI for six browser games using just three classic algorithms

A developer built six small browser games — including 2048, tic-tac-toe, and sudoku — each equipped with an AI opponent or solver written in plain JavaScript with no external libraries. Three foundational algorithms power all the games: Minimax with alpha-beta pruning for adversarial games, Expectimax for chance-based games like 2048, and BFS pathfinding for shortest-path style games. The 2048 solver uses a heuristic that rewards corner placement of large tiles, empty cell count, and tile smoothness, with search depth adapting to board state. Performance was validated through a headless self-play harness running thousands of games, revealing the solver reaches the 2048 tile roughly 70% of the time and the 4096 tile about 30% of the time. The entire project ships as a static file that runs locally in the browser, requiring no server calls or external dependencies.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Your AI chat history may be doing attackers' reconnaissance for them

Security researchers and law enforcement are raising alarms about the risk posed by personal AI chat accounts, which can contain detailed, self-written records of users' relationships, anxieties, and private language. Group-IB found over 101,000 stolen ChatGPT credentials in dark web infostealer logs between June 2022 and May 2023, with a follow-up count reaching around 225,000 log files the next year. Separate incidents — including an exposed DeepSeek database with over a million chat logs and accidental public sharing on Meta AI — show that breaches do not always require a sophisticated attacker. The FBI's May 2025 advisory warned that criminals are using AI-cloned voices alongside harvested personal data to commit fraud, logging over 22,000 AI-related complaints and $893 million in reported losses that year. Security experts note that in regions where a single smartphone serves as the gateway for banking, messaging, and authentication, the compromise of one AI app account can unravel an individual's entire digital security.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why bash's set -e can silently crash scripts over non-error exits

The bash directive set -e causes a script to exit immediately whenever any command returns a non-zero status, which is intended to catch errors. However, many common commands legitimately return non-zero without indicating a real failure, such as grep finding no match, curl receiving a 4xx response, or an arithmetic comparison evaluating to false. This behaviour can cause scripts to terminate unexpectedly during deployments or routine operations, often with no clear error message. Developers can work around the issue by appending '|| true' to suspect commands, toggling set -e off and on around specific lines, or using explicit conditional checks. Experts suggest that while set -e is not inherently bad, it should only be used with a clear understanding of which commands it may inadvertently treat as failures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solon Framework Uses Listener Interface Instead of Annotations for WebSocket Endpoints

The Solon Java framework takes a different approach to WebSocket development by replacing the standard JSR-356 lifecycle annotations — such as @OnOpen, @OnMessage, and @OnClose — with a WebSocketListener interface. Developers retain the @ServerEndpoint annotation for path declaration but handle lifecycle events by extending SimpleWebSocketListener or implementing WebSocketListener directly. Solon supports two deployment configurations: a shared-port mode where HTTP and WebSocket traffic use the same port, and an independent-port mode where WebSocket runs on a dedicated port configurable via app.yml. Path variables and query parameters are both accessed through a unified socket.param() method, simplifying endpoint logic. The framework's IoC container auto-discovers endpoint classes, requiring only a single enableWebSocket(true) call in the application's main method.

0 comments Read more at DEV Community