This is a continuation of part I of the multitenant series. You can check part 1 here. In this one, I will discuss how we can build the backend of our app using the third architecture discussed in the part I.

What are we building?

An online shop app! This will be a multitenant app where a user can create their own online shop and add users and products to this shop. There can exist any number of shops in our app.

A user can create a new shop and visit their shop using the shop code as the subdomain. Let's build the backend APIs for this system using the Django REST Framework.

Expected APIs

• Create a shop
• Create a user in this shop
• Create a product in this shop
• List the products in this shop

Database Design

We will have a table Tenant to store all the shops. All the other tables will have a reference to the Tenant table.

Our Django Models

import uuid
from django.db import models
from django.contrib.auth.models import AbstractBaseUser

from .managers.tenant import TenantManager
from .managers.user import CustomUserManager


class Tenant(models.Model):

    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
    name = models.CharField(max_length=128)
    code = models.CharField(max_length=128, unique=True)


class TenantBaseModel(models.Model):

    class Meta:
        abstract = True

    objects = TenantManager()
    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
    tenant = models.ForeignKey(Tenant, on_delete=models.CASCADE)


class User(AbstractBaseUser, TenantBaseModel):

    USERNAME_FIELD = 'id'
    REQUIRED_FIELDS = list()

    user_objects = CustomUserManager()
    first_name = models.CharField(max_length=512)
    last_name = models.CharField(max_length=512, null=True, blank=True)
    email = models.EmailField(max_length=512)

    class Meta:
        unique_together = ('tenant_id', 'email',)


class Product(TenantBaseModel):

    name = models.CharField(max_length=256)
    code = models.CharField(max_length=256)
    added_by = models.ForeignKey(User, on_delete=models.CASCADE)
    added_on = models.DateTimeField(auto_now_add=True)

TheTenant model on the top stores all the shop information.

The TenantBaseModel is an abstract class that can be inherited from all our tenant models like User and Product so they automatically get the tenant fields.

We have overridden the objects in the TenantBaseModel with the TenantManager which we will see next.

The TenantManager

from django.db import models


class TenantManager(models.Manager):

    def get_queryset(self):
        return None

    def t_filter(self, tenant, **kwargs):
        return super(TenantManager, self) \
            .get_queryset() \
            .filter(tenant=tenant, **kwargs)

We override the get_queryset to return None.

So, AnyTenantModel.objects.all() or AnyTenantModel.objects.filter() will return None.

We can use t_filter to get the single tenant related information, AnyTenantModel.objects.t_filter(tenant=tenant).

Tenant Routing Middleware

Every tenant-based API should have a tenant code passed. We can pass the tenant code via the API headers. This middleware will pick the tenant code from the headers, get the tenant object from the DB, and set the tenant in the request object.

from django.http import Http404
from django.urls import reverse

from ..models import Tenant

TENANT_URLS = [
    reverse('tenants-list')
]

class CustomTenantMiddleware:

    def __init__(self, get_response):
        self.get_response = get_response
        self.TENANT_NOT_FOUND_EXCEPTION = Http404

    def __call__(self, request):
        code = request.META.get('HTTP_TENANT_CODE')
        if request.path in TENANT_URLS:
            return self.get_response(request)
        try:
            tenant = Tenant.objects.get(code=code)
            request.tenant = tenant
            return self.get_response(request)
        except Exception:
            raise self.TENANT_NOT_FOUND_EXCEPTION(
                f'Tenant with code \'{code}\' does not exists'
            )

Handling authentication

Once the JWT token authentication is done, we also check if this authenticated user is a part of this tenant.

from rest_framework import exceptions
from knox.auth import TokenAuthentication
from ..models import User


class CustomTokenAuthentication(TokenAuthentication):

    def authenticate(self, request):
        user, auth_token = super().authenticate(request)

        if user.tenant != request.tenant:
            raise exceptions.AuthenticationFailed(
                'User does not exist in this tenant')

        return user, auth_token

Tenant based viewsets

Once we have completed all the above steps, we can easily integrate all this together. Our authentication class will be the CustomTokenAuthentication class, we can set it globally in the settings file as well.

We override get_queryset to use t_filter and we get the tenant in the request object. So User.objects.t_filter(tenant=self.request.tenant) means all the users in this tenant.

from rest_framework import viewsets
from ..serializers.user import UserSerializer
from ..models import User
from ..authentication.auth import CustomTokenAuthentication


class UserViewSet(viewsets.ModelViewSet):

    serializer_class = UserSerializer
    authentication_classes = (CustomTokenAuthentication, )
    pagination_class = None

    def get_queryset(self):
        return User.objects \
            .t_filter(tenant=self.request.tenant) \
            .order_by('first_name')

from rest_framework import viewsets
from ..models import Product
from ..serializers.product import ProductSerializer
from ..authentication.auth import CustomTokenAuthentication


class ProductViewSet(viewsets.ModelViewSet):

    serializer_class = ProductSerializer
    authentication_classes = (CustomTokenAuthentication, )
    pagination_class = None

    def get_queryset(self):
        return Product.objects \
            .t_filter(tenant=self.request.tenant) \
            .order_by('code')

Tada! You have your multitenant backend APIs ready. Check out the full code here.

Thanks for reading!