Multi-Tenancy

-- Each organization has isolated schema
CREATE SCHEMA org_12345;
CREATE SCHEMA org_67890;

-- Tables within organization schema
CREATE TABLE org_12345.datasets (...);
CREATE TABLE org_12345.queries (...);
CREATE TABLE org_12345.users (...);

-- PostgreSQL RLS policies
CREATE POLICY org_isolation ON datasets
    FOR ALL
    USING (organization_id = current_setting('app.current_org')::uuid);

-- Automatic filtering
SELECT * FROM datasets;  -- Only shows current org's data

/storage/
  /org-12345/
    /datasets/
      /dataset-abc/
        /data.parquet
        /metadata.json
    /exports/
    /temp/
  /org-67890/
    /datasets/
    /exports/
    /temp/

class OrganizationContext:
    def __init__(self, user_id: str, org_id: str):
        self.user_id = user_id
        self.org_id = org_id
        self.permissions = self.load_permissions()
    
    def can_access(self, resource: str) -> bool:
        return self.permissions.check(resource, self.org_id)

{
  "sub": "user_123",
  "org": "org_12345",
  "roles": ["analyst", "developer"],
  "permissions": ["read:datasets", "write:queries"],
  "exp": 1634567890
}

@app.middleware("http")
async def org_context_middleware(request: Request, call_next):
    # Extract organization from token
    org_id = extract_org_from_token(request.headers)
    
    # Set context for request
    request.state.org_id = org_id
    
    # Add to database session
    set_db_context(org_id)
    
    return await call_next(request)

/api/v1/organizations/{org_id}/datasets
/api/v1/organizations/{org_id}/queries
/api/v1/organizations/{org_id}/users

organization_tiers:
  starter:
    max_concurrent_queries: 5
    query_timeout_seconds: 300
    max_result_size_mb: 100
    cpu_cores: 2
    memory_gb: 8
    
  professional:
    max_concurrent_queries: 20
    query_timeout_seconds: 900
    max_result_size_mb: 1000
    cpu_cores: 8
    memory_gb: 32
    
  enterprise:
    max_concurrent_queries: unlimited
    query_timeout_seconds: 3600
    max_result_size_mb: 10000
    cpu_cores: dedicated
    memory_gb: dedicated

class ResourceManager:
    def allocate_query_resources(self, org_id: str, query: Query):
        tier = self.get_org_tier(org_id)
        
        return {
            "cpu_limit": tier.cpu_cores,
            "memory_limit": tier.memory_gb,
            "timeout": tier.query_timeout_seconds,
            "priority": tier.priority_level
        }

class StorageQuota:
    def check_quota(self, org_id: str, size_bytes: int) -> bool:
        current_usage = self.get_usage(org_id)
        quota_limit = self.get_quota(org_id)
        
        if current_usage + size_bytes > quota_limit:
            raise QuotaExceededException(
                f"Storage quota exceeded: {current_usage}/{quota_limit}"
            )
        
        return True

# Per-organization connection pools
connection_pools = {}

def get_connection(org_id: str):
    if org_id not in connection_pools:
        connection_pools[org_id] = create_pool(
            min_size=2,
            max_size=10,
            database=f"gopie_org_{org_id}"
        )
    
    return connection_pools[org_id].acquire()

# Redis keyspace per organization
def cache_key(org_id: str, key: str) -> str:
    return f"org:{org_id}:{key}"

# Separate cache instances for large orgs
def get_cache_client(org_id: str):
    if is_enterprise_org(org_id):
        return dedicated_cache_clients[org_id]
    return shared_cache_client

# Shard organizations across clusters
sharding_strategy:
  method: consistent_hash
  shards:
    - shard_1: [org_1 - org_1000]
    - shard_2: [org_1001 - org_2000]
    - shard_3: [org_2001 - org_3000]

class PublicDataset:
    def __init__(self):
        self.visibility = "public"
        self.owner_org = None
        self.access_list = ["*"]
    
    def can_access(self, org_id: str) -> bool:
        return True  # Public access

class DataShare:
    def create_share(self, dataset_id: str, target_org: str):
        # Generate secure access token
        token = generate_share_token()
        
        # Set expiration and permissions
        share = {
            "dataset_id": dataset_id,
            "source_org": self.current_org,
            "target_org": target_org,
            "token": token,
            "expires_at": datetime.now() + timedelta(days=30),
            "permissions": ["read"]
        }
        
        return self.save_share(share)

{
  "timestamp": "2024-01-15T10:30:00Z",
  "org_id": "org_12345",
  "user_id": "user_789",
  "action": "dataset.create",
  "resource": "dataset_abc",
  "ip_address": "192.168.1.1",
  "user_agent": "Mozilla/5.0...",
  "result": "success",
  "metadata": {
    "dataset_size": 1048576,
    "format": "csv"
  }
}

# Prometheus metrics per organization
query_latency = Histogram(
    'query_latency_seconds',
    'Query execution time',
    ['org_id', 'query_type']
)

storage_usage = Gauge(
    'storage_usage_bytes',
    'Storage usage per organization',
    ['org_id']
)

async def provision_organization(org_details: dict):
    # Create database schema
    await create_org_schema(org_details['id'])
    
    # Set up storage buckets
    await create_storage_namespace(org_details['id'])
    
    # Initialize vector collections
    await create_vector_collections(org_details['id'])
    
    # Configure default roles
    await setup_default_roles(org_details['id'])
    
    # Send welcome email
    await send_onboarding_email(org_details)