Building Multi-Tenant SaaS with Laravel

The Problem with Building Multi-Tenant SaaS

When building a Software as a Service (SaaS) application, one of the biggest challenges is providing a secure and isolated environment for each tenant. Without proper tenant isolation, you risk exposing sensitive data and compromising the security of your entire application. In a multi-tenant SaaS, each tenant expects their data to be separate and secure, which is a significant concern for businesses handling sensitive information. If not implemented correctly, you may face data breaches, compliance issues, and damage to your reputation.

Building Multi-Tenant SaaS with Laravel

To address the challenges of multi-tenancy, we'll focus on several key strategies: tenant isolation, subdomain routing, per-tenant settings, data partitioning, and billing integration. Our approach will be to use a combination of Laravel's built-in features and custom implementations to provide a robust and scalable solution.

The Implementation

First, let's create a Tenant model to store information about each tenant:

use Illuminate\Database\Eloquent\Model;

class Tenant extends Model
{
    protected $guarded = [];
}

Next, we'll create a middleware to handle tenant isolation and subdomain routing:

use Closure;
use Illuminate\Http\Request;

class TenantMiddleware
{
    public function handle(Request $request, Closure $next)
    {
        $domain = explode('.', $request->getHost());
        $tenant = Tenant::where('domain', $domain[0])->first();
        if ($tenant) {
            config(['database.connections.tenant.database' => $tenant->database]);
            return $next($request);
        }
        return response()->json(['error' => 'Tenant not found'], 404);
    }
}

We'll also create a controller to handle per-tenant settings and data partitioning:

use Illuminate\Http\Request;
use App\Http\Controllers\Controller;
use App\Models\Tenant;

class TenantController extends Controller
{
    public function settings(Request $request)
    {
        $tenant = Tenant::where('domain', $request->getHost())->first();
        // Return settings for the current tenant
        return response()->json($tenant->settings);
    }

    public function data(Request $request)
    {
        $tenant = Tenant::where('domain', $request->getHost())->first();
        // Return data for the current tenant
        return response()->json($tenant->data);
    }
}

To integrate billing, we can use a package like Laravel Cashier:

use Illuminate\Http\Request;
use Laravel\Cashier\Cashier;

class BillingController extends Controller
{
    public function subscription(Request $request)
    {
        $tenant = Tenant::where('domain', $request->getHost())->first();
        // Create or update subscription for the current tenant
        $subscription = $tenant->newSubscription('main', 'price_1');
        // Return subscription information
        return response()->json($subscription);
    }
}

Common Pitfalls

• Not properly implementing tenant isolation, leading to data exposure and security breaches
• Failing to use a separate database or schema for each tenant, resulting in data contamination
• Not handling per-tenant settings and data partitioning correctly, causing inconsistent behavior
• Integrating billing without proper error handling, leading to unexpected charges or failed payments

Key Takeaways

• Use a separate database or schema for each tenant to ensure data isolation
• Implement subdomain routing to provide a unique URL for each tenant
• Use a middleware to handle tenant isolation and routing
• Create a controller to handle per-tenant settings and data partitioning
• Integrate billing using a package like Laravel Cashier, with proper error handling and logging