Skip to main content

Source: ocean/docs/tenant-provisioning-implementation.md | ✏️ Edit on GitHub

Tenant Provisioning Implementation Summary

Overview​

This implementation provides a complete multi-tenant database provisioning system where each organization gets its own isolated Neon database with GraphQL endpoint.

What Was Implemented​

1. Database Schema (20250730_tenant_provisioning_system.sql)​

  • Enhanced organization_databases table with GraphQL and SSL fields
  • Added provisioning_status JSON field to organizations
  • Created tenant_health_checks table for monitoring
  • Added secure functions for credential management
  • Implemented RLS policies for tenant isolation

2. GraphQL API Extensions​

  • Schema Updates (graphql-v2/schema.ts):
    • Added tenant management types (ProvisioningStatus, TenantHealth, etc.)
    • New queries: tenantHealth, tenantConnectionInfo
    • New mutations: provisionTenant, retryTenantProvisioning, checkTenantHealth
  • Resolvers (graphql-v2/resolvers/tenant-resolvers.ts):
    • Secure tenant data access with permission checks
    • Real-time health monitoring
    • Retry logic for failed provisioning

3. Edge Functions​

  • provision-tenant-resources:
    • Provisions Neon database with configurable size
    • Sets up GraphQL endpoint
    • Encrypts and stores credentials
    • Supports retry for individual services
  • check-tenant-health:
    • Monitors connectivity, performance, and storage
    • Stores health metrics for trending
    • Updates database health status

4. React Components​

  • ProvisioningStatus: Real-time provisioning progress with retry capability
  • HealthDashboard: Comprehensive health monitoring UI
  • ProvisionTenantForm: Region and database size selection
  • TenantSettings: Connection info and management interface
  • TenantMonitor: Admin dashboard for all tenants

Architecture Flow​

User Signup → Organization Created → Provisioning Triggered
                                          ↓
                                   Neon Database Created
                                          ↓
                                   GraphQL Endpoint Setup
                                          ↓
                                   SSL Configuration
                                          ↓
                                   Credentials Encrypted
                                          ↓
                                   Ready for Use

Security Features​

  1. Credential Encryption: All database passwords and connection strings encrypted using Supabase Vault
  2. Row Level Security: Tenant data isolated at database level
  3. Permission Checks: Only organization owners/admins can view connection info
  4. API Key Management: Separate API keys per tenant

Deployment Steps​

  1. Run Database Migration:

    supabase migration up

  2. Deploy Edge Functions:

    supabase functions deploy provision-tenant-resources
    supabase functions deploy check-tenant-health

  3. Deploy GraphQL Updates:

    supabase functions deploy graphql-v2

  4. Configure Environment Variables:

    • NEON_API_KEY: Your Neon API key
    • ENCRYPTION_KEY_ID: Supabase Vault key ID for encryption

  5. Generate GraphQL Types:

    pnpm run codegen

Usage​

For New Organizations​

  1. User signs up and creates organization
  2. System automatically triggers provisioning
  3. User sees real-time progress in dashboard
  4. Once complete, connection details are available

For Existing Organizations​

  1. Navigate to Organization Settings → Infrastructure
  2. Click "Provision Tenant" if not already provisioned
  3. Select region and database size
  4. Monitor provisioning progress

Health Monitoring​

  • Automatic health checks every 30 seconds
  • Manual health check trigger available
  • Alerts for degraded or unhealthy status

Next Steps​

  1. Production Deployment:

    • Deploy updated GraphQL function
    • Configure Neon API credentials
    • Test end-to-end provisioning

  2. Monitoring Setup:

    • Configure alerts for failed provisioning
    • Set up health check notifications
    • Create admin dashboards

  3. Future Enhancements:

    • Automated scaling based on usage
    • Backup and restore functionality
    • Cross-region replication
    • Custom domain support

Testing​

Before going to production:

  1. Test provisioning with different regions
  2. Verify credential encryption
  3. Test health monitoring accuracy
  4. Validate permission checks
  5. Test retry mechanisms