I shipped this for one client: GrapesJS canvas, a ~900‑line server renderer, headless‑Chrome PDF export, cryptographic sealing, in‑browser signature capture. It works. Now I am pulling the single‑tenant assumptions out of it one at a time, which is turning out to be harder than building it was.

The editor was never the hard part. Tenancy is. Every B2B leak postmortem I have read comes down to the same thing: someone treated isolation as a query filter instead of a boundary the query cannot escape.

flowchart TD
    C["Company<br/><i>tenant · billing entity</i>"]
    T["Team<br/><i>grouping inside a company</i>"]
    U["User<br/><i>1 company · 0..n teams</i>"]
    R1["Owner · Admin · Member"]
    R2["team_admin · member"]

    C -->|"SECURITY BOUNDARY<br/>never removed"| T
    T -->|"VISIBILITY FILTER<br/>layered on top"| U
    U -.company role.-> R1
    U -.team role.-> R2

    classDef sec fill:#132E5C,stroke:#1F6FEB,stroke-width:2px,color:#F0F6FC
    classDef vis fill:#2A1B4D,stroke:#8957E5,stroke-width:2px,color:#F0F6FC
    classDef ent fill:#161B22,stroke:#30363D,color:#C9D1D9
    classDef role fill:#0D1117,stroke:#21262D,color:#8B949E
    class C sec
    class T vis
    class U ent
    class R1,R2 role

This one already bit me twice, in defaultTeam() and again in provisionRoles():

- // Looks harmless. Returns an empty collection when another tenant is current,
- // which produces users with no team and no visibility. No error, no warning.
- $company->teams()->get();

+ // Team carries CompanyScope, so any walk of a company's children has to run
+ // inside that company's context, even when you already hold the model.
+ CompanyContext::for($company->id, fn () => $company->teams()->get());

Phase 1 is not done until an isolation suite proves Company A cannot reach Company B's proposals, templates, settings, media, smart content, email templates, users or teams through any route. Nothing downstream starts before that gate passes.

• 1a Tenancy schema migrations
• 1b Models, BelongsToCompany, visibility scopes, factories
• 1c Global‑singleton fixes (cache keys, unique constraints)
• 1d Roles, permissions, policies
• 1i Internationalisation, dual‑axis  code done, ~110 admin strings left
• 1e Public sign‑up, registration links, invitations  in progress
• 1f Per‑tenant credentials plus SSRF guard
• 1g Cross‑tenant isolation suite  Phase 1 gate
• 1.5 Decoupling from the upstream billing system
• 2 Billing, plan limits, reminders
• 3 Approvals and multi‑signer

Debt I have written down rather than pretended away: the PDF endpoint regenerates with headless Chrome on every download. Sealed proposals are immutable, so that is pure waste, and it becomes the dominant hosting cost the moment a free tier exists. It gets cached before launch, not after.

Translation policy: formatting works for all 25 locales, but reviewed strings ship for en and de only. A proposal is a quasi‑legal document somebody signs. A mistranslated accept, decline or expiry clause is a dispute, not a typo, so machine translation does not go near the client‑facing axis.

Meta does not care about your queue depth. Return slowly enough, often enough, and it marks the endpoint unhealthy and throttles the campaign. So nothing does real work on the request thread.

sequenceDiagram
    autonumber
    participant M as Meta Lead Ads
    participant W as Webhook endpoint
    participant D as MySQL
    participant Q as Redis · Supervisor
    participant A as WhatsApp Cloud API

    M->>W: POST lead payload
    W->>W: verify X-Hub-Signature-256<br/>via hash_equals()
    W->>D: INSERT (unique meta_leadgen_id)
    Note over D: replay collides here,<br/>not in application code
    W-->>M: 200 in milliseconds
    W->>Q: dispatch job
    Q->>A: send templated message
    A--xQ: 5xx or rate limit
    Q->>Q: exponential backoff, time-bounded
    Q->>A: retry
    A-->>Q: delivered

Two integrity gates, deliberately independent. The signature check rejects forgeries. The unique index on meta_leadgen_id makes a replay a no‑op at the database level. I want the second one in the schema rather than in a service class, because schemas do not get refactored around at 2am.

Backoff is time‑bounded, not attempt‑bounded. A provider outage should degrade throughput and then recover. It should not silently exhaust retries and drop a lead somebody paid for.

Log a decision, revisit it on a schedule, find out whether your instincts actually calibrate. Backed by Google Cloud for Startups and MongoDB for Startups.

Building it alone taught me more about cost than about code. Embeddings are cheap to call and expensive to call badly, and the difference is entirely in what you cache.

Eight packages, 83 stars, all PHP. Each one exists because I hit the problem on a real project, went looking for the fix, and did not find one that worked properly.

CORE
DATA
INFRA
FRONT
APIS
TEST

The install count is the number I actually watch. Stars are a bookmark; an install means somebody put the package in a composer.json and let it run in their build.

PHP 87.1%  ·  Blade 6.6%  ·  JavaScript 3.5%  ·  CSS and HTML 2.8%

Measured across the eight packages, not every repo on the account. Counting everything puts JavaScript on top at 33.6%, which is just my portfolio site's vendored assets talking. The number that means something is the one over code other people run in their own CI.

A test that never disagrees with you is decoration. Write the one that fails when the invariant breaks, not the one that passes today. In a multi‑tenant system the tests worth having are the ones that go red the second somebody collapses two axes into one.

Fail loudly at the boundary, gracefully in the middle. Reject a malformed payload at ingestion, where it is cheap and you still have the context. The alternative is a half‑written row three services deep that a customer finds for you next week.

Write down the deviation and the reason. Plans are wrong in places. Six months later the useful artefact is not the plan, it is knowing why the code went the other way and what would have to change for the original idea to work.

Comments explain why. Code explains what. If a block needs a comment to say what it does, rewrite the block. Save the comments for the constraints you cannot see from the syntax, like a port collision that presents as an auth error.

Laravel · PHP · multi‑tenant SaaS · integration‑heavy systems

Based in Pakistan, working remotely.

adnanhaider0347@gmail.com  ·  codebyadnan.tech  ·  LinkedIn