多租户隔离：数据模型、资源配额与安全边界

-- 短文表：每条记录归属租户
CREATE TABLE posts (
    id         BIGSERIAL,
    tenant_id  BIGINT NOT NULL,          -- 租户隔离键
    user_id    BIGINT NOT NULL,
    content    TEXT,
    created_at TIMESTAMPTZ DEFAULT NOW(),
    PRIMARY KEY (tenant_id, id)
);

-- 复合主键 (tenant_id, id)：让主键天然按租户分区
CREATE TABLE follows (
    tenant_id  BIGINT NOT NULL,
    follower_id BIGINT NOT NULL,
    following_id BIGINT NOT NULL,
    created_at TIMESTAMPTZ DEFAULT NOW(),
    PRIMARY KEY (tenant_id, follower_id, following_id)
);

-- 索引同样以 tenant_id 为前缀
CREATE INDEX idx_posts_tenant_time ON posts(tenant_id, created_at DESC);

-- PostgreSQL 分 Schema：按租户切换 search_path
SET search_path TO tenant_42, public;

-- 每个租户的 schema 中有独立的表结构，可支持租户定制字段
CREATE SCHEMA tenant_42;
CREATE TABLE tenant_42.posts ( /* 允许租户扩展列 */ );

// Go 租户连接路由
package tenant

import (
	"database/sql"
	"fmt"
	"sync"
)

type Router struct {
	mu      sync.RWMutex
	conns   map[int64]*sql.DB // tenantID → 独立连接池
	dsnTpl  string            // "host=%s dbname=miniblog_tenant_%d"
}

// Conn 返回租户对应的数据库连接（独立库模式）
func (r *Router) Conn(tenantID int64) (*sql.DB, error) {
	r.mu.RLock()
	conn, ok := r.conns[tenantID]
	r.mu.RUnlock()
	if ok {
		return conn, nil
	}
	return r.open(tenantID) // 懒加载
}

// Go 租户级限流：基于 Redis 滑动窗口
package quota

import (
	"context"
	"github.com/redis/go-redis/v9"
	"time"
)

type QuotaService struct {
	redis *redis.Client
}

// CheckQuota 校验租户是否超过配额，窗口内超过 max 则拒绝
func (s *QuotaService) CheckQuota(ctx context.Context, tenantID int64, metric string, max int64, window time.Duration) (bool, error) {
	key := "quota:" + metric + ":" + strconv.FormatInt(tenantID, 10)
	now := time.Now().UnixNano()
	cutoff := now - int64(window)

	pipe := s.redis.TxPipeline()
	pipe.ZRemRangeByScore(ctx, key, "0", strconv.FormatInt(cutoff, 10))
	pipe.ZCard(ctx, key)
	pipe.ZAdd(ctx, key, redis.Z{Score: float64(now), Member: now})
	pipe.Expire(ctx, key, window*2)

	cmds, err := pipe.Exec(ctx)
	if err != nil {
		return false, err
	}
	count := cmds[1].(*redis.IntCmd).Val()
	return count <= max, nil
}

-- 启用行级安全
ALTER TABLE posts ENABLE ROW LEVEL SECURITY;
ALTER TABLE posts FORCE ROW LEVEL SECURITY;

-- 创建租户策略：只有匹配当前租户的行可见
CREATE POLICY tenant_isolation ON posts
    USING (tenant_id = current_setting('app.tenant_id')::BIGINT);

-- 应用连接后必须设置租户上下文
SELECT set_config('app.tenant_id', '42', true);

// Go ORM 层：每个请求绑定租户上下文
func WithTenant(ctx context.Context, tenantID int64) context.Context {
	return context.WithValue(ctx, tenantKey{}, tenantID)
}

// 查询时自动追加 tenant 条件，避免到处手写漏写
func ListPosts(ctx context.Context, db *sql.DB) ([]Post, error) {
	tid := ctx.Value(tenantKey{}).(int64)
	rows, err := db.QueryContext(ctx,
		`SELECT id, content, created_at
		 FROM posts
		 WHERE tenant_id = $1   -- 强制条件
		 ORDER BY created_at DESC LIMIT 50`, tid)
	// ...
}

// Go Prometheus 租户级指标
package monitor

import "github.com/prometheus/client_golang/prometheus"

var (
	tenantQPS = prometheus.NewCounterVec(
		prometheus.CounterOpts{
			Name: "tenant_api_requests_total",
			Help: "Per-tenant API request count",
		},
		[]string{"tenant_id", "method", "route", "status"},
	)
	tenantLatency = prometheus.NewHistogramVec(
		prometheus.HistogramOpts{
			Name:    "tenant_api_latency_seconds",
			Help:    "Per-tenant API latency",
			Buckets: prometheus.DefBuckets,
		},
		[]string{"tenant_id", "route"},
	)
)

func init() {
	prometheus.MustRegister(tenantQPS, tenantLatency)
}

// 请求中间件：按租户打点
func TenantMetricsMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		tid := tenantIDFromContext(r.Context())
		start := time.Now()
		rec := &statusRecorder{ResponseWriter: w, status: 200}
		next.ServeHTTP(rec, r)

		tenantQPS.WithLabelValues(strconv.FormatInt(tid, 10),
			r.Method, r.URL.Path, strconv.Itoa(rec.status)).Inc()
		tenantLatency.WithLabelValues(strconv.FormatInt(tid, 10),
			r.URL.Path).Observe(time.Since(start).Seconds())
	})
}