Teams & Multi-Tenancy
Multi-tenant organization structure, member roles, and data isolation.
Teams use Team, TeamMembership and TeamInvitation in the Prisma schema. Team includes its ID, name, optional slug and avatar path; TeamMembership links users to teams with OWNER or MEMBER roles.
Owners manage team settings, invitations, members and billing. Members can use team resources and leave their own membership; the creator membership is protected from removal. The user-level admin role is separate from membership roles; the existing ability helpers also grant admins owner/member access.
Extend a team feature
Use protectedProcedure and validate the input. Check ctx.abilities.isTeamMember(teamId) for member resources or ctx.abilities.isTeamOwner(teamId) for management actions before reading or writing team data. Import db from database; there is no ctx.db.
Every query for a tenant-owned resource must include the authorized team ID. For an operation using a resource ID, load its team ownership and check the caller before making changes. Follow the existing team procedures in packages/api/modules/team/procedures and test another team's IDs as forbidden cases.
See Team Invitations.