Multi-Tenant Data Isolation

In multi-tenant SaaS structures, multiple discrete sites (tenants) share a single database, codebase, and web server container. To guarantee absolute security, **no tenant must ever be allowed to see, query, or leak data belonging to another tenant!**

To enforce this boundary at the database level, **every single database table** in Zero CMS (including order items, variants, pages, and posts) physically possesses a site_id column string index.

Rather than relying on developers to manually write WHERE site_id = ? on every query, the core ActiveRecord trait (IsModel) automatically appends the active tenant site boundaries behind the scenes on all queries:

// Inside src/Models/Traits/IsModel.php

public static function all(): array {
    $siteId = \Zero\Core\App::getCurrentSiteId();
    $sql = "SELECT * FROM " . static::$tableName . " WHERE site_id = ?";
    return self::query($sql, [$siteId]);
}

To protect global database entities (such as sites and users registries), queries on these tables are restricted at the controller layer and strictly guarded using Role-Based Access Controls (RBAC), accessible only to Super Admins.