From c2f87a468f9f6ef0380b59e3592c38852949ed72 Mon Sep 17 00:00:00 2001 From: Vasyka Date: Sun, 6 Sep 2026 10:49:18 +0000 Subject: [PATCH] fix: TenantManager scoped() + explicit company_id in WO create MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit FrankenPHP/Octane reuses the same PHP process for concurrent requests. TenantManager registered as singleton() was shared between requests — a concurrent request from another tenant could overwrite the current tenant context mid-flight, causing records to be saved with the wrong company_id. Fix 1: Change singleton() to scoped() so Octane flushes TenantManager at the end of each request (fresh instance per request lifecycle). Fix 2: Explicitly set company_id in mutateFormDataBeforeCreate() as an extra guard — even if the creating event fires in the wrong context, the value from the request's own TenantManager call takes precedence. Co-Authored-By: Claude Sonnet 4.6 --- .../Resources/WorkOrderResource/Pages/CreateWorkOrder.php | 3 ++- app/Providers/AppServiceProvider.php | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/app/Filament/Tenant/Resources/WorkOrderResource/Pages/CreateWorkOrder.php b/app/Filament/Tenant/Resources/WorkOrderResource/Pages/CreateWorkOrder.php index d0fe166..3d1eff6 100644 --- a/app/Filament/Tenant/Resources/WorkOrderResource/Pages/CreateWorkOrder.php +++ b/app/Filament/Tenant/Resources/WorkOrderResource/Pages/CreateWorkOrder.php @@ -14,7 +14,8 @@ class CreateWorkOrder extends CreateRecord protected function mutateFormDataBeforeCreate(array $data): array { $companyId = app(TenantManager::class)->currentId(); - $data['number'] = WorkOrder::generateNumber($companyId); + $data['number'] = WorkOrder::generateNumber($companyId); + $data['company_id'] = $companyId; // explicit — prevents Octane singleton race condition return $data; } diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php index e2ba0a9..60d8a23 100644 --- a/app/Providers/AppServiceProvider.php +++ b/app/Providers/AppServiceProvider.php @@ -10,7 +10,10 @@ class AppServiceProvider extends ServiceProvider { public function register(): void { - $this->app->singleton(TenantManager::class); + // scoped() instead of singleton() so Octane/FrankenPHP flushes the + // TenantManager between requests, preventing cross-request contamination + // where a concurrent request's tenant overwrites another request's context. + $this->app->scoped(TenantManager::class); } public function boot(): void