# TenantIsolationContract > Tracon documentation. Tracon is a .NET package family that adds a control > plane on Microsoft Agent Framework, published as NuGet packages that run > inside your own ASP.NET Core application. > > Page: https://tracon.dev/api/tracon.testing.contracts.storage.tenantisolationcontract-1/ > Summary: TenantIsolationContract: The shared base that checks a store's tenant isolation both ways.
Namespace Tracon.Testing.Contracts.Storage · Assembly Tracon.Testing.Contracts.Xunit.dll
The shared base that checks a store's tenant isolation **both ways**. ```csharp public abstract class TenantIsolationContract : StoreCancellationContract, IAsyncLifetime, IAsyncDisposable ```
Type Parameters
TStore The store type under test.
Inheritance
object ← StoreCancellationContract<TStore> ← TenantIsolationContract<TStore>
Implements
IAsyncLifetime, IAsyncDisposable
Inherited Members
StoreCancellationContract<TStore>.CreateStoreAsync(), StoreCancellationContract<TStore>.InitializeAsync(), StoreCancellationContract<TStore>.DisposeAsync(), StoreCancellationContract<TStore>.OnDisposeAsync(), StoreCancellationContract<TStore>.CancellableReadAsync(CancellationToken), StoreCancellationContract<TStore>.CancellableWriteAsync(CancellationToken), StoreCancellationContract<TStore>.WroteAnythingAsync(), StoreCancellationContract<TStore>.Canceled_token_throws_on_read(), StoreCancellationContract<TStore>.The_write_this_contract_checks_can_be_read_back(), StoreCancellationContract<TStore>.Canceled_token_throws_on_write_and_leaves_no_trace(), StoreCancellationContract<TStore>.Store, object.GetType(), object.MemberwiseClone(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()
## Remarks Derived contracts write only their own scenarios and the four isolation hooks; the lifecycle plumbing and the cancellation promise come from [Storage.StoreCancellationContract](/api/tracon.testing.contracts.storage/). **The two-way check cannot be skipped.** If only "B must not see it" is checked, a broken query that returns nothing at all would also pass the test. Every scenario therefore also asks "does A see its own data", proving the filter is both sufficient and not too narrow. ## Constructors ### TenantIsolationContract\(\) ```csharp protected TenantIsolationContract() ``` ## Fields ### TenantA The tenant that writes the data. ```csharp protected const string TenantA = "tenant-a" ``` #### Field Value [string](https://learn.microsoft.com/dotnet/api/system.string) ### TenantB The tenant that must not see the data. ```csharp protected const string TenantB = "tenant-b" ``` #### Field Value [string](https://learn.microsoft.com/dotnet/api/system.string) ## Properties ### AmbientTenant The tenant stores read from [ITenantContext](/api/tracon.itenantcontext/). For stores that do not take the tenant as a parameter, the contract sets this property to the relevant tenant on the first line of its hooks. ```csharp protected MutableTenantContext AmbientTenant { get; } ``` #### Property Value [MutableTenantContext](/api/tracon.testing.contracts.storage.mutabletenantcontext/) ## Methods ### CancellableReadAsync\(CancellationToken\) Calls one **read** method of the store with the given token. ```csharp protected override ValueTask CancellableReadAsync(CancellationToken cancellationToken) ``` #### Parameters `cancellationToken` [CancellationToken](https://learn.microsoft.com/dotnet/api/system.threading.cancellationtoken) The token the store must observe. #### Returns [ValueTask](https://learn.microsoft.com/dotnet/api/system.threading.tasks.valuetask) The completion task; any result is discarded. #### Remarks The listing hook is the read: it needs no key, so it can be called on an untouched store. A contract whose store has no listing endpoint -- and whose [TenantIsolationContract.CountAsync](/api/tracon.testing.contracts.storage/) therefore makes no store call at all on an empty store -- overrides this with its own read. ### CancellableWriteAsync\(CancellationToken\) Calls one **write** method of the store with the given token. ```csharp protected override ValueTask CancellableWriteAsync(CancellationToken cancellationToken) ``` #### Parameters `cancellationToken` [CancellationToken](https://learn.microsoft.com/dotnet/api/system.threading.cancellationtoken) The token the store must observe. #### Returns [ValueTask](https://learn.microsoft.com/dotnet/api/system.threading.tasks.valuetask) The completion task. #### Remarks The write must be one [StoreCancellationContract.WroteAnythingAsync](/api/tracon.testing.contracts.storage/) can see. A write this contract cannot read back proves nothing about side effects, which is why [StoreCancellationContract.The_write_this_contract_checks_can_be_read_back](/api/tracon.testing.contracts.storage/) runs the same pair with a live token and requires the read to find it. ### CountAsync\(string, CancellationToken\) Reports how many records the given tenant sees through the listing endpoint. ```csharp protected abstract ValueTask CountAsync(string tenantId, CancellationToken cancellationToken) ``` #### Parameters `tenantId` [string](https://learn.microsoft.com/dotnet/api/system.string) The reading tenant. `cancellationToken` [CancellationToken](https://learn.microsoft.com/dotnet/api/system.threading.cancellationtoken) The token every store call inside the hook must be handed; see [TenantIsolationContract.SeedAsync](/api/tracon.testing.contracts.storage/). #### Returns [ValueTask](https://learn.microsoft.com/dotnet/api/system.threading.tasks.valuetask\-1)<[int](https://learn.microsoft.com/dotnet/api/system.int32)\> The number of records seen. ### ExistsAsync\(string, object\) Reports whether the record is visible from the given tenant's viewpoint. ```csharp protected abstract ValueTask ExistsAsync(string tenantId, object key) ``` #### Parameters `tenantId` [string](https://learn.microsoft.com/dotnet/api/system.string) The reading tenant. `key` [object](https://learn.microsoft.com/dotnet/api/system.object) The key returned by [TenantIsolationContract.SeedAsync](/api/tracon.testing.contracts.storage/). #### Returns [ValueTask](https://learn.microsoft.com/dotnet/api/system.threading.tasks.valuetask\-1)<[bool](https://learn.microsoft.com/dotnet/api/system.boolean)\> [true](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool) if the record is visible. ### Same\_name\_lives\_independently\_across\_two\_tenants\(\) ```csharp [Fact] public Task Same_name_lives_independently_across_two_tenants() ``` #### Returns [Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task) ### SeedAsync\(string, string, CancellationToken\) Writes a sample record for the given tenant. ```csharp protected abstract ValueTask SeedAsync(string tenantId, string name, CancellationToken cancellationToken) ``` #### Parameters `tenantId` [string](https://learn.microsoft.com/dotnet/api/system.string) The tenant that owns the record. `name` [string](https://learn.microsoft.com/dotnet/api/system.string) The name distinguishing the record. The same name may be used by two tenants. `cancellationToken` [CancellationToken](https://learn.microsoft.com/dotnet/api/system.threading.cancellationtoken) The token every store call inside the hook must be handed. The cancellation contract calls this hook with a token that is already cancelled, so a hook that drops the token reports a store as sound when it is not. #### Returns [ValueTask](https://learn.microsoft.com/dotnet/api/system.threading.tasks.valuetask\-1)<[object](https://learn.microsoft.com/dotnet/api/system.object)\> The key to use for reading the record back. ### Tenant\_cannot\_delete\_another\_tenants\_record\(\) ```csharp [Fact] public Task Tenant_cannot_delete_another_tenants_record() ``` #### Returns [Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task) ### Tenant\_cannot\_read\_another\_tenants\_record\(\) ```csharp [Fact] public Task Tenant_cannot_read_another_tenants_record() ``` #### Returns [Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task) ### Tenant\_does\_not\_see\_another\_tenants\_record\_in\_the\_list\(\) ```csharp [Fact] public Task Tenant_does_not_see_another_tenants_record_in_the_list() ``` #### Returns [Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task) ### Tenant\_reads\_its\_own\_record\(\) ```csharp [Fact] public Task Tenant_reads_its_own_record() ``` #### Returns [Task](https://learn.microsoft.com/dotnet/api/system.threading.tasks.task) ### TryDeleteAsync\(string, object\) Attempts to delete the record on behalf of the given tenant. ```csharp protected virtual ValueTask TryDeleteAsync(string tenantId, object key) ``` #### Parameters `tenantId` [string](https://learn.microsoft.com/dotnet/api/system.string) The tenant attempting the delete. `key` [object](https://learn.microsoft.com/dotnet/api/system.object) The key returned by [TenantIsolationContract.SeedAsync](/api/tracon.testing.contracts.storage/). #### Returns [ValueTask](https://learn.microsoft.com/dotnet/api/system.threading.tasks.valuetask\-1)<[bool](https://learn.microsoft.com/dotnet/api/system.boolean)?\> [true](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool) if the delete succeeded, [false](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool) if the record was not found; [null](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) if the store does not offer deletion. ### TryOverwriteAsync\(string, string\) Attempts to change the record's content on behalf of the given tenant. ```csharp protected virtual ValueTask TryOverwriteAsync(string tenantId, string name) ``` #### Parameters `tenantId` [string](https://learn.microsoft.com/dotnet/api/system.string) The tenant attempting the update. `name` [string](https://learn.microsoft.com/dotnet/api/system.string) The record's name. #### Returns [ValueTask](https://learn.microsoft.com/dotnet/api/system.threading.tasks.valuetask\-1)<[bool](https://learn.microsoft.com/dotnet/api/system.boolean)\> [true](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool) if the update was attempted; [false](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool) if the store does not support this scenario. #### Remarks The default implementation calls [TenantIsolationContract.SeedAsync](/api/tracon.testing.contracts.storage/) a second time: writing a record with the same name verifies that two tenants can carry the same name independently. ### UseAmbientTenant\(MutableTenantContext\) Attaches to a tenant context shared per class (used by multiple tests) and resets the tenant back to [TenantIsolationContract.TenantA](/api/tracon.testing.contracts.storage/). ```csharp protected void UseAmbientTenant(MutableTenantContext tenant) ``` #### Parameters `tenant` [MutableTenantContext](/api/tracon.testing.contracts.storage.mutabletenantcontext/) The shared context supplied by the schema/test CLASS fixture. #### Remarks When store instances are set up once per class (see the schema fixtures), they all capture the SAME [ITenantContext](/api/tracon.itenantcontext/) object; each test must therefore call this method inside [StoreCancellationContract.CreateStoreAsync](/api/tracon.testing.contracts.storage/) to attach to that object and reset any state a previous test may have left on [TenantIsolationContract.TenantB](/api/tracon.testing.contracts.storage/). ### WroteAnythingAsync\(\) Reports whether [StoreCancellationContract.CancellableWriteAsync](/api/tracon.testing.contracts.storage/) left anything behind. ```csharp protected override ValueTask WroteAnythingAsync() ``` #### Returns [ValueTask](https://learn.microsoft.com/dotnet/api/system.threading.tasks.valuetask\-1)<[bool](https://learn.microsoft.com/dotnet/api/system.boolean)\> [true](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool) if the store holds any record the write would have created.