You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Bug: AuditDbContext.OnModelCreating() does not call base.OnModelCreating() #1226
AuditDbContext.OnModelCreating() does not call base.OnModelCreating(modelBuilder), which means the soft-delete global query filter and Finbuckle multi-tenant
filters defined in BaseDbContext are never applied to audit records.
protectedoverridevoidOnModelCreating(ModelBuildermodelBuilder){ArgumentNullException.ThrowIfNull(modelBuilder);modelBuilder.ApplyConfigurationsFromAssembly(typeof(AuditDbContext).Assembly);// ← missing base.OnModelCreating(modelBuilder)}ExpectedcodeprotectedoverridevoidOnModelCreating(ModelBuildermodelBuilder){ArgumentNullException.ThrowIfNull(modelBuilder);modelBuilder.ApplyConfigurationsFromAssembly(typeof(AuditDbContext).Assembly);base.OnModelCreating(modelBuilder);}Impact
BaseDbContext.OnModelCreating() applies a globalquery filter for soft-delete:
modelBuilder.AppendGlobalQueryFilter<ISoftDeletable>(s=>!s.IsDeleted);
And BaseDbContext inheritsfrom Finbuckle's MultiTenantDbContext,whose OnModelCreating configures multi-tenant query filters.
Without the base call:1.Soft-deletedaudit records are still returned by queries (theISoftDeletable filter is not applied)2.Multi-tenant isolation is broken for audit data — a tenant could potentially see audit records from other tenants
Fix
One-line addition:base.OnModelCreating(modelBuilder);at the end of the method override.
The missing base.OnModelCreating() call is confirmed. One clarification: AuditRecord doesn't implement ISoftDeletable, so the soft-delete filter concern doesn't apply here. However, the multi-tenant isolation risk is real — without the base call, Finbuckle's MultiTenantDbContext.OnModelCreating() never activates the .IsMultiTenant() configuration into actual query filters.
Activity
fix(auditing): add missing base.OnModelCreating() call in AuditDbContext
iammukeshm commentedon Mar 26, 2026
Thanks for the report @fernando-santillana — good catch.
The missing
base.OnModelCreating()call is confirmed. One clarification:AuditRecorddoesn't implementISoftDeletable, so the soft-delete filter concern doesn't apply here. However, the multi-tenant isolation risk is real — without the base call, Finbuckle'sMultiTenantDbContext.OnModelCreating()never activates the.IsMultiTenant()configuration into actual query filters.Fixed in #1228.
fix(auditing): add missing base.OnModelCreating() call in AuditDbContext