Key Without A Tenant

Workspace settings are cached in front of a correctly tenant-scoped query. Workspace slugs are unique within a tenant, not across tenants.

const cacheKey = (slug: string) => `settings:${slug}`

export async function getSettings(slug: string, tenantId: string) {
  const hit = await redis.get(cacheKey(slug))
  if (hit) return JSON.parse(hit) as Settings

  const row = await db.query.settings.findFirst({
    where: and(eq(settings.slug, slug), eq(settings.tenantId, tenantId))
  })
  await redis.set(cacheKey(slug), JSON.stringify(row), { EX: 300 })
  return row
}

Under what condition does one tenant read another tenant's settings?

Only during a cache stampede, when two concurrent misses for different tenants race and the slower write overwrites the faster one.

Whenever two tenants use the same workspace slug. The first miss writes one shared key, and for the next 300 seconds every other tenant asking for that slug gets a hit and never reaches the tenant-scoped query.

Only if a caller can supply a tenantId that is not their own, which the database predicate already prevents.

Never. The cached value was produced by a query that carried the tenant predicate, so the stored copy is by construction the right tenant's row.