Per-customer isolation with environments

CREATE TABLE customers (
  id UUID PRIMARY KEY,
  name TEXT NOT NULL,
  memic_environment_id UUID NOT NULL,
  memic_api_key_encrypted TEXT NOT NULL,  -- encrypted at rest
  created_at TIMESTAMP NOT NULL DEFAULT NOW()
);

def provision_customer(db, customer_name: str) -> Customer:
    # 1. Create the environment in Memic
    env = memic_admin.environments.create(
        project_id=MEMIC_PROJECT_ID,
        slug=f"customer-{slugify(customer_name)}",
        name=customer_name,
    )

    # 2. Create an API key scoped to that environment
    key = memic_admin.api_keys.create(
        environment_id=env.id,
        name=f"{customer_name} production key",
    )

    # 3. Store in your DB
    customer = Customer(
        name=customer_name,
        memic_environment_id=env.id,
        memic_api_key_encrypted=encrypt(key.value),
    )
    db.add(customer)
    db.commit()

    return customer

from fastapi import FastAPI, Depends
from memic import Memic

app = FastAPI()


def get_memic_client(current_user = Depends(get_current_user)) -> Memic:
    """Returns a Memic client scoped to the current user's customer."""
    customer = db.get_customer(current_user.customer_id)
    key = decrypt(customer.memic_api_key_encrypted)
    return Memic(api_key=key)


@app.post("/search")
def search(
    query: str,
    memic: Memic = Depends(get_memic_client),
):
    return memic.search(query)

def test_customer_isolation():
    # Upload a file to Customer A's environment
    client_a = Memic(api_key=customer_a_key)
    client_a.files.upload("./a-secret.pdf")

    # Query from Customer B's environment — should return 0 results
    client_b = Memic(api_key=customer_b_key)
    results = client_b.search("a secret")
    assert len(results.semantic) == 0