Platform v2
Client SDK DB Studio Sign In
Docs / DBaaS Isolation
Core Engine

DBaaS v2 Engine & Isolation — OQENS Cloud Docs

Multi-tenant PostgreSQL database provisioning, user role isolation, and quota enforcement.

OQENS DBaaS v2 provides dynamic provisioning of isolated PostgreSQL databases with dedicated database users, parameterized query execution, and hardware-level isolation.

Database Provisioning Workflow

When a tenant creates a project (via UI or POST /api/dbaas/v2/projects), the platform executes:

  1. Generates a secure project slug (<slug>) and database identifier: db_<slug>_<tenant_id>.
  2. Creates a dedicated unprivileged PostgreSQL user: usr_<slug>_<tenant_id> with an entropy-hardened password.
  3. Executes CREATE DATABASE ... OWNER usr_... and restricts public schema permissions.
  4. Provisions internal metadata tables for end-user auth (_oq_auth_*) and storage metadata.
  5. Issues a project-scoped live API key (oq_live_...).

Role-Level Isolation

Tenant databases run with zero superuser privileges. Queries execute under the project user, preventing access to the system catalog, other tenant databases, or server-level configuration.

PostgreSQL Connection Spec 
Database Name: db_production-app_42
Database User: usr_production-app_42
Host: 10.0.0.83 (Private) / db.echo.oqens.me (HTTPS REST Gateway)
Port: 5432
SSL: Required

Disk Quotas & Storage Allotment

Every tenant plan defines a total storage capacity. Database projects allocate storage from this pool:

  • Default Project Quota: 20% of tenant total cloud storage (configurable up to plan maximum).
  • Storage Breakdown: Monitored via pg_total_relation_size() per table and index.
  • Quota Exceeded Behavior: Write operations (INSERT, UPDATE, CREATE TABLE) are rejected with 403 Forbidden: Storage quota exceeded; read operations (SELECT) remain active.
Copied