# Adding Features > Step-by-step guide to adding new features to your TanStack Start Drizzle SaaS application with multi-tenancy, type safety, and authorization. *Canonical: https://makerkit.dev/docs/tanstack-drizzle/development-guide/adding-features* --- Building features in a multi-tenant SaaS application requires careful attention to data isolation, authorization, and type safety. This guide walks through a complete example (a "Projects" feature) demonstrating how to structure your code from database schema through to the user interface. By the end of this guide, you'll have built a complete CRUD feature with proper organization scoping, server functions with validation, and a polished UI. ## Feature Planning Before writing code, answer these questions to clarify scope and prevent rework: 1. **Define requirements** — What does this feature do? What problem does it solve? 2. **Design data model** — What data needs to be stored? How does it relate to existing entities? 3. **Identify user actions** — What can users create, read, update, or delete? 4. **Determine access control** — Who can access this? Team members only? Specific roles? This is useful for both manual development and when using AI to help you with the feature - as it will help define the scope of what you need to build. ## Step-by-Step Example The following example builds a "Projects" feature where organization members can create and manage projects. Each step builds on the previous one, creating a type-safe chain from validation through to the UI. We will cover everything you need to know to add a new feature to your application: - Defining the Zod validation schema - Defining the database schema and creating a new migration - Creating the server functions - Fetching data in route loaders - Building the UI components - Creating the route - Verifying the feature ### Project Structure TanStack Start uses file-based routing. Routes live under `apps/web/src/routes`, shared UI under `apps/web/src/components`, and server/loader/schema code under `apps/web/src/lib`. A typical layout for the projects feature: ```text apps/web/src/routes/_authenticated/projects/ ├── index.tsx # list route: loader + component └── $projectId.tsx # detail route: dynamic segment apps/web/src/components/projects/ └── project-form.tsx apps/web/src/lib/projects/ ├── project.schema.ts ├── projects.loader.ts └── projects.functions.ts ``` The pathless `_authenticated` group (`apps/web/src/routes/_authenticated/route.tsx`) already guards auth and renders the app shell, so every nested route inherits the sidebar and the authenticated context. ### Step 1: Define Schemas Start with the [Zod](https://zod.dev) validation schema. This schema serves double duty: **it validates form input on the client and server-function input on the server**. Defining it first ensures type safety flows through your entire feature. **💡 Tip:** If you use Linux or MacOS, use the command `touch` to quickly create a new file in your terminal. ```bash touch apps/web/src/lib/projects/project.schema.ts ``` On Windows, you can use the command `New-Item` to create a new file in your terminal. ``` New-Item -Path apps/web/src/lib/projects/project.schema.ts -ItemType File ``` Better yet, on VSCode (or Cursor), you can use the command palette to create a new file. This will create a new file called `project.schema.ts` in the `lib/projects` directory. You can then open the file and add the following code: ```typescript {% title="apps/web/src/lib/projects/project.schema.ts" %} import * as z from 'zod'; export const createProjectSchema = z.object({ name: z.string().min(3, 'Name must be at least 3 characters'), }); export const updateProjectSchema = createProjectSchema.partial().extend({ id: z.uuid(), }); export type CreateProjectInput = z.output; export type UpdateProjectInput = z.output; ``` ### Step 2: Define Database Schema With the validation schema in place, we move on to defining the database table. The `organizationId` foreign key establishes the multi-tenant relationship — every project belongs to exactly one organization. In the example below, we use Postgres and Drizzle ORM to define the `project` table. Create the table file in the database package: ```bash touch packages/database/src/schema/project.ts ``` You can then open the file and add the following code: ```typescript {% title="packages/database/src/schema/project.ts" %} import { pgTable, text, timestamp } from 'drizzle-orm/pg-core'; import { organization } from './core'; export const project = pgTable('project', { id: text('id').primaryKey(), name: text('name').notNull(), organizationId: text('organization_id') .notNull() .references(() => organization.id, { onDelete: 'cascade' }), createdAt: timestamp('created_at').notNull().defaultNow(), updatedAt: timestamp('updated_at').notNull().defaultNow(), }); ``` **Understanding the schema:** - **`pgTable('project', {...})`** — Creates a PostgreSQL table named `project` with the specified columns - **`id: text('id').primaryKey()`** — A text-based primary key. You'll typically generate this using `generateId()` (UUIDv7) from `@kit/shared/uuid` when inserting records. You can also use the built-in `gen_random_uuid()` function to generate a random UUID when defining the schema. - **`name: text('name').notNull()`** — A required text field for the project name - **`organizationId`** — The foreign key that links each project to an organization. The `references()` function creates a database-level constraint, and `onDelete: 'cascade'` ensures projects are automatically deleted when their parent organization is removed - **`createdAt` / `updatedAt`** — Timestamp fields with `defaultNow()` that automatically set the current time on insert. Note that `updatedAt` must be manually updated in your code when modifying records > **💡 Tip**: For more information about using Drizzle ORM, please refer to the [Drizzle ORM documentation](https://orm.drizzle.team/docs/overview). Now, export the schema from the main `./schema/schema.ts` file, so that it can be picked up by the Drizzle CLI: ```typescript {% title="packages/database/src/schema/schema.ts" %} export * from './core'; export * from './project'; ``` After defining the schema, generate a new migration file by running the following command: ```bash pnpm --filter "@kit/database" drizzle:generate ``` The command above will create a new migration file in the `packages/database/src/schema` directory. You can then open the migration file and review the changes. Then output will be something like this: ``` > drizzle-kit generate --config drizzle.config.mjs 11 tables account 13 columns 1 indexes 1 fks invitation 8 columns 2 indexes 2 fks member 5 columns 2 indexes 2 fks organization_role 6 columns 2 indexes 1 fks organization 6 columns 0 indexes 0 fks session 10 columns 1 indexes 1 fks subscription 12 columns 0 indexes 0 fks two_factor 4 columns 2 indexes 1 fks user 13 columns 0 indexes 0 fks verification 6 columns 1 indexes 0 fks project 5 columns 0 indexes 1 fks [✓] Your SQL migration file ➜ ../../packages/database/src/schema/0001_xxxx_yyyy.sql 🚀 ``` You can then open the migration file and review the changes. Please note that the migration filename will be looking differently from the above one, so please check the output of the command above to locate it. If everything looks good, you can then apply the migration to the database by running the following command, which is just a shortcut for `drizzle-kit migrate` ([Read the documentation](https://orm.drizzle.team/docs/drizzle-kit-migrate)): ```bash pnpm --filter "@kit/database" drizzle:migrate ``` The command above will apply the migration to the database. The output will be something like this: ``` [✓] Changes applied ``` Let's now navigate to the Drizzle Studio to explore our new table. Run the following command to start the Drizzle Studio: ```bash pnpm --filter "@kit/database" drizzle:studio ``` If everything is working correctly, the CLI will list the URL at which you can access the Drizzle Studio: > Drizzle Studio is up and running on https://local.drizzle.studio Open the URL in your browser to explore the new table. You should see the new `project` table. It's a good idea to familiarize yourself with Drizzle Studio, as it will become an invaluable tool for you when working with the database. {% img src="/images/docs/drizzle-studio.webp" width="2856" height="1972" alt="Drizzle Studio database interface" /%} ### Step 3: Create Server Functions Server functions handle mutations. In the example below, we create three: `createProjectFunction`, `updateProjectFunction`, and `deleteProjectFunction`. TanStack Start compiles these into POST endpoints automatically — but we call them like normal async JavaScript functions (through TanStack Query). Pretty neat, right? We attach the `organizationFunctionMiddleware` tuple to each one, which guarantees the user is authenticated, that there is an active organization, and injects `context.organizationId` and `context.role`. 💡 **Note:** The middleware tuples (`authFunctionMiddleware`, `organizationFunctionMiddleware`, `adminFunctionMiddleware`) live in the `@kit/function-middleware` package. Attach one to a literal `createServerFn(...)` call via `.middleware(...)` when creating server functions! Notice how the Zod schema from Step 1 validates input automatically via `.validator()`: ```typescript {% title="apps/web/src/lib/projects/projects.functions.ts" %} import { eq, and } from 'drizzle-orm'; import * as z from 'zod'; import { createServerFn } from '@tanstack/react-start'; import { organizationFunctionMiddleware } from '@kit/function-middleware/functions'; import { db, project } from '@kit/database'; import { generateId } from '@kit/shared/uuid'; import { createProjectSchema, updateProjectSchema } from './project.schema'; export const createProjectFunction = createServerFn({ method: 'POST' }) .middleware(organizationFunctionMiddleware) .validator(createProjectSchema) .handler(async ({ data, context }) => { const [newProject] = await db .insert(project) .values({ ...data, id: generateId(), organizationId: context.organizationId, }) .returning(); return newProject; }); export const updateProjectFunction = createServerFn({ method: 'POST' }) .middleware(organizationFunctionMiddleware) .validator(updateProjectSchema) .handler(async ({ data, context }) => { const [updatedProject] = await db .update(project) .set({ ...data, updatedAt: new Date() }) .where( and( eq(project.id, data.id), eq(project.organizationId, context.organizationId), ), ) .returning(); return updatedProject; }); export const deleteProjectFunction = createServerFn({ method: 'POST' }) .middleware(organizationFunctionMiddleware) .validator(z.object({ id: z.string() })) .handler(async ({ data, context }) => { await db .delete(project) .where( and( eq(project.id, data.id), eq(project.organizationId, context.organizationId), ), ); }); ``` **Understanding the server functions:** - **`organizationFunctionMiddleware`** — Pre-composed auth + organization middleware tuple attached with `.middleware(...)`. `context.user`, `context.organizationId`, and `context.role` are guaranteed. - **`.validator(schema)`** — The Zod schema that validates the input of the action - **`.handler(...)`** — The server-side implementation. Its `{ data, context }` argument is fully typed. - **`generateId`** — Generates a new ID for the project using UUIDv7, a performant and secure way to generate a unique ID. Import from `@kit/shared/uuid`. > **Refreshing data:** there is no `revalidatePath` in TanStack Start. After a > mutation, refresh server data by invalidating the router from the client — > `router.invalidate()` (see Step 5) re-runs the affected route loaders. ### Step 4: Create Data Loader Route loaders fetch data on the server before the component renders. Because the database client is server-only, we expose the queries through `createServerFn({ method: 'GET' })` so the loader can call them during both initial SSR and client-side navigation. ```typescript {% title="apps/web/src/lib/projects/projects.loader.ts" %} import { createServerFn } from '@tanstack/react-start'; import { and, desc, eq } from 'drizzle-orm'; import { requireActiveOrganizationId } from '@kit/better-auth/context'; import { db, project } from '@kit/database'; export const getProjects = createServerFn({ method: 'GET' }).handler(async () => { const organizationId = await requireActiveOrganizationId(); return db .select() .from(project) .where(eq(project.organizationId, organizationId)) .orderBy(desc(project.createdAt)); }); export const getProject = createServerFn({ method: 'GET' }) .validator((id: string) => id) .handler(async ({ data: id }) => { const organizationId = await requireActiveOrganizationId(); const [result] = await db .select() .from(project) .where( and(eq(project.id, id), eq(project.organizationId, organizationId)), ) .limit(1); return result ?? null; }); ``` **Understanding the loader:** - **`createServerFn({ method: 'GET' })`** — Marks this as a server-only read. It can be called from route loaders and runs on the server; the database client is never bundled into client code. - **`requireActiveOrganizationId()`** — Reads the active organization from the request context and throws if none is set. Every tenant-scoped query is filtered by it. - **`db.select().from(project)`** — Drizzle's query builder syntax. It reads like SQL but provides full type safety. - **`eq()` and `desc()`** — Drizzle helper functions for equality comparisons and descending order. These compile to `WHERE` and `ORDER BY` clauses. The `getProject` function demonstrates a common pattern for fetching a single record: query with `.limit(1)` and return the first result or `null`. ### Step 5: Build UI Components The form component ties everything together on the client. It uses `useForm` from `@tanstack/react-form` for form state, the Zod schema for validation via `validators`, and TanStack Query's `useMutation` to call the server function with automatic lifecycle handling. We will wrap the form in a `Sheet` component to open a side panel to create a new project. **Tip**: it's a good practice to use separate components for the form, and for the container that wraps the form (be this a `Dialog`, `AlertDialog`, `Sheet`, etc.). This will make your code more readable and maintainable, and will instantiate the form component only when needed (e.g., when the user clicks the "Create Project" button in the header). ```typescript {% title="apps/web/src/components/projects/project-form.tsx" %} 'use client'; import { useState } from 'react'; import { useForm } from '@tanstack/react-form'; import { useMutation } from '@tanstack/react-query'; import { useRouter } from '@tanstack/react-router'; import { Button } from '@kit/ui/button'; import { Field, FieldError, FieldLabel } from '@kit/ui/field'; import { Input } from '@kit/ui/input'; import { Sheet, SheetContent, SheetDescription, SheetHeader, SheetTitle, SheetTrigger, } from '@kit/ui/sheet'; import { toast } from '@kit/ui/sonner'; import { createProjectFunction } from '#/lib/projects/projects.functions'; import { createProjectSchema } from '#/lib/projects/project.schema'; export function ProjectFormContainer({ children }: React.PropsWithChildren) { const [open, setOpen] = useState(false); return ( Create Project Create a new project to get started. setOpen(false)} /> ); } function ProjectForm({ onSuccess }: { onSuccess: () => void }) { const router = useRouter(); const createProject = useMutation({ mutationFn: createProjectFunction }); const form = useForm({ defaultValues: { name: '', }, validators: { onChange: createProjectSchema, onSubmit: createProjectSchema, }, onSubmit: ({ value }) => { toast.promise( createProject.mutateAsync({ data: value }).then(async () => { await router.invalidate(); // re-run the projects loader onSuccess(); }), { loading: 'Creating project...', success: 'Project created!', error: 'Failed to create project', }, ); }, }); const isPending = createProject.isPending; return (
{ e.preventDefault(); void form.handleSubmit(); }} className="space-y-4" > {(field) => { const isInvalid = field.state.meta.isTouched && !field.state.meta.isValid; return ( Project Name field.handleChange(e.target.value)} aria-invalid={isInvalid} /> ); }}
); } ``` We will be using this component in the route later on. **Note**: since we're using React Hooks and interactive components, we add the `use client` directive. This **does not mean that the component only renders on the client side** — it still server-renders during SSR and then hydrates on the client. ### Step 6: Create the Route The list route fetches data in its `loader` and renders the UI in its `component`. The component reads the loaded data with `Route.useLoaderData()`: ```tsx {% title="apps/web/src/routes/_authenticated/projects/index.tsx" %} import { Link, createFileRoute, redirect } from '@tanstack/react-router'; import { getActiveOrganization } from '@kit/better-auth/context'; import { AppBreadcrumbs } from '@kit/ui/app-breadcrumbs'; import { Button } from '@kit/ui/button'; import { CardButton, CardButtonHeader, CardButtonTitle, } from '@kit/ui/card-button'; import { EmptyState, EmptyStateButton, EmptyStateHeading, EmptyStateText, } from '@kit/ui/empty-state'; import { If } from '@kit/ui/if'; import { PageBody, PageHeader } from '@kit/ui/page'; import { ProjectFormContainer } from '#/components/projects/project-form'; import { getProjects } from '#/lib/projects/projects.loader'; export const Route = createFileRoute('/_authenticated/projects/')({ loader: async () => { const organization = await getActiveOrganization(); if (!organization) { throw redirect({ to: '/dashboard' }); } const projects = await getProjects(); return { organization, projects }; }, component: ProjectsPage, }); function ProjectsPage() { const { organization, projects } = Route.useLoaderData(); return (
No projects found Create a new project to get started. Create Project 0}>
{projects.map((project) => ( {project.name} ))}
); } ``` **What's happening here:** This route brings together everything we built in the previous steps. Let's break it down: 1. **Authorization check** — The `loader` calls `getActiveOrganization()`. If there isn't one, we `throw redirect({ to: '/dashboard' })`. Loaders run on the server during SSR and during client navigation, so this guard runs before the component renders. 2. **Data fetching** — We call our `getProjects()` server function from the loader. The active organization is resolved server-side from the request context, so the query is always tenant-scoped. 3. **Reading data** — The component calls `Route.useLoaderData()` to read what the loader returned, fully typed. 4. **Page structure** — We use `PageBody` and `PageHeader` for a consistent layout, with breadcrumbs and a "Create Project" button wrapped in our `ProjectFormContainer` (the sheet we built earlier). 5. **Conditional rendering** — The `If` component handles two states: an empty state when there are no projects, and a grid of project cards when projects exist. 6. **Project cards** — Each project renders as a `CardButton` inside a typed `Link` (`to` + `params`). The `key={project.id}` prop helps React efficiently update the list. The interactive parts are the `ProjectFormContainer` components, which are Client Components that handle the sheet behavior. #### About layouts You usually don't need a per-feature layout. The pathless `_authenticated` group (`apps/web/src/routes/_authenticated/route.tsx`) already renders the app shell — sidebar, header, and the authenticated context — for every nested route. If a specific feature needs a different shell, add a nested pathless layout route (`apps/web/src/routes/_authenticated/projects/route.tsx`) that renders an `` inside your custom layout. ### Step 7: Adding the route to the sidebar To add the route to the sidebar, add it to the `routes` array in the navigation config. ```tsx {% title="apps/web/src/config/navigation.config.tsx" %} import { Folder, Home } from 'lucide-react'; import * as z from 'zod'; import { env } from '@kit/shared/env'; import { NavigationConfigSchema } from '@kit/ui/navigation-schema'; const iconClasses = 'w-4'; /** * Navigation routes for the authenticated app section. * Items adapt based on the current account context via getContextAwareNavigation. */ export const routes: z.output['routes'] = [ { label: 'common.routes.application', children: [ { label: 'common.routes.dashboard', path: env('VITE_APP_HOME_PATH') ?? '/dashboard', Icon: , }, { label: 'Projects', path: '/projects', Icon: , context: 'organization', }, ], }, ]; ``` **Note**: for simplicity, we are not using a `common.routes.projects` translation key. You can translate the label by adding a key to `packages/i18n/src/messages/en/common.json` and using it as the `label`. **Understanding the context:** - **`context: 'organization'`** — Scopes the nav item to the organization context. If you omit the `context` property, the item is shown in both personal and organization contexts. ### Step 8: Let's see the result Below is a screenshot of the projects page: {% img src="/images/docs/projects-page-empty.webp" width="2856" height="1972" alt="Empty projects page state" /%} You can now create a new project by clicking the "Create Project" button in the header. {% img src="/images/docs/create-project-sheet.webp" width="2856" height="1972" alt="Create project slide-over form" /%} As you can see, as we don't currently have any projects, the empty state is displayed. Let's create a new project by clicking the "Create Project" button in the sheet: {% img src="/images/docs/projects-page.webp" width="2856" height="1972" alt="Projects list page with data" /%} ### Step 9: Create the project detail route At the moment, when you click on a project card, you are routed to a 404. This is totally normal and expected, as we haven't created the project detail route yet. Let's create a detail route at `apps/web/src/routes/_authenticated/projects/$projectId.tsx`. The `$projectId` filename creates a dynamic segment that we read from `params`: ```tsx {% title="apps/web/src/routes/_authenticated/projects/$projectId.tsx" %} import { createFileRoute, notFound } from '@tanstack/react-router'; import { AppBreadcrumbs } from '@kit/ui/app-breadcrumbs'; import { PageBody, PageHeader } from '@kit/ui/page'; import { getProject } from '#/lib/projects/projects.loader'; export const Route = createFileRoute('/_authenticated/projects/$projectId')({ loader: async ({ params }) => { const project = await getProject({ data: params.projectId }); if (!project) { throw notFound(); } return { project }; }, component: ProjectDetailPage, }); function ProjectDetailPage() { const { project } = Route.useLoaderData(); return (

{project.name}

 ); } ``` **What's happening here:** 1. **Dynamic route** — The `$projectId` filename creates a dynamic segment. When a user visits `/projects/abc123`, TanStack Router exposes `abc123` as `params.projectId`. 2. **Reading params in the loader** — The loader receives `{ params }` and passes the id to our server function: `getProject({ data: params.projectId })`. 3. **Fetching the project** — We reuse the `getProject()` server function from Step 4. It is tenant-scoped, so a project from another organization can't be loaded. 4. **Handling missing projects** — If `getProject()` returns `null`, we `throw notFound()`. This renders the router's not-found UI and stops execution. 5. **Breadcrumbs with dynamic values** — `AppBreadcrumbs` generates breadcrumbs from the URL path. The `values` prop overrides specific segments with human-readable names: ```tsx ``` This maps the project ID in the URL to the project's actual name. So instead of `Home / Projects / abc123`, users see `Home / Projects / My Project`. {% img src="/images/docs/project-detail-page.webp" width="2856" height="1972" alt="Project detail page view" /%} ### Step 10: Verify Before committing, run these checks to ensure everything works correctly: ```bash # Check types — catches schema mismatches and missing imports pnpm typecheck # Fix lint issues — auto-fixes formatting and style problems pnpm lint:fix # Format code pnpm format:fix ``` ## Summary You've now built a complete feature following the layered architecture: | Layer | Files Created | |-------|--------------| | **Validation** | `src/lib/projects/project.schema.ts` (Zod schemas) | | **Database** | `packages/database/src/schema/project.ts` | | **Server Functions** | `src/lib/projects/projects.functions.ts` | | **Data Loader** | `src/lib/projects/projects.loader.ts` | | **UI Components** | `src/components/projects/project-form.tsx` | | **Routes** | `src/routes/_authenticated/projects/index.tsx`, `.../$projectId.tsx` | This pattern scales well. As you add more features, the consistent structure makes your codebase navigable and maintainable. {% faq title="Common Questions" items=[ {"question": "Do I need to create a package for every feature?", "answer": "No. Place app features under apps/web/src/routes, components, and lib by default. Only create a workspace package under packages/ when you need to share code across multiple apps or when the feature becomes complex enough to warrant isolation."}, {"question": "Should I use organizationFunctionMiddleware or authFunctionMiddleware?", "answer": "Use organizationFunctionMiddleware for organization-scoped mutations: it guarantees an active organization and injects context.organizationId and context.role. Use authFunctionMiddleware (with requireActiveOrganizationId() when needed) for actions that only require an authenticated user."}, {"question": "How do I add authorization to specific actions?", "answer": "Spread the auth tuple and append withFeaturePermission or withMinRole in the .middleware([...]) step. For example: createServerFn({ method: 'POST' }).middleware([...authFunctionMiddleware, withFeaturePermission({ project: ['delete'] })]).validator(schema).handler(...)"}, {"question": "How do I refresh the list after a mutation?", "answer": "There is no revalidatePath in TanStack Start. Call router.invalidate() (from useRouter()) in the mutation's success callback to re-run the affected route loaders, or invalidate a TanStack Query cache with queryClient.invalidateQueries(...)."}, {"question": "What if I need to update multiple tables atomically?", "answer": "Wrap your operations in db.transaction(). If any operation fails, all changes roll back automatically. See the Database Operations guide for transaction examples."} ] /%} --- **Next:** [Server Functions →](./server-functions)