Adding Features

Building features in a multi-tenant SaaS application requires careful attention to data isolation, authorization, and type safety. This guide walks through a complete example (a "Projects" feature) demonstrating how to structure your code from database schema through to the user interface.

By the end of this guide, you'll have built a complete CRUD feature with proper organization scoping, server functions with validation, and a polished UI.

Feature Planning

Before writing code, answer these questions to clarify scope and prevent rework:

1. Define requirements — What does this feature do? What problem does it solve?
2. Design data model — What data needs to be stored? How does it relate to existing entities?
3. Identify user actions — What can users create, read, update, or delete?
4. Determine access control — Who can access this? Team members only? Specific roles?

This is useful for both manual development and when using AI to help you with the feature - as it will help define the scope of what you need to build.

Step-by-Step Example

The following example builds a "Projects" feature where organization members can create and manage projects. Each step builds on the previous one, creating a type-safe chain from validation through to the UI.

We will cover everything you need to know to add a new feature to your application:

• Defining the Zod validation schema
• Defining the database schema and creating a new migration
• Creating the server functions
• Fetching data in route loaders
• Building the UI components
• Creating the route
• Verifying the feature

Project Structure

TanStack Start uses file-based routing. Routes live under apps/web/src/routes, shared UI under apps/web/src/components, and server/loader/schema code under apps/web/src/lib. A typical layout for the projects feature:

apps/web/src/routes/_authenticated/projects/
├── index.tsx          # list route: loader + component
└── $projectId.tsx     # detail route: dynamic segment
apps/web/src/components/projects/
└── project-form.tsx
apps/web/src/lib/projects/
├── project.schema.ts
├── projects.loader.ts
└── projects.functions.ts

The pathless _authenticated group (apps/web/src/routes/_authenticated/route.tsx) already guards auth and renders the app shell, so every nested route inherits the sidebar and the authenticated context.

Step 1: Define Schemas

Start with the Zod validation schema.

This schema serves double duty: it validates form input on the client and server-function input on the server.

Defining it first ensures type safety flows through your entire feature.

💡 Tip: If you use Linux or MacOS, use the command touch to quickly create a new file in your terminal.

touch apps/web/src/lib/projects/project.schema.ts

On Windows, you can use the command New-Item to create a new file in your terminal.

New-Item -Path apps/web/src/lib/projects/project.schema.ts -ItemType File

Better yet, on VSCode (or Cursor), you can use the command palette to create a new file.

This will create a new file called project.schema.ts in the lib/projects directory.

You can then open the file and add the following code:

import * as z from 'zod';
export const createProjectSchema = z.object({
  name: z.string().min(3, 'Name must be at least 3 characters'),
});
export const updateProjectSchema = createProjectSchema.partial().extend({
  id: z.uuid(),
});
export type CreateProjectInput = z.output<typeof createProjectSchema>;
export type UpdateProjectInput = z.output<typeof updateProjectSchema>;

Step 2: Define Database Schema

With the validation schema in place, we move on to defining the database table.

The organizationId foreign key establishes the multi-tenant relationship — every project belongs to exactly one organization.

In the example below, we use Postgres and Drizzle ORM to define the project table.

Create the table file in the database package:

touch packages/database/src/schema/project.ts

You can then open the file and add the following code:

import { pgTable, text, timestamp } from 'drizzle-orm/pg-core';
import { organization } from './core';
export const project = pgTable('project', {
  id: text('id').primaryKey(),
  name: text('name').notNull(),
  organizationId: text('organization_id')
    .notNull()
    .references(() => organization.id, { onDelete: 'cascade' }),
  createdAt: timestamp('created_at').notNull().defaultNow(),
  updatedAt: timestamp('updated_at').notNull().defaultNow(),
});

Understanding the schema:

• pgTable('project', {...}) — Creates a PostgreSQL table named project with the specified columns
• id: text('id').primaryKey() — A text-based primary key. You'll typically generate this using generateId() (UUIDv7) from @kit/shared/uuid when inserting records. You can also use the built-in gen_random_uuid() function to generate a random UUID when defining the schema.
• name: text('name').notNull() — A required text field for the project name
• organizationId — The foreign key that links each project to an organization. The references() function creates a database-level constraint, and onDelete: 'cascade' ensures projects are automatically deleted when their parent organization is removed
• createdAt / updatedAt — Timestamp fields with defaultNow() that automatically set the current time on insert. Note that updatedAt must be manually updated in your code when modifying records

💡 Tip: For more information about using Drizzle ORM, please refer to the Drizzle ORM documentation.

Now, export the schema from the main ./schema/schema.ts file, so that it can be picked up by the Drizzle CLI:

export * from './core';
export * from './project';

After defining the schema, generate a new migration file by running the following command:

pnpm --filter "@kit/database" drizzle:generate

The command above will create a new migration file in the packages/database/src/schema directory. You can then open the migration file and review the changes.

Then output will be something like this:

> drizzle-kit generate --config drizzle.config.mjs
11 tables
account 13 columns 1 indexes 1 fks
invitation 8 columns 2 indexes 2 fks
member 5 columns 2 indexes 2 fks
organization_role 6 columns 2 indexes 1 fks
organization 6 columns 0 indexes 0 fks
session 10 columns 1 indexes 1 fks
subscription 12 columns 0 indexes 0 fks
two_factor 4 columns 2 indexes 1 fks
user 13 columns 0 indexes 0 fks
verification 6 columns 1 indexes 0 fks
project 5 columns 0 indexes 1 fks
[✓] Your SQL migration file ➜ ../../packages/database/src/schema/0001_xxxx_yyyy.sql 🚀

You can then open the migration file and review the changes. Please note that the migration filename will be looking differently from the above one, so please check the output of the command above to locate it.

If everything looks good, you can then apply the migration to the database by running the following command, which is just a shortcut for drizzle-kit migrate (Read the documentation):

pnpm --filter "@kit/database" drizzle:migrate

The command above will apply the migration to the database. The output will be something like this:

[✓] Changes applied

Let's now navigate to the Drizzle Studio to explore our new table.

Run the following command to start the Drizzle Studio:

pnpm --filter "@kit/database" drizzle:studio

If everything is working correctly, the CLI will list the URL at which you can access the Drizzle Studio:

Drizzle Studio is up and running on https://local.drizzle.studio

Open the URL in your browser to explore the new table. You should see the new project table. It's a good idea to familiarize yourself with Drizzle Studio, as it will become an invaluable tool for you when working with the database.

Click to expand

Step 3: Create Server Functions

Server functions handle mutations. In the example below, we create three: createProjectFunction, updateProjectFunction, and deleteProjectFunction.

TanStack Start compiles these into POST endpoints automatically — but we call them like normal async JavaScript functions (through TanStack Query). Pretty neat, right?

We attach the organizationFunctionMiddleware tuple to each one, which guarantees the user is authenticated, that there is an active organization, and injects context.organizationId and context.role.

💡 Note: The middleware tuples (authFunctionMiddleware, organizationFunctionMiddleware, adminFunctionMiddleware) live in the @kit/function-middleware package. Attach one to a literal createServerFn(...) call via .middleware(...) when creating server functions!

Notice how the Zod schema from Step 1 validates input automatically via .validator():

import { eq, and } from 'drizzle-orm';
import * as z from 'zod';
import { createServerFn } from '@tanstack/react-start';
import { organizationFunctionMiddleware } from '@kit/function-middleware/functions';
import { db, project } from '@kit/database';
import { generateId } from '@kit/shared/uuid';
import { createProjectSchema, updateProjectSchema } from './project.schema';
export const createProjectFunction = createServerFn({ method: 'POST' })
  .middleware(organizationFunctionMiddleware)
  .validator(createProjectSchema)
  .handler(async ({ data, context }) => {
    const [newProject] = await db
      .insert(project)
      .values({
        ...data,
        id: generateId(),
        organizationId: context.organizationId,
      })
      .returning();
    return newProject;
  });
export const updateProjectFunction = createServerFn({ method: 'POST' })
  .middleware(organizationFunctionMiddleware)
  .validator(updateProjectSchema)
  .handler(async ({ data, context }) => {
    const [updatedProject] = await db
      .update(project)
      .set({ ...data, updatedAt: new Date() })
      .where(
        and(
          eq(project.id, data.id),
          eq(project.organizationId, context.organizationId),
        ),
      )
      .returning();
    return updatedProject;
  });
export const deleteProjectFunction = createServerFn({ method: 'POST' })
  .middleware(organizationFunctionMiddleware)
  .validator(z.object({ id: z.string() }))
  .handler(async ({ data, context }) => {
    await db
      .delete(project)
      .where(
        and(
          eq(project.id, data.id),
          eq(project.organizationId, context.organizationId),
        ),
      );
  });

Understanding the server functions:

• organizationFunctionMiddleware — Pre-composed auth + organization middleware tuple attached with .middleware(...). context.user, context.organizationId, and context.role are guaranteed.
• .validator(schema) — The Zod schema that validates the input of the action
• .handler(...) — The server-side implementation. Its { data, context } argument is fully typed.
• generateId — Generates a new ID for the project using UUIDv7, a performant and secure way to generate a unique ID. Import from @kit/shared/uuid.

Refreshing data: there is no revalidatePath in TanStack Start. After a mutation, refresh server data by invalidating the router from the client — router.invalidate() (see Step 5) re-runs the affected route loaders.

Step 4: Create Data Loader

Route loaders fetch data on the server before the component renders. Because the database client is server-only, we expose the queries through createServerFn({ method: 'GET' }) so the loader can call them during both initial SSR and client-side navigation.

import { createServerFn } from '@tanstack/react-start';
import { and, desc, eq } from 'drizzle-orm';
import { requireActiveOrganizationId } from '@kit/better-auth/context';
import { db, project } from '@kit/database';
export const getProjects = createServerFn({ method: 'GET' }).handler(async () => {
  const organizationId = await requireActiveOrganizationId();
  return db
    .select()
    .from(project)
    .where(eq(project.organizationId, organizationId))
    .orderBy(desc(project.createdAt));
});
export const getProject = createServerFn({ method: 'GET' })
  .validator((id: string) => id)
  .handler(async ({ data: id }) => {
    const organizationId = await requireActiveOrganizationId();
    const [result] = await db
      .select()
      .from(project)
      .where(
        and(eq(project.id, id), eq(project.organizationId, organizationId)),
      )
      .limit(1);
    return result ?? null;
  });

Understanding the loader:

• createServerFn({ method: 'GET' }) — Marks this as a server-only read. It can be called from route loaders and runs on the server; the database client is never bundled into client code.
• requireActiveOrganizationId() — Reads the active organization from the request context and throws if none is set. Every tenant-scoped query is filtered by it.
• db.select().from(project) — Drizzle's query builder syntax. It reads like SQL but provides full type safety.
• eq() and desc() — Drizzle helper functions for equality comparisons and descending order. These compile to WHERE and ORDER BY clauses.

The getProject function demonstrates a common pattern for fetching a single record: query with .limit(1) and return the first result or null.

Step 5: Build UI Components

The form component ties everything together on the client. It uses useForm from @tanstack/react-form for form state, the Zod schema for validation via validators, and TanStack Query's useMutation to call the server function with automatic lifecycle handling.

We will wrap the form in a Sheet component to open a side panel to create a new project.

Tip: it's a good practice to use separate components for the form, and for the container that wraps the form (be this a Dialog, AlertDialog, Sheet, etc.). This will make your code more readable and maintainable, and will instantiate the form component only when needed (e.g., when the user clicks the "Create Project" button in the header).

'use client';
import { useState } from 'react';
import { useForm } from '@tanstack/react-form';
import { useMutation } from '@tanstack/react-query';
import { useRouter } from '@tanstack/react-router';
import { Button } from '@kit/ui/button';
import { Field, FieldError, FieldLabel } from '@kit/ui/field';
import { Input } from '@kit/ui/input';
import {
  Sheet,
  SheetContent,
  SheetDescription,
  SheetHeader,
  SheetTitle,
  SheetTrigger,
} from '@kit/ui/sheet';
import { toast } from '@kit/ui/sonner';
import { createProjectFunction } from '#/lib/projects/projects.functions';
import { createProjectSchema } from '#/lib/projects/project.schema';
export function ProjectFormContainer({ children }: React.PropsWithChildren) {
  const [open, setOpen] = useState(false);
  return (
    <Sheet open={open} onOpenChange={setOpen}>
      <SheetTrigger render={children} />
      <SheetContent className="flex flex-col gap-y-4">
        <SheetHeader className="gap-y-0">
          <SheetTitle>Create Project</SheetTitle>
          <SheetDescription className="text-base">
            Create a new project to get started.
          </SheetDescription>
        </SheetHeader>
        <ProjectForm onSuccess={() => setOpen(false)} />
      </SheetContent>
    </Sheet>
  );
}
function ProjectForm({ onSuccess }: { onSuccess: () => void }) {
  const router = useRouter();
  const createProject = useMutation({ mutationFn: createProjectFunction });
  const form = useForm({
    defaultValues: {
      name: '',
    },
    validators: {
      onChange: createProjectSchema,
      onSubmit: createProjectSchema,
    },
    onSubmit: ({ value }) => {
      toast.promise(
        createProject.mutateAsync({ data: value }).then(async () => {
          await router.invalidate(); // re-run the projects loader
          onSuccess();
        }),
        {
          loading: 'Creating project...',
          success: 'Project created!',
          error: 'Failed to create project',
        },
      );
    },
  });
  const isPending = createProject.isPending;
  return (
    <form
      onSubmit={(e) => {
        e.preventDefault();
        void form.handleSubmit();
      }}
      className="space-y-4"
    >
      <form.Field name="name">
        {(field) => {
          const isInvalid =
            field.state.meta.isTouched && !field.state.meta.isValid;
          return (
            <Field data-invalid={isInvalid}>
              <FieldLabel>Project Name</FieldLabel>
              <Input
                name={field.name}
                disabled={isPending}
                placeholder="e.g. My Project"
                value={field.state.value}
                onBlur={field.handleBlur}
                onChange={(e) => field.handleChange(e.target.value)}
                aria-invalid={isInvalid}
              />
              <FieldError errors={field.state.meta.errors} />
            </Field>
          );
        }}
      </form.Field>
      <Button type="submit" disabled={isPending}>
        {isPending ? 'Creating...' : 'Create Project'}
      </Button>
    </form>
  );
}

We will be using this component in the route later on.

Note: since we're using React Hooks and interactive components, we add the use client directive. This does not mean that the component only renders on the client side — it still server-renders during SSR and then hydrates on the client.

Step 6: Create the Route

The list route fetches data in its loader and renders the UI in its component. The component reads the loaded data with Route.useLoaderData():

import { Link, createFileRoute, redirect } from '@tanstack/react-router';
import { getActiveOrganization } from '@kit/better-auth/context';
import { AppBreadcrumbs } from '@kit/ui/app-breadcrumbs';
import { Button } from '@kit/ui/button';
import {
  CardButton,
  CardButtonHeader,
  CardButtonTitle,
} from '@kit/ui/card-button';
import {
  EmptyState,
  EmptyStateButton,
  EmptyStateHeading,
  EmptyStateText,
} from '@kit/ui/empty-state';
import { If } from '@kit/ui/if';
import { PageBody, PageHeader } from '@kit/ui/page';
import { ProjectFormContainer } from '#/components/projects/project-form';
import { getProjects } from '#/lib/projects/projects.loader';
export const Route = createFileRoute('/_authenticated/projects/')({
  loader: async () => {
    const organization = await getActiveOrganization();
    if (!organization) {
      throw redirect({ to: '/dashboard' });
    }
    const projects = await getProjects();
    return { organization, projects };
  },
  component: ProjectsPage,
});
function ProjectsPage() {
  const { organization, projects } = Route.useLoaderData();
  return (
    <PageBody>
      <PageHeader>
        <div className="flex-1">
          <AppBreadcrumbs
            values={{
              dashboard: organization.name ?? 'Dashboard',
            }}
          />
        </div>
        <div className="flex justify-end">
          <ProjectFormContainer>
            <Button size="sm">Create Project</Button>
          </ProjectFormContainer>
        </div>
      </PageHeader>
      <If condition={projects.length === 0}>
        <EmptyState>
          <EmptyStateHeading>No projects found</EmptyStateHeading>
          <EmptyStateText>Create a new project to get started.</EmptyStateText>
          <ProjectFormContainer>
            <EmptyStateButton>Create Project</EmptyStateButton>
          </ProjectFormContainer>
        </EmptyState>
      </If>
      <If condition={projects.length > 0}>
        <div className="grid grid-cols-1 gap-4 md:grid-cols-2 lg:grid-cols-3">
          {projects.map((project) => (
            <Link
              key={project.id}
              to="/projects/$projectId"
              params={{ projectId: project.id }}
            >
              <CardButton>
                <CardButtonHeader>
                  <CardButtonTitle className="text-left">
                    <span className="truncate">{project.name}</span>
                  </CardButtonTitle>
                </CardButtonHeader>
              </CardButton>
            </Link>
          ))}
        </div>
      </If>
    </PageBody>
  );
}

What's happening here:

This route brings together everything we built in the previous steps. Let's break it down:

1. Authorization check — The loader calls getActiveOrganization(). If there isn't one, we throw redirect({ to: '/dashboard' }). Loaders run on the server during SSR and during client navigation, so this guard runs before the component renders.
2. Data fetching — We call our getProjects() server function from the loader. The active organization is resolved server-side from the request context, so the query is always tenant-scoped.
3. Reading data — The component calls Route.useLoaderData() to read what the loader returned, fully typed.
4. Page structure — We use PageBody and PageHeader for a consistent layout, with breadcrumbs and a "Create Project" button wrapped in our ProjectFormContainer (the sheet we built earlier).
5. Conditional rendering — The If component handles two states: an empty state when there are no projects, and a grid of project cards when projects exist.
6. Project cards — Each project renders as a CardButton inside a typed Link (to + params). The key={project.id} prop helps React efficiently update the list.

The interactive parts are the ProjectFormContainer components, which are Client Components that handle the sheet behavior.

About layouts

You usually don't need a per-feature layout. The pathless _authenticated group (apps/web/src/routes/_authenticated/route.tsx) already renders the app shell — sidebar, header, and the authenticated context — for every nested route. If a specific feature needs a different shell, add a nested pathless layout route (apps/web/src/routes/_authenticated/projects/route.tsx) that renders an <Outlet /> inside your custom layout.

Step 7: Adding the route to the sidebar

To add the route to the sidebar, add it to the routes array in the navigation config.

import { Folder, Home } from 'lucide-react';
import * as z from 'zod';
import { env } from '@kit/shared/env';
import { NavigationConfigSchema } from '@kit/ui/navigation-schema';
const iconClasses = 'w-4';
/**
 * Navigation routes for the authenticated app section.
 * Items adapt based on the current account context via getContextAwareNavigation.
 */
export const routes: z.output<typeof NavigationConfigSchema>['routes'] = [
  {
    label: 'common.routes.application',
    children: [
      {
        label: 'common.routes.dashboard',
        path: env('VITE_APP_HOME_PATH') ?? '/dashboard',
        Icon: <Home className={iconClasses} />,
      },
      {
        label: 'Projects',
        path: '/projects',
        Icon: <Folder className={iconClasses} />,
        context: 'organization',
      },
    ],
  },
];

Note: for simplicity, we are not using a common.routes.projects translation key. You can translate the label by adding a key to packages/i18n/src/messages/en/common.json and using it as the label.

Understanding the context:

• context: 'organization' — Scopes the nav item to the organization context. If you omit the context property, the item is shown in both personal and organization contexts.

Step 8: Let's see the result

Below is a screenshot of the projects page:

Click to expand

You can now create a new project by clicking the "Create Project" button in the header.

Click to expand

As you can see, as we don't currently have any projects, the empty state is displayed. Let's create a new project by clicking the "Create Project" button in the sheet:

Click to expand

Step 9: Create the project detail route

At the moment, when you click on a project card, you are routed to a 404. This is totally normal and expected, as we haven't created the project detail route yet.

Let's create a detail route at apps/web/src/routes/_authenticated/projects/$projectId.tsx. The $projectId filename creates a dynamic segment that we read from params:

import { createFileRoute, notFound } from '@tanstack/react-router';
import { AppBreadcrumbs } from '@kit/ui/app-breadcrumbs';
import { PageBody, PageHeader } from '@kit/ui/page';
import { getProject } from '#/lib/projects/projects.loader';
export const Route = createFileRoute('/_authenticated/projects/$projectId')({
  loader: async ({ params }) => {
    const project = await getProject({ data: params.projectId });
    if (!project) {
      throw notFound();
    }
    return { project };
  },
  component: ProjectDetailPage,
});
function ProjectDetailPage() {
  const { project } = Route.useLoaderData();
  return (
    <PageBody>
      <PageHeader>
        <AppBreadcrumbs values={{ [project.id]: project.name }} />
      </PageHeader>
      <div className="border-border rounded-lg border p-4">
        <h1 className="text-2xl font-bold">{project.name}</h1>
      </div>
    </PageBody>
  );
}

What's happening here:

1. Dynamic route — The $projectId filename creates a dynamic segment. When a user visits /projects/abc123, TanStack Router exposes abc123 as params.projectId.
2. Reading params in the loader — The loader receives { params } and passes the id to our server function: getProject({ data: params.projectId }).
3. Fetching the project — We reuse the getProject() server function from Step 4. It is tenant-scoped, so a project from another organization can't be loaded.
4. Handling missing projects — If getProject() returns null, we throw notFound(). This renders the router's not-found UI and stops execution.
5. Breadcrumbs with dynamic values — AppBreadcrumbs generates breadcrumbs from the URL path. The values prop overrides specific segments with human-readable names:

<AppBreadcrumbs values={{ [project.id]: project.name }} />

This maps the project ID in the URL to the project's actual name. So instead of Home / Projects / abc123, users see Home / Projects / My Project.

Click to expand

Step 10: Verify

Before committing, run these checks to ensure everything works correctly:

# Check types — catches schema mismatches and missing imports
pnpm typecheck
# Fix lint issues — auto-fixes formatting and style problems
pnpm lint:fix
# Format code
pnpm format:fix

Summary

You've now built a complete feature following the layered architecture:

This pattern scales well. As you add more features, the consistent structure makes your codebase navigable and maintainable.

Next: Server Functions →