Remember when you first added multi-tenancy to an app? You probably went through the exact same stages I did:

Phase 1: just add tenant_id = ? to the controller. Easy.

Phase 2: realize you have 30 controllers. Add it everywhere. Swear a lot.

Phase 3: someone adds a new endpoint and forgets. Bug in prod. More swearing.

Phase 4: create a base repository method. Feels clever for about a week.