This repository has been archived by the owner on Nov 10, 2023. It is now read-only.
Create a authentication service #8
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
riflowth
added
type: enhancement
riflowth
changed the title
riflowth
requested review from
eltfshr,
Porama6400 and
XiaoXuxxxx
and removed request for
eltfshr and
Porama6400
|
I will do |
7 tasks
riflowth
added a commit
that referenced
this pull request
Nov 28, 2022
* docs: add readme * docs: add pull request template * feat: add avatar generator from boring-avatar * build(deps): add package for authentication * refactor: reforming database schema & proto * fix: json module and decorator linting issues * fix: log not transport to console on production * refactor: use real backend connection * feat: add google auth * style: add eslint on `api-types` * refactor: add grpc error code * refactor: more consistency controller code style * fix: wrong date comparing logic * feat: add working logout button * fix: wrong logic cause from parameter * perf: reduce round-trip for get user data * feat: add `/me` to get authenticated user data * refactor: add related grpc and error types * fix(api-types): build issues * refactor: error handling and exception filter * refactor: add example env * feat: add workspace backend service * refactor: fix auth service grpc port * refactor: auth logic with nestjs's guard feature
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Feature description
What
Allow users to log in with Google and their email & password which have registered on Codern.
Why
We need authentication & authorization to identify a user and grant access to our internal sub-services.
How
Create a new service named
auth serviceto be independently scaled which communicates betweenAPI gatewayby using gRPC as a transport layer.The gRPC uses Protocol Buffers behind the screen, so they need the
.protofile to define the structure of data to serialize. Beforehand I use the default transport layer of NestJS (TCP). I realized that if we create a new service that not build with NestJS, how do we serialize the NestJS's TCP? Because of that, we must know how NestJS serialize/deserialize data when sending via TCP. It will be easier if we used the standard protocol. So I choosegRRCfor that way.The reason why I choose gRPC for communication between the API gateway and first layer service:
The API gateway is a single entry point for clients to communicate with our services. The gateway needs to pass an incoming request to the sub-service with a synchronous communication strategy to instantly acknowledge the client to know their request has been received and will do the requesting task later and ensure the service is ready to work (I planned to implement circuit breaker soon). In the sub-sequence call, it must use asynchronous message-based communication for scalability and decoupling of our services.
I select
session cookie-basedwith a server-signed signature for the authentication mechanism.So the malicious request will be rejected by the server before querying the database to check the session, this implementation reduces the latency and database resources. (I planned to cache the session / user in some ways on the future).
When user register, their profile image will be generated with the local version of boring-avatar and saved as an output SVG file into our file storage system (SeaweedFS) with filer API.
Todo list (if applicable)
Checklist
Associated Tracking