Add tenant service

[luksamuk]

Story

As a system administrator, I would like to be able to manage tenants so that each client using the system has a corresponding tenant to itself.

As a system user, I would like to be able to log in to my company's own separate subsystem.

As a system user, I would like to be able to manage my company's products and users, but my company's data should be inaccessible to other companies. Furthermore, other companies' data should be inaccessible to me.

Functional Requirements

• Tenants

  • Create, read, update, disable companies
  • Companies should not be deleted (for now), only disabled
  • Companies should have a UUID and always be referred by it, but should also have a "slug" -- a unique, human-readable identifier to the company

• REST API

  • All company-related REST endpoints should be prefixed by the company UUID. Example: GET /api/v1/<company-uuid>/users/<user-uuid>
  • Future remark: Company UUIDs could be validated by comparing with the UUID to be contained by a JWT token.

• Other services

  • All entities should now be separated by company. Companies can never leak data onto one another.

• Extra

  • Create utility for filling the database with some fuzzy data.

Non-functional Requirements

• TENANT Service

  • Create a TENANT gRPC service with Company CRUD, models, mappers.
  • Manage deletion so that it only deactivates the company, but does not remove it.
  • Add Company search by slug
  • Add Company single existence message by UUID

• REST Service

  • Create routes for managing the TENANT service
  • Add connection pool to TENANT service
  • Add tenant ID to every relevant route + middleware
  • Entity creation schemas shouldn't need company ID
  • Entity models (used for returning data on REST endpoints) should have a company ID now, but it should be omitted when serialized -- mappers should be adapted
  • Entity messages (for communication with services) should now require a company ID

• USER and PRODUCTS Services

  • Adapt messages to require company id within objects
  • Controllers won't need to verify whether a company exists -- if it doesn't, then manipulating an object with invalid company ID should raise a constraint violation by the database
  • Repositories should now ALWAYS use company ID as filter, and take care not to leak data from other companies.

• Fuzzy Tool

  • Populate database with fuzzy data

[luksamuk]

Technical Refinement

TENANT Service

• [x] Create Protocol Buffers
  • Basic CRUD (replace delete with disable, using deleted_at field)
  • Method: Search by slug
  • Method: Check if exists
• [x] Create gRPC service
  • [x] Model for Company (with AutoMigration)
  • [x] Entity mappers
  • [x] Controller
  • [x] Repository

USER and PRODUCT Services

• Update User and Product models and messages to accept and manipulate company_id
  • [x] Update models
  • Update messages
  • [x] User
  • [x] Product
  • [x] Index messages
  • Update microservices with multi-tenant behaviour (Ensure that data is never leaked nor manipulated between companies!)
  • [x] USER service
  • [x] USER controller
  • [x] USER repository (filter queries by company_id)
  • [x] PRODUCTS service
  • [x] PRODUCTS controller
  • [x] PRODUCTS repository (filter queries by company_id)
  • [x] Omit company_id from models while serializing to JSON (REST services won't need to return it)

REST Service

• [x] Company routes
• [x] TENANT service connection pool
• [x] Add company UUID to routes
  • [x] Add company existence verification middleware
  • Ensure that disabled companies cannot manipulate entities as well!
• [x] Update mappers to take company_id into consideration

Extra

• [x] Update Dockerfile
• [x] Update Docker Compose
• [x] Update Kubernetes definitions

[luksamuk]

Fuzzy test tool will be broken into another task.