Rewrite the global id system to include tenant id
The API should be aware of the tenant they are working on. Many solution is possible like passing a header, adding the tenant id in each function call, encode the tenant id in the GID. I consider the header as a hack it force the client to keep in mind to pass this header, having to returns an error in case of not defined header and add a non standard header make the API more harder to use. Passing the tenant id everywhere will be a good option but since Relay impose to have node(id: ID!) Node interface it is not possible or by hacking by wrapping node(id: ID!) Node in top query who getting the tenant_id. I finish by simpliy encode the tenant id directly in the object id, it what AWS do too, it allow to always have the information, and it ensure a right data isolation. Signed-off-by: gearnode <bryan@frimin.fr>
This commit is contained in:
gearnode
103
pkg/gid/gid.go
103
pkg/gid/gid.go
@@ -1,51 +1,40 @@
|
||||
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package gid
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"database/sql/driver"
|
||||
"encoding/base64"
|
||||
"encoding/binary"
|
||||
"fmt"
|
||||
"time"
|
||||
)
|
||||
|
||||
"go.gearno.de/crypto/uuid"
|
||||
const (
|
||||
GIDSize = 32 // 256 bits total
|
||||
)
|
||||
|
||||
type (
|
||||
GID uuid.UUID
|
||||
GID [GIDSize]byte
|
||||
TenantID [16]byte // 128-bit tenant ID
|
||||
)
|
||||
|
||||
var (
|
||||
Nil = GID(uuid.Nil)
|
||||
Nil = GID{}
|
||||
)
|
||||
|
||||
// ParseGID parses a string representation of a GID
|
||||
func ParseGID(encoded string) (GID, error) {
|
||||
gid := GID{}
|
||||
|
||||
err := gid.UnmarshalText([]byte(encoded))
|
||||
if err != nil {
|
||||
return Nil, err
|
||||
}
|
||||
|
||||
return gid, nil
|
||||
}
|
||||
|
||||
// New creates a new GID with a default entity type of 0
|
||||
func New() GID {
|
||||
id, err := NewGID(0)
|
||||
// New creates a new GID with default entity type and nil tenant ID
|
||||
func New(tenantID TenantID, entityType uint16) GID {
|
||||
id, err := NewGID(tenantID, entityType)
|
||||
if err != nil {
|
||||
// This should never happen with a valid random source
|
||||
panic(fmt.Sprintf("failed to generate GID: %v", err))
|
||||
@@ -53,26 +42,58 @@ func New() GID {
|
||||
return id
|
||||
}
|
||||
|
||||
// NewGID creates a new GID with the specified entity type
|
||||
func NewGID(et uint32) (GID, error) {
|
||||
id, err := uuid.NewV7()
|
||||
// NewGID creates a new GID with the specified entity type and tenant ID
|
||||
// Structure:
|
||||
// - Bytes 0-15: Tenant ID (full 16 bytes)
|
||||
// - Bytes 16-17: Entity Type (uint16)
|
||||
// - Bytes 18-25: Timestamp (milliseconds since epoch)
|
||||
// - Bytes 26-31: Random data for uniqueness
|
||||
func NewGID(tenantID TenantID, entityType uint16) (GID, error) {
|
||||
var id GID
|
||||
|
||||
// Write full tenant ID (16 bytes)
|
||||
copy(id[0:16], tenantID[:])
|
||||
|
||||
// Write entity type (2 bytes)
|
||||
binary.BigEndian.PutUint16(id[16:18], entityType)
|
||||
|
||||
// Get current timestamp (milliseconds) and write it (8 bytes)
|
||||
now := time.Now().UnixMilli()
|
||||
binary.BigEndian.PutUint64(id[18:26], uint64(now))
|
||||
|
||||
// Fill the rest with random data (6 bytes)
|
||||
_, err := rand.Read(id[26:32])
|
||||
if err != nil {
|
||||
return Nil, err
|
||||
return Nil, fmt.Errorf("failed to generate random bytes: %v", err)
|
||||
}
|
||||
|
||||
binary.BigEndian.PutUint32(id[10:14], et)
|
||||
|
||||
return GID(id), nil
|
||||
return id, nil
|
||||
}
|
||||
|
||||
// Value implements the database/sql/driver.Valuer interface
|
||||
func (gid GID) Value() (driver.Value, error) {
|
||||
return gid.String(), nil
|
||||
}
|
||||
|
||||
func (gid GID) EntityType() uint32 {
|
||||
return binary.BigEndian.Uint32(gid[10:14])
|
||||
// TenantID extracts the tenant ID from the GID
|
||||
func (gid GID) TenantID() TenantID {
|
||||
var tenantID TenantID
|
||||
copy(tenantID[:], gid[0:16])
|
||||
return tenantID
|
||||
}
|
||||
|
||||
// EntityType extracts the entity type from the GID
|
||||
func (gid GID) EntityType() uint16 {
|
||||
return binary.BigEndian.Uint16(gid[16:18])
|
||||
}
|
||||
|
||||
// Timestamp extracts the timestamp from the GID
|
||||
func (gid GID) Timestamp() time.Time {
|
||||
millis := binary.BigEndian.Uint64(gid[18:26])
|
||||
return time.UnixMilli(int64(millis))
|
||||
}
|
||||
|
||||
// Scan implements the database/sql/driver.Scanner interface
|
||||
func (gid *GID) Scan(value interface{}) error {
|
||||
switch v := value.(type) {
|
||||
case string:
|
||||
@@ -82,33 +103,43 @@ func (gid *GID) Scan(value interface{}) error {
|
||||
return err
|
||||
}
|
||||
|
||||
*gid = GID(id)
|
||||
if len(id) != GIDSize {
|
||||
return fmt.Errorf("invalid length for GID: got %d, want %d", len(id), GIDSize)
|
||||
}
|
||||
|
||||
copy((*gid)[:], id)
|
||||
default:
|
||||
return fmt.Errorf("invalid type for GID: expected string, got %T", value)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// String returns the base64url encoded representation of the GID
|
||||
func (gid GID) String() string {
|
||||
return base64.RawURLEncoding.EncodeToString(gid[:])
|
||||
}
|
||||
|
||||
// MarshalText returns the base64url encoded representation of the GID
|
||||
func (gid GID) MarshalText() ([]byte, error) {
|
||||
enc := base64.RawURLEncoding
|
||||
|
||||
buf := make([]byte, enc.EncodedLen(len(gid)))
|
||||
enc.Encode(buf, gid[:])
|
||||
|
||||
return buf, nil
|
||||
}
|
||||
|
||||
// UnmarshalText decodes a base64url encoded GID
|
||||
func (gid *GID) UnmarshalText(encoded []byte) error {
|
||||
enc := base64.RawURLEncoding
|
||||
|
||||
_, err := enc.Decode(gid[:], encoded)
|
||||
dst := make([]byte, enc.DecodedLen(len(encoded)))
|
||||
n, err := enc.Decode(dst, encoded)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if n != GIDSize {
|
||||
return fmt.Errorf("invalid length for GID: got %d, want %d", n, GIDSize)
|
||||
}
|
||||
|
||||
copy((*gid)[:], dst)
|
||||
return nil
|
||||
}
|
||||
|
||||
173
pkg/gid/tenant_id.go
Normal file
173
pkg/gid/tenant_id.go
Normal file
@@ -0,0 +1,173 @@
|
||||
package gid
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"database/sql/driver"
|
||||
"encoding/base64"
|
||||
"encoding/binary"
|
||||
"fmt"
|
||||
"os"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
)
|
||||
|
||||
var (
|
||||
// NilTenant represents an empty tenant ID
|
||||
NilTenant = TenantID{}
|
||||
|
||||
// Global generation singleton
|
||||
defaultTenantGenerator = newTenantGenerator()
|
||||
)
|
||||
|
||||
// TenantGenerator handles creation of unique tenant IDs
|
||||
type tenantGenerator struct {
|
||||
// Process-specific values
|
||||
machineID [6]byte // 48 bits for machine identifier
|
||||
processID uint16 // 16 bits for process
|
||||
counter uint32 // Counter for the sequence
|
||||
}
|
||||
|
||||
// NewTenantID generates a new globally unique tenant ID
|
||||
func NewTenantID() TenantID {
|
||||
return defaultTenantGenerator.NewTenantID()
|
||||
}
|
||||
|
||||
// ParseTenantID parses a string representation into a TenantID
|
||||
func ParseTenantID(s string) (TenantID, error) {
|
||||
var id TenantID
|
||||
decoded, err := base64.RawURLEncoding.DecodeString(s)
|
||||
if err != nil {
|
||||
return NilTenant, fmt.Errorf("invalid tenant ID encoding: %w", err)
|
||||
}
|
||||
|
||||
if len(decoded) != len(id) {
|
||||
return NilTenant, fmt.Errorf("invalid tenant ID length: got %d, want %d", len(decoded), len(id))
|
||||
}
|
||||
|
||||
copy(id[:], decoded)
|
||||
return id, nil
|
||||
}
|
||||
|
||||
// newTenantGenerator creates a new generator with machine-specific components
|
||||
func newTenantGenerator() *tenantGenerator {
|
||||
g := &tenantGenerator{
|
||||
counter: 0,
|
||||
}
|
||||
|
||||
// Generate machine ID component
|
||||
if _, err := rand.Read(g.machineID[:]); err != nil {
|
||||
// Fallback if random source fails
|
||||
hostname, _ := os.Hostname()
|
||||
copy(g.machineID[:], []byte(hostname))
|
||||
|
||||
// Pad with timestamp bits if hostname is short
|
||||
if len(hostname) < len(g.machineID) {
|
||||
ts := time.Now().UnixNano()
|
||||
binary.BigEndian.PutUint32(g.machineID[len(hostname):], uint32(ts))
|
||||
}
|
||||
}
|
||||
|
||||
// Set process ID from OS PID
|
||||
g.processID = uint16(os.Getpid() & 0xFFFF)
|
||||
|
||||
return g
|
||||
}
|
||||
|
||||
// NewTenantID generates a new 128-bit tenant ID with the structure:
|
||||
// - 48 bits: Machine ID (random, unique per machine)
|
||||
// - 16 bits: Process ID (unique per process on machine)
|
||||
// - 48 bits: Timestamp (milliseconds, sequential)
|
||||
// - 16 bits: Counter (increments per ID)
|
||||
func (g *tenantGenerator) NewTenantID() TenantID {
|
||||
// Create new ID
|
||||
var id TenantID
|
||||
|
||||
// 1. Get timestamp (48 bits = milliseconds since epoch)
|
||||
now := time.Now().UnixMilli()
|
||||
|
||||
// 2. Increment counter atomically (16 bits used)
|
||||
count := atomic.AddUint32(&g.counter, 1) & 0xFFFF
|
||||
|
||||
// 3. Assemble the ID
|
||||
// First 6 bytes: Machine ID
|
||||
copy(id[0:6], g.machineID[:])
|
||||
|
||||
// Next 2 bytes: Process ID
|
||||
binary.BigEndian.PutUint16(id[6:8], g.processID)
|
||||
|
||||
// Next 6 bytes: Timestamp (48 bits)
|
||||
id[8] = byte(now >> 40)
|
||||
id[9] = byte(now >> 32)
|
||||
id[10] = byte(now >> 24)
|
||||
id[11] = byte(now >> 16)
|
||||
id[12] = byte(now >> 8)
|
||||
id[13] = byte(now)
|
||||
|
||||
// Last 2 bytes: Counter
|
||||
binary.BigEndian.PutUint16(id[14:16], uint16(count))
|
||||
|
||||
return id
|
||||
}
|
||||
|
||||
// Value implements the database/sql/driver.Valuer interface
|
||||
func (id TenantID) Value() (driver.Value, error) {
|
||||
return id.String(), nil
|
||||
}
|
||||
|
||||
// Scan implements the database/sql.Scanner interface
|
||||
func (id *TenantID) Scan(value interface{}) error {
|
||||
switch v := value.(type) {
|
||||
case string:
|
||||
decoded, err := base64.RawURLEncoding.DecodeString(v)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if len(decoded) != len(*id) {
|
||||
return fmt.Errorf("invalid tenant ID length: got %d, want %d", len(decoded), len(*id))
|
||||
}
|
||||
|
||||
copy((*id)[:], decoded)
|
||||
return nil
|
||||
default:
|
||||
return fmt.Errorf("invalid type for TenantID: expected string, got %T", value)
|
||||
}
|
||||
}
|
||||
|
||||
// String returns the base64 representation of the TenantID
|
||||
func (id TenantID) String() string {
|
||||
return base64.RawURLEncoding.EncodeToString(id[:])
|
||||
}
|
||||
|
||||
// MarshalText returns the base64 representation for JSON encoding
|
||||
func (id TenantID) MarshalText() ([]byte, error) {
|
||||
encoded := base64.RawURLEncoding.EncodeToString(id[:])
|
||||
return []byte(encoded), nil
|
||||
}
|
||||
|
||||
// UnmarshalText parses the base64 representation for JSON decoding
|
||||
func (id *TenantID) UnmarshalText(text []byte) error {
|
||||
decoded, err := base64.RawURLEncoding.DecodeString(string(text))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if len(decoded) != len(*id) {
|
||||
return fmt.Errorf("invalid tenant ID length: got %d, want %d", len(decoded), len(*id))
|
||||
}
|
||||
|
||||
copy((*id)[:], decoded)
|
||||
return nil
|
||||
}
|
||||
|
||||
// IsValid returns true if the tenant ID is not nil
|
||||
func (id TenantID) IsValid() bool {
|
||||
return id != NilTenant
|
||||
}
|
||||
|
||||
// Timestamp extracts the timestamp from the TenantID
|
||||
func (id TenantID) Timestamp() time.Time {
|
||||
millis := int64(id[8])<<40 | int64(id[9])<<32 | int64(id[10])<<24 |
|
||||
int64(id[11])<<16 | int64(id[12])<<8 | int64(id[13])
|
||||
return time.UnixMilli(millis)
|
||||
}
|
||||
Reference in New Issue
Block a user