Implement a full OAuth2 2.0 and OpenID Connect 1.0 authorization
server with support for authorization code flow (with PKCE),
refresh token rotation, device authorization grant, dynamic
client registration, token introspection, and token revocation.
Includes database schema, coredata layer, service logic, HTTP
handlers, OIDC discovery endpoint, and JWKS publishing.
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
The API should be aware of the tenant they are working on. Many solution
is possible like passing a header, adding the tenant id in each function
call, encode the tenant id in the GID.
I consider the header as a hack it force the client to keep in mind to
pass this header, having to returns an error in case of not defined
header and add a non standard header make the API more harder to use.
Passing the tenant id everywhere will be a good option but since Relay
impose to have node(id: ID!) Node interface it is not possible or by
hacking by wrapping node(id: ID!) Node in top query who getting the
tenant_id.
I finish by simpliy encode the tenant id directly in the object id, it
what AWS do too, it allow to always have the information, and it ensure
a right data isolation.
Signed-off-by: gearnode <bryan@frimin.fr>
