The API should be aware of the tenant they are working on. Many solution is possible like passing a header, adding the tenant id in each function call, encode the tenant id in the GID. I consider the header as a hack it force the client to keep in mind to pass this header, having to returns an error in case of not defined header and add a non standard header make the API more harder to use. Passing the tenant id everywhere will be a good option but since Relay impose to have node(id: ID!) Node interface it is not possible or by hacking by wrapping node(id: ID!) Node in top query who getting the tenant_id. I finish by simpliy encode the tenant id directly in the object id, it what AWS do too, it allow to always have the information, and it ensure a right data isolation. Signed-off-by: gearnode <bryan@frimin.fr>
17 KiB
17 KiB