bakulinav / loyalty Goto Github PK

Send info about client to ENG from authentication session.

Build client info from session.
Create JWT token from this info and attach to ENG request.
See description and comments to issue #12 about how requirements to JWT token.

Description
As soon Loyalty system is a decomposed to modules with specific functions like processing facts (Rules Engine) we need to create a separate module to provide public API for clients can connect to it, send own shopping cart (or other container) and get processed entity back with applied rules.

Need to be done

• create separate maven module based on Spring Boot and having dependency to Spring Web component;
• create endpoint to accept ShoppingCart object in JSON for processing
• implement endpoint above into 2 aproaches: a) accepting single object, b) accepting batch of objects
• update Postman collection with new endpoints

Description
By default, DRools knowledge base loads from resources/META-INF/kmodule.xml where places description about all Bases and Sessions. Also, according this description, rules places in *.drl files in filesystem (in the resources by default)

Need to be done

• To find the way to store and get kmodule.xml description and *.drl content in datastore like document database.
• To find the way programmatically download Knowledge Base files from document database

• Implement passing shopping cart from requests to engine processing service to apply Client's Rules.

• Implement single SC processing

• Implement batch SC processing

• Processing should happen in scope of Client rules set.

• Response should include list of fired Rules to explain what exactly rules were affect of shopping cart

All requests about processing ShoppingCart should be passed to the Engine for processing process.

Implement 2 approaches:

• direct sync connect over web API to Engine
• middelware async queue on Kafka

From client's prespective both cases should be sync req-resp process.

UPD: The introducing of asyc calls to Engine is overenginiring at a moment. So, it's faster to implement simple web communication over http endpoints

Create config files for different environments for modules API and ENG.

Environement config files should destinguish env specific parameters.
Maven build process should be destinguished too over the Maven profiles.

As soon the Project base on Spring Boot framework, use framework's configuration approach

Set up 3 types of environments:

• Production (prod)
• Testing (test)
• Development (dev)
  May require additional env for integration testing (interation).

List of aspects require to destinguishing:

• logging level
  • prod: INFO
  • test & dev: DEBUG
• module host ???
• artefacts:
  • prod: lightweigh JAR
  • test: JAR with dependendencies for testing
  • dev: JAR with dependendencies for development

Create simple Web API to accept ShoppingCart for processing.
Sync communication with caller.
Request Event should have:

• ShoppingCart - instance of processing
• ClientId - to know a scope of processing
• Statefull/Staless flag (in client's scope)
• ??? some other attributes

Response Event should have:

• Original ShoppingCart - instance of processing
• Updated ShoppingCart - if rules were affect
• ShoppingCart - processed instance
• ClientId - scope of processing
• List of fired Rules

TODO:

• create Engine Web API, provide Response and Request DTOs #7
• create Engine Web API client to communicate with its API over web #8

UPD: Don't return separately Original and Updated shopping carts, suppose that client knows original state of it's shopping cart.

Engine service (ENG) should support authorisation over JWT mechanism (RFC-7519).

A JWT token should include at least clientID to distiguish client's scope while ShoppingCart processing in rules engine processor. Also JWT token will have clientName attribute.
For current state of the project clientID1 and clientID2 stubs are available.

Make API service to send JWT to ENG service.
Use HS512 (HMAC using SHA-512) algorithm for JWT sign.

It should decline non-JWT requests.
It should decline requests having unknown clientID.

Update ENG Postman collections to use JWT auth.

Add authentication and authorisation over login form in JSON:
auth object {"username": "<string>", "password": <string>}

Service should have endpoint for login POST /login and logout of user GET /logout.

API Gateway service should store user's session for 1 hour (3600 sec).