Support JWT tenant_id to serve multiple tenants

[diegosz]

It would be interesting to share a single instance of GraphJin to serve multiple tenants.

Usually you do this by passing a tenant_id in different ways:

• As a query parameter in the request
• With a URL path tenant identification
• Domain-based tenant identification
• Using an HTTP header, like "X-TENANT-ID"
• Inspecting the "aud" claim of the JWT token
• As part of a custom attribute in the JWT token

I think the best way to handle it is with a custom attribute in the JWT token, in the same way GraphJin is doing authentication extracting the user_id from the subject claim of the JWT token.

The idea is to add a JWT config variable tenant_id_attribute to define the custom attribute for the tenant_id. If not defined, the tenant is not going to be searched.

Also in development mode, in the same way we use "X-USER-ID" header to simulate an authenticated user_id of the user you want to test with, we could use "X-TENANT-ID" to simulate the tenant_id for testing.

I'm working on refactoring the JWT provider to use an interface, after that, I would like to work on this tenant_id idea.

Any comments?

[dosco]

I was thinking about having this down the road mostly with the domain based tenants but I like this list of ways to set the tenant. You've obviously given this some thought. Sounds like a great addition happy to help land it.

[diegosz]

I think the domain based tenant is good option to add too.

[dosco]

There are 3 options to implement this.

1. Use the core library with your own http service and have multiple instances of GraphJin
2. Use the new namespace feature with the core library to build your own using just a single instance with multiple namespaces
3. We build support for multi-tenancy into the standalone GraphJin service using one of the above

[vardhmanbaid]

We can do this by using it as a library
I used it with fiber but could do with mux or gin too,
The below GraphHandler will connect to respective graphql and return respective results.

var Tenants = map[string]*core.GraphJin{}

func LoadAll() {
	pgdb := Get()
        // To get all tenants stored in database
	var tenants []common.Tenant
	err := pgdb.Model(&tenants).Select()
	if err != nil {
		fmt.Print("Error", err)
	}
        // loop to create respective graphql service for each tenant
	for _, item := range tenants {
		ConnectionString := "postgresql://" + item.DbUsername + ":" + item.DbPassword + "@" + item.DbHost + ":" + item.DbPort + "/" + item.DbName + ""
		dbConn, err := sql.Open("pgx", ConnectionString)
		if err != nil {
			fmt.Println("Error", err.Error())
		}
		supergraph, err := core.NewGraphJin(&conf, dbConn)
		//check err
		if err != nil {
			fmt.Print("Error", err.Error())
		}
		Tenants[item.Slug] = supergraph
	}
}

func GraphHandler() fiber.Handler {
	return func(c *fiber.Ctx) error {

		body := new(QueryBody)
		if err := c.BodyParser(&body); err != nil {
			return c.Status(400).JSON(fiber.Map{"message": err.Error()})
		}

		slug := string(c.Context().Request.Header.Peek("Slug"))

		if slug == "" {
			return c.Status(400).JSON(fiber.Map{"message": "Please check slug in header"})
		}

		GraphqlContext := context.WithValue(c.Context(), core.UserIDKey, 1)
		res, err := db.Tenants[string(c.Context().Request.Header.Peek("Slug"))].GraphQL(GraphqlContext, body.Query, body.Variables, nil)

		if err != nil {
			return c.Status(400).JSON(fiber.Map{"message": err.Error()})
		} else {
			return c.JSON(res)
		}

	}
}

[dosco]

Checkout request level namespaceing will use less memory than multiple instances of GraphJin. All namespaces will share the config and db so if you want those to be different per tenant that multiple instances are the way to go.

https://pkg.go.dev/github.com/dosco/graphjin/core#ReqConfig