Overview

Note

Currently the job of Authentication is left to the individual plugins.

The framework delegates authentication responsibilities to individual plugins. Additionally, for other microservices, you have the flexibility to integrate various secret mechanisms. Copy the respective index.ts file and customize it to add logic based on your specific needs.

Event spec

Add authn: true or authn: false in the event DSL to enable or disable authentication for any event.

http.post./v1/loan-application/:lender_loan_application_id/kyc/ckyc/initiate: 
  authn: true
  fn: com.biz.kyc.ckyc.ckyc_initiate
  on_validation_error: com.jfs.handle_validation_error
  data:
    schema:
      body: 
        required: true
        content:
          application/json:
            schema:
              type: 'object'
              required: []
              properties:
                dob:  { type : 'string', format : 'date', pattern : "[0-9]{4}-[0-9]{2}-[0-9]{2}" }
                meta:
                  type: 'object'
      params: 
      - name: lender_loan_application_id
        in: params
        required: true
        allow_empty_value: false
        schema:
          type: string
  responses: #Output data defined as per the OpenAPI spec
    200:
      schema:
        data: 
          required: # default value is false
          content:
            application/json:
              schema: 
                type: object
                properties:
                  application_id: 
                    type: string
                additionalProperties: false
                required: [application_id]

Authorization

Authorization is a crucial component of access control, determining who can access what resources and perform specific actions.

Types of Authorization

1. Role-Based Access Control (RBAC): RBAC is a widely-used authorization model where access is granted based on predefined roles. Users are assigned roles, and these roles dictate the permissions associated with accessing resources and performing actions.

2. Attribute-Based Access Control (ABAC): ABAC is a dynamic authorization model that considers various attributes associated with users, resources, actions, and context. Policies are defined based on these attributes, allowing for more granular control over access.

Key Agents in Authorization

Authorization involves four key agents:

a. User Users are entities seeking access to resources or the ability to perform actions within a system.

b. Resource Resources are entities or data within a system that users may want to access or manipulate.

c. Action Actions define the specific operations or activities that users may want to perform on resources.

d. Context Context refers to the circumstances or conditions under which a user's request for access is evaluated. This includes factors such as time, location, or any other relevant contextual information.