ZK_AUTH - Authorization service for ZK Projects

Current API version is v1

Testing

It's highly recommended to use vagga for testing

vagga test

Run application

Use vagga to run project

vagga run

Run worker

Use vagga to run worker

vagga worker

API

Zk_auth is a complex application that includes json-rpc server and worker. For testing api methods use jsonrpcclient

client = HTTPClient('http://zk_auth-trunk.dev-cluster.uaprom/api/v1')

login(email, passwd)

Use this method to get auth_token

>>> client = HTTPClient('http://zk_auth-trunk.dev-cluster.uaprom/api/v1')
>>> client.send('{"jsonrpc": "2.0", "method": "login", "params": {"email": "my@smartweb.com.ua", "passwd": "passwd"}, "id": 1}')
>>> '9777ddb9bfa7b4de2e231c9e54bdad825b5238e2'

logout(auth_token)

Remove auth_token from redis storage. Return bool (True if success).

>>> client = HTTPClient('http://zk_auth-trunk.dev-cluster.uaprom/api/v1')
>>> client.send('{"jsonrpc": "2.0", "method": "logout", "params": {"auth_token": "9777ddb9bfa7b4de2e231c9e54bdad825b5238e2"}, "id": 1}')
>>> True

If auth in sudo mode then auth data rewrites with sudo data.

check(auth_token)

Check if user signed in. Return employee and current merchant data or False otherwise

>>> client = HTTPClient('http://zk_auth-trunk.dev-cluster.uaprom/api/v1')
>>> client.send('{"jsonrpc": "2.0", "method": "check", "params": {"auth_token": "9777ddb9bfa7b4de2e231c9e54bdad825b5238e2"}, "id": 1}')
>>> False
>>> client.send('{"jsonrpc": "2.0", "method": "login", "params": {"email": "my@smartweb.com.ua", "passwd": "passwd"}, "id": 1}')
>>> 'cf22f1507f6a18a06b91867137d6ae9c7f76beca'
>>> client.send('{"jsonrpc": "2.0", "method": "check", "params": {"auth_token": "cf22f1507f6a18a06b91867137d6ae9c7f76beca"}, "id": 1}')

If check is success this method return auth employee data. Data structure is like this:

{
    'employee': {
        'data': {'id': 35, 'full_name': 'Vitalii', 'email': 'v.mazur@smartweb.com.ua.test'}, 
        '_hash': '38ede7063e1da47f3f50c876b71eb75d'
    },
    'merchant': {
        'data': {'id': 35, 'name': 'Mazvv Company'},
        '_hash': '2f213bb0b570fccebe07698d8c475e25'
    }
}

We use _hash for invalidation data in redis storage If auth is in sudo mode data structure is like this:

{
    'sudo': {
        'employee': {
            'data': {'id': 36, 'full_name': 'Vitalii 1', 'email': 'v.mazur+1@smartweb.com.ua.test'},
            '_hash': '38ede7063e1da47f3uyuy345uyiiu234'
        },
        'merchant': {
            'data': {'id': 36, 'name': 'Mazvv Company 1'},
            '_hash': '234gjhg12341qwer7262345ewrt78ert'
        }
    }
    'employee': {
        'data': {'id': 35, 'full_name': 'Vitalii', 'email': 'v.mazur@smartweb.com.ua.test'}, 
        '_hash': '38ede7063e1da47f3f50c876b71eb75d'
    },
    'merchant': {
        'data': {'id': 35, 'name': 'Mazvv Company'},
        '_hash': '2f213bb0b570fccebe07698d8c475e25'
    }
}

In sudo key we store auth data of superuser that makes sudo.

switch(auth_token, merchant_id)

Switch employee to another merchant. Return True if switching success.

>>> client.send('{"jsonrpc": "2.0", "method": "switch", "params": {"auth_token": "cf22f1507f6a18a06b91867137d6ae9c7f76beca", "merchant_id": 35}, "id": 1}')
>>> True

sudo(auth_token, employee_id)

Sudo to employee with id employee_id. Return True if switching success.

>>> client.send('{"jsonrpc": "2.0", "method": "sudo", "params": {"auth_token": "cf22f1507f6a18a06b91867137d6ae9c7f76beca", "employee_id": 40}, "id": 1}')
>>> True

This creates sudo key in auth data with previus auth data.

Invalidation cache

To cache invalidation zk_auth uses pub-sub with amqp. Publish messages into queue profile with format employees|merchants:id if employee or merchant profile was changed.

Benchmarks

ab -p post.txt -T application/json -c 10 -n 2000 http://zk_auth-trunk.dev-cluster.uaprom/api/v1

post.txt content is something like this

{"jsonrpc": "2.0", "method": "login", "params": {"email": "1", "passwd": "2"}, "id": 1}