API needs to manage data from multiple communities

[Cahllagerfeld]

The Bot, which is planned to be multitenant, needs to store the data based on community in a database.
We should discuss which requirements we're having and how they can be realized

[Cahllagerfeld]

When storing data which are related to a community we need to seperate them, logically with the discord guild-id.

• How to transfer guild => My suggestion would be in a singed JWT
• how to make sure noone is able to access data from a foreign community
• How to handle Frontend-Apps where token would be public => Oauth-Flow / add redirect URI to database and validate host afterwards?

[eddiejaoude]

how to make sure noone is able to access data from a foreign community

I think any data that is specific to a guild, all access to it needs to filter the data down to that guild - using a required discord ID

How to handle Frontend-Apps where token would be public => Oauth-Flow / add redirect URI to database and validate host afterwards?

Would having the JWT contain the guild id solve this?

[Cahllagerfeld]

Would having the JWT contain the guild id solve this?

Yes this would solve the problem. Imo we would still need a mechanism to make sure, that only the app that the token got created for is able to use the token. Especially when having a Frontend App there might be a risk that tokens are getting copied and used in other apps. This could cause that we loose control of who is able to access the API.
I need to think of a solution, but at a first glance we might validate the host of the request-sender. We would have to add the URL of the host on token creation to the database, to vlaidate the request host with the token host.

[eddiejaoude]

Ah I see. Then if they move environments from say dev to prod which is on a different url, they will need another token - which could be a good thing.

Just another idea... could we simplify this, by having the API only for EddieHub community and anything we want to be multi-community we move to another micro project?

I think the main features we need for EddieHub at the moment are (which might be EddieHub specific?)

• update profile via Discord bot
• profile data used by LinkFree
• GitHub Action to collect stats and display on LinkFree with badges
• Discord stats to also display as Badges on LinkFree

[Cahllagerfeld]

If we only have eddiehub using the api, we dont have to worry about any tokens I think. We only need to protect the Write-Endpoints then

[eddiejaoude]

Wed 3rd Nov, Discord call

TODO

• setup mongo to the project (Cahl) [FEATURE] initialize mongoose #229
• pull out events in GitHub DTO (GitHubEvents) Move event to its own DTO #227
• create DTO for DiscordEvents [OTHER] Create DTO for DiscordEvents #228
• Link Discord and GitHub data with Discord Bot
• Discord DTO to have socials as more generic { name: string, platform: string, url: string }
• Update tests
• Mongo to EddieHub Kubernetes cluster (Eddie) [FEATURE] Deploy Mongo #222

IDEAS

• API calls
• Scoreboard: Total Discord events by user, Total GitHub events by user
• Activity for the last 24 hours
• Community stats: how many PR reviews, how many XYZ
• Export mongo (TTL 12 months) data to Elastic (to use Kabana from ELK)
• Realtime data for Event data (map project) - look at automated testing also https://www.npmjs.com/package/superwstest

[Cahllagerfeld]

I feel like we should pull out the Socials from the Discord-DTO (like in the github-module with the Events), to update them indenependant from the bio, or stuff. What do you think about this? Question is if we should link the Socials-Entity with the related Discord-Entity to get the match between the discord profile and the Socials they added.

[Cahllagerfeld]

The more I'm thinking about the socials thing, the less I like the idea of having a complete generic object with { name: string, platform: string, url: string }. How would you delete an social if a user for example did a typo in the name for example.
I think we should limit the allowed socials to have a solid and well-defined object thats stored in the db. The generic thing would be too fragile, woulnt it? What do you think about that @eddiejaoude

[Cahllagerfeld]

Fancy Idea:

• create a own LinkFree-Entity (name is discussable) which contains the socials, milestones and bio sentence
• use the discord-entity just for discord-event-tracking

[eddiejaoude]

The generic thing would be too fragile, woulnt it?

we would need to do a check that it exists in our allowed list of socials

create a own LinkFree-Entity (name is discussable) which contains the socials, milestones and bio sentence
use the discord-entity just for discord-event-tracking

that sounds like a good idea I think 👍

[Cahllagerfeld]

Thanks for your feedback 👍 Which name would you give the entity, I cant say if LinkFree is too Eddiehub-specific although its the Eddiehub-Api though

[gptkrsh]

The generic thing would be too fragile, woulnt it?

we would need to do a check that it exists in our allowed list of socials

create a own LinkFree-Entity (name is discussable) which contains the socials, milestones and bio sentence
use the discord-entity just for discord-event-tracking

that sounds like a good idea I think 👍

sounds good to me too!

[roopeshsn]

This API is for the project good-first-issue-finder, right? or anything I am missing out?