Company & User Management

[duonganhthu43]

Multi-tenant with Cognito - Precondition

• Each tenant is a user pool in Cognito
• Each tenant has a unique Slug to access on the dozer-admin URL
• All data config in dozer-admin is tight with tenant_id

Create Tenant

Since we don't have a BackOffice module, in the first version: we could use

• script to create a Cognito pool + update DB with a new pool created
• script to create a user in pool

User Login

(1) User access dozer-admin with Slug prefix on URL

• FE: Fetch public metadata endpoint by Slug for: tenant_id, cognito_pool_id, cognito_app_client_id, region
• BE: Query DB to return metadata

(2) User performs login with email + password

• FE: Use Amplify + Metadata from step (1) to authentication with Cognito => Result will be the access_token

(3) Perform any action on Dozer-Admin with access_token from step (2)

• FE: include access_token in the Authorization header
• BE:
  • request hit API gateway with Lambda Authorizer attached
  • Lambda Authorizer performs some validation with access_token then return context tenant_id
  • API Gateway forward request to dozer admin with tenant_id
  • Dozer Admin performs actions with context Tenant_Id

Check List

• Scripts for backoffice action - create pool, create use
• DB setup for metadata + other data with tenant id
• Setup Gateway for dozer-admin
• Metadata public endpoint in dozer-admin
• Lambda Authorization
• FE authentication using Slug + Amplify
• Domain resolve with *.dozer-admin.io

[duonganhthu43]

@v3g42 @vumdao I add some draft idea about Company & User Management, we could discuss more on this topic