MODSIDECAR-13: Options for handling modules which call OKAPI

Owned by Pavel Filippov
Last updated: Mar 14, 2024
4 min read

Overview

User story: MODSIDECAR-13: PLACEHOLDER - Spike - Options for handling modules which call OKAPIClosed

Some modules (FE and BE) make API calls directly to OKAPI.  On the new platform, these things are going to break.  We need to look at the options and decide how we want to resolve this issue.

Okapi permissions usage

Permission

Interface

Required by modules

Notes

Permission

Interface

Required by modules

Notes

okapi.env.list

GET /_/env

  • ui-developer

mgr-applications or mgr-tenant-entitlements does not store env variables for deploy, so it can be performed by grabbing env section from module descriptors

okapi.proxy.modules.list

GET /_/proxy/modules

  • ui-developer

can be provided by mgr-applications

okapi.proxy.tenants.modules.list

GET /_/proxy/tenants/{tenantId}/modules

  • ui-developer

  • mod-bulk-operations

  • mod-data-export-worker

a list of installed modules can be provided by mgr-tenant-entitlements, module descriptors can be retrieved from mgr-applications

mod-bulk-operations uses this API to retrieve mod-users moduleId and then perform request for custom-fields (x-okapi-module-id is required). Request is performed with filter=mod-users

mod-data-export-worker the same as mod-bulk-operations

okapi.proxy.tenants.modules.post

POST /_/proxy/tenants/{tenantId}/modules

  • ui-developer

This API cannot be provided, cause mgr-components cannot perform installation of a single module

okapi.proxy.tenants.modules.enabled.delete

DELETE /_/proxy/tenants/{tenantId}/modules/{moduleId}

  • ui-developer

This API cannot be provided, cause mgr-components cannot perform uninstallation of a single module

okapi.discovery.get

GET /_/discovery/modules/{serviceId}/{instanceId}

  • ui-developer

Can be provided by mgr-applications

okapi.version.get

GET /_/version

  • ui-developer

There is no okapi in the system, this interface cannot be supported

Note: UI-Developer is not included in the production deployment, according to the README.md file

mod-permissions requires perms.users.assign.okapi permission to assign okapi permissions to the user. This permission is hardcoded in the codebase and required in permissionsDesired section, without this permission - okapi permissions cannot be assigned.

Okapi interface provision using mgr-components

mgr-tenant-entitlement

If the module requires okapi interface API

  • allowed okapi endpoints are stored in mgr-tenant-entitlements in Json (key is the permission id, values - is the Authorization resource(permission + endpoint)

  • mgr-tenant-entitlements generates and adds Keycloak resources (for instance, GET /_/proxy/tenants/{tenantId}/modules)

  • mgr-tenant-entitlements generates corresponding capabilities (for instance, view + Tenant Modules with assigned endpoint GET /_/proxy/tenants/{tenantId}/modules)

mgr-applications

mgr-applications will collect (using HTTP calls) okapi interfaces from the mgr-components and will include them in the module bootstrap information. This service will provide endpoints with new field pathOverwrite, so sidecar can overwrite the path to call mgr-components: