┌────────────────────────────────┐
│ Gateway Layer(skipped │
│ │
│ HTTP/Rest etc... skiped │
│ │
├────────────────────────────────┤
│ Service Layer: Auth Service ├─────┐
│ ┌───────────────────┤ │
│ │Session Management:│ │
│ │ │ │
├────────────┴───────────────────┼─────▼────┐
│ Repo Layer: User/Role Service │ utils: │
│ │ │
│ │ │
│ │ Token... │
├────────────────────────────────┤ │
│ Domain Layer: User/Role │ │
│ │ │
│ │ │
│ │ │
└────────────────────────────────┴──────────┘
Rich Domain Modeling
- User.roles --> a set in user
- token
- could be invalidated, means: token should be maintained in a stateful collections in serverside
- could get user from token, means: userName encoded in token
- gson for serializable
- sl4j for logging
- Junit for test
- aspectJ(assertThat) for better testing
- Util Test(Util Layer)
- generate token
- parse token
- Role Test(Internal Service Layer)
- create role
- delete role
- get role
- User Test(Internal Service Layer)
- create user
- delete user
- get user
- Auth Test(API Layer)
- add role to a user
- auth(login) --> get token
- invalid --> remove token in session store
- get all roles by token
- check token & single role
- ttl config as parameters of getInstance()