Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Milestone Updates API Security & Legacy Architecture #19

Merged
merged 4 commits into from
Jun 20, 2023
Merged

Milestone Updates API Security & Legacy Architecture #19

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0bb3b80
feat: Adds new milestone descriptions
widal001 Jun 15, 2023
e6ab042
feat: Adds new milestones and dependencies to diagram
widal001 Jun 15, 2023
f48de78
Merge branch 'main' into milestone-updates-api-security-legacy-archit…
widal001 Jun 15, 2023
38c50cd
fix: Missing period in milestone short descriptions
widal001 Jun 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion documentation/milestones/milestone_dependency_diagram.mmd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,12 +126,13 @@ flowchart LR
Onboard-Dev-Team --> SaaS-Plan
SaaS-Plan
SaaS-Plan --> DB-API-Plan
Legacy-Architecture
Onboard-Dev-Team:::executing
Onboard-Dev-Team --> Dev-Tools
Onboard-Dev-Team --> DB-API-Plan
Onboard-Dev-Team --> Feature-Flags
DB-API-Plan --> API-Docs-Plan
Onboard-Dev-Team --> DB-Replica
Onboard-Dev-Team & DB-API-Plan --> Dev-Tools
Beta-Domain
Beta-Domain --> Static-Site
DB-API-Plan --> Infrastructure-as-Code
Expand All @@ -154,6 +155,7 @@ flowchart LR
DB-API-Plan --> Dependency-Fundraising-Tracking
GET-Opportunities --> Search-API
GET-Opportunities --> NOFOs-Text
DB-API-Plan & GET-Opportunities --> API-Security
end

subgraph Hackathon
Expand Down
24 changes: 23 additions & 1 deletion documentation/milestones/milestone_short_descriptions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ Have the software development team for this effort start their work and get syst
## Developer tools
Diagram short name: `Dev-Tools`

Dependencies: `None`
Dependencies: `Onboard-Dev-Team`, `DB-API-Plan`
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good change!


Install developer tools for backend, including:

Expand Down Expand Up @@ -80,6 +80,15 @@ This will dramatically speed up development because it will allow any developer

By having consistent test data, we can create integration tests that look for expected and unexpected behaviors.

## Legacy architecture documentation
Diagram short name: `Legacy-Architecture`

Dependencies: `None`

Create or update existing documentation about the legacy system architecture in order to help inform the DB API Plan for new development.

While the new Search API will be greenfield development, it's helpful to document how the legacy system currently interacts with other Federally managed systems in order to understand the integrations that the new grants.gov site will be expected to support in the future. These external dependencies may inform some architectural decisions we make early in the project.

## Review of software-as-a-service (SaaS) alternatives
Diagram short name: `SaaS-Plan`

Expand Down Expand Up @@ -290,6 +299,19 @@ Make a plan for the technological and legal/process aspects of A/B testing exper

This plan will need to account for any concerns about fairness that could be brought up by exposing some users to updated content as compared to other users.

## API security planning

Diagram short name: `API-Security`

Dependencies: `DB-API-Plan`, `GET-Opportunities`

Develop a plan for securing the public API. While the broader AuthN and AuthZ framework will be designed and implemented in a different set of milestones, this plan should account for applying basic security measures to the initial set of endpoints we will be deploying, namely `GET /opportunities`
widal001 marked this conversation as resolved.
Show resolved Hide resolved

At a minimum the plan should address the following security needs and determine if/when they should be implemented before the broader Auth milestones are addressed:
- Authenticating requests with API keys
- Rate limiting API requests
- Managing access with scopes/claims

# Communications Tooling

## Communication platforms
Expand Down