[WIP] Project Design - novium/core GitHub Wiki
This is a top-level rundown of Core. It will include an overview of important modules and systems, it also includes an overview of the web frontend for non-oauth related services. This document is subject to change during development.
General Overview
The project is divided into two parts - backend (core) and web-frontend (coreweb). The web-frontend is used for any non-performance critical parts of the service such as management functionality where UX is important whilst the backend implements the API and the OAuth flows. In addition several packages that handle certain aspects of the project such as email authentication are separate from the main repo's.
Backend
Core's backend is implemented in Elixir with the use of Phoenix.
Frontend
Design
OAuth
The OAuth 2.0 implementation follows rfc8252. In addition the server is to implement OpenID Connect as per OpenID Connect Core 1.0 which is an identity layer on top of OAuth 2.0
API Authentication
API authentication consists of several parts due to the different types of API's. The OAuth 2.0 endpoints (prefix /oauth) follow the authentication scheme defined in rfc8252. Other API endpoints (prefix /api) are if specified authenticated using [https://jwt.io/](JSON Web Tokens). The exp field in the token is mandatory and the token should be checked for validity against the database for security-critical endpoints as specified in the API documentation.