Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ADRs: 012-016 - Adding Impact Sections #1627

Open
wants to merge 7 commits into
base: main
Choose a base branch
from

Conversation

tjohnson7021
Copy link
Contributor

@tjohnson7021 tjohnson7021 commented Nov 28, 2024

Description

This PR covers filling in the impact sections for ADRs 012-016 so that it is understood why the decision was made at the time and what the concerns were.

This PR errs on the side of being more verbose than not so that unneeded items can be stripped away during review, so please read carefully.

NOTE: a change to ADR 001 was added to this PR to make linking work better in the IDE.

Issue #1247

Checklist

  • I have updated the documentation accordingly

Copy link

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis ✅

1247 - Fully compliant

Fully compliant requirements:

  • Completed the "Impact" section for ADRs 012-016.
⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪
🧪 No relevant tests
🔒 No security concerns identified
⚡ Recommended focus areas for review

Complexity Concern
The added complexity due to the AuthN/AuthZ layers might need further review to ensure it does not overly complicate the system.

Wrapper Design
The design of the wrapper interface should be reviewed to ensure it does not limit flexibility or create tight coupling with specific implementations.


### Positive

- **Enhanced Security:** AuthN/AuthZ ensures that only authorized users can access specific resources, reducing the risk of unauthorized access.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider reducing the verbosity of the Impact section by summarizing the key points more succinctly. This will help maintain the readability and focus of the document. [important]


### Positive

- **Decoupling of Business Logic and Third-Party Libraries:** allows us to decouple our business logic from the specific implementation details of the third-party library. This enhances maintainability and readability.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might be beneficial to add specific examples or case studies that demonstrate the positive impacts mentioned, such as how the decoupling has concretely improved maintainability in past projects. [medium]


### Risks

- **Human Error in Implementation:** Incorrectly applying the naming convention during key creation or migration could lead to confusion or outages.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To address the risk of human error in implementation, consider recommending specific tools or automated checks that can enforce the naming conventions consistently across the project. [important]

Copy link

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Score
Possible issue
Implement error handling for JWT validation to enhance security and stability

Add error handling for JWT validation failures to prevent unauthorized access and
ensure system stability.

adr/012-auth.md [24]

-3. We validate that the JWT is valid given the public key they sent to us earlier.
+3. We validate that the JWT is valid given the public key they sent to us earlier, implementing error handling to manage validation failures securely.
Suggestion importance[1-10]: 8

Why: Adding error handling for JWT validation failures is crucial for security and system stability, preventing unauthorized access and ensuring the system can gracefully handle errors.

8
General
Use automation to enforce the new key naming convention and manage key migrations

Implement automated tools or scripts to enforce the new naming convention and manage
the migration of existing keys to reduce human error.

adr/014-keys.md [29]

-This naming convention applies to all locations where our keys are stored.
+This naming convention applies to all locations where our keys are stored, enforced through automated tools or scripts to ensure consistency and manage the migration of existing keys.
Suggestion importance[1-10]: 8

Why: Implementing automated tools to enforce naming conventions and manage key migrations reduces the risk of human error and ensures consistency across the system, which is crucial for security and operational efficiency.

8
Design the wrapper interface to be adaptable to changes in the third-party library

Ensure that the wrapper interface is designed to be flexible enough to accommodate
changes in the underlying third-party library without significant rework.

adr/013-wrapped-domain-objects.md [17]

-The implementation of this interface is customized to use the underlying third party library.
+The implementation of this interface is customized to use the underlying third party library, designed with flexibility to adapt to changes in the third-party library with minimal rework.
Suggestion importance[1-10]: 6

Why: The suggestion to design the wrapper interface with flexibility enhances maintainability and adaptability, allowing easier updates or changes to the third-party library with minimal impact on the system.

6
Security
Enhance the security of JWT tokens by ensuring encryption and secure transmission

Ensure that the JWT tokens are properly encrypted and securely transmitted to
prevent interception and misuse.

adr/012-auth.md [7]

-We will use an AuthN/AuthZ concept similar to ReportStream's "two legged" auth. This model uses JSON Web Tokens (JWT) for secure client authentication and authorization across API interactions.
+We will use an AuthN/AuthZ concept similar to ReportStream's "two legged" auth. This model uses encrypted JSON Web Tokens (JWT) for secure client authentication and authorization across API interactions, ensuring tokens are securely transmitted.
Suggestion importance[1-10]: 7

Why: The suggestion to ensure encryption and secure transmission of JWT tokens directly addresses a critical security aspect of authentication mechanisms, enhancing the security posture of the system.

7

Copy link

sonarcloud bot commented Nov 28, 2024

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the FHIR library the only wrapped domain object currently?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
devex/opex A development excellence or operational excellence backlog item.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants