inventory-manager | Angular 2 Flask MongoDB Example | Frontend Framework library

The signature of the executeSql is :

I cannot find any ORM for Go that supports multiple tenants out there. Is writing my own on top of perhaps the sqlx package a valid option?

ORMs in Go are a controversial topic! Some Go users love them, others hate them and prefer to write SQL manually. This is a matter of personal preference. Asking for specific library recommendations is off-topic here, and in any event, I don't know of any multi-tenant ORM libraries – but there's nothing to prevent you using a wrapper of sqlx (I work daily on a system which does exactly this).

Other services in the future will require multi-tenant support too, so I guess I would have to create some library/package anyway.

It would make sense to abstract this behavior from those internal services in a way which suits your programming and interface schemas, but there's no further details here to answer more concretely.

Today, I resolve the tenants by using a ResolveTenantBySubdomain middleware for the public API server. I then place the resolved tenant id in a context value that is sent with the call to the manager. Inside the different methods in the manager, I get the tenant id from the context value. This is then used with every SQL query/exec calls or returns a error if missing or invalid tenant id. Should I even use context for this purpose?

context.Context is mostly about cancellation, not request propagation. While your use is acceptable according to the documentation for the WithValue function, it's widely considered a bad code smell to use the context package as currently implemented to pass values. Rather than use implicit behavior, which lacks type safety and many other properties, why not be explicit in the function signature of your downstream data layers by passing the tenant ID to the relevant function calls?

Resolving the tenant on the gRPC server, I believe I have to use the UnaryInterceptor function for middleware handling. Since the gRPC API interface will only be accessed by other backend services, i guess resolving by subdomain is unneccessary here. But how should I embed the tenant id? In the header? [sic]

The gRPC library is not opinionated about your design choice. You can use a header value (to pass the tenant ID as an "ambient" parameter to the request) or explicitly add a tenant ID parameter to each remote method invocation which requires it.

Note that passing a tenant ID between your services in this way creates external trust between them – if service A makes a request of service B and annotates it with a tenant ID, you assume service A has performed the necessary access control checks to verify a user of that tenant is indeed making the request. There is nothing in this simple model to prevent a rogue service C asking service B for information about some arbitrary tenant ID. An alternative implementation would implement a more complex trust-nobody policy whereby each service is provided with sufficient access control information to make its own policy decision as to whether a particular request scoped to a particular tenant should be fulfilled.

The description field has a number formatter. Type numbers or remove the number formatter.

Q: Why was my node process not able to boot up?

A: This is the reason why your application was dying.

Error: listen EADDRINUSE :::7088

It means that another process is already on port 7088 and your node process was not able to bind to it.

Since this is a pretty broad question with a lot of exceptions, I'll be pretty general. But this should be represented as a One-to-Many/Many-to-One relation within your database. In other words, a User can own multiple Items, but an Item can only be owned by one User. You'll want to have a Foreign Key constraint within your Items table that represents a user_id, or the ID of the owner. From their you'll want to query the database for only items that match the requesting User's ID.

In terms of keeping users from requesting other items, you might have to implement some kind of middleware that runs on your backend to check when a user is requesting a specific item that returns an error if they do not own it (Like what you suggested).

To be honest though, if its security you are concerned about you should consider restructuring your API calls. Since you are determining identity based on the user_id parameter within the url you are opening yourself up to users changing their advertised ID at will. Using web tokens to establish identity will go a long way in terms of beefing up the security of your application.

'that' is just the name of a variable used to store the original value of 'this' at the start of your code, as the value of 'this' changes. The variable name could just as easily be 'dog' or 'apple'.

You might choose to use 'this' later on in your code instead if you intend to access the current value of 'this' at that point in time. Otherwise you will probably reference your original variable that stored it's value, e.g. 'that', 'dog' or 'apple'.