Build workforce-api REST + MCP layers (Layer 3), full build in one pass
16 routes: Office (single key, full CRUD + employees sub-resource) and Employee (single key, full CRUD + reports + customers sub-resources). MCP layer built with the single-route pattern from the start. Only domain where customer role has zero access — verified against ReferenceDataPermission.check(): read_only/product_manager/support get reads, writes are admin-only, customer isn't in the allow-list at all. All 9 MCP tool ACLs reflect this exactly. Keycloak (local): workforce-api-audience + mcp-workforce-audience client scopes, resource clients, broker/librechat attachments. Deploy key and broker secret reused/mirrored, same pattern as every domain since payments-api.
This commit is contained in:
Stéphane Tailland
@@ -0,0 +1,269 @@
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-listoffices-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-listoffices
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-listoffices
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-createoffice-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-createoffice
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-createoffice
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-getoffice-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-getoffice
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-getoffice
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-updateoffice-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-updateoffice
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-updateoffice
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-patchoffice-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-patchoffice
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-patchoffice
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-deleteoffice-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-deleteoffice
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-deleteoffice
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-getofficeemployees-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-getofficeemployees
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-getofficeemployees
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-listemployees-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-listemployees
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-listemployees
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-createemployee-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-createemployee
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-createemployee
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-getemployee-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-getemployee
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-getemployee
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-updateemployee-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-updateemployee
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-updateemployee
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-patchemployee-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-patchemployee
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-patchemployee
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-deleteemployee-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-deleteemployee
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-deleteemployee
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-getemployeereports-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-getemployeereports
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-getemployeereports
|
||||
---
|
||||
apiVersion: configuration.konghq.com/v1alpha1
|
||||
kind: KongPluginBinding
|
||||
metadata:
|
||||
name: ${NAME}-workforce-api-rewrite-getemployeecustomers-binding
|
||||
namespace: ${NAMESPACE}
|
||||
spec:
|
||||
controlPlaneRef:
|
||||
type: konnectNamespacedRef
|
||||
konnectNamespacedRef:
|
||||
name: ${CONTROL_PLANE_REF_NAME}
|
||||
pluginRef:
|
||||
name: ${NAME}-workforce-api-rewrite-getemployeecustomers
|
||||
targets:
|
||||
routeRef:
|
||||
group: configuration.konghq.com
|
||||
kind: KongRoute
|
||||
name: ${NAME}-workforce-api-getemployeecustomers
|
||||
Reference in New Issue
Block a user