Suppose you have a setup where there is an API Server and all interaction revolve around the API. There is the admin, public and third party components that interact with the API server.
Suppose we have an e-commerce model, the components' have the following capabilities: Admin - ability to manage products, orders and customer information Public - ability to manage customer and order information belonging to the user Third Party - ability to retrieve list of products, view orders - create orders in behalf of the user (meaning must have authorization from user) - view customer info (need authorization from user)
My concern is regarding authorization. I'm familiar how to handle the third party through the OAuth workflow. But I'm confused with the Admin and Public components. The said two components doesn't seem to fit the OAuth workflow were there are typically 3 actors: the server, consumer and user.
For example for the public component, it's the front facing application where your users can manage their profiles, order and view products. Are we going to treat this component as special from the API authorization perspective. The same goes with the admin component which offers the ability to manage almost all aspect of your application, even set API keys.
Just like Facebook, Twitter, etc.. They offer an API. But internally do they communicate using some sort of API as well?
Should these core components (UI for admin and public) NOT be decoupled from the API Server in the first place?