client_id + client_secret are inaccessible to modify if associated consumer object is deleted

[ahmadnassri]

scenario:

• create API profile
• create consumer object
• associate oauth2 plugin with API
• create consumer "authentication credentials / application" with client_id + client_secret
• 👍
• delete consumer object
• create new consumer object
• attempt to create authentication credentials using the same client_id + client_secret as before
• will be rejected, with error:

{
  "client_id": "client_id already exists with value 'xxx'",
  "client_secret": "client_secret already exists with value 'yyy'"
}

in addition, there is no possible way to modify the plugin configrations, or attempt to reset the client_id and client_secret, so the result is that those values are stored forever in the database with no chance of ever re-using them.

[ahmadnassri]

cc: @lucamaraschi

[subnetmarco]

@thibaultcha this is the consistency problem that we have been discussing a couple of times. Somehow related to #107.

[thibaultcha]

Context: Cassandra has no concept of foreign keys and cascade operations.

To solve this the Cassandra DAO Factory could trigger an event such as on_delete_consumer on all loaded DAOs, and those DAOs can chose to implement the event method if they have something to delete when a consumer is being deleted.

function my_dao:on_delete_consumer(consumer_id)

end

function my_dao:on_delete_api(api_id)

end

More work for developers but tied to the Cassandra DAO so no need to apply it to the future Postgres DAO which can use proper cascade deletes.