4

Suppose I have an aggregate root Tenant and an aggregate root Organization. Multiples Organizations can be linked to a single Tenant. Tenant only has the Id of the Organizations in it's aggregate.

Suppose I have the following invariant in the Organization aggregate: Organization can only have one subscription for a specific product type.

Suppose I have the following invariant in the Tenant aggregate: only one subscription for a product type must exists across all Organizations related to a Tenant.

How can we enforce those invariants using the one aggregate per transaction rule? When adding a subscription to an Organization, we can easily validate the first invariant, and fire a domain event to update (eventual consistency) the Tenant, but what happens if the invariant is violated in the Tenant aggregate?

Does it imply to fire another domain event to rollback what happens in the Organization aggregate? Seems tricky in the case a response had been sent to a UI after the first aggregate had been modified successfully.

Or is the real approach here is to use a domain service to validate the invariants of both aggregates before initiating the update? If so, do we place the invariants/rules inside the domain service directly or do we place kind of boolean validation methods on aggregates to keep the logic there?

UPDATE What if the UI must prevent the user from saving in the UI if one invariants is violated? In this case we are not even trying to update an aggregate.

4
  • Wouldn't the second invariant imply the first one? Also, why do you need to update Tenant after you've added a new subscription to an Organization? May 2, 2018 at 12:28
  • Yes the second invariant implies the first one. But it is not explicit. When add a discussion about this, it is risky in refactor scenario where implicit rules can be broken. For example, if one day we allow an organization to be linked to multiple tenants, the rule is broken without knowing it. I prefer explicit modeling instead of a single invariant "covering" another one. For your second question, some unmentioned use cases on a Tenant required to know all the subscriptions related to it. May 2, 2018 at 13:16
  • IMO, redundant invariants are a modelling smell. It shows that aggregates don't have a clear, focused responsibility. Thinking about a single place for the invariant will also help you find the one appropriate entrypoint aggregate for that command. May 2, 2018 at 13:35

4 Answers 4

6

One thing you might want to consider is the possibility of a missing concept in your domain. You might want to explore the possibility of your scenario having something as a Subscription Plan concept, which by itself is an aggregate and enforces all of these rules you're currently trying to put inside the Tenant/Organization aggregates.

When facing such scenarios I tend to think to myself "what would an organization do if there was no system at all facilitating this operation". In your case, if there were multiple people from the same tenant, each responsible for an organization... how would they synchronize their subscriptions to comply with the invariants?

In such an exercise, you will probably reach some of the scenarios already explored:

  • Have a gathering event (such as a conference call) to make sure no redundant subscriptions are being made: that's the Domain Service path.

  • Each make their own subscriptions and they notify each other, eventually charging back redundant ones: that's the Event + Rollback path.

  • They might compromise and keep a shared ledger where they can check how subscriptions are going corporation wide and the ledger is the authority in such decisions: that's the missing aggregate path.

You will probably reach other options if you stress the issue enough.

1
  • 3
    It is the first time I saw an approach like "what would an organization do if there was no system at all facilitating this operation". I like it. It is like if the system was not automated yet, and a manual process needed to handle the invariants. Those manual strategies could be translated to the code keeping the same "problem resolution logic". May 3, 2018 at 11:52
5

How can we enforce those invariants using the one aggregate per transaction rule?

There are a few different answers.

One is to abandon the "rule" - limiting yourself to one aggregate per transaction isn't important. What really matters is that all of the objects in the unit of work are stored together, so that the transaction is an all or nothing event.

BEGIN TRANSACTION
    UPDATE ORGANIZATION
    UPDATE TENANT
COMMIT

A challenge in this design is that the aggregates no longer describe atomic units of storage - the fact that this organization and this tenant need to be stored in the same shard is implicit, rather than explicit.

Another is to redesign your aggregates - boundaries are hard, and its often the case that our first choice of boundaries are wrong. Udi Dahan, in his talk Finding Service Boundaries, observed that (as an example) the domain behaviors associated with a book title usually have little or nothing to do with the book price; they are two separate things that have a relation to a common thing, but they have no rules in common. So they could be treated as part of separate aggregates.

So you can redesign your Organization/Tenant boundaries to more correctly capture the relations between them. Thus, all of the relations that we need to correctly evaluate this rule are in a single aggregate, and therefore necessarily stored together.

The third possibility is to accept that these two aggregates are independent of each other, and the "invariant" is more like a guideline than an actual rule. The two aggregates act like participants in a protocol, and we design into the protocol not only the happy path, but also the failure modes.

The simple forms of these protocols, where we have reversible actions to unwind from a problem, are called sagas. Caitie McCaffrey gave a well received talk on this in 2015, or you could read Clemens Vasters or Bernd Rücker; Garcia-Molina and Salem introduced the term in their study of long lived transactions.

Process Managers are another common term for this idea of a coordinated protocol, where you might have a more complicated graph of states than commit/rollback.

2
  • Interesting. So I see that the domain service approach is not an option you mentioned / recommend. The second option (redefining the boundaries) seems a logic one. But doing this implies that I cluster "everything" in my new aggregate. But there is still other scenarios where the Organization as an aggregate root make sens (i.e.: changing it's address), and in that case, using the "new" aggregate that validates all the invariants we discussed makes no sens. May 2, 2018 at 14:11
  • I never had a use case where I needed to modelize a concept being an independant aggregate root and also being an entity with rules inside another aggregate root. Is it a good/bad practice? May 2, 2018 at 14:11
1

The first idea that came to my mind is to have a property of the organization called "tenantHasSubscription" that property can be updated with domain events. Once you have this property you can enforce the invariant in the organization aggregate.

4
  • How would it works? Add the subscription to the organization first, then raising an event to update the tenant, then raising an event to reupdate the organization to set the flag? May 2, 2018 at 12:57
  • before adding the subscription to the organization, check the invariant by checking if tenantHasSubscription is false. Then emit an event "subscriptionAdded". handle that event by updating all the organizations of the same tenant by setting tenantHasSubscription to true. And do the reverse logic when removing a subscription. May 2, 2018 at 13:03
  • All right. This works fine. The only thing that I "don't like" with that approach but it is not that bad, is the data leaking from the Tenant to the Organization. If you imagine that an Organization can have multiple subscriptions (for different products), then instead of a flag it would be a kind of a list of "illegal/already used subscription because already linked to a Tenant". All organization would have it's own copy of the list, but conceptually, this data is the property of the Tenant. It's like if we admit that the organization aggregate root is not self sufficient. May 2, 2018 at 13:09
  • But your solution removes the rollback problem nicely. May 2, 2018 at 13:11
1

If you want to be 100% sure that the invariant is never violated, all the commands SubscribeToProduct(TenantId, OrganizationId) have to be managed by the same aggregate (maybe the Tenant), that has internally all the values to check the invariant.
Otherwise to do your operation you will always have to query for an "external" value (from the aggregate point of view), this will introduce "latency" in the operation that open a window for inconsistency.

If you query a db to have values, can it happen that when the result is on the wire, somebody else is updating it, because the db doesn't wait you consumed your read to allow others to modify it, so your aggregate will use stale data to check invariants.

Obviously this is an extremism, this doesn't mean that it is for sure dangerous, but you have to calculate the probability of a failure to happen, how can you be warned when it happen, and how to solve it (automatically by the program, or maybe a manual intervention, depending on the situation).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.