diff --git a/apps/portal-admin/src/app/app.routes.ts b/apps/portal-admin/src/app/app.routes.ts index 646c8ce..ebe549b 100644 --- a/apps/portal-admin/src/app/app.routes.ts +++ b/apps/portal-admin/src/app/app.routes.ts @@ -4,6 +4,7 @@ import { authGuard } from 'feature-auth'; const homeTitle = $localize`:@@route.home.title:APF Portal Admin`; const auditTitle = $localize`:@@route.audit.title:Audit log — APF Portal Admin`; const usersTitle = $localize`:@@route.users.title:Users — APF Portal Admin`; +const userScopesTitle = $localize`:@@route.user-scopes.title:User scopes — APF Portal Admin`; const profileTitle = $localize`:@@route.profile.title:Profile — APF Portal Admin`; export const appRoutes: Route[] = [ @@ -23,6 +24,11 @@ export const appRoutes: Route[] = [ loadComponent: () => import('./pages/users/users').then((m) => m.UsersPage), title: usersTitle, }, + { + path: 'users/:oid/scopes', + loadComponent: () => import('./pages/user-scopes/user-scopes').then((m) => m.UserScopesPage), + title: userScopesTitle, + }, { path: 'profile', canActivate: [authGuard], diff --git a/apps/portal-admin/src/app/pages/user-scopes/user-scopes.html b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.html new file mode 100644 index 0000000..39c7c7c --- /dev/null +++ b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.html @@ -0,0 +1,126 @@ +
+
+

+ ← Back to users +

+

User scopes

+ @if (page(); as p) { +

+ Managing scopes for {{ p.user.displayName }} ({{ p.user.email ?? '—' }}, + {{ p.user.oid }}). Every grant emits admin.scope_granted and every + revoke emits admin.scope_revoked — scope-management is itself auditable per + ADR-0013. +

+ } +
+ +
+ @if (loading()) { + Loading… + } @else if (error(); as msg) { + {{ msg }} + } +
+ + @if (page(); as p) { +
+

Current scopes

+ @if (p.scopes.length === 0) { +

No scopes granted to this user yet.

+ } @else { +
+ + + + + + + + + + + + @for (scope of p.scopes; track scope.id) { + + + + + + + + } + +
ScopeSourceGrantedExpiresActions
+ {{ formatScope(scope.kind, scope.value) }} + {{ scope.source }}{{ formatTimestamp(scope.createdAt) }}{{ formatTimestamp(scope.expiresAt) }} + +
+
+ } +
+ +
+

Grant a new scope

+
+
+ + + +
+ @if (submitError(); as msg) { + + } +
+ +
+
+
+ } +
diff --git a/apps/portal-admin/src/app/pages/user-scopes/user-scopes.scss b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.scss new file mode 100644 index 0000000..bf8e16a --- /dev/null +++ b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.scss @@ -0,0 +1,152 @@ +.user-scopes { + padding: 1.5rem; + display: flex; + flex-direction: column; + gap: 1.5rem; +} + +.user-scopes-header { + .crumbs { + margin: 0 0 0.5rem; + font-size: 0.875rem; + } + .title { + margin: 0 0 0.5rem; + } + .intro { + margin: 0; + color: var(--color-text-secondary, #555); + } +} + +.status-bar { + min-height: 1.5rem; +} + +.status-line--error { + color: var(--color-danger, #b00020); +} + +.section-heading { + margin: 0 0 0.75rem; + font-size: 1.125rem; +} + +.empty { + font-style: italic; + color: var(--color-text-secondary, #555); +} + +.table-wrap { + overflow-x: auto; +} + +.scopes-table { + width: 100%; + border-collapse: collapse; + + th, + td { + padding: 0.5rem 0.75rem; + text-align: left; + border-bottom: 1px solid var(--color-border, #ddd); + } + + .cell-scope code { + font-family: var(--font-mono, monospace); + } + + .cell-actions { + text-align: right; + } +} + +.grant-section { + background: var(--color-bg-surface, #fafafa); + padding: 1rem; + border: 1px solid var(--color-border, #ddd); + border-radius: 0.5rem; +} + +.grant-grid { + display: grid; + gap: 1rem; + grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); + margin-bottom: 1rem; +} + +.field { + display: flex; + flex-direction: column; + gap: 0.25rem; + + &.field--hidden { + visibility: hidden; + } + + .field-label { + font-weight: 600; + font-size: 0.875rem; + } + + .field-hint { + font-size: 0.75rem; + color: var(--color-text-secondary, #555); + } + + input, + select { + padding: 0.5rem; + border: 1px solid var(--color-border, #ccc); + border-radius: 0.25rem; + min-height: 44px; /* WCAG 2.2 AA touch target (2.5.5 / 2.5.8). */ + } +} + +.submit-error { + color: var(--color-danger, #b00020); + margin: 0 0 0.75rem; +} + +.grant-actions { + display: flex; + justify-content: flex-end; +} + +.btn { + min-height: 44px; + min-width: 44px; + padding: 0.5rem 1rem; + border-radius: 0.25rem; + border: 1px solid transparent; + cursor: pointer; + font-weight: 600; + + &:disabled { + opacity: 0.5; + cursor: not-allowed; + } +} + +.btn--primary { + background: var(--color-brand-accent-500, #de9415); + color: white; +} + +.btn--danger { + background: transparent; + color: var(--color-danger, #b00020); + border-color: currentColor; +} + +.sr-only { + position: absolute; + width: 1px; + height: 1px; + padding: 0; + margin: -1px; + overflow: hidden; + clip: rect(0, 0, 0, 0); + white-space: nowrap; + border: 0; +} diff --git a/apps/portal-admin/src/app/pages/user-scopes/user-scopes.service.spec.ts b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.service.spec.ts new file mode 100644 index 0000000..e4b3cf2 --- /dev/null +++ b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.service.spec.ts @@ -0,0 +1,92 @@ +import { provideHttpClient } from '@angular/common/http'; +import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing'; +import { TestBed } from '@angular/core/testing'; +import { firstValueFrom } from 'rxjs'; +import { AUTH_BFF_BASE_URL } from 'feature-auth'; +import { UserScopesService, type UserScope, type UserScopesPayload } from './user-scopes.service'; + +const BFF_BASE = 'http://bff.test/api'; + +const SCOPE: UserScope = { + id: 'scope-1', + kind: 'etablissement', + value: '0330800013', + source: 'seed', + createdAt: '2026-05-26T10:00:00.000Z', + expiresAt: null, +}; + +const PAGE: UserScopesPayload = { + user: { + oid: 'target-oid', + userId: 'user-uuid-1', + displayName: 'Jane Doe', + email: 'jane@apf.example', + }, + scopes: [SCOPE], +}; + +function setup() { + TestBed.configureTestingModule({ + providers: [ + provideHttpClient(), + provideHttpClientTesting(), + { provide: AUTH_BFF_BASE_URL, useValue: BFF_BASE }, + ], + }); + return { + service: TestBed.inject(UserScopesService), + http: TestBed.inject(HttpTestingController), + }; +} + +describe('UserScopesService.list', () => { + it('GETs /admin/users/:oid/scopes and returns the page', async () => { + const { service, http } = setup(); + const promise = firstValueFrom(service.list('target-oid')); + const req = http.expectOne(`${BFF_BASE}/admin/users/target-oid/scopes`); + expect(req.request.method).toBe('GET'); + req.flush(PAGE); + await expect(promise).resolves.toEqual(PAGE); + }); + + it('URL-encodes the oid', async () => { + const { service, http } = setup(); + void firstValueFrom(service.list('weird/oid')); + const req = http.expectOne(`${BFF_BASE}/admin/users/weird%2Foid/scopes`); + req.flush(PAGE); + }); +}); + +describe('UserScopesService.grant', () => { + it('POSTs the input body and returns the created scope', async () => { + const { service, http } = setup(); + const promise = firstValueFrom( + service.grant('target-oid', { + kind: 'etablissement', + value: '0330800013', + expiresAt: '2026-12-31T23:59:59.000Z', + }), + ); + const req = http.expectOne(`${BFF_BASE}/admin/users/target-oid/scopes`); + expect(req.request.method).toBe('POST'); + expect(req.request.body).toEqual({ + kind: 'etablissement', + value: '0330800013', + expiresAt: '2026-12-31T23:59:59.000Z', + }); + req.flush(SCOPE); + await expect(promise).resolves.toEqual(SCOPE); + }); +}); + +describe('UserScopesService.revoke', () => { + it('DELETEs the scope by id', async () => { + const { service, http } = setup(); + const promise = firstValueFrom(service.revoke('target-oid', 'scope-1')); + const req = http.expectOne(`${BFF_BASE}/admin/users/target-oid/scopes/scope-1`); + expect(req.request.method).toBe('DELETE'); + req.flush(null); + await expect(promise).resolves.toBeNull(); + }); +}); diff --git a/apps/portal-admin/src/app/pages/user-scopes/user-scopes.service.ts b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.service.ts new file mode 100644 index 0000000..36c6df4 --- /dev/null +++ b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.service.ts @@ -0,0 +1,65 @@ +import { HttpClient } from '@angular/common/http'; +import { Injectable, inject } from '@angular/core'; +import { AUTH_BFF_BASE_URL } from 'feature-auth'; +import type { Observable } from 'rxjs'; + +/** + * One scope row as the SPA sees it — mirror of `UserScopeDto` on + * the BFF side. ISO-string timestamps; the SPA never round-trips + * `Date` instances per the audit-page convention. + */ +export interface UserScope { + readonly id: string; + readonly kind: string; + readonly value: string; + readonly source: string; + readonly createdAt: string; + readonly expiresAt: string | null; +} + +export interface UserScopesPayload { + readonly user: { + readonly oid: string; + readonly userId: string; + readonly displayName: string; + readonly email: string | null; + }; + readonly scopes: ReadonlyArray; +} + +export interface GrantUserScopeInput { + readonly kind: string; + readonly value?: string; + readonly expiresAt?: string; +} + +/** + * `UserScopesService` — Thin HttpClient wrapper around + * `/api/admin/users/:oid/scopes`. Same shape convention as + * `AdminUsersService` — `providedIn: 'root'` because the single + * consumer is the `UserScopesPayload`. + */ +@Injectable({ providedIn: 'root' }) +export class UserScopesService { + private readonly http = inject(HttpClient); + private readonly bffBaseUrl = inject(AUTH_BFF_BASE_URL); + + list(oid: string): Observable { + return this.http.get( + `${this.bffBaseUrl}/admin/users/${encodeURIComponent(oid)}/scopes`, + ); + } + + grant(oid: string, input: GrantUserScopeInput): Observable { + return this.http.post( + `${this.bffBaseUrl}/admin/users/${encodeURIComponent(oid)}/scopes`, + input, + ); + } + + revoke(oid: string, scopeId: string): Observable { + return this.http.delete( + `${this.bffBaseUrl}/admin/users/${encodeURIComponent(oid)}/scopes/${encodeURIComponent(scopeId)}`, + ); + } +} diff --git a/apps/portal-admin/src/app/pages/user-scopes/user-scopes.spec.ts b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.spec.ts new file mode 100644 index 0000000..725224e --- /dev/null +++ b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.spec.ts @@ -0,0 +1,134 @@ +import { provideHttpClient } from '@angular/common/http'; +import { provideHttpClientTesting } from '@angular/common/http/testing'; +import { TestBed } from '@angular/core/testing'; +import { ActivatedRoute, provideRouter } from '@angular/router'; +import { of, throwError } from 'rxjs'; +import { AUTH_BFF_BASE_URL } from 'feature-auth'; +import { + UserScopesService, + type GrantUserScopeInput, + type UserScope, + type UserScopesPayload, +} from './user-scopes.service'; +import { UserScopesPage } from './user-scopes'; + +const SCOPE: UserScope = { + id: 'scope-1', + kind: 'etablissement', + value: '0330800013', + source: 'seed', + createdAt: '2026-05-26T10:00:00.000Z', + expiresAt: null, +}; + +const PAGE: UserScopesPayload = { + user: { + oid: 'target-oid', + userId: 'user-uuid-1', + displayName: 'Jane Doe', + email: 'jane@apf.example', + }, + scopes: [SCOPE], +}; + +function setup(opts?: { + list?: ReturnType; + grant?: ReturnType; + revoke?: ReturnType; +}) { + const list = opts?.list ?? vi.fn().mockReturnValue(of(PAGE)); + const grant = opts?.grant ?? vi.fn().mockReturnValue(of(SCOPE)); + const revoke = opts?.revoke ?? vi.fn().mockReturnValue(of(undefined)); + TestBed.configureTestingModule({ + imports: [UserScopesPage], + providers: [ + provideHttpClient(), + provideHttpClientTesting(), + provideRouter([]), + { provide: AUTH_BFF_BASE_URL, useValue: 'http://bff.test/api' }, + { + provide: UserScopesService, + useValue: { list, grant, revoke }, + }, + { + provide: ActivatedRoute, + useValue: { snapshot: { paramMap: new Map([['oid', 'target-oid']]) } }, + }, + ], + }); + const fixture = TestBed.createComponent(UserScopesPage); + return { fixture, list, grant, revoke }; +} + +describe('UserScopesPage', () => { + it('loads the scopes for the route param oid on init', async () => { + const { fixture, list } = setup(); + fixture.detectChanges(); + await fixture.whenStable(); + expect(list).toHaveBeenCalledWith('target-oid'); + }); + + it('surfaces a 404 with the seed/sign-in hint', async () => { + const list = vi.fn().mockReturnValue(throwError(() => ({ status: 404 }))); + const { fixture } = setup({ list }); + fixture.detectChanges(); + await fixture.whenStable(); + fixture.detectChanges(); + const html = (fixture.nativeElement as HTMLElement).innerHTML; + expect(html).toMatch(/User not found/); + }); + + it('forbids a 403 with a friendly error', async () => { + const list = vi.fn().mockReturnValue(throwError(() => ({ status: 403 }))); + const { fixture } = setup({ list }); + fixture.detectChanges(); + await fixture.whenStable(); + fixture.detectChanges(); + const html = (fixture.nativeElement as HTMLElement).innerHTML; + expect(html).toMatch(/admin access/); + }); +}); + +describe('UserScopesPage.grant', () => { + it('sends value for value-bearing kinds + refreshes the list on success', async () => { + let grantPayload: GrantUserScopeInput | null = null; + const grant = vi.fn((_oid: string, payload: GrantUserScopeInput) => { + grantPayload = payload; + return of(SCOPE); + }); + const list = vi.fn().mockReturnValue(of(PAGE)); + const { fixture } = setup({ list, grant }); + fixture.detectChanges(); + await fixture.whenStable(); + const component = fixture.componentInstance as unknown as { + newKind: { set: (v: string) => void }; + newValue: { set: (v: string) => void }; + grant: () => Promise; + }; + component.newKind.set('etablissement'); + component.newValue.set('0330800013'); + await component.grant(); + expect(grant).toHaveBeenCalledTimes(1); + expect(grantPayload).toEqual({ kind: 'etablissement', value: '0330800013' }); + // List re-fetched after the grant. + expect(list).toHaveBeenCalledTimes(2); + }); + + it('omits value for valueless kinds', async () => { + let grantPayload: GrantUserScopeInput | null = null; + const grant = vi.fn((_oid: string, payload: GrantUserScopeInput) => { + grantPayload = payload; + return of(SCOPE); + }); + const { fixture } = setup({ grant }); + fixture.detectChanges(); + await fixture.whenStable(); + const component = fixture.componentInstance as unknown as { + newKind: { set: (v: string) => void }; + grant: () => Promise; + }; + component.newKind.set('unrestricted'); + await component.grant(); + expect(grantPayload).toEqual({ kind: 'unrestricted' }); + }); +}); diff --git a/apps/portal-admin/src/app/pages/user-scopes/user-scopes.ts b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.ts new file mode 100644 index 0000000..8c5a78b --- /dev/null +++ b/apps/portal-admin/src/app/pages/user-scopes/user-scopes.ts @@ -0,0 +1,180 @@ +import { + ChangeDetectionStrategy, + Component, + computed, + inject, + signal, + type OnInit, +} from '@angular/core'; +import { FormsModule } from '@angular/forms'; +import { ActivatedRoute, RouterLink } from '@angular/router'; +import { firstValueFrom } from 'rxjs'; +import { + UserScopesService, + type GrantUserScopeInput, + type UserScopesPayload, +} from './user-scopes.service'; + +/** + * The six scope kinds from ADR-0025's catalogue. Hardcoded here so + * the SPA can dropdown them without importing from `shared-auth` + * (which would couple the admin app to the BFF lib path). Drift gate + * lives BFF-side; if the catalogue grows, this list grows in lockstep. + */ +const SCOPE_KINDS = [ + 'self', + 'etablissement', + 'delegation', + 'region', + 'siege', + 'unrestricted', +] as const; + +const VALUE_BEARING = new Set(['etablissement', 'delegation', 'region']); + +/** + * Admin scope-management screen per [ADR-0026 PR 2b](https://git.unespace.com/julien/apf_portal/src/branch/main/docs/decisions/0026-person-user-portal-data-model.md). + * Lists every UserScope row for the target user, lets the admin grant + * a new one (kind dropdown + value + optional expiresAt), and revoke + * existing ones inline. + * + * Reaches the BFF at `/api/admin/users/:oid/scopes`. The `:oid` URL + * param is the affected user's Entra `oid` — same identifier the + * `/admin/users` list page uses, so a "Manage scopes" link from that + * list lands here without a lookup. + * + * A11y posture (per [ADR-0016](https://git.unespace.com/julien/apf_portal/src/branch/main/docs/decisions/0016-accessibility-baseline-wcag-aa-targeted-aaa.md)): + * - Form labels associated via `