fix(portal-bff): use the real portal-admin dev port (4300) in admin-flow references (#131)

## Summary

PR #129 (`feat(portal-bff): distinct admin session + /api/admin/auth flow`) baked `4201` into a handful of comments, test fixtures, and the `.env.example` as the portal-admin dev port. The actual port wired in [apps/portal-admin/project.json](apps/portal-admin/project.json#L87) `serve.options.port` is **4300** — that's what `pnpm nx serve portal-admin` listens on.

This PR aligns the references so a contributor copying values from `.env.example` (or reading the test fixtures) sees the same port their browser is going to hit.

It also drops `http://localhost:4300` into `CORS_ALLOWED_ORIGINS` — the portal-admin SPA will hit the BFF with credentials as soon as the admin auth flow is exercised end-to-end, and without the origin in the allowlist the browser blocks the call. Better to set the right example now than have the next contributor chase a CORS error.

## Touched

- [apps/portal-bff/.env.example](apps/portal-bff/.env.example):
  - `ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI` default + the surrounding comment now point at `http://localhost:4300/`.
  - `CORS_ALLOWED_ORIGINS` example lists both `:4200` (portal-shell) and `:4300` (portal-admin).
  - Both sections cite `apps/<app>/project.json` `serve.options.port` as the source of truth so a future reader doesn't have to grep.
- [apps/portal-bff/src/config/check-cors-allowlist.ts](apps/portal-bff/src/config/check-cors-allowlist.ts) — stale doc-comment that pre-dated the portal-admin scaffolding, now matches reality.
- Test-fixture `adminPostLogoutRedirectUri` values in `auth.module.spec.ts`, `auth.controller.spec.ts`, `auth.service.spec.ts`, `admin-auth.controller.spec.ts`, `check-entra-config.spec.ts` — tests don't depend on the port; aligned for clarity only.

## Test plan

- [x] `grep -rn 4201 apps/ libs/` → empty.
- [x] `pnpm nx test portal-bff` — **278 specs pass** (unchanged from #129; this PR only touches strings).
- [x] No behaviour change in the BFF; only the example values shift. Developers must update their local `.env` to pick up the new port + origin.

## Notes for the reviewer

The two new env vars from #129 (`ENTRA_ADMIN_REDIRECT_URI`, `ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI`) plus the existing `CORS_ALLOWED_ORIGINS` are mandatory at boot. If your local `apps/portal-bff/.env` still has the `4201` value, the BFF will still start (any valid URL passes the validators) — but admin logout will 302 you to a port nothing is listening on, and the admin SPA's BFF calls will fail CORS. Update to `4300` to match the actual portal-admin dev server.

---------

Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr>
Reviewed-on: #131

apps/portal-bff/.env.example

@@ -67,9 +67,10 @@ ENTRA_POST_LOGOUT_REDIRECT_URI=http://localhost:4200/
 # session. Both `ENTRA_REDIRECT_URI` and `ENTRA_ADMIN_REDIRECT_URI`
 # must be registered in the same Entra app registration's
 # "Redirect URIs" list. Distinct post-logout URL routes admin
-# sign-outs to the admin SPA's landing page (port 4201 in dev).
+# sign-outs to the admin SPA's landing page (port 4300 in dev — see
+# apps/portal-admin/project.json `serve.options.port`).
 ENTRA_ADMIN_REDIRECT_URI=http://localhost:3000/api/admin/auth/callback
-ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI=http://localhost:4201/
+ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI=http://localhost:4300/
 
 # Cookie signing secret (per ADR-0009 §"Cookies"). Used to sign the
 # transient pre-auth cookie that carries the OIDC `state` + PKCE
@@ -132,9 +133,10 @@ LOG_USER_ID_SALT=replace_with_32_random_bytes_base64url
 # defaulting to localhost is the classic "works in dev, breaks in
 # prod" trap.
 #
-# Local dev: the portal-shell dev server on :4200. Add :4201 once
-# portal-admin grows its own dev server.
-CORS_ALLOWED_ORIGINS=http://localhost:4200
+# Local dev: portal-shell on :4200 and portal-admin on :4300 — both
+# call the BFF with credentials. Source of truth for the ports:
+# `apps/<app>/project.json` `serve.options.port`.
+CORS_ALLOWED_ORIGINS=http://localhost:4200,http://localhost:4300
 
 # Rate limiting (per ADR-0015 §"DoS mitigation"). Both optional
 # with conservative defaults; override per environment when traffic

apps/portal-bff/src/admin/admin-auth.controller.spec.ts

@@ -16,7 +16,7 @@ const ENTRA: EntraConfig = {
   redirectUri: 'http://localhost:3000/api/auth/callback',
   postLogoutRedirectUri: 'http://localhost:4200/',
   adminRedirectUri: 'http://localhost:3000/api/admin/auth/callback',
-  adminPostLogoutRedirectUri: 'http://localhost:4201/',
+  adminPostLogoutRedirectUri: 'http://localhost:4300/',
   authority: 'https://login.microsoftonline.com/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee',
 };
 

apps/portal-bff/src/auth/auth.controller.spec.ts

@@ -17,7 +17,7 @@ const ENTRA: EntraConfig = {
   redirectUri: 'http://localhost:3000/api/auth/callback',
   postLogoutRedirectUri: 'http://localhost:4200/',
   adminRedirectUri: 'http://localhost:3000/api/admin/auth/callback',
-  adminPostLogoutRedirectUri: 'http://localhost:4201/',
+  adminPostLogoutRedirectUri: 'http://localhost:4300/',
   authority: 'https://login.microsoftonline.com/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee',
 };
 

apps/portal-bff/src/auth/auth.module.spec.ts

@@ -43,7 +43,7 @@ const VALID = {
   ENTRA_REDIRECT_URI: 'http://localhost:3000/api/auth/callback',
   ENTRA_POST_LOGOUT_REDIRECT_URI: 'http://localhost:4200/',
   ENTRA_ADMIN_REDIRECT_URI: 'http://localhost:3000/api/admin/auth/callback',
-  ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI: 'http://localhost:4201/',
+  ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI: 'http://localhost:4300/',
   // Well-formed but unreachable Redis URL — `ioredis` opens the
   // socket lazily so the module compiles without any network access.
   REDIS_URL: 'redis://default:test-pass@127.0.0.1:65535/0',

apps/portal-bff/src/auth/auth.service.spec.ts

@@ -12,7 +12,7 @@ const ENTRA: EntraConfig = {
   redirectUri: 'http://localhost:3000/api/auth/callback',
   postLogoutRedirectUri: 'http://localhost:4200/',
   adminRedirectUri: 'http://localhost:3000/api/admin/auth/callback',
-  adminPostLogoutRedirectUri: 'http://localhost:4201/',
+  adminPostLogoutRedirectUri: 'http://localhost:4300/',
   authority: 'https://login.microsoftonline.com/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee',
 };
 

apps/portal-bff/src/config/check-cors-allowlist.ts

@@ -21,8 +21,9 @@
  * Production should set `CORS_ALLOWED_ORIGINS` to the SPA / admin
  * SPA's deploy origins (e.g.
  * `https://portal.apf.example,https://admin.portal.apf.example`).
- * Dev `.env` lists `http://localhost:4200` (and 4201 once
- * portal-admin grows a dev server).
+ * Dev `.env` lists `http://localhost:4200` (portal-shell) and
+ * `http://localhost:4300` (portal-admin) — see
+ * apps/portal-admin/project.json `serve.options.port`.
  */
 export function readCorsAllowlist(): readonly string[] {
   const raw = process.env['CORS_ALLOWED_ORIGINS'];

apps/portal-bff/src/config/check-entra-config.spec.ts

@@ -8,7 +8,7 @@ const VALID = {
   ENTRA_REDIRECT_URI: 'http://localhost:3000/api/auth/callback',
   ENTRA_POST_LOGOUT_REDIRECT_URI: 'http://localhost:4200/',
   ENTRA_ADMIN_REDIRECT_URI: 'http://localhost:3000/api/admin/auth/callback',
-  ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI: 'http://localhost:4201/',
+  ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI: 'http://localhost:4300/',
 };
 
 describe('assertEntraConfig', () => {