PR 3 of 3 — final piece of the user-menu / profile / cross-app
chantier.
BFF
* New `MeModule` ships `GET /api/me/capabilities`, a curated view
derived from the active user-portal session. Returns
`{ canAccessAdmin: boolean }` today; the shape is deliberately
binary so the SPA cannot reconstruct the raw `roles` claim. 401
on missing session, consistent posture with `/auth/me`.
* ADR-0009 amended: new "Curated public view" section codifies
the "no raw roles on `/auth/me`, capabilities is the release
valve" stance; the routes table grows a row for the endpoint.
portal-shell
* New `CapabilitiesService` (app-local) calls the BFF on auth-state
flip and exposes `canAccessAdmin` as a signal. Anonymous
sessions short-circuit to the all-false default without firing
a request.
* Header's `userMenuItems` is now a `computed` — the "Open Portal
Admin" entry appears in the dropdown only when
`canAccessAdmin()` is true, pointing at
`environment.adminAppUrl`.
* Sidebar role widget reads the auth + capabilities signals to
render one of three labels ("Anonymous" / "User" /
"Administrator") in place of the hardcoded "Anonymous".
portal-admin
* Symmetric: unconditional "Open Portal Shell" entry in the admin
user menu, pointing at `environment.shellAppUrl`. Anyone who
can reach portal-admin can reach portal-shell, so no
capabilities check needed.
i18n
* `header.userMenu.openAdmin`, `sidebar.role.{administrator,user}`,
`sidebar.role.aria` reshaped to take the role as a placeholder.
Render the OAuth 2.0 Authorization Code + PKCE flow as a Mermaid
sequence diagram at the top of the Decision Outcome section. Five
participants (user, SPA, BFF, Entra, Redis), thirteen autonumbered
steps covering the authorize redirect, the user-side authentication
(with the Conditional Access MFA enforcement annotated), the
callback, the state verification, the token exchange, the id_token
validation pipeline (signature, iss against the tenant allowlist,
aud, exp/nbf, amr sanity-check, audience-claim mapping), the
encrypted session write to Redis, and the cookie set.
Inline rather than in docs/architecture.md per the convention stated
at the top of architecture.md: cross-cutting diagrams live in the
architecture file, single-decision diagrams live inside the ADR they
visualise. ADR-0009 IS the auth flow decision; the sequence diagram
belongs here.
Cross-references the related ADRs (0010 sessions, 0011 MFA, 0008
audience model) so the diagram reads as the integration point of
the security stack rather than as an isolated picture.
Move the ADR folder under docs/ alongside the rest of the project
documentation. Convention (flat folder, globally-sequential 4-digit
numbering, tags-based categorization, MADR 4.0.0 format) is unchanged
- only the path moved.
- git mv decisions docs/decisions preserves history for all 18 ADRs +
README + template (19 files renamed in this commit).
- ADR-0001 amended in-place with a dated note documenting the
relocation. Status remains 'accepted' - the location detail
changed, the decision did not.
- All cross-references updated:
- CLAUDE.md (~17 ADR links + 3 mentions of decisions/ in the Project
rules section)
- docs/README.md (now references decisions/ as a sibling under docs/)
- docs/setup/03-angular-nx-monorepo.md (paths shortened from
../../decisions/ to ../decisions/, since setup/ and decisions/ are
now both inside docs/)
- docs/decisions/0003 ../CLAUDE.md adjusted to ../../CLAUDE.md
(one extra level of nesting)
- docs/decisions/template.md mention of the README path
- notes/asvs-level-decision-briefing-rssi.md mention of the index
Sanity verified: every ADR link in CLAUDE.md, docs/setup/03, and
docs/decisions/0001 resolves to an existing file. pnpm nx run-many
-t lint passes on 8 projects.
Julien Gautier