e43fa5ce24be526a141927ac6170a20ccde11720
2 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Julien Gautier
|
e43fa5ce24 |
feat(portal-bff): signed-assertion strategy + /.well-known/jwks.json
Second half of the DownstreamApiClient + OBO chantier per ADR-0014.
Ships the signed-assertion strategy (non-Entra downstreams) and the
JWKS publishing endpoint as testable primitives. The framework
around them (DownstreamApiClientFactory, cockatiel, audience
pre-check, error translation) still waits for the first concrete
integration per the ADR's "until then" clause.
What lands
- assertJwksConfig (config/check-jwks-config.ts):
- Reads the PEM private key once at boot, refuses missing /
unreadable / weak material (RSA < 2048, Ed25519, unknown key
type). Derives the JOSE algorithm (RS256 / ES256 / ES384) from
the key shape so neither the strategy nor the JWKS controller
has to re-decide on the hot path.
- Validates BFF_JWKS_KID against [A-Za-z0-9_-]{4,128} so the
value lives unescaped in JWT headers + JWKS payloads.
- Wired in main.ts alongside the other assertX() validators.
- BffSigningKey (downstream/bff-signing-key.ts):
- Singleton holding { config: JwksConfig, publicJwk: JWK }.
publicJwk is derived from the private key via `jose.exportJWK`
on a public KeyObject — no private material leaks through.
- DI token BFF_SIGNING_KEY wires both consumers (strategy +
controller) to the same source of truth.
- SignedAssertionStrategy (downstream/strategies/signed-assertion.strategy.ts):
- Wraps `jose.SignJWT` with the ADR-0014 claim shape: iss,
sub, aud, audience (workforce|customer), claims (curated
subset), trace_id, iat, exp.
- 60 s TTL hard-coded — the ADR mandates it; cache disabled
because the savings on a 60 s JWT would be marginal and a
cache would let replayed assertions linger past their TTL.
- kid header matches the JWKS so a downstream picks the right
key during rotation.
- Supports RS256 / ES256 / ES384 transparently — picks the alg
the validator derived at boot.
- JwksController (downstream/jwks.controller.ts):
- GET /.well-known/jwks.json returns { keys: [<single jwk>] }.
- main.ts excludes /.well-known/* from the global /api prefix so
the route lands at the bare root per RFC 8615.
- No auth gate (the JWKS is the verification anchor — gating it
would defeat the purpose). Read-only, so the CSRF middleware's
GET-exempt path already handles it.
Configuration
- Generate a key:
mkdir -p apps/portal-bff/.secrets && \
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 \
-out apps/portal-bff/.secrets/jwks.pem
- BFF_JWKS_PRIVATE_KEY_PATH (path to the PEM)
- BFF_JWKS_KID (URL-safe id, 4..128 chars)
- Both mandatory at boot.
- `apps/portal-bff/.secrets/` is matched by the repo's existing
*.pem / *.key gitignore patterns.
Deps
- jose@^6 added as a direct dep (was transitive). Pinned at the
workspace root since the BFF is the only consumer today and the
package isn't part of the Angular bundle graph.
- jest.config.cts: jose ships ESM-only, so its node_modules path
is removed from transformIgnorePatterns. The pattern walks
pnpm's deep `.pnpm/` layout — anything under /node_modules/ that
also contains `jose` somewhere in the path gets transformed.
Tests: +24 specs (env validators 11, signing key 4, strategy 6,
controller 3).
Out of scope (deferred per ADR-0014 "until then"):
- DownstreamApiClientFactory + per-service typed config.
- cockatiel resilience composition.
- Audience pre-check at the call site.
- Error translation tables.
- OTel custom spans `downstream.<service>.<verb>.<path>`.
- The framework wiring that calls SignedAssertionStrategy.sign()
+ attaches the `X-User-Assertion` + ServiceCredential auth
header to outbound HTTP requests.
- Key rotation (the JWKS lists one key for now; rotation chantier
adds a second entry + a window-based eviction policy).
These land alongside the first concrete integration so the
framework shape is validated against a real consumer.
|
||
|
Julien Gautier
|
bea5e1954f |
chore: generate portal-shell and portal-bff apps per ADR-0004 / ADR-0005
Add the @nx/angular, @nx/nest, @nx/vite, @nx/eslint plugins, then generate the two apps. Adjust the empty-template tsconfig.base.json to be Angular-compatible (drop project references and customConditions that the empty-template defaults to but Angular doesn't support; keep the strict-TS extensions from ADR-0004). apps/portal-shell (Angular 21): - standalone APIs, routing, SCSS, esbuild - vitest-angular as unitTestRunner, playwright for e2e - strict mode - tags scope:portal-shell, type:app - app.config.ts wired with provideZonelessChangeDetection() per ADR-0004 (Angular 21 + Nx 22 generates without zone.js by default) apps/portal-bff (NestJS 11): - Express adapter (default per ADR-0005) - Jest as unitTestRunner - tags scope:portal-bff, type:app - main.ts wired with a global ValidationPipe configured whitelist + forbidNonWhitelisted + transform per ADR-0005 - Phase-2 security additions (helmet, CORS, sessions, CSRF, rate limit, auth guards, error filter) deferred to their respective ADRs - placeholder comment in main.ts Workspace dependencies: class-validator + class-transformer added (required by NestJS ValidationPipe at runtime). Nx-generated .gitignore additions (.angular, __screenshots__) merged into ours. .vscode/extensions.json and launch.json added by Nx are kept (do not override our existing settings.json). |