feat(portal-admin): spa auth wiring + admin shell skeleton #134

Merged

julien merged 1 commits from feat/portal-admin-spa-auth-shell into main 2026-05-14 17:00:39 +02:00

Conversation 0 Commits 1 Files Changed 27

+1085 -44

julien commented 2026-05-14 16:59:28 +02:00

Owner

Copy Link

Copy Source

Summary

Phase-3a step per ADR-0020 §"Confirmation" item 4 (entry route + admin shell). Wires the existing feature-auth library against the distinct admin OIDC routes (/api/admin/auth/*) the BFF exposes since PR #129, ships a lean header/sidebar/footer chrome with an "Admin" badge so an internal user can never mistake the surface for portal-shell, and gives the landing page a self-test panel that confirms the auth chain end-to-end as soon as an admin Entra role gets assigned.

What lands

Lib change — AUTH_PATH_PREFIX injection token

libs/feature/auth gains one injection token. AuthService composes URLs as ${bffBaseUrl}${pathPrefix}/{me,login,logout} instead of hard-coding /auth/.... Default factory returns /auth, so portal-shell-shaped consumers keep working without an explicit provider — no churn on existing call sites. Admin hosts override with /admin/auth.

The interceptors (bffCredentialsInterceptor, csrfInterceptor, bffUnauthorizedInterceptor) are unchanged — they only care about the BFF base URL, not the path prefix.

portal-admin wiring

• environment.ts — same shape as portal-shell, same BFF base URL (both SPAs talk to one BFF per ADR-0020 §"Where does the admin app live"). Same CSRF cookie name in v1.
• app.config.ts — HttpClient with the standard interceptor chain (credentials → csrf → unauthorized), AUTH_BFF_BASE_URL from env, AUTH_PATH_PREFIX = '/admin/auth', AUTH_CSRF_COOKIE_NAME from env.

Admin shell

• AdminHeader — APF wordmark + persistent "Admin" badge + auth widget. No global search / notifications / help cluster: admins land on tabular workloads, not a discovery dashboard (ADR-0020 §"UX style is data-dense").
• AdminSidebar — static menu listing the four ADR-0020 v1 modules. Audit log is a live router link (target of the next PR); the others are aria-disabled placeholders with a "Soon" badge so the navigation shape is visible even before they ship.
• AdminFooter — copyright + persistent "Admin surface" tag. Stays in view for long workloads where the header has scrolled off.

Home — auth self-test panel

apps/portal-admin/src/app/pages/home/:

• Signed-in: shows displayName, username, tenant, oid in a monospaced detail list.
• Anonymous: "No admin session detected" + a "Sign in via Entra" button that delegates to AuthService.login() → 302 through /api/admin/auth/login.
• Error: "Could not reach the BFF" + retry button.
• Roadmap list quoting ADR-0020's v1 catalogue.

Known limitations (v1, documented)

• CSRF cookie shared between surfaces. Both portals issue portal_csrf on session creation. A user with both portals open will see overwrites on the second sign-in; mutating actions on the first surface will then 403 until refresh. Splitting to portal_admin_csrf is a follow-up if the pattern becomes common.
• Shell chrome strings are plain English. The admin app's $localize plumbing is wired (matches portal-shell), but adding markers to the shell here would require regenerating messages.fr.xlf and i18nMissingTranslation=error fails the prod build on every gap. Full admin i18n is its own follow-up.
• LayoutStateService not yet consumed. No collapse toggle in v1. Theme preference still threads through because both apps read the same localStorage key — toggle in portal-shell, see it honoured in portal-admin.
• ci:perf only runs against portal-shell. Admin perf budgets are enforced at build time by apps/portal-admin/project.json (maximumError == maximumWarning per ADR-0020's relaxed thresholds: 500 KB initial JS / 1.5 MB initial total). Adding admin to pnpm ci:perf's gzip + Lighthouse chain is a follow-up.

Test plan

• pnpm nx test feature-auth — 29 specs pass (was 28; +1 for the AUTH_PATH_PREFIX override).
• pnpm nx test portal-admin — 15 specs pass (was 1; +14: AdminHeader 5, AdminSidebar 3, AdminFooter 2, Home 4, App 1 expanded).
• pnpm exec nx affected -t format:check lint test build --base=origin/main — clean.
• Gzip-budget script run manually against dist/apps/portal-admin/browser: 86.65 KB initial / 300 KB budget, 4.46 KB CSS / 150 KB budget, 2.15 KB largest lazy / 100 KB per-chunk budget. Both en + fr bundles checked thanks to PR #133's multi-locale detection.
• e2e — pending an Entra admin role assignment. Once available: pnpm nx serve portal-admin, visit http://localhost:4300, see "No admin session detected", click "Sign in via Entra", complete the round-trip, land back on / with the signed-in payload + portal_admin_session cookie set.

Notes for the reviewer

• AdminHeader is intentionally narrower than Header from portal-shell — no shared base class. The two are likely to evolve in different directions (admin-specific banner with system-status badges, audit-trail link, etc.) and a premature abstraction would be expensive to undo.
• AdminSidebar's "Soon" badge is a deliberate signal — without it, an admin who clicked a placeholder link and got a route-not-found would assume the app is broken. The badge sets expectations.
• All shell components use :host-context(.dark) for dark-mode SCSS instead of :host(.dark) — same pattern as portal-shell, since the .dark class lives on <html> outside the component's view encapsulation.

## Summary Phase-3a step per [ADR-0020](docs/decisions/0020-portal-admin-app.md) §"Confirmation" item 4 (entry route + admin shell). Wires the existing [`feature-auth`](libs/feature/auth) library against the distinct admin OIDC routes (`/api/admin/auth/*`) the BFF exposes since PR #129, ships a lean header/sidebar/footer chrome with an "Admin" badge so an internal user can never mistake the surface for portal-shell, and gives the landing page a self-test panel that confirms the auth chain end-to-end as soon as an `admin` Entra role gets assigned. ## What lands ### Lib change — `AUTH_PATH_PREFIX` injection token [`libs/feature/auth`](libs/feature/auth/src/lib/auth.config.ts) gains one injection token. AuthService composes URLs as `${bffBaseUrl}${pathPrefix}/{me,login,logout}` instead of hard-coding `/auth/...`. Default factory returns `/auth`, so portal-shell-shaped consumers keep working without an explicit provider — no churn on existing call sites. Admin hosts override with `/admin/auth`. The interceptors (`bffCredentialsInterceptor`, `csrfInterceptor`, `bffUnauthorizedInterceptor`) are **unchanged** — they only care about the BFF base URL, not the path prefix. ### portal-admin wiring - [environment.ts](apps/portal-admin/src/environments/environment.ts) — same shape as portal-shell, same BFF base URL (both SPAs talk to one BFF per ADR-0020 §"Where does the admin app live"). Same CSRF cookie name in v1. - [app.config.ts](apps/portal-admin/src/app/app.config.ts) — `HttpClient` with the standard interceptor chain (credentials → csrf → unauthorized), `AUTH_BFF_BASE_URL` from env, `AUTH_PATH_PREFIX = '/admin/auth'`, `AUTH_CSRF_COOKIE_NAME` from env. ### Admin shell - **[AdminHeader](apps/portal-admin/src/app/components/header/header.ts)** — APF wordmark + persistent "Admin" badge + auth widget. No global search / notifications / help cluster: admins land on tabular workloads, not a discovery dashboard (ADR-0020 §"UX style is data-dense"). - **[AdminSidebar](apps/portal-admin/src/app/components/sidebar/sidebar.ts)** — static menu listing the four ADR-0020 v1 modules. Audit log is a live router link (target of the next PR); the others are `aria-disabled` placeholders with a "Soon" badge so the navigation shape is visible even before they ship. - **[AdminFooter](apps/portal-admin/src/app/components/footer/footer.ts)** — copyright + persistent "Admin surface" tag. Stays in view for long workloads where the header has scrolled off. ### Home — auth self-test panel [apps/portal-admin/src/app/pages/home/](apps/portal-admin/src/app/pages/home/): - Signed-in: shows `displayName`, `username`, `tenant`, `oid` in a monospaced detail list. - Anonymous: "No admin session detected" + a "Sign in via Entra" button that delegates to `AuthService.login()` → 302 through `/api/admin/auth/login`. - Error: "Could not reach the BFF" + retry button. - Roadmap list quoting ADR-0020's v1 catalogue. ## Known limitations (v1, documented) - **CSRF cookie shared between surfaces.** Both portals issue `portal_csrf` on session creation. A user with both portals open will see overwrites on the second sign-in; mutating actions on the first surface will then 403 until refresh. Splitting to `portal_admin_csrf` is a follow-up if the pattern becomes common. - **Shell chrome strings are plain English.** The admin app's `$localize` plumbing is wired (matches portal-shell), but adding markers to the shell here would require regenerating `messages.fr.xlf` and `i18nMissingTranslation=error` fails the prod build on every gap. Full admin i18n is its own follow-up. - **`LayoutStateService` not yet consumed.** No collapse toggle in v1. Theme preference still threads through because both apps read the same `localStorage` key — toggle in portal-shell, see it honoured in portal-admin. - **`ci:perf` only runs against portal-shell.** Admin perf budgets are enforced at build time by `apps/portal-admin/project.json` (`maximumError == maximumWarning` per ADR-0020's relaxed thresholds: 500 KB initial JS / 1.5 MB initial total). Adding admin to `pnpm ci:perf`'s gzip + Lighthouse chain is a follow-up. ## Test plan - [x] `pnpm nx test feature-auth` — **29 specs pass** (was 28; +1 for the `AUTH_PATH_PREFIX` override). - [x] `pnpm nx test portal-admin` — **15 specs pass** (was 1; +14: AdminHeader 5, AdminSidebar 3, AdminFooter 2, Home 4, App 1 expanded). - [x] `pnpm exec nx affected -t format:check lint test build --base=origin/main` — clean. - [x] Gzip-budget script run manually against `dist/apps/portal-admin/browser`: 86.65 KB initial / 300 KB budget, 4.46 KB CSS / 150 KB budget, 2.15 KB largest lazy / 100 KB per-chunk budget. Both `en` + `fr` bundles checked thanks to PR #133's multi-locale detection. - [ ] e2e — pending an Entra `admin` role assignment. Once available: `pnpm nx serve portal-admin`, visit `http://localhost:4300`, see "No admin session detected", click "Sign in via Entra", complete the round-trip, land back on `/` with the signed-in payload + `portal_admin_session` cookie set. ## Notes for the reviewer - `AdminHeader` is intentionally narrower than `Header` from portal-shell — no shared base class. The two are likely to evolve in different directions (admin-specific banner with system-status badges, audit-trail link, etc.) and a premature abstraction would be expensive to undo. - `AdminSidebar`'s "Soon" badge is a deliberate signal — without it, an admin who clicked a placeholder link and got a route-not-found would assume the app is broken. The badge sets expectations. - All shell components use `:host-context(.dark)` for dark-mode SCSS instead of `:host(.dark)` — same pattern as portal-shell, since the `.dark` class lives on `<html>` outside the component's view encapsulation.

julien added 1 commit 2026-05-14 16:59:29 +02:00

feat(portal-admin): spa auth wiring + admin shell skeleton ... 4a707cdb0f

Phase-3a step per ADR-0020 §"Confirmation" item 4 (entry route +
admin shell). Wires the existing `feature-auth` library against the
distinct admin OIDC routes (`/api/admin/auth/*`) the BFF exposes
since PR #129, ships a lean header/sidebar/footer chrome with an
"Admin" badge so an internal user can never mistake the surface for
portal-shell, and gives the landing page a self-test panel that
confirms the auth chain end-to-end as soon as an `admin` Entra role
gets assigned.

Lib changes (libs/feature/auth)

- New AUTH_PATH_PREFIX injection token. Default factory returns
  `/auth` so portal-shell-shaped hosts keep working without an
  explicit provider. Admin hosts override with `/admin/auth`.
- AuthService composes URLs as `${bffBaseUrl}${pathPrefix}/{me,login,
  logout}`. The interceptors are unchanged — they only care about
  the BFF base URL.

portal-admin wiring

- environment.ts: same shape as portal-shell, same BFF base URL
  (both SPAs talk to one BFF per ADR-0020 §"Where does the admin
  app live"), same CSRF cookie name in v1.
- app.config.ts: HttpClient with the standard interceptor chain
  (credentials → csrf → unauthorized), AUTH_BFF_BASE_URL from env,
  AUTH_PATH_PREFIX = '/admin/auth', AUTH_CSRF_COOKIE_NAME from env.

Admin shell components

- AdminHeader: APF wordmark + persistent "Admin" badge + auth widget.
  No global search / notifications / help cluster — admins land on
  tabular workloads, not discovery. Per ADR-0020 §"UX style is
  data-dense".
- AdminSidebar: static menu listing the four ADR-0020 v1 modules.
  Audit log is a live router link (target of PR 8); the others are
  aria-disabled placeholders with a "Soon" badge so the navigation
  shape is visible even before they ship.
- AdminFooter: copyright + persistent "Admin surface" tag — the
  badge stays in view for long workloads where the header may have
  scrolled off.

Home page

- Auth self-test panel: signed-in payload (display name, tenant,
  oid) when authenticated, Sign in button when anonymous, error
  state when the BFF is unreachable.
- Roadmap list quoting ADR-0020's v1 catalogue so a returning
  contributor sees what's pending without grepping.

Notes

- LayoutStateService isn't consumed yet (no collapse toggle in v1),
  but the theme preference still threads through because both apps
  read the same localStorage key — toggle in portal-shell, see it
  honoured in portal-admin.
- Strings are plain English in v1. The admin app's $localize plumbing
  is wired but adding markers to the shell chrome here would require
  regenerating messages.fr.xlf and i18nMissingTranslation=error fails
  the prod build on every gap. Full i18n is its own follow-up.
- v1 reuses the shared `portal_csrf` cookie name. A user with both
  portals open could see CSRF cookie overwrites on session creation;
  splitting to `portal_admin_csrf` is a follow-up if the pattern
  becomes common.
- Build verified locally: 86.65 KB gzip initial / 300 KB budget,
  4.46 KB CSS / 150 KB budget.

Tests: +15 specs (AdminHeader 5, AdminSidebar 3, AdminFooter 2,
Home 4, App 1 expanded). 1 new test in feature-auth AuthService for
the AUTH_PATH_PREFIX override path.

julien merged commit 40741ce326 into main 2026-05-14 17:00:39 +02:00

julien deleted branch feat/portal-admin-spa-auth-shell 2026-05-14 17:00:42 +02:00

julien referenced this pull request 2026-05-14 17:23:33 +02:00

fix(feature-auth): use AUTH_PATH_PREFIX to skip the /me endpoint in the 401 interceptor #135

julien referenced this issue from a commit 2026-05-14 17:23:48 +02:00

fix(feature-auth): use AUTH_PATH_PREFIX to skip the /me endpoint in the 401 interceptor (#135)

julien referenced this pull request 2026-05-14 17:47:41 +02:00

feat(portal-admin): audit log viewer screen #136

julien referenced this issue from a commit 2026-05-14 17:50:23 +02:00

feat(portal-admin): audit log viewer screen (#136)

julien referenced this issue from a commit 2026-05-15 23:06:57 +02:00

docs(development): refresh after phase-3a + add topology / trace diagrams

julien referenced this pull request 2026-05-15 23:08:17 +02:00

docs(development): refresh after phase-3a + add topology / trace diagrams #160

julien referenced this issue from a commit 2026-05-15 23:08:53 +02:00

docs(development): refresh after phase-3a + add topology / trace diagrams (#160)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

adastra-bot (AdAstra Bot) julien (Julien Gautier)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: julien/apf_portal#134