Julien Gautier
afd9f175bf
The original `amr-missing` guard in PR #107 misread ADR-0011's intent. `amr` is an OPTIONAL claim in Entra ID tokens: it's populated for fresh interactive sign-ins where Conditional Access asked for an MFA method, and frequently absent for SSO / refresh flows or in tenants without a CA policy on the app. Rejecting tokens on empty `amr` blocks every legitimate dev sign-in against a tenant that hasn't yet had CA configured — observed in practice: {"context":"AuthCallback","event":"auth.flow_error", "failure":{"kind":"amr-missing"}} ADR-0011 specifies that MFA enforcement is the Conditional Access policy's job (org-side) and the `@RequireMfa({ freshness: 600 })` decorator's job on sensitive routes (designed-in, no v1 consumer). The BFF's part is to surface `amr` through the audit log and the future guard, NOT to gate the callback on its presence. Changes: - `AuthCodeFlowError` discriminator drops the `amr-missing` variant. Three failure modes left: state-mismatch, flow-expired, token-exchange-failed. MSAL's own ID-token validation (signature, issuer, audience, exp, nbf) is the real gate at this stage. - `AuthService.toAuthenticatedUser` keeps extracting `amr` and passing it through (as a possibly-empty string array) so the log line and future `@RequireMfa` guard still see it. The strict `if (amr.length === 0) throw` is gone, replaced by a comment block explaining the new shape. - Spec test `'throws amr-missing'` becomes `'returns the user even when the ID token has no amr claim'` — asserts the array passes through empty rather than blocking the flow. Verified: 52/52 specs green, lint clean, build green. Smoke test against the live tenant — sign-in now lands cleanly on the SPA; Pino's `auth.signed_in` log shows the resolved identity with the `amr` value (often `[]` until CA is configured on the org side).
Documentation index
This is the entry point to all project documentation. It is maintained automatically: any addition, rename, or removal of a .md file under docs/ must be reflected here in the same change.
Conventions
- Documentation is written in English.
- One topic per file. Group related files into a folder when there are three or more.
- Cross-reference with relative links so they keep working in GitHub, IDEs, and exported sites.
- For architectural decisions, do not add them here — they belong in decisions/ as MADR 4.0.0 ADRs.
Sections
Daily development
- development.md — repo layout, prerequisites, initial setup, daily commands, observability dev-loop (Jaeger UI, log ↔ trace correlation), dependency updates (Renovate), conventional commit cycle. Day-to-day reference for working on the project.
Architecture
- architecture.md — cross-cutting Mermaid diagrams: C4 system context, C4 containers, Nx module boundaries, CI/CD pipeline. Single-decision diagrams (auth sequence, ERD, etc.) live inline in their ADR.
Onboarding & environment
Setup guides for new contributors:
- setup/01-wsl-terminal-setup.md — modern WSL terminal (Zsh + Powerlevel10k + CLI tools)
- setup/02-dev-web-stack.md — Node via nvm, pnpm via corepack, Docker
- setup/03-angular-nx-monorepo.md — Angular + Nx monorepo bootstrap
Operations & runbooks
Empty — to be populated when we deploy.
Security, performance, accessibility
Empty — placeholders to be filled with rationale docs alongside their corresponding ADRs.