Julien Gautier
e055578142
portal-bff/tsconfig.app.json declares a TypeScript project reference to libs/shared/auth, so when webpack runs tsc against that tsconfig it validates that the referenced project's declarations exist at the location libs/shared/auth/tsconfig.lib.json declares as outDir (dist/out-tsc/libs/shared/auth). But nx's @nx/js:tsc executor was emitting them to dist/libs/shared/auth (the project.json outputPath), so tsc fails with TS6305 "Output file ... has not been built". The mismatch was harmless locally because a manual `tsc --build` during development populated both directories. Fresh CI runners only run nx's executor, so only one directory was populated. Aligning outputPath to dist/out-tsc/libs/shared/auth makes both agree. shared-auth is the first lib in the workspace that's consumed by portal-bff in a way that triggers tsc project-reference validation; the SPA-targeted libs (shared-util, shared-tokens) ride the same mismatch but don't hit it because the Angular build pipeline doesn't validate project references the same way.
shared-auth
Framework-agnostic authorization primitives shared across portal-bff and
portal-shell per ADR-0025:
- Catalogues (
authorization.types.ts) — closed-set lists of the four privileges (Portal.*Entra app roles), the 24 functional roles (apf-role-*Entra security groups), and the six scope kinds. Adding an entry is an ADR amendment, not a code change in isolation. Principaltype — the session-resident shape consumed by route guards (@RequirePrivilege,@RequireRole,@RequireScope) and projected to the AI service's flatroles[]contract.EntraGroupToRoleResolver— turns the tenant-specific Entra group GUIDs carried in the OIDCgroupsclaim into the catalogue's role slugs. Configured at boot frominfra/<env>-tenant.entra.json(gitignored — GUIDs are tenant-private).
Building
Run pnpm nx build shared-auth to build the library.
Running unit tests
Run pnpm nx test shared-auth to execute the unit tests via Vitest.