lionsdev/btpxpress-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16 Commits 1 Branch 0 Tags
39b7cff4ed6fb4be3fb3fe6575c10a137666feb0
Commit Graph

9 Commits

Author SHA1 Message Date
DahoudG
7df5f346f1 Refactor: Backend Frontend-Centric Auth - Suppression OIDC, validation JWT 
Architecture modifiée pour Frontend-Centric Authentication:

1. **Suppression des dépendances OIDC**
   - quarkus-oidc → quarkus-smallrye-jwt
   - quarkus-keycloak-authorization → quarkus-smallrye-jwt-build
   - Le backend ne gère plus l'authentification OAuth

2. **Configuration JWT simple**
   - Validation des tokens JWT envoyés par le frontend
   - mp.jwt.verify.publickey.location (JWKS de Keycloak)
   - mp.jwt.verify.issuer (Keycloak realm)
   - Authentification via Authorization: Bearer header

3. **Suppression configurations OIDC**
   - application.properties: Suppression %dev.quarkus.oidc.*
   - application.properties: Suppression %prod.quarkus.oidc.*
   - application-prod.properties: Remplacement par mp.jwt.*
   - Logging: io.quarkus.oidc → io.quarkus.smallrye.jwt

4. **Sécurité simplifiée**
   - quarkus.security.auth.proactive=false
   - @Authenticated sur les endpoints
   - CORS configuré pour le frontend
   - Endpoints publics: /q/*, /openapi, /swagger-ui/*

Flux d'authentification:
1️⃣ Frontend → Keycloak (OAuth login)
2️⃣ Frontend ← Keycloak (access_token)
3️⃣ Frontend → Backend (Authorization: Bearer token)
4️⃣ Backend valide le token JWT (signature + issuer)
5️⃣ Backend → Frontend (données API)

Avantages:
✅ Pas de secret backend à gérer
✅ Pas de client btpxpress-backend dans Keycloak
✅ Séparation claire frontend/backend
✅ Backend devient une API REST stateless
✅ Tokens gérés par le frontend (localStorage/sessionStorage)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-31 17:05:11 +00:00
dahoud
7a72d13ffa Fix: Suppression de quarkus.http.root-path pour compatibilité avec Ingress rewrite-target 
Le backend sert maintenant les endpoints directement sans préfixe de contexte:
- /api/v1/users au lieu de /btpxpress/api/v1/users
- /q/health/ready au lieu de /btpxpress/q/health/ready
- /openapi au lieu de /btpxpress/openapi

L'Ingress nginx gère le préfixe /btpxpress et le retire avant de transmettre au backend.
Cela corrige les erreurs 404 sur tous les endpoints REST.
 2025-10-23 22:44:03 +00:00
dahoud
3bd7f74a77 Fix: Correct Dockerfile HEALTHCHECK and Swagger UI URL for root-path configuration 
- Fixed HEALTHCHECK to use /btpxpress/q/health/ready instead of /q/health/ready
- Added quarkus.swagger-ui.urls.default=/btpxpress/openapi for correct OpenAPI loading
- Ensures Swagger UI loads the spec from the correct path with root-path

These fixes ensure:
1. Docker health checks work correctly with quarkus.http.root-path=/btpxpress
2. Swagger UI correctly loads /btpxpress/openapi instead of /openapi
3. Pods are marked healthy by Kubernetes

Resolves the 404 error in Swagger UI when loading API definition.
 2025-10-23 15:26:11 +00:00
dahoud
a0b0db5ec8 Fix: Configure quarkus.http.root-path for proper Swagger UI routing 
- Added quarkus.http.root-path=/btpxpress in production config
- Removed custom Swagger UI files (index.html, swagger-initializer.js)
- Backend now knows it's served under /btpxpress context path
- Swagger UI will correctly generate URLs like /btpxpress/openapi

IMPORTANT: Ingress configuration must be updated to NOT use rewrite-target
The Ingress should pass requests to backend with full path preserved:
  https://api.lions.dev/btpxpress/openapi -> http://backend:8080/btpxpress/openapi

This is the proper solution instead of using rewrite-target which breaks
context-aware applications like Swagger UI.
 2025-10-23 11:57:24 +00:00
dahoud
a48c07d0a9 Fix: Configure Swagger UI to load OpenAPI from /btpxpress/openapi via custom initializer 
Ajoute un fichier swagger-initializer.js personnalisé qui surcharge
l'URL par défaut pour charger l'OpenAPI spec depuis /btpxpress/openapi.

Cela corrige le problème où Swagger UI ne pouvait pas charger la spécification
derrière l'Ingress nginx avec rewrite-target.
 2025-10-23 11:40:03 +00:00
dahoud
a440d705b0 Fix: Configure Swagger UI to load OpenAPI from /btpxpress/openapi 
Ajoute quarkus.swagger-ui.url=/btpxpress/openapi pour corriger le chargement
de la spécification OpenAPI dans Swagger UI derrière l'Ingress nginx avec rewrite.
 2025-10-23 11:23:20 +00:00
dahoud
559a968d2c Fix: Allow public access to Swagger UI and OpenAPI endpoints 
Added explicit HTTP auth permissions to allow unauthenticated access to:
- /q/* (health endpoints)
- /openapi (OpenAPI spec)
- /swagger-ui/* (Swagger UI)

This fixes the issue where proactive auth mode blocked access to
documentation endpoints in production.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-20 13:02:07 +00:00
dahoud
3dc0ce9176 Fix: Remove quarkus.http.root-path to fix API routing 
The Ingress already handles the /btpxpress path prefix with rewrite-target,
so the backend should serve requests directly without a root-path.

This fixes the 404 errors when accessing endpoints like:
- https://api.lions.dev/btpxpress/q/health
- https://api.lions.dev/btpxpress/api/*

Before: Backend expected /btpxpress/q/health (due to root-path)
After: Backend serves /q/health (Ingress rewrites /btpxpress/... to /...)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-20 10:34:46 +00:00
dahoud
f2bb633142 Initial commit 2025-10-01 01:37:34 +00:00