feat(bff): add server-session BFF foundation and step-up (V2) - #103

Merged

cuioss-oliver merged 39 commits into

mainfrom

feature/bff-server-session

Jul 26, 2026

Commits on Jul 26, 2026

feat(bff): extend OIDC/session config surface for user-info and login folds

cuioss-oliver
and
claude
committed
feat(bff): add pending-authorization record, store, and browser-binding cookie

cuioss-oliver
and
claude
committed
feat(bff): add server-side session store and opaque session cookie

cuioss-oliver
and
claude
committed
feat(bff): add reserved-path registry and OIDC callback endpoint
cuioss-oliver
committed
feat(bff): add confidential-client login initiation flow
cuioss-oliver
committed
feat(gateway): implement require:session stage-4 runtime (D4)
cuioss-oliver
committed
feat(bff): add fixed CSRF defence for session routes

cuioss-oliver
and
claude
committed
feat(bff): add RP-initiated and back-channel logout (D8)

cuioss-oliver
and
claude
committed
chore(quality): normalize import ordering in bff sources

cuioss-oliver
and
claude
committed
test(bff): cover logout-token matrix and RP-initiated logout (D8)

cuioss-oliver
and
claude
committed
feat(bff): add transparent token refresh and RFC 9470 step-up (D9)

cuioss-oliver
and
claude
committed
feat(bff): add session metrics, LogRecords, and server-mode readiness

cuioss-oliver
and
claude
committed
feat(bff): add session/user-info reserved endpoint (fold)

cuioss-oliver
and
claude
committed
test(bff): cover session/user-info reserved endpoint (fold)

cuioss-oliver
and
claude
committed
feat(bff): add login-initiation reserved path with already-authenticated short-circuit

cuioss-oliver
and
claude
committed
feat(bff): wire server-mode BFF runtime into the live gateway edge

cuioss-oliver
and
claude
committed
feat(benchmarks): add session-mediation benchmark and comparison headline

cuioss-oliver
and
claude
committed
docs(bff): author three-layer server-session BFF documentation

cuioss-oliver
and
claude
committed
test(bff): add Keycloak-backed server-mode BFF integration tests

cuioss-oliver
and
claude
committed
fix(native): initialize BFF SecureRandom-holding classes at runtime
cuioss-oliver
committed
fix(native): initialize token-sheriff engine flow package at runtime
cuioss-oliver
committed
fix(it): resolve BFF oidc client_secret via env indirection
cuioss-oliver
committed
fix(it): keep mtls gateway.yaml in lockstep with the shared BFF endpoint

cuioss-oliver
and
claude
committed
fix(it): trust the private-CA IdP via the JVM default truststore for OIDC discovery (token-sheriff-client#597)

cuioss-oliver
and
claude
committed
fix(bff): register token-sheriff-client engine response DTOs for native DslJson deserialization

cuioss-oliver
and
claude
committed
fix(bff): address CodeRabbit review — events object claim, backslash open-redirect, local logout on failure, CSRF port normalization, bounded logout body, benchmark route

cuioss-oliver
and
claude
committed
fix(bff): honor session-stage short-circuit at the edge so unauthenticated require:session navigations redirect (302) instead of reaching the upstream

cuioss-oliver
and
claude
committed
chore(sonar): drive PR-103 new-code findings to zero (2 reliability bugs + smells)

cuioss-oliver
and
claude
committed
fix(bff): support OIDC form_post callback (POST /auth/callback, body-parsed code preserving BFF-13) and adapt the Keycloak IT flow

cuioss-oliver
and
claude
committed
fix(bff): guard nullable rawQuery in callback selector (Sonar S2637); surface CI login page in IT form-scrape failure

cuioss-oliver
and
claude
committed
fix(bff): send pre-encoded IT URLs verbatim and harden callbackParameters null-return

cuioss-oliver
and
claude
committed
fix(bff): read the reserved POST form body by resuming the paused request

cuioss-oliver
and
claude
committed
fix(bff): exempt reserved-path params from the url-parameter pipeline; fix userinfo IT assertion

cuioss-oliver
and
claude
committed
fix(bff): read reserved POST body eagerly on the event loop (robust under constrained CPU)

cuioss-oliver
and
claude
committed
docs(architecture): add threading-model rule — never drive inbound-socket I/O from the request virtual thread

cuioss-oliver
and
claude
committed
fix(bff): make the reserved-POST body-read deadline race-proof under CPU contention

cuioss-oliver
and
claude
committed
test(it): capture api-sheriff app logs on test failure + TEMP debug logging (diagnostic)

cuioss-oliver
and
claude
committed
fix(it): start Keycloak before the gateway so the JWKS loader finds it ready

cuioss-oliver
and
claude
committed
chore(it): remove the temporary diagnostic DEBUG logging

cuioss-oliver
and
claude
committed