Feat/auth bff v1

[shyeavr]

Summary

This PR implements the Auth Manager BFF service — a Backend-for-Frontend that acts as the single entry point for auth-ui, routing traffic to the auth-manager instance and environment-specific OPA servers.

---

What's Included

Native Endpoints

GET /capabilities

Returns the current BFF state so the UI can adapt dynamically:

{
  "site": "...",
  "environments": ["np", "stage", "prod"],
  "features": {
    "managerEnabled": true,
    "opaEnabled": true
  }
}

Auth Manager Proxy (/manager/*)

• Transparently proxies all requests to the configured manager.url
• Returns 503 Service Unavailable with:

{
  "message": "Auth Manager capabilities are disabled on this node"
}

when manager.enabled = false

• Returns 502 Bad Gateway with:

{
  "message": "Auth Manager is currently unreachable"
}

on upstream failure

OPA Proxy (/opa/{environment}/evaluate/*)

• Looks up the OPA server URL from configuration using the {environment} path parameter
• Rewrites the request path by stripping /opa/{environment}/evaluate and prepending /v1/data

Example:

POST /opa/prod/evaluate/authz/allow
→
POST http://opa-prod:8181/v1/data/authz/allow

• Method filter:

  • GET and POST are allowed
  • PUT, PATCH, and DELETE return 405 Method Not Allowed

• Returns 503 Service Unavailable when opa.enabled = false

• Returns 404 Not Found when the requested environment does not exist in configuration

• Returns:

{
  "message": "OPA server is unreachable",
  "environment": "...",
  "targetUrl": "..."
}

on upstream failure

Cross-Cutting Concerns

CORS

• Global middleware configured from the cors.allowedDomains configuration array

Authentication Middleware

• Placeholder middleware that currently calls next() on /manager/* and /opa/* routes
• Ready for future JWT validation implementation

Telemetry

• http-proxy-middleware transparently forwards OpenTelemetry headers (including traceparent)
• No caching is performed

---

Code Standards & Quality

• Aligned with the TypeScript server boilerplate architecture
• Dependency Injection implemented using TSyringe
• Configuration injected through constructors instead of accessing configuration as a singleton inside middleware
• Middleware refactored to a factory pattern (createX(config)) to improve testability
• Renamed directories to follow the plural convention (middlewares/)
• Removed hardcoded cluster URLs from configuration
• Removed unused jsonwebtoken and jwks-rsa dependencies
• 35 tests passing (unit and integration tests)
• Code coverage ≥ 98%

[ronenkapelian]

1.Placeholder tests are still in the codebase
tests/integration/capabilities/capabilities.spec.ts:54-56 "should in theory test 400 status code" → expect(true).toBe(true)
tests/integration/capabilities/capabilities.spec.ts:60-62 "should in theory test 500 status code" → expect(true).toBe(true)
tests/integration/manager/manager.spec.ts:58-60 "should in theory test 500 status code" → expect(true).toBe(true)
tests/integration/opa/opa.spec.ts:77-79 "should in theory test 500 status code" → expect(true).toBe(true)

2. npm run generate:openapi-types - regenrate it, (you changes the openapi spec so it should be generated
   it seems that npm run lint fails locally - validate it - and fix

3.npm run lint:openapi
you also have warning to solve it

Very good progress Shyeke

[ronenkapelian]

also rename to middlewares