chore: resolve issues with print service/client/auth

Author: jeastham1993

docker-compose.yml

@@ -249,6 +249,13 @@ services:
       - "5435:5432"
     volumes:
       - print-service-data:/var/lib/postgresql/data
+      - ./shared/infra/compose/postgres-init:/docker-entrypoint-initdb.d:ro
+    command:
+      - postgres
+      - -c
+      - shared_preload_libraries=pg_stat_statements
+      - -c
+      - pg_stat_statements.track=all
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U print_service_user -d print_service"]
       interval: 1s
@@ -348,7 +355,7 @@ services:
       dockerfile: src/Stickerlandia.PrintService.Api/Dockerfile
     container_name: print-service
     depends_on:
-      redpanda:
+      kafka:
         condition: service_healthy
       print-service-db-migrations:
         condition: service_completed_successfully
@@ -370,10 +377,10 @@ services:
       DRIVING: AGNOSTIC
       DRIVEN: AGNOSTIC
       DISABLE_SSL: "true"
-      ConnectionStrings__messaging: "redpanda:9092"
+      ConnectionStrings__messaging: "kafka:29092"
       ConnectionStrings__database: "Host=print-service-db;Port=5432;Database=print_service;Username=print_service_user;Password=print_service_password"
-      KAFKA__BOOTSTRAPSERVERS: "redpanda:9092"
-      KAFKA__SCHEMAREGISTRY: "http://redpanda:8082"
+      KAFKA__BOOTSTRAPSERVERS: "kafka:9092"
+      KAFKA__SCHEMAREGISTRY: "http://kafka:8082"
       KAFKA__GROUPID: "stickerlandia-print"
       Authentication__Audience: "stickerlandia"
       Authentication__Authority: ${DEPLOYMENT_HOST_URL}
@@ -384,7 +391,7 @@ services:
       DEPLOYMENT_HOST_URL: ${DEPLOYMENT_HOST_URL}
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080/api/print/v1/health"]
-      interval: 1s
+      interval: 120s
       timeout: 15s
       retries: 10
     labels:
@@ -401,6 +408,8 @@ services:
     depends_on:
       print-service-db:
         condition: service_healthy
+      kafka:
+        condition: service_healthy
     environment:
       # DataDog APM configuration
       DD_SERVICE: print-service-migration-service
@@ -413,10 +422,10 @@ services:
       ASPNETCORE_ENVIRONMENT: Development
       DRIVING: AGNOSTIC
       DRIVEN: AGNOSTIC
-      ConnectionStrings__messaging: "redpanda:9092"
+      ConnectionStrings__messaging: "kafka:29092"
       ConnectionStrings__database: "Host=print-service-db;Port=5432;Database=print_service;Username=print_service_user;Password=print_service_password"
-      KAFKA__BOOTSTRAPSERVERS: "redpanda:9092"
-      KAFKA__SCHEMAREGISTRY: "http://redpanda:8082"
+      KAFKA__BOOTSTRAPSERVERS: "kafka:9092"
+      KAFKA__SCHEMAREGISTRY: "http://kafka:8082"
       KAFKA__GROUPID: "stickerlandia-print"
       DEPLOYMENT_HOST_URL: ${DEPLOYMENT_HOST_URL}
     command: ["migrations/Stickerlandia.PrintService.MigrationService.dll"]
@@ -519,6 +528,8 @@ services:
     depends_on:
       user-management-db:
         condition: service_healthy
+      kafka:
+        condition: service_healthy
     environment:
       # DataDog APM configuration
       DD_SERVICE: user-management-migration-service
@@ -778,3 +789,9 @@ configs:
           username: datadog
           password: datadog_password
           dbname: sticker_catalogue
+        - dbm: true
+          host: print-service-db
+          port: 5432
+          username: datadog
+          password: datadog_password
+          dbname: print_service

print-service/src/Stickerlandia.PrintService.Api/Configurations/AuthenticationExtensions.cs

@@ -25,6 +25,10 @@ public static IServiceCollection AddPrintServiceAuthentication(
         services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
             .AddJwtBearer(options =>
             {
+                // Prevent mapping "role" → long ClaimTypes.Role URI so that
+                // RoleClaimType = "role" matches the actual JWT claim name.
+                options.MapInboundClaims = false;
+
                 if (authMode.Equals("OidcDiscovery", StringComparison.OrdinalIgnoreCase))
                 {
                     ConfigureOidcDiscovery(options, configuration);
@@ -70,7 +74,8 @@ private static void ConfigureOidcDiscovery(JwtBearerOptions options, IConfigurat
             ValidAudience = audience,
             ValidateLifetime = true,
             ValidateIssuerSigningKey = true,
-            ClockSkew = TimeSpan.FromMinutes(5)
+            ClockSkew = TimeSpan.FromMinutes(5),
+            RoleClaimType = "role"
         };
 
         // If a separate metadata address is configured, use it for all OIDC fetching
@@ -82,13 +87,15 @@ private static void ConfigureOidcDiscovery(JwtBearerOptions options, IConfigurat
                 metadataAddress += "/";
             }
 
-            using var httpHandler = new HttpClientHandler();
+            var httpHandler = new HttpClientHandler();
             if (!requireHttpsMetadata)
             {
                 httpHandler.ServerCertificateCustomValidationCallback = (_, _, _, _) => true;
             }
 
-            using var httpClient = new HttpClient(httpHandler);
+            // Do NOT use 'using var' here — the HttpClient is captured by the
+            // IssuerSigningKeyResolver lambda and must survive beyond this method.
+            var httpClient = new HttpClient(httpHandler);
             var internalJwksUrl = metadataAddress + ".well-known/jwks";
 
             // Use IssuerSigningKeyResolver to dynamically fetch keys from internal URL
@@ -135,7 +142,8 @@ private static void ConfigureSymmetricKey(JwtBearerOptions options, IConfigurati
             ValidateLifetime = true,
             ValidateIssuerSigningKey = true,
             IssuerSigningKey = new SymmetricSecurityKey(Convert.FromBase64String(signingKey)),
-            ClockSkew = TimeSpan.FromMinutes(5)
+            ClockSkew = TimeSpan.FromMinutes(5),
+            RoleClaimType = "role"
         };
     }
 }

print-service/src/Stickerlandia.PrintService.Client/print-jobs/2026-01-15/28969626-0aaf-4b69-b059-3cc2186ee4cd.json

@@ -24,8 +24,6 @@ public bool IsValid()
     {
         return !string.IsNullOrEmpty(UserId)
                && !string.IsNullOrEmpty(StickerId)
-               && !string.IsNullOrEmpty(StickerUrl)
-               && Uri.TryCreate(StickerUrl, UriKind.Absolute, out var uri)
-               && (uri.Scheme == Uri.UriSchemeHttp || uri.Scheme == Uri.UriSchemeHttps);
+               && !string.IsNullOrEmpty(StickerUrl);
     }
 }

print-service/src/Stickerlandia.PrintService.Client/print-jobs/2026-01-15/e799f018-7edf-4e9c-bd47-701695dd627f.json

@@ -19,5 +19,5 @@ public RegisterPrinterResponse(Printer printer) : base(printer)
         Key = printer.Key;
     }
 
-    [JsonPropertyName("Key")] public string Key { get; set; } = string.Empty;
+    [JsonPropertyName("key")] public string Key { get; set; } = string.Empty;
 }

print-service/src/Stickerlandia.PrintService.Core/PrintJobs/SubmitPrintJobCommand.cs

@@ -122,6 +122,16 @@ public static IServiceCollection AddCoreAuthentication(this IServiceCollection s
                             context.EmailVerified = false;
                         }
 
+                        if (context.AccessTokenPrincipal.HasScope(OpenIddictConstants.Scopes.Roles))
+                        {
+                            var roles = context.AccessTokenPrincipal.GetClaims(OpenIddictConstants.Claims.Role);
+                            if (roles.Any())
+                            {
+                                context.Claims[OpenIddictConstants.Claims.Role] =
+                                    System.Text.Json.JsonSerializer.SerializeToElement(roles.ToList());
+                            }
+                        }
+
                         return default;
                     }));
             })

print-service/src/Stickerlandia.PrintService.Core/RegisterPrinter/RegisterPrinterResponse.cs

@@ -167,7 +167,7 @@ await manager.CreateAsync(new OpenIddictApplicationDescriptor
             {
                 EmailAddress = "admin@stickerlandia.com",
                 FirstName = "Default",
-                LastName = "User",
+                LastName = "Admin",
                 Password = "Admin2025!"
             }, AccountType.Admin);
 

user-management/src/Stickerlandia.UserManagement.Auth/AuthServiceExtensions.cs

@@ -63,7 +63,7 @@ app.use(lusca({
     secret: process.env.CSRF_SECRET || 'dev-csrf-secret-change-in-production',
     cookie: true, // Store CSRF token in cookie
     header: 'x-csrf-token', // Accept token in header
-    whitelist: ['/api/app/auth/callback'] // Skip CSRF for OAuth callback
+    whitelist: ['/api/app/auth/callback', '/api/app/auth/token'] // Skip CSRF for OAuth callback and token exchange
   },
   csp: false, // Disable Lusca's CSP (we use Helmet)
   xframe: false, // Disable Lusca's X-Frame-Options (we use Helmet)
@@ -182,9 +182,6 @@ app.post('/api/app/auth/login', loginRateLimit, (req, res) => {
 // Step 3: IdP redirects back to BFF with authorization code
 app.get('/api/app/auth/callback', async (req, res) => {
   try {
-    console.debug('Callback URL:', req.url)
-    console.debug('Query params:', req.query)
-    
     if (!client) {
       return res.status(500).send('OIDC client not initialized')
     }
@@ -212,29 +209,11 @@ app.get('/api/app/auth/callback', async (req, res) => {
     }
 
     // Exchange authorization code for tokens
-    console.debug('Attempting token exchange with:', {
-      redirect_uri: sessionOAuth.redirect_uri,
-      code: code.substring(0, 10) + '...',
-      state: state.substring(0, 10) + '...',
-      issuer: client.issuer.issuer
-    })
-    
-    console.debug('Full callback parameters:', { code, state })
-    console.debug('Session OAuth data:', sessionOAuth)
-    console.debug('Client issuer metadata:', {
-      issuer: client.issuer.issuer,
-      token_endpoint: client.issuer.token_endpoint
-    })
-    
-    // Debug what we're passing to callback
-    const checks = { 
+    const checks = {
       code_verifier: sessionOAuth.code_verifier,
       nonce: sessionOAuth.nonce,
       state: sessionOAuth.state
     }
-    console.debug('Callback params:', callbackParams)
-    console.debug('Callback checks:', checks)
-    console.debug('Using configured redirect URI:', sessionOAuth.redirect_uri)
 
     const tokenSet = await client.callback(sessionOAuth.redirect_uri, callbackParams, checks)
 
@@ -255,11 +234,13 @@ app.get('/api/app/auth/callback', async (req, res) => {
     // Clear OAuth temp data
     delete req.session.oauth
 
-    // Redirect back to frontend with token in query params (for new client-side flow)
-    const queryParams = new URLSearchParams()
-    queryParams.set('access_token', tokenSet.access_token)
-    queryParams.set('expires_at', tokenSet.expires_at)
-    res.redirect(`/?${queryParams.toString()}`)
+    // Flag that a token is ready for pickup via /api/app/auth/token
+    req.session.pendingToken = {
+      access_token: tokenSet.access_token,
+      expires_at: tokenSet.expires_at
+    }
+
+    res.redirect('/?auth=complete')
   } catch (error) {
     console.error('OAuth callback failed:', error)
     res.status(400).send('Authentication failed')
@@ -300,6 +281,22 @@ app.get('/api/app/auth/user', async (req, res) => {
   }
 })
 
+// One-time token exchange — frontend calls this after ?auth=complete redirect
+app.post('/api/app/auth/token', (req, res) => {
+  const pending = req.session.pendingToken
+  if (!pending) {
+    return res.status(404).json({ error: 'No pending token' })
+  }
+
+  // Clear immediately so the token can only be retrieved once
+  delete req.session.pendingToken
+
+  res.json({
+    access_token: pending.access_token,
+    expires_at: pending.expires_at
+  })
+})
+
 // Logout - clear session and optionally call IdP logout
 app.post('/api/app/auth/logout', (req, res) => {
   // Capture id_token before destroying session
@@ -308,7 +305,7 @@ app.post('/api/app/auth/logout', (req, res) => {
   // Clear session and cookie
   req.session.destroy((err) => {
     if (err) console.error('Session destroy error:', err)
-    res.clearCookie('connect.sid', { path: '/' })
+    res.clearCookie('sessionId', { path: '/' })
 
     if (idToken && client) {
       // Generate IdP logout URL with correct deployment host

user-management/src/Stickerlandia.UserManagement.MigrationService/Worker.cs

@@ -7,6 +7,7 @@ import { API_BASE_URL } from "../config";
 import AuthService from "../services/AuthService";
 import { useAuth } from "../context/AuthContext";
 import { authFetch } from "../utils/authFetch";
+import { getLastActiveEvent } from "../services/eventStorage";
 
 function StickerDetail() {
   const { id } = useParams();
@@ -164,7 +165,13 @@ function StickerDetail() {
                     </div>
                     <div className="flex justify-center">
                       <button
-                        onClick={() => navigate('/print-station', { state: { sticker } })}
+                        onClick={() => {
+                          const lastEvent = getLastActiveEvent()
+                          const path = lastEvent
+                            ? `/print-station/${encodeURIComponent(lastEvent)}`
+                            : '/print-station'
+                          navigate(path, { state: { sticker } })
+                        }}
                         className="flex items-center gap-2 px-6 py-3 bg-purple-600 text-white rounded-lg hover:bg-purple-700 transition-colors"
                       >
                         <LocalPrintshopOutlinedIcon />