Merge pull request #3 from bcgov/alex-feature-work

front end, api libraries, auth

Author: alex-struk

apps/backend-services/.env.sample

@@ -1,16 +1,10 @@
 # Database Configuration
 DATABASE_URL="postgresql://postgres:postgres@localhost:5432/ai_doc_intelligence?schema=public"
 
-# Application Configuration
-PORT=3002
-NODE_ENV=development
-
-# CORS Configuration
+# BC Gov SSO Express Configuration
 FRONTEND_URL=http://localhost:3000
-
-# Storage Configuration
-UPLOAD_DESTINATION=./storage/uploads
-
-# OCR Configuration (if needed)
-AZURE_FORM_RECOGNIZER_ENDPOINT=
-AZURE_FORM_RECOGNIZER_KEY=
+BACKEND_URL=http://localhost:3002
+SSO_AUTH_SERVER_URL=https://dev.loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect
+SSO_REALM=standard
+SSO_CLIENT_ID=xxxxxxxxxxxxxxxx
+SSO_CLIENT_SECRET=xxxxxx

apps/backend-services/package.json

@@ -24,15 +24,18 @@
     "db:seed": "tsx prisma/seed.ts"
   },
   "dependencies": {
+    "@bcgov/citz-imb-sso-express": "^1.0.2",
     "@nestjs/common": "^11.0.1",
     "@nestjs/config": "^4.0.2",
     "@nestjs/core": "^11.0.1",
-    "@nestjs/platform-fastify": "^11.0.1",
+    "@nestjs/platform-express": "^11.1.9",
     "@prisma/client": "^6.19.0",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.0",
+    "cookie-parser": "^1.4.7",
     "dotenv": "^17.2.3",
-    "fastify": "^5.0.0",
+    "jsonwebtoken": "^9.0.2",
+    "jwks-rsa": "^3.2.0",
     "pg": "^8.16.3",
     "prisma": "^6.19.0",
     "reflect-metadata": "^0.1.13",
@@ -46,6 +49,7 @@
     "@swc/cli": "^0.7.9",
     "@swc/core": "^1.15.0",
     "@types/jest": "^29.5.11",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^22.0.0",
     "@types/uuid": "^9.0.8",
     "eslint-config-custom": "file:../../packages/eslint-config-custom",

apps/backend-services/src/app.module.ts

@@ -1,5 +1,6 @@
 import { Module } from '@nestjs/common';
 import { ConfigModule } from '@nestjs/config';
+import { AuthModule } from './auth/auth.module';
 import { UploadModule } from './upload/upload.module';
 import { DatabaseModule } from './database/database.module';
 import { DocumentModule } from './document/document.module';
@@ -13,6 +14,7 @@ import { OcrModule } from './ocr/ocr.module';
       envFilePath: '.env',
       cache: true,
     }),
+    AuthModule,
     DatabaseModule,
     DocumentModule,
     QueueModule,

apps/backend-services/src/auth/auth.module.ts

@@ -0,0 +1,20 @@
+import { Module } from '@nestjs/common';
+import { ConfigModule } from '@nestjs/config';
+import { APP_GUARD } from '@nestjs/core';
+import { BCGovAuthGuard } from './bcgov-auth.guard';
+import { RolesGuard } from './roles.guard';
+
+@Module({
+  imports: [ConfigModule],
+  providers: [
+    {
+      provide: APP_GUARD,
+      useClass: BCGovAuthGuard,
+    },
+    {
+      provide: APP_GUARD,
+      useClass: RolesGuard,
+    },
+  ],
+})
+export class AuthModule {}

apps/backend-services/src/auth/bcgov-auth.guard.ts

@@ -0,0 +1,122 @@
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  UnauthorizedException,
+  ForbiddenException,
+} from '@nestjs/common';
+import { Request } from 'express';
+import { Reflector } from '@nestjs/core';
+import { ConfigService } from '@nestjs/config';
+import * as jwt from 'jsonwebtoken';
+import { JwksClient } from 'jwks-rsa';
+import { IS_PUBLIC_KEY } from './public.decorator';
+
+interface User {
+  idir_username?: string;
+  display_name?: string;
+  email?: string;
+  roles?: string[];
+  [key: string]: unknown; // Allow additional properties from JWT
+}
+
+declare module 'express' {
+  interface Request {
+    user?: User;
+  }
+}
+
+@Injectable()
+export class BCGovAuthGuard implements CanActivate {
+  private jwksClient: JwksClient;
+
+  constructor(
+    private configService: ConfigService,
+    private reflector: Reflector,
+  ) {
+    const ssoAuthServerUrl = this.configService.get<string>('SSO_AUTH_SERVER_URL');
+
+    // If SSO_AUTH_SERVER_URL includes the full OIDC path, extract the base realm URL
+    let jwksUri: string;
+    if (ssoAuthServerUrl.includes('/protocol/openid-connect')) {
+      // SSO_AUTH_SERVER_URL is the full OIDC endpoint
+      jwksUri = ssoAuthServerUrl.replace('/protocol/openid-connect', '') + '/protocol/openid-connect/certs';
+    } else {
+      // SSO_AUTH_SERVER_URL is the base Keycloak URL
+      const realm = this.configService.get<string>('SSO_REALM');
+      jwksUri = `${ssoAuthServerUrl}/realms/${realm}/protocol/openid-connect/certs`;
+    }
+
+    this.jwksClient = new JwksClient({
+      jwksUri,
+      cache: true,
+      cacheMaxAge: 86400000, // 24 hours
+    });
+  }
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    // Check if route is public
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (isPublic) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest<Request>();
+    const authHeader = request.headers['authorization'];
+
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      throw new UnauthorizedException('No Bearer token provided');
+    }
+
+    const token = authHeader.substring(7);
+
+    try {
+      const user = await this.validateToken(token);
+      // Attach user to request (like Express middleware does)
+      request.user = user;
+      return true;
+    } catch {
+      throw new ForbiddenException('Invalid token');
+    }
+  }
+
+  private async validateToken(token: string): Promise<User> {
+    try {
+      // Decode token header to get key ID
+      const decoded = jwt.decode(token, { complete: true });
+      if (!decoded || !decoded.header.kid) {
+        throw new UnauthorizedException('Invalid token format');
+      }
+
+      // Get signing key
+      const key = await this.jwksClient.getSigningKey(decoded.header.kid);
+      const signingKey = key.getPublicKey();
+
+      // Determine the correct issuer
+      const ssoAuthServerUrl = this.configService.get<string>('SSO_AUTH_SERVER_URL');
+      let expectedIssuer: string;
+      if (ssoAuthServerUrl.includes('/protocol/openid-connect')) {
+        // SSO_AUTH_SERVER_URL is the full OIDC endpoint, issuer is the realm URL
+        expectedIssuer = ssoAuthServerUrl.replace('/protocol/openid-connect', '');
+      } else {
+        // SSO_AUTH_SERVER_URL is the base Keycloak URL
+        const realm = this.configService.get<string>('SSO_REALM');
+        expectedIssuer = `${ssoAuthServerUrl}/realms/${realm}`;
+      }
+
+      // Verify and decode token
+      const verified = jwt.verify(token, signingKey, {
+        algorithms: ['RS256'],
+        issuer: expectedIssuer,
+      });
+
+      return verified as User;
+    } catch {
+      throw new UnauthorizedException('Token validation failed');
+    }
+  }
+}

apps/backend-services/src/auth/public.decorator.ts

@@ -0,0 +1,4 @@
+import { SetMetadata, MethodDecorator, ClassDecorator } from '@nestjs/common';
+
+export const IS_PUBLIC_KEY = 'isPublic';
+export const Public = (): MethodDecorator & ClassDecorator => SetMetadata(IS_PUBLIC_KEY, true);

apps/backend-services/src/auth/roles.decorator.ts

@@ -0,0 +1,4 @@
+import { SetMetadata, MethodDecorator, ClassDecorator } from '@nestjs/common';
+
+export const ROLES_KEY = 'roles';
+export const Roles = (...roles: string[]): MethodDecorator & ClassDecorator => SetMetadata(ROLES_KEY, roles);

apps/backend-services/src/auth/roles.guard.ts

@@ -0,0 +1,34 @@
+import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { ROLES_KEY } from './roles.decorator';
+
+@Injectable()
+export class RolesGuard implements CanActivate {
+  constructor(private reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const requiredRoles = this.reflector.getAllAndOverride<string[]>(ROLES_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (!requiredRoles) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+
+    if (!user || !user.roles) {
+      throw new ForbiddenException('User has no roles');
+    }
+
+    const hasRole = requiredRoles.some((role) => user.roles.includes(role));
+
+    if (!hasRole) {
+      throw new ForbiddenException('Insufficient permissions');
+    }
+
+    return true;
+  }
+}

apps/backend-services/src/database/database.service.ts

@@ -72,6 +72,24 @@ export class DatabaseService implements OnModuleInit {
     }
   }
 
+  async findAllDocuments(): Promise<DocumentData[]> {
+    this.logger.debug('=== DatabaseService.findAllDocuments ===');
+
+    try {
+      const documents = await this.prisma.document.findMany({
+        orderBy: { created_at: 'desc' },
+      });
+
+      this.logger.debug(`Found ${documents.length} documents`);
+      this.logger.debug('=== DatabaseService.findAllDocuments completed ===');
+
+      return documents;
+    } catch (error) {
+      this.logger.error(`Failed to find documents: ${error.message}`, error.stack);
+      throw error;
+    }
+  }
+
   async updateDocument(
     id: string,
     data: Partial<Omit<DocumentData, 'id' | 'created_at'>>,

apps/backend-services/src/document/document.controller.ts

@@ -6,8 +6,11 @@ import {
   HttpStatus,
   Logger,
   NotFoundException,
+  Req,
 } from '@nestjs/common';
-import { DatabaseService } from '../database/database.service';
+import { Request } from 'express';
+import { Roles } from '../auth/roles.decorator';
+import { DatabaseService, DocumentData } from '../database/database.service';
 import { OcrResult } from '../ocr/ocr.service';
 
 @Controller('api')
@@ -16,6 +19,71 @@ export class DocumentController {
 
   constructor(private readonly databaseService: DatabaseService) {}
 
+  @Get('protected')
+  getProtectedData(@Req() req: Request): {
+    message: string;
+    user: {
+      idirUsername?: string;
+      displayName?: string;
+      email?: string;
+    };
+  } {
+    const user = req.user; // Contains decoded token
+    return {
+      message: 'Protected data',
+      user: {
+        idirUsername: user?.idir_username,
+        displayName: user?.display_name,
+        email: user?.email,
+      }
+    };
+  }
+
+  @Get('admin')
+  @Roles('admin')
+  getAdminData(@Req() req: Request): {
+    message: string;
+    user: {
+      idirUsername?: string;
+      displayName?: string;
+      email?: string;
+      roles: string[];
+    };
+  } {
+    const user = req.user;
+    return {
+      message: 'Admin only data',
+      user: {
+        idirUsername: user?.idir_username,
+        displayName: user?.display_name,
+        email: user?.email,
+        roles: user?.roles || [],
+      }
+    };
+  }
+
+  @Get('documents')
+  @HttpCode(HttpStatus.OK)
+  async getAllDocuments(): Promise<DocumentData[]> {
+    this.logger.debug('=== DocumentController.getAllDocuments ===');
+
+    try {
+      const documents = await this.databaseService.findAllDocuments();
+
+      this.logger.debug(`Retrieved ${documents.length} documents`);
+      this.logger.debug('=== DocumentController.getAllDocuments completed ===');
+
+      return documents;
+    } catch (error) {
+      this.logger.error(`Error retrieving documents: ${error.message}`);
+      this.logger.error(`Stack: ${error.stack}`);
+
+      throw new NotFoundException(
+        error.message || 'Failed to retrieve documents',
+      );
+    }
+  }
+
   @Get('documents/:documentId/ocr')
   @HttpCode(HttpStatus.OK)
   async getOcrResult(@Param('documentId') documentId: string): Promise<OcrResult> {