9ae20bc441
Why: protect admin endpoints with thalos session validation. What: add edge auth guard call to thalos session/me, preserve anonymous health endpoints, and add auth enforcement docs. Rule: keep identity ownership in thalos and standardize edge auth behavior.
46 lines
980 B
Markdown
46 lines
980 B
Markdown
# Auth Enforcement
|
|
|
|
## Scope
|
|
|
|
This BFF enforces authenticated access on business endpoints using Thalos session validation.
|
|
|
|
## Protected Endpoints
|
|
|
|
- `/api/restaurant/admin/config`
|
|
- `/api/restaurant/admin/service-window`
|
|
|
|
## Anonymous Endpoints
|
|
|
|
- `/health`
|
|
- `/healthz`
|
|
|
|
## Session Validation Contract
|
|
|
|
- BFF requires at least one session cookie:
|
|
- `thalos_session`
|
|
- `thalos_refresh`
|
|
- BFF calls Thalos session introspection endpoint:
|
|
- `GET /api/identity/session/me`
|
|
- Base address configured by:
|
|
- `ThalosAuth:BaseAddress`
|
|
|
|
## Error Semantics
|
|
|
|
Standard auth error payload:
|
|
|
|
```json
|
|
{
|
|
"code": "unauthorized|forbidden|session_missing|session_invalid",
|
|
"message": "human-readable message",
|
|
"correlationId": "request correlation id"
|
|
}
|
|
```
|
|
|
|
- `401`: missing or invalid session
|
|
- `403`: permission denied by identity service
|
|
|
|
## Correlation
|
|
|
|
- Incoming/outgoing correlation header: `x-correlation-id`
|
|
- Correlation ID is forwarded to Thalos session validation call.
|