b507a3bd65
Why: protect waiter business endpoints with thalos session validation. What: add edge auth guard call to thalos session/me, preserve anonymous health endpoints, and add auth enforcement docs. Rule: keep identity ownership in thalos and standardize edge auth behavior.
46 lines
969 B
Markdown
46 lines
969 B
Markdown
# Auth Enforcement
|
|
|
|
## Scope
|
|
|
|
This BFF enforces authenticated access on business endpoints using Thalos session validation.
|
|
|
|
## Protected Endpoints
|
|
|
|
- `/api/waiter/floor/assignments`
|
|
- `/api/waiter/floor/orders`
|
|
|
|
## Anonymous Endpoints
|
|
|
|
- `/health`
|
|
- `/healthz`
|
|
|
|
## Session Validation Contract
|
|
|
|
- BFF requires at least one session cookie:
|
|
- `thalos_session`
|
|
- `thalos_refresh`
|
|
- BFF calls Thalos session introspection endpoint:
|
|
- `GET /api/identity/session/me`
|
|
- Base address configured by:
|
|
- `ThalosAuth:BaseAddress`
|
|
|
|
## Error Semantics
|
|
|
|
Standard auth error payload:
|
|
|
|
```json
|
|
{
|
|
"code": "unauthorized|forbidden|session_missing|session_invalid",
|
|
"message": "human-readable message",
|
|
"correlationId": "request correlation id"
|
|
}
|
|
```
|
|
|
|
- `401`: missing or invalid session
|
|
- `403`: permission denied by identity service
|
|
|
|
## Correlation
|
|
|
|
- Incoming/outgoing correlation header: `x-correlation-id`
|
|
- Correlation ID is forwarded to Thalos session validation call.
|