feat(bff): add server-session BFF foundation and step-up (V2)#103

Open

cuioss-oliver wants to merge 32 commits into

mainfrom

feature/bff-server-session

Commits on Jul 25, 2026

feat(bff): extend OIDC/session config surface for user-info and login folds

cuioss-oliver
and
claude
committed
feat(bff): add pending-authorization record, store, and browser-binding cookie

cuioss-oliver
and
claude
committed
feat(bff): add server-side session store and opaque session cookie

cuioss-oliver
and
claude
committed
feat(bff): add reserved-path registry and OIDC callback endpoint
cuioss-oliver
committed
feat(bff): add confidential-client login initiation flow
cuioss-oliver
committed
feat(gateway): implement require:session stage-4 runtime (D4)
cuioss-oliver
committed
feat(bff): add fixed CSRF defence for session routes

cuioss-oliver
and
claude
committed
feat(bff): add RP-initiated and back-channel logout (D8)

cuioss-oliver
and
claude
committed
chore(quality): normalize import ordering in bff sources

cuioss-oliver
and
claude
committed
test(bff): cover logout-token matrix and RP-initiated logout (D8)

cuioss-oliver
and
claude
committed
feat(bff): add transparent token refresh and RFC 9470 step-up (D9)

cuioss-oliver
and
claude
committed
feat(bff): add session metrics, LogRecords, and server-mode readiness

cuioss-oliver
and
claude
committed
feat(bff): add session/user-info reserved endpoint (fold)

cuioss-oliver
and
claude
committed
test(bff): cover session/user-info reserved endpoint (fold)

cuioss-oliver
and
claude
committed
feat(bff): add login-initiation reserved path with already-authenticated short-circuit

cuioss-oliver
and
claude
committed
feat(bff): wire server-mode BFF runtime into the live gateway edge

cuioss-oliver
and
claude
committed
feat(benchmarks): add session-mediation benchmark and comparison headline

cuioss-oliver
and
claude
committed
docs(bff): author three-layer server-session BFF documentation

cuioss-oliver
and
claude
committed
test(bff): add Keycloak-backed server-mode BFF integration tests

cuioss-oliver
and
claude
committed
fix(native): initialize BFF SecureRandom-holding classes at runtime
cuioss-oliver
committed
fix(native): initialize token-sheriff engine flow package at runtime
cuioss-oliver
committed
fix(it): resolve BFF oidc client_secret via env indirection
cuioss-oliver
committed
fix(it): keep mtls gateway.yaml in lockstep with the shared BFF endpoint

cuioss-oliver
and
claude
committed
fix(it): trust the private-CA IdP via the JVM default truststore for OIDC discovery (token-sheriff-client#597)

cuioss-oliver
and
claude
committed
fix(bff): register token-sheriff-client engine response DTOs for native DslJson deserialization

cuioss-oliver
and
claude
committed
fix(bff): address CodeRabbit review — events object claim, backslash open-redirect, local logout on failure, CSRF port normalization, bounded logout body, benchmark route

cuioss-oliver
and
claude
committed
fix(bff): honor session-stage short-circuit at the edge so unauthenticated require:session navigations redirect (302) instead of reaching the upstream

cuioss-oliver
and
claude
committed
chore(sonar): drive PR-103 new-code findings to zero (2 reliability bugs + smells)

cuioss-oliver
and
claude
committed
fix(bff): support OIDC form_post callback (POST /auth/callback, body-parsed code preserving BFF-13) and adapt the Keycloak IT flow

cuioss-oliver
and
claude
committed
fix(bff): guard nullable rawQuery in callback selector (Sonar S2637); surface CI login page in IT form-scrape failure

cuioss-oliver
and
claude
committed
fix(bff): send pre-encoded IT URLs verbatim and harden callbackParameters null-return

cuioss-oliver
and
claude
committed
fix(bff): read the reserved POST form body by resuming the paused request

cuioss-oliver
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(bff): add server-session BFF foundation and step-up (V2)#103

feat(bff): add server-session BFF foundation and step-up (V2)#103
cuioss-oliver wants to merge 32 commits into
mainfrom
feature/bff-server-session

Commits on Jul 25, 2026

feat(bff): extend OIDC/session config surface for user-info and login folds

feat(bff): add pending-authorization record, store, and browser-binding cookie

feat(bff): add server-side session store and opaque session cookie

feat(bff): add reserved-path registry and OIDC callback endpoint

feat(bff): add confidential-client login initiation flow

feat(gateway): implement require:session stage-4 runtime (D4)

feat(bff): add fixed CSRF defence for session routes

feat(bff): add RP-initiated and back-channel logout (D8)

chore(quality): normalize import ordering in bff sources

test(bff): cover logout-token matrix and RP-initiated logout (D8)

feat(bff): add transparent token refresh and RFC 9470 step-up (D9)

feat(bff): add session metrics, LogRecords, and server-mode readiness

feat(bff): add session/user-info reserved endpoint (fold)

test(bff): cover session/user-info reserved endpoint (fold)

feat(bff): add login-initiation reserved path with already-authenticated short-circuit

feat(bff): wire server-mode BFF runtime into the live gateway edge

feat(benchmarks): add session-mediation benchmark and comparison headline

docs(bff): author three-layer server-session BFF documentation

test(bff): add Keycloak-backed server-mode BFF integration tests

fix(native): initialize BFF SecureRandom-holding classes at runtime

fix(native): initialize token-sheriff engine flow package at runtime

fix(it): resolve BFF oidc client_secret via env indirection

fix(it): keep mtls gateway.yaml in lockstep with the shared BFF endpoint

fix(it): trust the private-CA IdP via the JVM default truststore for OIDC discovery (token-sheriff-client#597)

fix(bff): register token-sheriff-client engine response DTOs for native DslJson deserialization

fix(bff): address CodeRabbit review — events object claim, backslash open-redirect, local logout on failure, CSRF port normalization, bounded logout body, benchmark route

fix(bff): honor session-stage short-circuit at the edge so unauthenticated require:session navigations redirect (302) instead of reaching the upstream

chore(sonar): drive PR-103 new-code findings to zero (2 reliability bugs + smells)

fix(bff): support OIDC form_post callback (POST /auth/callback, body-parsed code preserving BFF-13) and adapt the Keycloak IT flow

fix(bff): guard nullable rawQuery in callback selector (Sonar S2637); surface CI login page in IT form-scrape failure

fix(bff): send pre-encoded IT URLs verbatim and harden callbackParameters null-return

fix(bff): read the reserved POST form body by resuming the paused request