Add OpenFGC Portal Backend

[rashmithachamikara]

Purpose

Bootstrap and initialize the OpenFGC Portal backend BFF (Backend-For-Frontend) with API proxying, security hardening, and backend infrastructure.

Goals

• Bootstrap the backend BFF with a proxy layer
• Set up linters, configurations, tests, and project structure
• Add CI/CD scripts for the backend project
• Set up API proxying between frontend and consent server
• Implement request forwarding and security middleware

Approach

• Built the backend using Go with a stateless BFF architecture
• Implemented request proxying between the portal frontend and consent server
• Added hop-by-hop header stripping and correlation ID propagation
• Configured backend project structure, linting, testing, and runtime configuration
• Included security hardening and proxy validation mechanisms

User stories

• Backend proxies requests securely to the consent server
• Frontend applications can communicate through a centralized BFF layer
• Developers can extend backend proxy routes and middleware cleanly

Documentation

• README initiated for portal/backend
• OpenAPI documentation added under portal/backend/openapi/bff.yaml
• AGENTS.md and Copilot instructions added for development guidance

Automation tests

• Unit tests added for backend handlers and middleware
• Integration tests added for proxy configuration and routing behavior

Security checks

✓ Followed secure coding standards in WSO2 Secure Engineering Guidelines
✓ Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets

[Copilot]

Pull request overview

Copilot reviewed 32 out of 33 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

.github/workflows/portal-backend-ci.yml:45

• The workflow pins golangci-lint-action to install version: v2.12.2. If that golangci-lint version doesn’t exist, CI will fail at linting. Consider using a known golangci-lint release (and matching the version used in portal/backend/Taskfile.yml).

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          working-directory: portal/backend
          version: v2.12.2

portal/backend/internal/proxy/service.go:325

• setTrustedHeaders always injects org-id / TPP-client-id from placeholder config when present, even when placeholder identity mode is disabled. This makes it easy to accidentally run with static trusted headers (including in production if misconfigured), undermining the header-trust boundary. Consider only setting these placeholder headers when placeholder mode is enabled (or when an authenticated identity context is available).

func (s *Service) setTrustedHeaders(incoming *http.Request, outgoing *http.Request, trustedClientID string) {
	if s.cfg.PlaceholderOrgID != "" {
		outgoing.Header.Set("org-id", s.cfg.PlaceholderOrgID)
	}
	if trustedClientID != "" {
		outgoing.Header.Set("TPP-client-id", trustedClientID)
	} else if s.cfg.PlaceholderClientID != "" {
		outgoing.Header.Set("TPP-client-id", s.cfg.PlaceholderClientID)
	}

[Copilot]

Pull request overview

Copilot reviewed 32 out of 33 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 32 out of 33 changed files in this pull request and generated 4 comments.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.