Add OpenFGC Portal Backend

.github/workflows/portal-backend-ci.yml

@@ -0,0 +1,44 @@
+name: Portal Backend CI
+
+on:
+  pull_request:
+    paths:
+      - 'portal/backend/**'
+      - '.github/workflows/portal-backend-ci.yml'
+  push:
+    branches: [ main ]
+    paths:
+      - 'portal/backend/**'
+      - '.github/workflows/portal-backend-ci.yml'
+
+jobs:
+  portal-backend-ci:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: portal/backend
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: portal/backend/go.mod
+
+      - name: Download deps
+        run: go mod download
+
+      - name: Format check
+        run: |
+          test -z "$(gofmt -l . | tee /dev/stderr)"
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          working-directory: portal/backend
+          version: v2.12.2
+
+      - name: Run tests
+        run: go test ./... -v

portal/backend/.env.example

@@ -0,0 +1,35 @@
+# Optional config file path. If unset, defaults are used and env overrides apply.
+BFF_CONFIG_FILE=
+
+# Server
+BFF_SERVER__HOST=0.0.0.0
+BFF_SERVER__PORT=8080
+BFF_SERVER__READ_TIMEOUT=15s
+BFF_SERVER__WRITE_TIMEOUT=15s
+BFF_SERVER__IDLE_TIMEOUT=60s
+BFF_SERVER__SHUTDOWN_TIMEOUT=10s
+
+# Logging
+BFF_LOG__LEVEL=info
+
+# Environment
+BFF_ENV=development
+
+# CORS (frontend integration)
+BFF_CORS__ALLOWED_ORIGINS=http://localhost:3000,http://localhost:5173
+BFF_CORS__ALLOWED_METHODS=GET,POST,PUT,DELETE,OPTIONS
+BFF_CORS__ALLOWED_HEADERS=Content-Type,X-Correlation-ID
+BFF_CORS__ALLOW_CREDENTIALS=false
+
+# Proxy
+BFF_PROXY__OPENFGC_API_URL=http://localhost:9090
+BFF_PROXY__OPENFGC_API_TIMEOUT=10s
+BFF_PROXY__MAX_REQUEST_BYTES=1048576
+BFF_PROXY__MAX_RESPONSE_BYTES=10485760
+BFF_PROXY__ALLOWED_PASSTHROUGH_METHODS=["GET","POST","PUT","DELETE"]
+
+# Placeholder identity mode (Phase 2 only; must be false in production)
+BFF_PROXY__PLACEHOLDER_MODE_ENABLED=false
+BFF_PROXY__PLACEHOLDER_USER_ID=
+BFF_PROXY__PLACEHOLDER_ORG_ID=
+BFF_PROXY__PLACEHOLDER_CLIENT_ID=

portal/backend/.gitignore

@@ -0,0 +1,28 @@
+# Go build outputs
+bin/
+*.exe
+*.dll
+*.so
+*.dylib
+*.test
+*.out
+
+# Coverage outputs
+coverage.out
+coverage.txt
+*.cov
+
+# Local environment/config files
+.env
+.env.local
+local.yaml
+local.yml
+
+# IDE/editor files
+.vscode/
+.idea/
+*.swp
+
+# OS files
+.DS_Store
+Thumbs.db

portal/backend/.golangci.yml

@@ -0,0 +1,15 @@
+version: "2"
+
+run:
+  timeout: 3m
+  tests: true
+
+linters:
+  enable:
+    - govet
+    - staticcheck
+    - revive
+
+formatters:
+  enable:
+    - gofmt

portal/backend/Dockerfile

@@ -0,0 +1,11 @@
+FROM golang:1.26.3 AS builder
+WORKDIR /app
+COPY . .
+RUN go mod download && go build -o /out/bff ./cmd/server
+
+FROM gcr.io/distroless/base-debian12:nonroot
+WORKDIR /app
+COPY --from=builder /out/bff /app/bff
+USER 65532:65532
+EXPOSE 8080
+ENTRYPOINT ["/app/bff"]

portal/backend/README.md

@@ -0,0 +1,110 @@
+<!--
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ -->
+
+# OpenFGC Portal Backend (BFF)
+
+Stateless backend-for-frontend (BFF) for OpenFGC Portal, responsible for handling portal-facing authentication flows and securely proxying API requests from `portal/frontend` to `/consent-server`.
+
+## Commands
+
+- `task fmt`
+- `task fmt:check` (no edits. check only)
+- `task lint`
+- `task lint:install` (optional, installs golangci-lint to GOPATH/bin)
+- `task test`
+- `task build`
+- `task run`
+- `task run:env` (loads variables from `.env` for local development)
+
+Install Task if needed: https://taskfile.dev/installation/
+
+## Configuration
+
+- Primary source: `BFF_` environment variables
+- Optional file overlay: set `BFF_CONFIG_FILE` to a YAML config file path
+- Final effective config is: defaults < file < env
+
+### CORS for local frontend
+
+When running `portal/frontend` on a different origin (for example Vite dev server), allow that origin with:
+
+- `BFF_CORS__ALLOWED_ORIGINS` (comma-separated origins)
+- `BFF_CORS__ALLOWED_METHODS` (comma-separated methods)
+- `BFF_CORS__ALLOWED_HEADERS` (comma-separated request headers)
+- `BFF_CORS__ALLOW_CREDENTIALS` (`true`/`false`)
+
+Requests that include an `Origin` header from a non-allowlisted origin are rejected.
+When credentials are enabled, origins must be explicitly allowlisted (wildcard origin is rejected).
+
+## Health endpoints
+
+- `GET /health`
+- `GET /health/liveness`
+- `GET /health/readiness`
+
+## API endpoints
+
+Portal-facing user endpoints:
+
+- `GET /me/consents` -> upstream `GET /api/v1/consents` with forced `userIds=<placeholder>`
+- `GET /me/consents/{consentId}` -> upstream `GET /api/v1/consents/{consentId}`
+- `POST /me/consents/{consentId}/approve` -> BFF fetches current consent, merges selected optional approvals, uses the consent's `clientId` as the trusted upstream `TPP-client-id`, updates an existing authorization to approved for the trusted user (or creates one if none exist), and upstreams `PUT /api/v1/consents/{consentId}`
+- `PUT /me/consents/{consentId}/revoke` -> upstream `PUT /api/v1/consents/{consentId}/revoke`
+
+Proxy hardening:
+
+- Path rewrite `/api/*` -> `/api/v1/*` with query preservation
+- Deny-by-default allowlist for consent-server routes (unknown path -> `404`, known path wrong method -> `405`)
+- Hop-by-hop header stripping and trusted-header override prevention (`org-id`, `TPP-client-id`)
+- Correlation ID propagation/generation via `X-Correlation-ID`
+- Request body limit enforcement (`BFF_PROXY__MAX_REQUEST_BYTES`) with `413`
+- Deterministic upstream error mapping: timeout -> `504`, other connectivity failures -> `502`
+
+Error contract for proxy-originated failures:
+
+```json
+{
+	"code": "REQUEST_TOO_LARGE",
+	"message": "request entity too large"
+}
+```
+
+Common error codes:
+
+- `REQUEST_TOO_LARGE`
+- `METHOD_NOT_ALLOWED`
+- `NOT_FOUND`
+- `INVALID_PAYLOAD`
+- `UPSTREAM_TIMEOUT`
+- `UPSTREAM_UNAVAILABLE`
+
+## Placeholder mode guardrails
+
+- `BFF_PROXY__PLACEHOLDER_MODE_ENABLED=true` is blocked when `BFF_ENV=production`
+- `BFF_PROXY__PLACEHOLDER_USER_ID` must be empty if placeholder mode is disabled
+
+## AI Instructions
+
+This repository uses VS Code Copilot instruction files to keep AI-generated changes aligned with project and organization standards.
+
+- Backend standards: `portal/backend/AGENTS.md`
+- Copilot workspace entrypoint (repo root): `.github/copilot-instructions.md`
+- Scoped instructions folder (repo root): `.github/instructions/`
+- Backend scope mapping: `portal/backend/**` -> `.github/instructions/portal-backend.instructions.md`
+
+Copilot instructions are discovered automatically and scoped using `applyTo` patterns.

portal/backend/Taskfile.yml

@@ -0,0 +1,47 @@
+version: '3'
+
+vars:
+  GOLANGCI_LINT_VERSION: v2.12.2
+
+tasks:
+  fmt:
+    desc: Format Go source files
+    cmds:
+      - gofmt -w cmd internal tests
+
+  fmt:check:
+    desc: Check formatting without modifying files
+    cmds:
+      - gofmt -l cmd internal tests
+
+  lint:
+    desc: Run golangci-lint (no global install required)
+    cmds:
+      - go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@{{.GOLANGCI_LINT_VERSION}} run ./...
+
+  lint:install:
+    desc: Install golangci-lint to GOPATH/bin (optional)
+    cmds:
+      - go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@{{.GOLANGCI_LINT_VERSION}}
+
+  test:
+    desc: Run all tests
+    cmds:
+      - go test ./... -v
+
+  build:
+    desc: Build the BFF binary
+    cmds:
+      - go build -o bin/portal-backend{{if eq OS "windows"}}.exe{{end}} ./cmd/server
+
+  run:
+    desc: Run the BFF server
+    cmds:
+      - go run ./cmd/server
+
+  run:env:
+    desc: Run the BFF server with variables loaded from .env
+    dotenv:
+      - .env
+    cmds:
+      - go run ./cmd/server