S219: Docs Angular Auth Migration
Migrate docs-angular admin from DOCS_ADMIN_PASS to backend-api JWT; restrict admin to T0/T1; keep docs content open to all users
Session 219: Docs Angular Auth Migration
Goals
- Replace legacy DOCS_ADMIN_PASS with backend-api JWT authentication
- Restrict admin access to T0/T1 roles only (executives, developers, admins, system)
- Keep documentation content accessible to any user (based on project selection and privacy level)
- Fix content loading 404 in dev and login chunk load failure
Access Control Summary
| Area | Who Can Access | Mechanism |
|---|---|---|
Admin (/admin, /admin/config, etc.) |
Executives, developers, admins, system only | docsAdminGuard + backend RolesGuard |
| Documentation content | Any user | projectSelectedGuard + AccessService (privacy) |
Login (/auth/login) |
Unauthenticated users | docsLoginPageGuard redirects if already logged in |
Changes Made
Phase 1: Auth Migration
- Frontend: Switched from
AdminAuthServicetoAuthService(backend-api JWT) - Guards:
docsAdminGuardallowsexecutive,developer,admin,system; redirects others to/unauthorizedor/auth/login - Backend: Added
RolesGuard+@Roles(SystemRoles.EXECUTIVE, SystemRoles.DEVELOPER, SystemRoles.ADMIN, SystemRoles.SYSTEM)on admin endpoints - Login:
DocsLoginComponentwraps@auth-uiLoginComponent withshowGuestOption: false; eager-loaded to avoid chunk issues
Phase 2: Configuration
- Environment:
docsApiUrl: undefinedin dev so MarkdownService uses static files;backendApiUrlfor login - Proxy:
/api→ backend-api (3000);/api/admin/docs→ docs-admin-proxy (5011) - Split: MarkdownService reads
environment.docsApiUrl; DocsApiService usesDOCS_API_URLfor admin
Phase 3: Bugfixes
- 404 on content:
docsApiUrlwas/api→ MarkdownService hit backend-api (no/sync/files). Fix:docsApiUrl: undefinedin dev → static files - Login chunk failure: Lazy
loadComponentfor DocsLoginComponent failed. Fix: Usecomponent: DocsLoginComponent(eager-load)
Key Files
| File | Purpose |
|---|---|
apps/docs-angular/src/app/guards/docs-admin.guard.ts |
T0/T1 admin guard |
apps/docs-angular/src/app/pages/docs-login/docs-login.component.ts |
Login wrapper |
apps/docs-angular/src/app/services/dynamic-routes.service.ts |
Routes, guards |
apps/docs-angular/src/environments/environment.ts |
Dev config |
APIs/backend-docs-api/src/app/admin/admin.controller.ts |
RolesGuard on admin |
docs/english/Docs-angular/docs-auth-implementation.md |
Technical doc |
docs/english/Docs-angular/docs-auth-progress-timeline.md |
Non-developer timeline |
Decisions Logged (MCP)
| Decision ID | Question | Chosen |
|---|---|---|
dev_1773498739714_yxgl509 |
How should docs-angular admin auth integrate? | Migrate to backend-api JWT with T0/T1 |
dev_1773498742269_t6ldgu7 |
Why 404 on /api/sync/files in dev? | Set docsApiUrl undefined for static files |
dev_1773498744346_5003zl9 |
Why docs-login chunk load failure? | Eager-load DocsLoginComponent |
Documentation
- Technical: docs-auth-implementation.md
- Non-developer timeline: docs-auth-progress-timeline.md
Future Steps
- Deprecate
AdminAuthServiceandPOST /admin/auth/loginon backend-docs-api - Add audit logging for admin actions
- Consider 2FA for admin