Architektúra BFF
Frontend (SPA) CentralAuth Backend APIs
localhost:5173 cauth.badcat.eu Docker network
│ │ │
│ fetch('/bff/poc/api/...') │ │
├─────────────────────────────────►│ │
│ (session cookie) │ │
│ │ GET http://poc-api:5000/... │
│ ├──────────────────────────────►│
│ │ + Authorization: Bearer JWT │
│ │ │
│ │◄──────────────────────────────┤
│◄─────────────────────────────────┤ response │
│ response │ │
Session Cookie
Frontend komunikuje s CentralAuth cez HTTP-only session cookie. Token nie je nikdy exponovaný JavaScriptu.
JWT Injection
BFF automaticky generuje JWT token a pridáva ho do requestov na interné API.
Network Isolation
Backend API sú v Docker networku bez exposed portov. Prístupné len cez BFF.
Dynamic Routing
Proxy routes sú konfigurovateľné cez Admin UI alebo API.
Ako pridať novú aplikáciu
-
Vytvor backend API pomocou KPM
kpm add-app orders --name "Orders Service" --deploy
kpm add-app orders --skip-project --api-key "your-api-key"
-
Nastav JWT kľúč v appsettings.json
{
"Jwt": {
"Key": "rovnaký-kľúč-ako-v-centralauth",
"Issuer": "CentralAuth",
"Audience": "InternalApis"
}
}
-
Nastav GitHub Secrets pre deploy
BADCAT_SRV_USER = "ssh-username"
BADCAT_SRV_PSW = "ssh-password"
JWT_KEY = "jwt-signing-key"
-
Push na GitHub
git init && git add . && git commit -m "Initial"
git remote add origin https://github.com/user/orders-api
git push -u origin main
-
Volaj API z frontendu
const response = await fetch('https://cauth.badcat.eu/bff/orders/api/orders', {
credentials: 'include'
});
const data = await response.json();
API Endpointy
Autentifikácia
POST /auth/logout
GET /bff/user
GET /bff/ping
Admin API (vyžaduje Admin rolu)
GET /api/admin/apps
POST /api/admin/apps
GET /api/admin/routes
POST /api/admin/routes
GET /api/admin/users
BFF Proxy
/bff/{app-code}/*
GET /bff/orders/api/orders
POST /bff/inventory/api/items
Konfigurácia
Environment Variables (Docker)
ASPNETCORE_ENVIRONMENT=Production
DbConfig__Host=mariadb
DbConfig__Port=3306
DbConfig__Username=root
DbConfig__Password=your-password
Jwt__Key=your-64-char-jwt-key
Admin__ApiKey=your-admin-api-key
CORS Origins
Cors__Origins__0=http://localhost:5173
Cors__Origins__1=https://your-frontend.com