LEGLINK-620: Add-Secret-Key-to-Vendor (#1788)

* LEGLINK-620: record the vendor signing-key UI design

Captures the decisions behind associating a Key Vault secret with a vendor,
so the reasoning survives outside a chat log: why the association is
vendor-scoped rather than facility-scoped (Veradigm needs a different key
generation algorithm than Epic and Cerner), and why the stored value is the
Key Vault secret id rather than a JWKS kid, which LEGLINK-63's title
conflates.

Also records what this ticket deliberately cannot do. The update endpoint
that persists a secret id is owned by neither LEGLINK-620 nor LEGLINK-743,
so the UI is built against a single isolated service method. LEGLINK-63's
audit-trail acceptance criterion is produced from backend managers onto
Kafka and no UI change can satisfy it.

Claude-Session: https://claude.ai/code/session_01STFKxmDaJenKVny6WUoWKo

* LEGLINK-620: associate a Key Vault secret with a vendor in the UI

Link signs the JWT that Data Acquisition presents to Epic and Cerner during
client-credentials auth. LEGLINK-14 moved the PEM into Key Vault; this makes
the association explicit and vendor-scoped, because Veradigm needs a
different key generation algorithm and so cannot share a key.

Add an edit path to Vendor Management. The dashboard grows a Secret ID
column that reads "Not set" when empty and a per-row edit action; the form
grows a JWT / Authentication panel holding the Key Vault Secret ID, expanded
when a vendor already has one so existing configuration is visible without
hunting. An emptied box travels as undefined rather than "", so clearing the
association reads as absent rather than set-to-empty.

No update endpoint exists yet. The Vendor model is moving out of
Normalization into Tenant under LEGLINK-743, whose acceptance criteria cover
list, add and delete but not update, so this operation is owned by neither
ticket. VendorService.updateVendor is the single place that knows the route:
when the contract lands, that method is the only edit required. A
config-flagged dual path was considered and rejected as permanent complexity
bought against a decision expected within days.

Two defects in files this already touches: createVendor was typed as
IVendorConfigModel while callers pass a name string, which interpolated
"[object Object]" into the URL for anything else; and getVendors never
cleared its loading flag on success.

Deferred: the mocked Playwright spec the design calls for. That harness
arrives with PR #1773, which is not yet merged into dev, so there is nowhere
on this branch for the spec to live. LEGLINK-63's audit-trail criterion is
also outstanding -- audit events are produced from backend managers onto
Kafka, so it belongs with the update endpoint rather than here.

16 unit specs pass; the app builds clean.

Claude-Session: https://claude.ai/code/session_01STFKxmDaJenKVny6WUoWKo

* LEGLINK-620: report a failed vendor save once, and clear a key explicitly

Two defects found reviewing 4b894e1 against the design.

ErrorHandlingService raises its own toastr before rethrowing, so once the
save paths began emitting failure to the dialog -- which shows a snackbar and
stays open so the admin's input survives -- one failed save reported itself
twice, toastr bottom-full-width and snackbar top-right. Saves now route
through handleSaveError, which suppresses the toastr and leaves the dialog as
the single surface. List and delete keep theirs, having no dialog to carry
the news. The rethrown error still carries the sanitized message either way.

Clearing a key sent secretId as undefined, which JSON.stringify drops, so the
field never reached the wire. An absent field reads as "leave unchanged" to
any endpoint with partial-update semantics, which would have made clearing an
association succeed visibly and do nothing. It now travels as an explicit
null, and the design's open items record that the backend must honour null as
"remove the association" when the contract is settled.

Adds vendor.service.spec.ts, the service having had no direct coverage: the
update route and body, a cleared key surviving serialization, name escaping
in the create route, and the toastr suppressed for saves but kept for list
and delete. Both new behaviours fail against the previous code -- args[1] was
absent rather than false, and secretId was undefined rather than null.

21 unit specs pass; the app builds clean.

Claude-Session: https://claude.ai/code/session_01CX9BzMrPhTzGSakXYDaAVa

* LEGLINK-620: cover the vendor create failure branch

A failed createVendor had no test. Assert it emits a single failure with
the error message and does not fall through into the update path.

Claude-Session: https://claude.ai/code/session_01TDPYGwkQDCXConLTuyU4is

* LEGLINK-620: gate vendor editing until an update endpoint exists

VendorController exposes list, add and delete only -- no PUT -- so the edit
dialog added on this branch would save into a 404. Put the edit button and
onEdit behind a vendorEditEnabled config flag, shipped off, following the
existing AppConfig boolean pattern. Flip it once the update contract,
including clearing secretId with null, is confirmed.

Claude-Session: https://claude.ai/code/session_01TDPYGwkQDCXConLTuyU4is

* LEGLINK-566: design for validating a vendor secret id against Key Vault

Validation lives on Admin.BFF, which already holds an ISecretManager and is
independent of the Vendor model's move to Tenant. Adds ISecretInspector and
PemSigningKeyValidator to Shared; the UI warns inline on blur and on save
without ever blocking the save.

Claude-Session: https://claude.ai/code/session_01TDPYGwkQDCXConLTuyU4is

* LEGLINK-566: implementation plan for vendor secret id validation

Eight tasks, TDD throughout: characterize EpicAuth's PKCS#8 behavior, then
PemSigningKeyValidator and ISecretInspector in Shared, the Admin.BFF endpoint,
the Angular service call, and the form's blur/save warnings.

Claude-Session: https://claude.ai/code/session_01TDPYGwkQDCXConLTuyU4is

* LEGLINK-620: store a vendor's Key Vault signing key secret id

Vendor moved into Tenant under LEGLINK-743 carrying only Id and Name, so there
was nowhere to record the Key Vault secret holding a vendor's PEM signing key.
LEGLINK-63 scopes that key to the vendor rather than the facility, because the
key generation algorithm differs by EHR.

Stored as a JSON column rather than a plain one so later vendor-level auth
settings need no migration, following the AuthenticationConfiguration precedent
in DataAcquisitionDbContext. Only the signing key lives here: TokenUrl, Audience
and ClientId are per-EHR-instance and stay on the facility's authentication
configuration, where EpicAuth already reads them.

The value converter carries an explicit ValueComparer. Without one EF snapshots
the property by reference, so mutating a field on the existing instance is never
detected and SaveChanges writes nothing -- a test covers that specifically.

Update treats a missing authentication object as "leave unchanged", matching how
Name already behaves, so a caller that omits it cannot wipe a configured key.
Clearing a key means sending the object with a null inside it.

Vendor versions expose the parent vendor's settings as a read-only projection,
so consumers holding only a vendor version id -- as Data Acquisition will -- can
resolve the key in one call while writes stay on the vendor.

EpicAuth is untouched: it still derives {facilityId}-pem, so nothing changes at
runtime until the fallback rule between vendor and facility keys is settled.

Claude-Session: https://claude.ai/code/session_01QoUHyt1ALkruCbuYxHSXiB

* LEGLINK-620: point the vendor screens at the Tenant API

LEGLINK-743 deleted Normalization's VendorController when it moved the model to
Tenant, but left this service calling the old routes. Every vendor operation in
Admin.UI has been hitting a controller that no longer exists.

The API nests the signing key under authentication; the vendor screens work with
a flat secretId. Translating at the gateway keeps that difference out of the
components, so a second vendor-level setting only touches this file.

Create now carries the secret id. The add form has always shown the field, but
the create branch sent the name alone, so anything typed there was silently
discarded behind a success message. Both write paths build the same payload
before branching, which is what stops them drifting apart again.

authentication is always sent, including when the key is being cleared: the
Tenant manager reads an absent object as "leave unchanged", so omitting it would
make a clear no-op. Null inside the object is what removes the association.

The vendorEditEnabled flag is gone with it. It existed only to keep the edit
button hidden while no update endpoint existed, and PUT /api/vendor/{id} now
does, so the gate has nothing left to protect.

Claude-Session: https://claude.ai/code/session_01QoUHyt1ALkruCbuYxHSXiB

* LEGLINK-620: drop the superpowers design and plan docs

The vendor signing-key design and the secret-id validation design and plan were
working notes for this change, not reference material the repository needs to
carry. They stay recoverable through history.

Claude-Session: https://claude.ai/code/session_01QoUHyt1ALkruCbuYxHSXiB

* LEGLINK-620: Add Secret Key to Vendor screen

* LEGLINK-620: revert local environment files off the branch

The previous commit swept in five files that belong to a local development
setup rather than to this change. Both appsettings.Development.json files in
particular replaced the committed SQLEXPRESS defaults with a machine-specific
SQL Server instance and a plaintext sa password, which would have become the
checked-in default for everyone.

Restores all five to their dev contents so the branch carries only the vendor
signing key work. The AGENTS.md documentation, the check_health.sh compose fix
and the Admin.UI Dockerfile npm layer-caching fix are worth landing, but each
on its own terms rather than inside this ticket.

Claude-Session: https://claude.ai/code/session_01QoUHyt1ALkruCbuYxHSXiB

Author: arianamihailescu

DotNet/ServiceTests/IntegrationTests/Tenant/VendorControllerTests.cs

@@ -33,6 +33,36 @@ public VendorControllerTests(TenantIntegrationTestFixture fixture)
 
     public void Dispose() => _scope.Dispose();
 
+    [Fact]
+    public async Task Post_WithAuthentication_ReturnsTheSavedSigningKeySecretId()
+    {
+        var result = await _controller.Post(new CreateVendorModel
+        {
+            Name = $"Vendor-{Guid.NewGuid():N}",
+            Authentication = new VendorAuthenticationSettings { SigningKeySecretId = "epic-signing-key" }
+        });
+
+        var created = Assert.IsType<CreatedAtActionResult>(result.Result);
+        var vendor = Assert.IsType<VendorModel>(created.Value);
+        Assert.Equal("epic-signing-key", vendor.Authentication?.SigningKeySecretId);
+    }
+
+    [Fact]
+    public async Task Put_WithAuthentication_ReturnsTheSavedSigningKeySecretId()
+    {
+        var created = await _vendorManager.CreateVendorAsync(new VendorModel { Name = $"Vendor-{Guid.NewGuid():N}" });
+
+        var result = await _controller.Put(created.Id!.Value.ToString(), new UpdateVendorModel
+        {
+            Name = created.Name,
+            Authentication = new VendorAuthenticationSettings { SigningKeySecretId = "epic-signing-key" }
+        });
+
+        var ok = Assert.IsType<OkObjectResult>(result.Result);
+        var vendor = Assert.IsType<VendorModel>(ok.Value);
+        Assert.Equal("epic-signing-key", vendor.Authentication?.SigningKeySecretId);
+    }
+
     [Fact]
     public async Task Post_DuplicateVendor_ReturnsConflict()
     {

DotNet/ServiceTests/IntegrationTests/Tenant/VendorManagerTests.cs

@@ -1,6 +1,7 @@
 using LantanaGroup.Link.Sdk.ApiClient;
 using LantanaGroup.Link.Sdk.Clients;
 using LantanaGroup.Link.Shared.Application.Models.Integration.Normalization;
+using LantanaGroup.Link.Shared.Application.Models.Tenant;
 using LantanaGroup.Link.Tenant.Business.Managers;
 using LantanaGroup.Link.Tenant.Entities;
 using LantanaGroup.Link.Tenant.Repository.Context;
@@ -75,6 +76,96 @@ public async Task DeleteVendorVersion_WhenNormalizationHasNoReferences_DeletesVe
             .SingleOrDefaultAsync(version => version.Id == vendorVersion.Id));
     }
 
+    [Fact]
+    public async Task CreateVendor_WithAuthentication_PersistsSigningKeySecretId()
+    {
+        var created = await _vendorManager.CreateVendorAsync(new VendorModel
+        {
+            Name = $"Vendor-{Guid.NewGuid():N}",
+            Authentication = new VendorAuthenticationSettings { SigningKeySecretId = "epic-signing-key" }
+        });
+
+        var persisted = await _dbContext.Vendors
+            .AsNoTracking()
+            .SingleAsync(v => v.Id == created.Id);
+
+        Assert.Equal("epic-signing-key", persisted.Authentication?.SigningKeySecretId);
+    }
+
+    [Fact]
+    public async Task UpdateVendor_WithAuthentication_PersistsSigningKeySecretId()
+    {
+        var vendor = await CreateVendorAsync();
+
+        await _vendorManager.UpdateVendorAsync(vendor.Id, new VendorModel
+        {
+            Id = vendor.Id,
+            Name = vendor.Name,
+            Authentication = new VendorAuthenticationSettings { SigningKeySecretId = "epic-signing-key" }
+        });
+
+        var persisted = await _dbContext.Vendors
+            .AsNoTracking()
+            .SingleAsync(v => v.Id == vendor.Id);
+
+        Assert.Equal("epic-signing-key", persisted.Authentication?.SigningKeySecretId);
+    }
+
+    [Fact]
+    public async Task UpdateVendor_WithoutAuthentication_LeavesTheConfiguredSecretIdIntact()
+    {
+        var vendor = await CreateVendorAsync();
+        await _vendorManager.UpdateVendorAsync(vendor.Id, new VendorModel
+        {
+            Name = vendor.Name,
+            Authentication = new VendorAuthenticationSettings { SigningKeySecretId = "epic-signing-key" }
+        });
+
+        await _vendorManager.UpdateVendorAsync(vendor.Id, new VendorModel { Name = "Renamed Vendor" });
+
+        var persisted = await _dbContext.Vendors
+            .AsNoTracking()
+            .SingleAsync(v => v.Id == vendor.Id);
+
+        Assert.Equal("epic-signing-key", persisted.Authentication?.SigningKeySecretId);
+    }
+
+    [Fact]
+    public async Task SaveChanges_AfterMutatingAuthenticationInPlace_PersistsTheChange()
+    {
+        var vendor = await CreateVendorAsync();
+        await _vendorManager.UpdateVendorAsync(vendor.Id, new VendorModel
+        {
+            Name = vendor.Name,
+            Authentication = new VendorAuthenticationSettings { SigningKeySecretId = "original-key" }
+        });
+
+        var tracked = await _dbContext.Vendors.SingleAsync(v => v.Id == vendor.Id);
+        tracked.Authentication!.SigningKeySecretId = "rotated-key";
+        await _dbContext.SaveChangesAsync();
+
+        _dbContext.ChangeTracker.Clear();
+        var persisted = await _dbContext.Vendors
+            .AsNoTracking()
+            .SingleAsync(v => v.Id == vendor.Id);
+
+        Assert.Equal("rotated-key", persisted.Authentication?.SigningKeySecretId);
+    }
+
+    private async Task<Vendor> CreateVendorAsync()
+    {
+        var vendor = new Vendor
+        {
+            Id = Guid.NewGuid(),
+            Name = $"Vendor-{Guid.NewGuid():N}"
+        };
+
+        await _dbContext.Vendors.AddAsync(vendor);
+        await _dbContext.SaveChangesAsync();
+
+        return vendor;
+    }
+
     private async Task<VendorVersion> CreateVendorVersionAsync()
     {
         var vendor = new Vendor

DotNet/ServiceTests/IntegrationTests/Tenant/VendorQueriesTests.cs

@@ -0,0 +1,78 @@
+using LantanaGroup.Link.Shared.Application.Models.Tenant;
+using LantanaGroup.Link.Tenant.Business.Managers;
+using LantanaGroup.Link.Tenant.Business.Queries;
+using LantanaGroup.Link.Tenant.Entities;
+using LantanaGroup.Link.Tenant.Repository.Context;
+using Microsoft.Extensions.DependencyInjection;
+using Task = System.Threading.Tasks.Task;
+
+namespace IntegrationTests.Tenant;
+
+[Collection("IntegrationTests")]
+[Trait("Category", "IntegrationTests")]
+public class VendorQueriesTests : IDisposable
+{
+    private readonly IServiceScope _scope;
+    private readonly IVendorQueries _vendorQueries;
+    private readonly IVendorManager _vendorManager;
+    private readonly TenantDbContext _dbContext;
+
+    public VendorQueriesTests(TenantIntegrationTestFixture fixture)
+    {
+        _scope = fixture.ServiceProvider.CreateScope();
+        var serviceProvider = _scope.ServiceProvider;
+
+        _vendorQueries = serviceProvider.GetRequiredService<IVendorQueries>();
+        _vendorManager = serviceProvider.GetRequiredService<IVendorManager>();
+        _dbContext = serviceProvider.GetRequiredService<TenantDbContext>();
+    }
+
+    public void Dispose() => _scope.Dispose();
+
+    [Fact]
+    public async Task GetVendor_ReturnsTheConfiguredSigningKeySecretId()
+    {
+        var vendorVersion = await CreateVendorWithSigningKeyAsync("epic-signing-key");
+
+        var vendor = await _vendorQueries.GetVendor(vendorVersion.VendorId);
+
+        Assert.Equal("epic-signing-key", vendor?.Authentication?.SigningKeySecretId);
+    }
+
+    [Fact]
+    public async Task GetVendorVersion_ExposesTheParentVendorsSigningKeySecretId()
+    {
+        var vendorVersion = await CreateVendorWithSigningKeyAsync("cerner-signing-key");
+
+        var version = await _vendorQueries.GetVendorVersion(vendorVersion.Id);
+
+        Assert.Equal("cerner-signing-key", version?.Authentication?.SigningKeySecretId);
+    }
+
+    private async Task<VendorVersion> CreateVendorWithSigningKeyAsync(string signingKeySecretId)
+    {
+        var vendor = new Vendor
+        {
+            Id = Guid.NewGuid(),
+            Name = $"Vendor-{Guid.NewGuid():N}"
+        };
+        var vendorVersion = new VendorVersion
+        {
+            Id = Guid.NewGuid(),
+            VendorId = vendor.Id,
+            Version = "default"
+        };
+
+        await _dbContext.Vendors.AddAsync(vendor);
+        await _dbContext.VendorVersions.AddAsync(vendorVersion);
+        await _dbContext.SaveChangesAsync();
+
+        await _vendorManager.UpdateVendorAsync(vendor.Id, new VendorModel
+        {
+            Name = vendor.Name,
+            Authentication = new VendorAuthenticationSettings { SigningKeySecretId = signingKeySecretId }
+        });
+
+        return vendorVersion;
+    }
+}

DotNet/ServiceTests/UnitTests/Tenant/VendorModelBindingTests.cs

@@ -0,0 +1,47 @@
+using LantanaGroup.Link.Shared.Application.Models.Tenant;
+using System.Text.Json;
+
+namespace UnitTests.Tenant;
+
+public class VendorModelBindingTests
+{
+    private static readonly JsonSerializerOptions WebDefaults = new(JsonSerializerDefaults.Web);
+
+    [Fact]
+    public void CreateVendorModel_BindsTheNestedSigningKeySecretId()
+    {
+        const string payload = """
+            { "name": "Epic", "authentication": { "signingKeySecretId": "epic-signing-key" } }
+            """;
+
+        var model = JsonSerializer.Deserialize<CreateVendorModel>(payload, WebDefaults);
+
+        Assert.Equal("Epic", model?.Name);
+        Assert.Equal("epic-signing-key", model?.Authentication?.SigningKeySecretId);
+    }
+
+    [Fact]
+    public void UpdateVendorModel_BindsTheNestedSigningKeySecretId()
+    {
+        const string payload = """
+            { "name": "Epic", "authentication": { "signingKeySecretId": "epic-signing-key" } }
+            """;
+
+        var model = JsonSerializer.Deserialize<UpdateVendorModel>(payload, WebDefaults);
+
+        Assert.Equal("epic-signing-key", model?.Authentication?.SigningKeySecretId);
+    }
+
+    [Fact]
+    public void UpdateVendorModel_DistinguishesAClearedKeyFromAnOmittedOne()
+    {
+        var cleared = JsonSerializer.Deserialize<UpdateVendorModel>(
+            """{ "name": "Epic", "authentication": { "signingKeySecretId": null } }""", WebDefaults);
+        var omitted = JsonSerializer.Deserialize<UpdateVendorModel>(
+            """{ "name": "Epic" }""", WebDefaults);
+
+        Assert.NotNull(cleared?.Authentication);
+        Assert.Null(cleared!.Authentication!.SigningKeySecretId);
+        Assert.Null(omitted?.Authentication);
+    }
+}

DotNet/Shared/Application/Models/Tenant/CreateVendorModel.cs

@@ -9,5 +9,8 @@ public class CreateVendorModel
         [Required]
         [DataMember]
         public string? Name { get; set; }
+
+        [DataMember]
+        public VendorAuthenticationSettings? Authentication { get; set; }
     }
 }

DotNet/Shared/Application/Models/Tenant/UpdateVendorModel.cs

@@ -9,5 +9,8 @@ public class UpdateVendorModel
         [Required]
         [DataMember]
         public string? Name { get; set; }
+
+        [DataMember]
+        public VendorAuthenticationSettings? Authentication { get; set; }
     }
 }

DotNet/Shared/Application/Models/Tenant/VendorAuthenticationSettings.cs

@@ -0,0 +1,13 @@
+using System.Runtime.Serialization;
+using System.Text.Json.Serialization;
+
+namespace LantanaGroup.Link.Shared.Application.Models.Tenant
+{
+    [DataContract]
+    public class VendorAuthenticationSettings
+    {
+        [DataMember]
+        [JsonPropertyName("signingKeySecretId")]
+        public string? SigningKeySecretId { get; set; }
+    }
+}

DotNet/Shared/Application/Models/Tenant/VendorModel.cs

@@ -13,5 +13,9 @@ public class VendorModel
         [DataMember]
         [JsonPropertyName("name")]
         public string? Name { get; set; }
+
+        [DataMember]
+        [JsonPropertyName("authentication")]
+        public VendorAuthenticationSettings? Authentication { get; set; }
     }
 }

DotNet/Shared/Application/Models/Tenant/VendorVersionModel.cs

@@ -23,5 +23,9 @@ public class VendorVersionModel
         [JsonPropertyName("version")]
         [Required]
         public string? Version { get; set; }
+
+        [DataMember]
+        [JsonPropertyName("authentication")]
+        public VendorAuthenticationSettings? Authentication { get; set; }
     }
 }

DotNet/Tenant/Business/Managers/VendorManager.cs

@@ -77,7 +77,8 @@ public async Task<VendorModel> CreateVendorAsync(VendorModel newVendor, Cancella
             var vendorEntity = new Vendor
             {
                 Id = Guid.NewGuid(),
-                Name = newVendor.Name
+                Name = newVendor.Name,
+                Authentication = newVendor.Authentication
             };
             var vendorVersionEntity = new VendorVersion
             {
@@ -91,7 +92,8 @@ public async Task<VendorModel> CreateVendorAsync(VendorModel newVendor, Cancella
             return new VendorModel
             {
                 Id = vendorEntity.Id,
-                Name = vendorEntity.Name
+                Name = vendorEntity.Name,
+                Authentication = vendorEntity.Authentication
             };
         }
 
@@ -187,12 +189,15 @@ public async Task<VendorModel> UpdateVendorAsync(Guid id, VendorModel vendor, Ca
 
             existingVendor.Name = vendor.Name ?? existingVendor.Name;
 
+            existingVendor.Authentication = vendor.Authentication ?? existingVendor.Authentication;
+
             _dbContext.Vendors.Update(existingVendor);
             await _dbContext.SaveChangesAsync(cancellationToken);
             return new VendorModel
             {
                 Id = existingVendor.Id,
-                Name = existingVendor.Name
+                Name = existingVendor.Name,
+                Authentication = existingVendor.Authentication
             };
         }