Fix multiple issues

- Document the authentication toggle and split-cookie variables.
- Malformed logout allowlist entries are now skipped individually while valid origins remain usable.
- Added regression coverage for mixed valid and invalid origins.
- Vite now uses one fallback-safe `apiBaseURL` for HTTPS detection and both CSP policies.
- Production and development still require an explicitly configured API URL; only test mode uses the fallback.

Author: rashmithachamikara

portal/frontend/README.md

@@ -49,10 +49,15 @@ pnpm install
 
 Create a local `.env` file from `.env.example` before running or building the portal.
 
-| Variable                           | Description                                                                                                               | Example                   |
-| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
-| `VITE_API_BASE_URL`                | Required base URL for the OpenFGC Portal backend API. Vite embeds this value at build time.                               | `http://localhost:8080`   |
-| `VITE_AUTH_LOGOUT_ALLOWED_ORIGINS` | Exact comma-separated origins accepted for logout navigation. Include the IdP origin when using its end-session endpoint. | `https://idp.example.com` |
+| Variable                               | Description                                                                                                               | Example                   |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
+| `VITE_API_BASE_URL`                    | Required base URL for the OpenFGC Portal backend API. Vite embeds this value at build time.                               | `http://localhost:8080`   |
+| `VITE_AUTH_ENABLED`                    | Enables frontend authentication gating; set to `true` for protected deployments.                                          | `true`                    |
+| `VITE_AUTH_ACCESS_TOKEN_PART1_COOKIE`  | Cookie name for the readable access-token part.                                                                           | `portal-at-p1`            |
+| `VITE_AUTH_REFRESH_TOKEN_PART1_COOKIE` | Cookie name for the readable refresh-token part.                                                                          | `portal-rt-p1`            |
+| `VITE_AUTH_ID_TOKEN_PART1_COOKIE`      | Cookie name for ID-token part 1.                                                                                          | `portal-id-p1`            |
+| `VITE_AUTH_ID_TOKEN_PART2_COOKIE`      | Cookie name for ID-token part 2.                                                                                          | `portal-id-p2`            |
+| `VITE_AUTH_LOGOUT_ALLOWED_ORIGINS`     | Exact comma-separated origins accepted for logout navigation. Include the IdP origin when using its end-session endpoint. | `https://idp.example.com` |
 
 ## Production security headers
 

portal/frontend/src/__tests__/AuthClient.test.ts

@@ -169,6 +169,29 @@ describe('portal auth client', () => {
     expect(assign).toHaveBeenCalledWith('https://idp.example/logout')
   })
 
+  it('ignores malformed logout origins without discarding valid configured origins', async () => {
+    vi.stubEnv('VITE_API_BASE_URL', 'http://api.example')
+    vi.stubEnv(
+      'VITE_AUTH_LOGOUT_ALLOWED_ORIGINS',
+      'not-a-url,ftp://unsupported.example,https://idp.example',
+    )
+    setCookie('portal-at-p1', 'access-part')
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ logoutUrl: 'https://idp.example/logout' }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    )
+    vi.stubGlobal('fetch', fetchMock)
+    const assign = vi.fn()
+    vi.stubGlobal('window', { location: { assign, origin: 'http://portal.example' } })
+
+    await logout()
+
+    expect(fetchMock).toHaveBeenCalledOnce()
+    expect(assign).toHaveBeenCalledWith('https://idp.example/logout')
+  })
+
   it('rejects a BFF-returned logout URL outside the navigation allowlist', async () => {
     vi.stubEnv('VITE_API_BASE_URL', 'http://api.example')
     vi.stubEnv('VITE_AUTH_LOGOUT_ALLOWED_ORIGINS', 'https://idp.example')

portal/frontend/src/utils/authClient.ts

@@ -39,11 +39,18 @@ function allowedNavigationOrigins(): Set<string> {
   }
 
   const configured = import.meta.env.VITE_AUTH_LOGOUT_ALLOWED_ORIGINS as string | undefined
-  configured
+  const configuredOrigins = configured
     ?.split(',')
     .map((origin) => origin.trim())
     .filter(Boolean)
-    .forEach((origin) => origins.add(httpURL(origin).origin))
+
+  configuredOrigins?.forEach((origin) => {
+    try {
+      origins.add(httpURL(origin).origin)
+    } catch {
+      // Invalid configured entries fail closed without disabling valid origins.
+    }
+  })
 
   return origins
 }

portal/frontend/vite.config.ts

@@ -46,20 +46,21 @@ function securityHeadersPlugin(policy: string, metaPolicy: string): Plugin {
 // https://vite.dev/config/
 export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd(), 'VITE_')
+  const apiBaseURL = env.VITE_API_BASE_URL || 'http://localhost:8080'
 
   if (mode !== 'test' && !env.VITE_API_BASE_URL) {
     throw new Error('VITE_API_BASE_URL is required. Create a .env file from .env.example.')
   }
 
   const production = mode === 'production'
-  const upgradeInsecureRequests = production && env.VITE_API_BASE_URL.startsWith('https://')
+  const upgradeInsecureRequests = production && apiBaseURL.startsWith('https://')
   const policy = contentSecurityPolicy({
-    apiBaseURL: env.VITE_API_BASE_URL || 'http://localhost:8080',
+    apiBaseURL,
     upgradeInsecureRequests,
   })
   // frame-ancestors is supported only in the HTTP header, not a CSP meta element.
   const metaPolicy = contentSecurityPolicy({
-    apiBaseURL: env.VITE_API_BASE_URL || 'http://localhost:8080',
+    apiBaseURL,
     includeFrameAncestors: false,
     upgradeInsecureRequests,
   })