BFF trust boundary

Phase 6 documentation for the Services Lab Ops Console.


Browser
  │  HTML / cookies only (no lab secrets)
  ▼
Next.js Ops Console (BFF)
  │  HttpOnly session cookie (JWE)
  │  Server Components + Server Actions
  │  RBAC in middleware + action guards
  ▼
Services Lab reference-api  (LAB_API_BASE_URL — server-only)
  ▼
PostgreSQL

What the browser can see

Rendered HTML for pages the role may access
HttpOnly cookie is sent automatically — not readable by JavaScript
No direct access to reference-api from the browser in this design

What stays server-side

SESSION_SECRET
LAB_API_BASE_URL and lab responses until filtered into RSC HTML
Demo user password table (OPS_DEMO_USERS)

Authentication

Login Server Action validates credentials with Zod, seals a JWE session into lab_ops_session (HttpOnly, SameSite=Lax, Secure in production).

Authorization

Middleware maps /console/* paths to permissions. Missing permission redirects to /unauthorized. Mutations re-check ops:mutate inside the Server Action.

CSRF

Cookie is SameSite=Lax. Mutations use Server Actions (same-origin POST). Actions call assertSameOriginMutation() (Origin must match Host).

Full write-up: docs/capabilities/ops-console-bff.md in the monorepo.