Dev release

src/auth/auth.module.ts

@@ -1,23 +1,10 @@
 import { Module } from '@nestjs/common';
 import { PassportModule } from '@nestjs/passport';
 import { JwtStrategy } from '@/common/guards/keycloak.strategy';
-import { RbacJwtStrategy } from '@/common/guards/rbac.strategy';
 
-/**
- * Auth module — mirrors user-microservice auth pattern.
- *
- * Auth flow:
- * 1. User authenticates via user-microservice (Keycloak login → /auth/login)
- * 2. User gets RBAC token from user-microservice (/auth/rbac/token)
- * 3. Survey service validates both tokens:
- *    - Authorization: Bearer <keycloak_jwt> → validated by JwtStrategy (RSA public key)
- *    - rbac_token: <rbac_jwt> → validated by RbacJwtStrategy (RBAC_JWT_SECRET)
- *
- * No login/logout endpoints here — those live in user-microservice.
- */
 @Module({
   imports: [PassportModule],
-  providers: [JwtStrategy, RbacJwtStrategy],
-  exports: [JwtStrategy, RbacJwtStrategy],
+  providers: [JwtStrategy],
+  exports: [JwtStrategy],
 })
 export class AuthModule {}

src/common/guards/keycloak.strategy.ts

@@ -1,15 +1,19 @@
 import { ExtractJwt, Strategy } from 'passport-jwt';
 import { PassportStrategy } from '@nestjs/passport';
-import { Injectable } from '@nestjs/common';
+import { Injectable, Logger } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 
 @Injectable()
 export class JwtStrategy extends PassportStrategy(Strategy, 'jwt-keycloak') {
   constructor(configService: ConfigService) {
+    const publicKey = configService.get('KEYCLOAK_REALM_RSA_PUBLIC_KEY');
+    new Logger('JwtStrategy').log(
+      `KEYCLOAK_REALM_RSA_PUBLIC_KEY loaded: ${publicKey ? publicKey.substring(0, 80) + '...' : 'NOT SET / EMPTY'}`,
+    );
     super({
       jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
       ignoreExpiration: false,
-      secretOrKey: configService.get('KEYCLOAK_REALM_RSA_PUBLIC_KEY'),
+      secretOrKey: publicKey,
     });
   }
 

src/config/auth.config.ts

@@ -4,11 +4,6 @@ export default registerAs('auth', () => ({
   // Keycloak JWT validation
   keycloakRsaPublicKey: process.env.KEYCLOAK_REALM_RSA_PUBLIC_KEY || '',
 
-  // RBAC JWT validation
-  rbacJwtSecret: process.env.RBAC_JWT_SECRET || '',
-  rbacIssuer: process.env.RBAC_JWT_ISSUER || 'survey-service',
-  rbacAudience: process.env.RBAC_JWT_AUDIENCE || 'survey-service',
-
   // Legacy (kept for backward compatibility)
   jwtSecret: process.env.JWT_SECRET || 'default-secret-change-me',
   jwtExpiration: parseInt(process.env.JWT_EXPIRATION || '3600', 10),

src/main.ts

@@ -31,7 +31,6 @@ async function bootstrap() {
       'Authorization',
       'tenantid',
       'academicyearid',
-      'rbac_token',
     ],
   });