ACHOO-146: AuthZ

.env.example

@@ -46,3 +46,14 @@ SAML_SP_CERT="-----BEGIN CERTIFICATE-----
 SAML_SP_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----
 ...
 -----END PRIVATE KEY-----"
+
+# Authorization Configuration
+# Global access via eduPersonEntitlement (comma-separated list)
+# Users with any of these entitlements get full access to all applications
+CHURRO_GLOBAL_ENTITLEMENTS=stanford:staff
+
+# Per-application access via SUNet ID mappings
+# Format: uuid1:uid1,uid2;uuid2:uid3,uid4
+# Each section (separated by ;) maps an application UUID to authorized SUNet IDs
+# Example: CHURRO_APP_ACCESS=app-uuid-1:jdoe,jsmith;app-uuid-2:jdoe
+CHURRO_APP_ACCESS=

.github/copilot-instructions.md

@@ -141,6 +141,49 @@ const getAttr = (key: string): string | undefined => {
 - JWT tokens stored in HTTP-only cookies (not accessible to JavaScript)
 - Clock skew: 5 minutes (`acceptedClockSkewMs: 300000`)
 
+### Authorization System
+
+**Two-Tier Access Control**:
+1. **Global Access**: Users with specific `eduPersonEntitlement` values access everything
+2. **Per-Application Access**: SUNet ID mappings grant access to specific applications
+
+**Environment Variables**:
+- `CHURRO_GLOBAL_ENTITLEMENTS` - Comma-separated list (e.g., `uit:sws,stanford:faculty`)
+- `CHURRO_APP_ACCESS` - UUID:uid mappings (e.g., `uuid1:jdoe,jsmith;uuid2:jdoe`)
+
+**Key Components** (`lib/auth-utils.ts`):
+- `hasGlobalAccess(user)` - Check if user has global entitlement
+- `hasApplicationAccess(user, uuid)` - Check specific app access
+- `hasDashboardAccess(user)` - Check if can access dashboard (global OR any app)
+- `parseAppAccessMappings()` - Parse environment variable mappings
+
+**Middleware Protection** (`middleware.ts`):
+- `/` - Dashboard requires global access OR access to ≥1 application
+- `/applications/[uuid]` - Requires global access OR specific application access
+- Returns 403 with clear error messages for unauthorized access
+
+**API Protection** (`lib/api-auth.ts`):
+```typescript
+export async function GET(request: NextRequest) {
+  return withApiAuthorization(async (request: NextRequest, context: { user: SamlUser }) => {
+    // Protected API logic with user context
+    return NextResponse.json({ data: 'protected' });
+  })(request);
+}
+```
+
+**Client-Side Handling**:
+- Authorization errors (403) display user-friendly error pages
+- Client components check API response status and handle authorization failures
+- Provides contact information and "Return to Dashboard" links
+
+**Authorization Flow**:
+1. User authenticates via Stanford SAML
+2. Middleware checks global entitlements first
+3. If no global access, checks per-application mappings
+4. Routes/APIs enforce access before rendering/processing
+5. Clear error messages for authorization failures
+
 ### Component Patterns
 
 **Client Components** - Use `'use client'` directive when:

.gitignore

@@ -44,3 +44,6 @@ next-env.d.ts
 # saml
 saml-sp.key
 saml-sp.crt
+
+# Cache directory, if present
+.cache

README.md

@@ -92,6 +92,13 @@ Then open:
 | `SAML_SP_CERT` | Your SP certificate | Multi-line PEM format |
 | `SAML_SP_PRIVATE_KEY` | Your SP private key | Multi-line PEM format |
 
+### Authorization Variables
+
+| Variable | Description | Example |
+|----------|-------------|----------|
+| `CHURRO_GLOBAL_ENTITLEMENTS` | eduPersonEntitlement values for global access | `uit:sws` or `uit:sws,other:entitlement` |
+| `CHURRO_APP_ACCESS` | Per-application SUNet ID mappings | `uuid1:jdoe,jsmith;uuid2:jdoe` |
+
 ### Optional Variables
 
 | Variable | Description | Default |

app/api/acquia/applications/route.ts

@@ -1,7 +1,9 @@
 import { NextRequest, NextResponse } from 'next/server';
 import AcquiaApiServiceFixed from '@/lib/acquia-api';
+import { withApiAuthorization } from '@/lib/api-auth';
 
 export async function GET(request: NextRequest) {
+  return withApiAuthorization(async (request: NextRequest, context: { user: any }) => {
   // console.log('🚀 Applications API Route called');
 
   // Update the API service initialization with better error handling
@@ -55,4 +57,5 @@ export async function GET(request: NextRequest) {
       { status: 500 }
     );
   }
+  })(request);
 }

app/api/acquia/views/route.ts

@@ -1,27 +1,29 @@
 import { NextRequest, NextResponse } from 'next/server';
 import AcquiaApiServiceFixed from '@/lib/acquia-api';
+import { withApiAuthorization } from '@/lib/api-auth';
 
 export async function GET(request: NextRequest) {
-  const searchParams = request.nextUrl.searchParams;
-  const subscriptionUuid = searchParams.get('subscriptionUuid');
-  const from = searchParams.get('from');
-  const to = searchParams.get('to');
-  const resolution = searchParams.get('resolution'); // Get granularity for daily data
-  /**
-  console.log('🚀 Views by Application API Route called with params:', {
-    subscriptionUuid,
-    from,
-    to,
-    resolution
-  });
-  */
-  if (!subscriptionUuid) {
-    console.error('❌ Missing required parameter: subscriptionUuid');
-    return NextResponse.json(
-      { error: 'subscriptionUuid is required' },
-      { status: 400 }
-    );
-  }
+  return withApiAuthorization(async (request: NextRequest, context: { user: any }) => {
+    const searchParams = request.nextUrl.searchParams;
+    const subscriptionUuid = searchParams.get('subscriptionUuid');
+    const from = searchParams.get('from');
+    const to = searchParams.get('to');
+    const resolution = searchParams.get('resolution'); // Get granularity for daily data
+    /**
+    console.log('🚀 Views by Application API Route called with params:', {
+      subscriptionUuid,
+      from,
+      to,
+      resolution
+    });
+    */
+    if (!subscriptionUuid) {
+      console.error('❌ Missing required parameter: subscriptionUuid');
+      return NextResponse.json(
+        { error: 'subscriptionUuid is required' },
+        { status: 400 }
+      );
+    }
 
   if (!process.env.ACQUIA_API_KEY || !process.env.ACQUIA_API_SECRET) {
     console.error('❌ Missing required environment variables!');
@@ -82,4 +84,5 @@ export async function GET(request: NextRequest) {
       { status: 500 }
     );
   }
+  })(request);
 }

app/api/acquia/visits/route.ts

@@ -1,7 +1,9 @@
 import { NextRequest, NextResponse } from 'next/server';
 import AcquiaApiServiceFixed from '@/lib/acquia-api';
+import { withApiAuthorization } from '@/lib/api-auth';
 
 export async function GET(request: NextRequest) {
+  return withApiAuthorization(async (request: NextRequest, context: { user: any }) => {
   const searchParams = request.nextUrl.searchParams;
   const subscriptionUuid = searchParams.get('subscriptionUuid');
   const from = searchParams.get('from');
@@ -85,4 +87,5 @@ export async function GET(request: NextRequest) {
       { status: 500 }
     );
   }
+  })(request);
 }

app/api/auth/logout/route.ts

@@ -8,11 +8,22 @@ import { getBaseUrl } from '@/lib/url-utils'
  */
 export async function GET(request: NextRequest) {
   const cookieStore = await cookies()
+  const { searchParams } = new URL(request.url)
 
   // Delete the JWT cookie
   cookieStore.delete(getSessionCookieName())
 
-  // Redirect to home page or login page
+  // Check if redirect URL is specified (e.g., from test page)
+  const redirectTo = searchParams.get('redirectTo')
   const baseUrl = getBaseUrl(request)
+
+  if (redirectTo) {
+    // Validate that redirect is to a safe path (starts with /)
+    if (redirectTo.startsWith('/')) {
+      return NextResponse.redirect(new URL(redirectTo, baseUrl))
+    }
+  }
+
+  // Default redirect to home page
   return NextResponse.redirect(new URL('/', baseUrl))
 }

app/applications/[uuid]/page.tsx

@@ -41,17 +41,34 @@ export default function ApplicationDetailPage({ params }: any) {
   const [error, setError] = useState<string | null>(null);
   const [dailyViews, setDailyViews] = useState<DailyDataPoint[]>([]);
   const [dailyVisits, setDailyVisits] = useState<DailyDataPoint[]>([]);
+  const [authError, setAuthError] = useState<string | null>(null);
+
+  // Check for authorization errors from API calls
+  const handleApiResponse = async (response: Response) => {
+    if (response.status === 403) {
+      const errorData = await response.json().catch(() => ({}));
+      setAuthError(errorData.error || 'Access denied. You do not have permission to view this application.');
+      return null;
+    }
+    if (!response.ok) {
+      throw new Error(`API error: ${response.status} ${response.statusText}`);
+    }
+    return response.json();
+  };
 
   // Fetch application name on mount or when subscriptionUuid changes
   useEffect(() => {
     const fetchAppName = async () => {
       try {
         setLoadingStep('Fetching application info...');
         const res = await fetch(`/api/acquia/applications?subscriptionUuid=${subscriptionUuid}`);
-        const apps = await res.json();
+        const apps = await handleApiResponse(res);
+        if (!apps) return; // Authorization error handled by handleApiResponse
+
         const app = Array.isArray(apps) ? apps.find((a: any) => a.uuid === typedParams.uuid) : null;
         setAppName(app ? app.name : '');
-      } catch {
+      } catch (err) {
+        console.error('Error fetching app name:', err);
         setAppName('');
       } finally {
         setLoadingStep('');
@@ -60,6 +77,31 @@ export default function ApplicationDetailPage({ params }: any) {
     if (subscriptionUuid) fetchAppName();
   }, [subscriptionUuid, typedParams.uuid]);
 
+  // Show authorization error if user doesn't have access
+  if (authError) {
+    return (
+      <div className="min-h-screen p-8">
+        <div className="max-w-2xl mx-auto">
+          <div className="bg-red-50 border border-red-200 rounded-lg p-6">
+            <h1 className="text-xl font-semibold text-red-800 mb-2">Access Denied</h1>
+            <p className="text-red-700 mb-4">{authError}</p>
+            <p className="text-sm text-red-600">
+              If you believe you should have access to this application, please contact your administrator.
+            </p>
+            <div className="mt-4">
+              <a
+                href="/"
+                className="inline-flex items-center px-4 py-2 border border-red-300 rounded-md text-sm font-medium text-red-700 bg-white hover:bg-red-50"
+              >
+                Return to Dashboard
+              </a>
+            </div>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
   const fetchAppDetail = async () => {
     setLoading(true);
     setLoadingStep('Fetching analytics data...');
@@ -80,10 +122,11 @@ export default function ApplicationDetailPage({ params }: any) {
         fetch(`/api/acquia/visits?${dailyQuery}`),
       ]);
 
-      const [dailyViewsRaw, dailyVisitsRaw]: [AcquiaApiResponse, AcquiaApiResponse] = await Promise.all([
-        dailyViewsRes.ok ? dailyViewsRes.json() : {},
-        dailyVisitsRes.ok ? dailyVisitsRes.json() : {},
-      ]);
+      // Handle authorization errors
+      const dailyViewsRaw = await handleApiResponse(dailyViewsRes);
+      const dailyVisitsRaw = await handleApiResponse(dailyVisitsRes);
+
+      if (!dailyViewsRaw || !dailyVisitsRaw) return; // Authorization error handled
 
       // Helper to process and aggregate daily data with proper types
       const processDailyData = (rawData: AcquiaApiResponse, metric: 'views' | 'visits'): DailyDataPoint[] => {
@@ -115,8 +158,8 @@ export default function ApplicationDetailPage({ params }: any) {
       const overallViewsData = dailyViewsRaw.data || [];
       const overallVisitsData = dailyVisitsRaw.data || [];
 
-      const overallTotalViews = overallViewsData.reduce((sum, v) => sum + (v.views || 0), 0);
-      const overallTotalVisits = overallVisitsData.reduce((sum, v) => sum + (v.visits || 0), 0);
+      const overallTotalViews = overallViewsData.reduce((sum: number, v: any) => sum + (v.views || 0), 0);
+      const overallTotalVisits = overallVisitsData.reduce((sum: number, v: any) => sum + (v.visits || 0), 0);
 
       setViews(appTotalViews);
       setVisits(appTotalVisits);