From 92d16eb2c1aa5f650e1a1cf160cea95894a221ae Mon Sep 17 00:00:00 2001
From: Nessar <th.theophyl.hoguet@gmail.com>
Date: Tue, 14 Jul 2026 20:31:31 +0200
Subject: [PATCH] fix: proxy OAuth2/login/logout paths through nginx to Spring
 BFF

nginx was only forwarding /api/* to the backend.
Added proxy locations for:
  - /oauth2/  (Spring Security login initiation)
  - /login/oauth2/  (OAuth2 authorization code callback)
  - /logout  (Spring Security logout + RP-initiated end-session)

Also revert incorrect /api prefix on the login redirect URL.
---
 frontend/nginx.conf     | 27 +++++++++++++++++++++++++++
 frontend/src/app/app.ts |  2 +-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/frontend/nginx.conf b/frontend/nginx.conf
index fa7eb33..9222bd9 100644
--- a/frontend/nginx.conf
+++ b/frontend/nginx.conf
@@ -16,6 +16,33 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
+    # Spring Security OAuth2 login initiation
+    location /oauth2/ {
+        proxy_pass http://backend:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Spring Security OAuth2 callback (authorization code)
+    location /login/oauth2/ {
+        proxy_pass http://backend:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Spring Security logout endpoint
+    location /logout {
+        proxy_pass http://backend:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
     error_page 500 502 503 504 /50x.html;
     location = /50x.html {
         root /usr/share/nginx/html;
diff --git a/frontend/src/app/app.ts b/frontend/src/app/app.ts
index 7366663..49433b5 100644
--- a/frontend/src/app/app.ts
+++ b/frontend/src/app/app.ts
@@ -42,7 +42,7 @@ export class App implements OnInit {
   }
 
   ngOnInit() {
-    this.http.get<{authenticated: boolean, username?: string, email?: string}>('/api/user').subscribe({
+    this.http.get<{ authenticated: boolean, username?: string, email?: string }>('/api/user').subscribe({
       next: (user) => {
         if (user.authenticated) {
           this._isLoggedIn.set(true);