feat(quiz-service): pipeline complet de gamification (RabbitMQ)

mobile/lib/core/network/api_client.dart

@@ -1,12 +1,14 @@
 import 'package:dio/dio.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'auth_interceptor.dart';
 
 /// Single entry point for all HTTP calls, routed through api-gateway.
 /// Never hit a microservice's own port directly from the app.
 class ApiClient {
   static const String baseUrl = 'http://localhost:8080';
   late final Dio dio;
 
-  ApiClient() {
+  ApiClient(FlutterSecureStorage storage) {
     dio = Dio(
       BaseOptions(
         baseUrl: baseUrl,
@@ -15,9 +17,10 @@ class ApiClient {
         headers: {'Content-Type': 'application/json'},
       ),
     );
+    dio.interceptors.add(AuthInterceptor(storage));
   }
 
   /// Test-only constructor: injects a (typically mocked) Dio instance
-  /// directly, bypassing real network configuration.
+  /// directly, bypassing real network configuration and the auth interceptor.
   ApiClient.withDio(this.dio);
-}
+}

mobile/lib/core/network/auth_interceptor.dart

@@ -0,0 +1,20 @@
+import 'package:dio/dio.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
+/// Attaches the stored access token to every outgoing request. Without this,
+/// every call is rejected with 401 by api-gateway's JwtAuthenticationFilter
+/// (except the public /api/auth/** routes).
+class AuthInterceptor extends Interceptor {
+  final FlutterSecureStorage _storage;
+
+  AuthInterceptor(this._storage);
+
+  @override
+  void onRequest(RequestOptions options, RequestInterceptorHandler handler) async {
+    final token = await _storage.read(key: 'access_token');
+    if (token != null) {
+      options.headers['Authorization'] = 'Bearer $token';
+    }
+    handler.next(options);
+  }
+}

mobile/lib/features/auth/presentation/auth_providers.dart

@@ -4,7 +4,7 @@ import '../../../core/network/api_client.dart';
 import '../data/auth_repository.dart';
 import '../domain/auth_models.dart';
 
-final apiClientProvider = Provider((ref) => ApiClient());
+final apiClientProvider = Provider((ref) => ApiClient(ref.watch(secureStorageProvider)));
 
 final authRepositoryProvider = Provider((ref) {
   return AuthRepository(ref.watch(apiClientProvider));
@@ -21,20 +21,46 @@ class AuthController extends StateNotifier<AuthResponse?> {
 
   Future<AuthResponse> login(String email, String password) async {
     final result = await _repository.login(email: email, password: password);
-    await _storage.write(key: 'access_token', value: result.accessToken);
-    await _storage.write(key: 'refresh_token', value: result.refreshToken);
-    await _storage.write(key: 'account_id', value: result.id);
+    await _persistSession(result);
     state = result;
     return result;
   }
 
   Future<AuthResponse> register(String email, String password) async {
     final result = await _repository.register(email: email, password: password);
+    await _persistSession(result);
+    state = result;
+    return result;
+  }
+
+  Future<void> _persistSession(AuthResponse result) async {
     await _storage.write(key: 'access_token', value: result.accessToken);
     await _storage.write(key: 'refresh_token', value: result.refreshToken);
     await _storage.write(key: 'account_id', value: result.id);
-    state = result;
-    return result;
+    await _storage.write(key: 'email', value: result.email);
+    await _storage.write(key: 'role', value: result.role);
+  }
+
+  /// Reconstructs the session from secure storage on app startup (page
+  /// reload, direct URL navigation, hot restart). Without this, the
+  /// in-memory-only state means every reload silently logs the user out
+  /// even though valid tokens are still on disk.
+  Future<void> restoreSession() async {
+    final accessToken = await _storage.read(key: 'access_token');
+    final refreshToken = await _storage.read(key: 'refresh_token');
+    final accountId = await _storage.read(key: 'account_id');
+    final email = await _storage.read(key: 'email');
+    final role = await _storage.read(key: 'role');
+
+    if (accessToken != null && refreshToken != null && accountId != null && email != null && role != null) {
+      state = AuthResponse(
+        id: accountId,
+        accessToken: accessToken,
+        refreshToken: refreshToken,
+        email: email,
+        role: role,
+      );
+    }
   }
 
   Future<void> logout() async {
@@ -50,4 +76,10 @@ final authControllerProvider = StateNotifierProvider<AuthController, AuthRespons
 /// Convenience accessor: the current session's accountId, or null if logged out.
 final accountIdProvider = Provider<String?>((ref) {
   return ref.watch(authControllerProvider)?.id;
-});
+});
+/// Gate used at app startup: the app waits for this to complete before
+/// building any real screen, so no route ever runs with a stale/null
+/// session while restoreSession() is still in flight.
+final sessionRestorationProvider = FutureProvider<void>((ref) async {
+  await ref.read(authControllerProvider.notifier).restoreSession();
+});

mobile/lib/main.dart

@@ -2,9 +2,23 @@ import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'core/router/app_router.dart';
 import 'core/theme/app_theme.dart';
+import 'features/auth/presentation/auth_providers.dart';
 
-void main() {
-  runApp(const ProviderScope(child: AfriLinguaApp()));
+Future<void> main() async {
+  // Restaure la session AVANT de construire l'arbre de widgets, pour que
+  // go_router (via MaterialApp.router) evalue l'URL initiale du navigateur
+  // avec un accountIdProvider deja peuple. Ca evite a la fois le flash
+  // "login -> ecran demande" et le bug de parsing d'URL introduit par une
+  // precedente tentative avec un MaterialApp non-router imbrique.
+  final container = ProviderContainer();
+  await container.read(authControllerProvider.notifier).restoreSession();
+
+  runApp(
+    UncontrolledProviderScope(
+      container: container,
+      child: const AfriLinguaApp(),
+    ),
+  );
 }
 
 class AfriLinguaApp extends ConsumerWidget {
@@ -13,7 +27,6 @@ class AfriLinguaApp extends ConsumerWidget {
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final router = ref.watch(routerProvider);
-
     return MaterialApp.router(
       title: 'AfriLingua',
       debugShowCheckedModeBanner: false,
@@ -22,4 +35,3 @@ class AfriLinguaApp extends ConsumerWidget {
     );
   }
 }
-

services/api-gateway/pom.xml

@@ -20,6 +20,7 @@
     <properties>
         <java.version>21</java.version>
         <spring-cloud.version>2023.0.3</spring-cloud.version>
+        <jjwt.version>0.12.6</jjwt.version>
     </properties>
 
     <dependencies>
@@ -35,6 +36,23 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-actuator</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-api</artifactId>
+            <version>${jjwt.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-impl</artifactId>
+            <version>${jjwt.version}</version>
+            <scope>runtime</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-jackson</artifactId>
+            <version>${jjwt.version}</version>
+            <scope>runtime</scope>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-test</artifactId>

services/api-gateway/src/main/java/cm/afrilingua/gateway/ApiGatewayApplication.java

@@ -2,8 +2,10 @@
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.context.properties.ConfigurationPropertiesScan;
 
 @SpringBootApplication
+@ConfigurationPropertiesScan
 public class ApiGatewayApplication {
     public static void main(String[] args) {
         SpringApplication.run(ApiGatewayApplication.class, args);

services/api-gateway/src/main/java/cm/afrilingua/gateway/config/JwtProperties.java

@@ -0,0 +1,8 @@
+package cm.afrilingua.gateway.config;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+/** Mirrors auth-service's JwtProperties -- must share the same secret-key so
+ * tokens signed by auth-service can be verified here. */
+@ConfigurationProperties(prefix = "application.security.jwt")
+public record JwtProperties(String secretKey) {}

services/api-gateway/src/main/java/cm/afrilingua/gateway/security/JwtAuthenticationFilter.java

@@ -0,0 +1,100 @@
+package cm.afrilingua.gateway.security;
+
+import cm.afrilingua.gateway.config.JwtProperties;
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.JwtException;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.security.Keys;
+import org.springframework.cloud.gateway.filter.GatewayFilterChain;
+import org.springframework.cloud.gateway.filter.GlobalFilter;
+import org.springframework.core.Ordered;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.server.reactive.ServerHttpRequest;
+import org.springframework.http.server.reactive.ServerHttpResponse;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Mono;
+
+import javax.crypto.SecretKey;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+
+/**
+ * Validates the JWT on every request except the public auth routes, then
+ * strips the client-supplied Authorization header and replaces it with a
+ * trusted X-User-Id header before forwarding downstream. Internal services
+ * never need to know about JWT at all -- they just trust X-User-Id, because
+ * this filter is the only entry point into the system (services are not
+ * exposed directly, only through this gateway).
+ *
+ * This is the single point of authentication for the whole platform: no
+ * other service validates tokens. Keeping it here (rather than duplicating
+ * JWT validation in every microservice) is what makes X-User-Id trustworthy
+ * downstream -- as long as nothing bypasses the gateway in production.
+ */
+@Component
+public class JwtAuthenticationFilter implements GlobalFilter, Ordered {
+
+    private static final List<String> PUBLIC_PATH_PREFIXES = List.of("/api/auth/");
+
+    private final SecretKey signingKey;
+
+    public JwtAuthenticationFilter(JwtProperties jwtProperties) {
+        this.signingKey = Keys.hmacShaKeyFor(jwtProperties.secretKey().getBytes(StandardCharsets.UTF_8));
+    }
+
+    @Override
+    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
+        String path = exchange.getRequest().getURI().getPath();
+
+        if (isPublicPath(path)) {
+            return chain.filter(exchange);
+        }
+
+        String authHeader = exchange.getRequest().getHeaders().getFirst("Authorization");
+        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
+            return unauthorized(exchange, "Missing or malformed Authorization header");
+        }
+
+        String token = authHeader.substring("Bearer ".length());
+
+        try {
+            Claims claims = Jwts.parser()
+                    .verifyWith(signingKey)
+                    .build()
+                    .parseSignedClaims(token)
+                    .getPayload();
+
+            String userId = claims.getSubject();
+
+            ServerHttpRequest mutatedRequest = exchange.getRequest().mutate()
+                    .headers(headers -> {
+                        headers.remove("Authorization");
+                        headers.remove("X-User-Id"); // never trust a client-supplied value
+                        headers.set("X-User-Id", userId);
+                    })
+                    .build();
+
+            return chain.filter(exchange.mutate().request(mutatedRequest).build());
+        } catch (JwtException | IllegalArgumentException e) {
+            return unauthorized(exchange, "Invalid or expired token");
+        }
+    }
+
+    private boolean isPublicPath(String path) {
+        return PUBLIC_PATH_PREFIXES.stream().anyMatch(path::startsWith);
+    }
+
+    private Mono<Void> unauthorized(ServerWebExchange exchange, String message) {
+        ServerHttpResponse response = exchange.getResponse();
+        response.setStatusCode(HttpStatus.UNAUTHORIZED);
+        response.getHeaders().add("Content-Type", "application/json");
+        byte[] body = ("{\"message\":\"" + message + "\"}").getBytes(StandardCharsets.UTF_8);
+        return response.writeWith(Mono.just(response.bufferFactory().wrap(body)));
+    }
+
+    @Override
+    public int getOrder() {
+        return Ordered.HIGHEST_PRECEDENCE;
+    }
+}

services/api-gateway/src/main/resources/application.yml

@@ -70,4 +70,8 @@ management:
   endpoints:
     web:
       exposure:
-        include: health,gateway
+        include: health,gateway
+application:
+  security:
+    jwt:
+      secret-key: ${JWT_SECRET_KEY:404E635266556A586E3272357538782F413F4428472B4B6250645367566B59}