Update documentation for SWA authentication and implemented frontend #30
Conversation
…azor frontend Co-authored-by: MWG-Logan <[email protected]>
There was a problem hiding this comment.
Pull request overview
This PR updates documentation to accurately reflect the current authentication architecture (Static Web Apps with Azure AD handles authentication upstream, Azure Functions use AuthorizationLevel.Anonymous) and corrects the frontend implementation status from "to be implemented" to fully implemented with details about the Blazor WebAssembly features.
- Changed frontend documentation from "to be implemented" to describing the fully functional Blazor WebAssembly application with Fluent UI components, Markdig rendering, and PDF export
- Documented the authentication architecture where Static Web Apps enforces Azure AD authentication before requests reach Azure Functions
- Added detailed authentication flow descriptions and Azure AD configuration steps across all documentation files
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| docs/frontend.md | Added authentication section explaining SWA/Azure AD integration, updated key behaviors to reflect authentication requirement, clarified HTTP client behavior with SWA routing |
| docs/deployment.md | Added Azure AD configuration steps for both integrated and separate deployment scenarios, documented SWA authentication enforcement |
| docs/architecture.md | Updated data flow to include authentication steps, added new "Authentication Architecture" section explaining the SWA authentication layer |
| README.md | Updated project overview to reflect three projects including Shared DTOs, changed frontend status from "to be implemented" to implemented with feature details, expanded security section with authentication flow diagram, updated project structure to show all three projects |
| Bezalu.ProjectReporting.API/README.md | Updated security section to document SWA authentication layer and AuthorizationLevel.Anonymous pattern |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| ## Authentication Architecture | ||
| - **Static Web Apps** handles authentication via Azure AD (Entra ID) | ||
| - `staticwebapp.config.json` enforces `authenticated` role for `/api/*` routes |
There was a problem hiding this comment.
Consider specifying the full path to the configuration file (e.g., "Bezalu.ProjectReporting.Web/staticwebapp.config.json") to help readers locate this file in the project structure.
| - `staticwebapp.config.json` enforces `authenticated` role for `/api/*` routes | |
| - `Bezalu.ProjectReporting.Web/staticwebapp.config.json` enforces `authenticated` role for `/api/*` routes |
| - Add Entra ID or other auth on Static Web Apps; issue front-end access token; secure Functions with Easy Auth or custom. | ||
| - **Azure Static Web Apps** integrated with **Azure AD (Entra ID)** for authentication | ||
| - Configure authentication provider in Azure Portal under SWA > Settings > Authentication | ||
| - `staticwebapp.config.json` enforces authentication: |
There was a problem hiding this comment.
Consider specifying the full path to the configuration file (e.g., "Bezalu.ProjectReporting.Web/staticwebapp.config.json") to help readers locate this file in the project structure.
| - `staticwebapp.config.json` enforces authentication: | |
| - `Bezalu.ProjectReporting.Web/staticwebapp.config.json` enforces authentication: |
| - Configured in `staticwebapp.config.json`: | ||
| - `/api/*` routes require `authenticated` role | ||
| - Unauthenticated users redirected to `/.auth/login/aad` | ||
| - SWA session cookies automatically included in API requests |
There was a problem hiding this comment.
Inconsistent terminology: This line refers to "SWA session cookies" while line 28 refers to "SWA authentication cookies". Consider using consistent terminology throughout the documentation to refer to the same concept.
| - SWA session cookies automatically included in API requests | |
| - SWA authentication cookies automatically included in API requests |
| ### Authentication Flow | ||
|
|
||
| 1. User accesses the Blazor WebAssembly app hosted on Azure Static Web Apps | ||
| 2. Static Web Apps enforces authentication via Azure AD (configured in `staticwebapp.config.json`) |
There was a problem hiding this comment.
The documentation states "configured in staticwebapp.config.json" but doesn't specify where this file is located. Consider adding the file path (e.g., "configured in Bezalu.ProjectReporting.Web/staticwebapp.config.json") to help readers locate this configuration file.
| 2. Static Web Apps enforces authentication via Azure AD (configured in `staticwebapp.config.json`) | |
| 2. Static Web Apps enforces authentication via Azure AD (configured in `Bezalu.ProjectReporting.Web/staticwebapp.config.json`) |
|
|
||
| ## Authentication | ||
| - **Azure Static Web Apps** handles authentication via Azure AD (Entra ID) | ||
| - Configured in `staticwebapp.config.json`: |
There was a problem hiding this comment.
Consider specifying the full path to the configuration file (e.g., "Configured in Bezalu.ProjectReporting.Web/staticwebapp.config.json") to help readers locate this file in the project structure.
| - Configured in `staticwebapp.config.json`: | |
| - Configured in `Bezalu.ProjectReporting.Web/staticwebapp.config.json`: |
| - Markdown + Markdig chosen for flexibility in AI summary formatting. | ||
| - QuestPDF chosen for deterministic server-side PDF rendering. | ||
| - **Azure Static Web Apps** provides integrated hosting, authentication, and API routing. | ||
| - **Function AuthorizationLevel.Anonymous** used because authentication is enforced upstream by SWA. |
There was a problem hiding this comment.
The phrase "Function AuthorizationLevel.Anonymous" reads awkwardly. Consider rewording to "Azure Functions use AuthorizationLevel.Anonymous" for better clarity and readability.
| - **Function AuthorizationLevel.Anonymous** used because authentication is enforced upstream by SWA. | |
| - **Azure Functions use AuthorizationLevel.Anonymous** because authentication is enforced upstream by SWA. |
Documentation was outdated regarding authentication architecture (functions use
AuthorizationLevel.Anonymousbut are secured by Static Web Apps) and frontend implementation status (Blazor frontend is fully implemented, not "to be implemented").Updated Documentation
Authentication architecture:
staticwebapp.config.jsonAuthorizationLevel.Anonymousand trust SWA authentication layerFrontend implementation:
Files updated:
README.md- Architecture overview, security section, project structureBezalu.ProjectReporting.API/README.md- Security modeldocs/architecture.md- Authentication architecture, data flowdocs/deployment.md- Azure AD configurationdocs/frontend.md- Frontend overview, auth behaviorAuthentication Flow
The key design: Functions don't need function keys because SWA's
authenticatedrole requirement on/api/*routes provides authentication before requests reach Azure Functions.💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.