Support runtime Portal authentication configuration #1450

Summary

The production Portal currently supports changing the authentication enablement flag at container startup, but its Microsoft Entra client settings remain build-time-only. Extend the runtime /config.js mechanism so one Portal image can be configured for the target environment when the container starts.

Current behavior

• SCOPE_AUTH_ENABLED is read by apps/portal/docker-entrypoint.sh and written to window.__SCOPE_CONFIG__.authEnabled.
• The Portal reads the client ID, authority, and scopes only from build-time values:
  • VITE_AUTH_CLIENT_ID
  • VITE_AUTH_AUTHORITY
  • VITE_AUTH_SCOPES
• Setting corresponding values on the running container does not configure MSAL because those values are not written to /config.js or consumed from window.__SCOPE_CONFIG__.

This limits the ability to promote the same image between environments that use different Entra app registrations.

Proposed runtime contract

Support these container environment variables:

SCOPE_AUTH_CLIENT_ID
SCOPE_AUTH_AUTHORITY
SCOPE_AUTH_SCOPES

At container startup, docker-entrypoint.sh should safely serialize them into /config.js, alongside SCOPE_AUTH_ENABLED. The Portal auth configuration should prefer runtime values when present and retain the existing VITE_AUTH_* behavior as a fallback for development and direct builds.

A possible runtime shape is:

window.__SCOPE_CONFIG__ = {
  authEnabled: true,
  authClientId: "...",
  authAuthority: "...",
  authScopes: ["..."],
};

The exact property names can follow the existing runtime configuration conventions.

Requirements

• Escape or serialize runtime strings safely when generating JavaScript.
• Parse scopes consistently with the existing VITE_AUTH_SCOPES behavior.
• Prefer explicitly supplied runtime values over build-time values.
• Preserve the current development defaults and build-time fallback behavior.
• When authentication is enabled but required configuration is incomplete, continue showing the existing not-configured state rather than silently using unintended defaults.
• Do not expose client secrets or access tokens; these settings are public OAuth client metadata.

Tests

Add coverage for:

• entrypoint generation of client ID, authority, scopes, and enablement
• escaping values written to /config.js
• runtime values overriding build-time values
• build-time fallback when runtime values are absent
• incomplete runtime configuration
• disabled authentication not initializing MSAL

Documentation

Update ENV_VARIABLES.md and the authentication architecture documentation to distinguish runtime SCOPE_AUTH_* settings from build-time VITE_AUTH_* fallbacks.

Context

#1385 added API authentication and Portal sign-in. The Portal runtime enablement switch is present, but the remaining MSAL configuration is still embedded during the Vite build.