From 72d681bdd380ec9d96e34a22cdd78117b24dd7b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81sd=C3=ADs=20Erna=20Gu=C3=B0mundsd=C3=B3ttir?=
 <disa@hugsmidjan.is>
Date: Thu, 31 Oct 2024 13:40:32 +0000
Subject: [PATCH 01/12] fix(my-pages): law and order breadcrumbs + button
 filter (#16668)

Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 libs/service-portal/core/src/components/Filter/Filter.css.ts | 2 +-
 libs/service-portal/core/src/components/Filter/Filter.tsx    | 1 +
 libs/service-portal/core/src/lib/messages.ts                 | 4 ++++
 libs/service-portal/law-and-order/src/lib/navigation.ts      | 3 +--
 4 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/libs/service-portal/core/src/components/Filter/Filter.css.ts b/libs/service-portal/core/src/components/Filter/Filter.css.ts
index 5b4792c2e7e0..fd90a32391f9 100644
--- a/libs/service-portal/core/src/components/Filter/Filter.css.ts
+++ b/libs/service-portal/core/src/components/Filter/Filter.css.ts
@@ -18,6 +18,6 @@ export const popoverContainer = style({
 
 export const lgBtn = style({})
 
-globalStyle(`${lgBtn} span`, {
+globalStyle(`${lgBtn} > span`, {
   height: '100%',
 })
diff --git a/libs/service-portal/core/src/components/Filter/Filter.tsx b/libs/service-portal/core/src/components/Filter/Filter.tsx
index cbe6f6045117..a1c56538fabd 100644
--- a/libs/service-portal/core/src/components/Filter/Filter.tsx
+++ b/libs/service-portal/core/src/components/Filter/Filter.tsx
@@ -136,6 +136,7 @@ export const Filter: FC<React.PropsWithChildren<FilterProps>> = ({
                     icon="filter"
                     fluid
                     nowrap
+                    size="small"
                   >
                     {popover.visible ? labelClose : labelOpen}
                   </Button>
diff --git a/libs/service-portal/core/src/lib/messages.ts b/libs/service-portal/core/src/lib/messages.ts
index 7bb01507e4e2..eb534bda0c73 100644
--- a/libs/service-portal/core/src/lib/messages.ts
+++ b/libs/service-portal/core/src/lib/messages.ts
@@ -1656,6 +1656,10 @@ export const m = defineMessages({
     defaultMessage:
       'Hér eru upplýsingar og yfirlit yfir mál sem þú átt hjá dómskerfinu.',
   },
+  myCourtCases: {
+    id: 'service.portal:my-court-cases',
+    defaultMessage: 'Mín dómsmál',
+  },
   courtCases: {
     id: 'service.portal:court-cases',
     defaultMessage: 'Dómsmál',
diff --git a/libs/service-portal/law-and-order/src/lib/navigation.ts b/libs/service-portal/law-and-order/src/lib/navigation.ts
index e5b58bb4798e..f929f58a9c41 100644
--- a/libs/service-portal/law-and-order/src/lib/navigation.ts
+++ b/libs/service-portal/law-and-order/src/lib/navigation.ts
@@ -15,9 +15,8 @@ export const lawAndOrderNavigation: PortalNavigationItem = {
       path: LawAndOrderPaths.Overview,
     },
     {
-      name: m.courtCases,
+      name: m.myCourtCases,
       path: LawAndOrderPaths.CourtCases,
-      breadcrumbHide: true,
       children: [
         {
           name: m.courtCases,

From 319f2bd4e4a8364e62122d1947490921186e2d14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafn=20=C3=81rnason?= <rafnarnason@gmail.com>
Date: Thu, 31 Oct 2024 14:53:53 +0000
Subject: [PATCH 02/12] feat(system-e2e): Endorsements tests refresh (#16651)

* admin portal test fix

* chore: nx format:write update dirty files

* service portal test fix

* chore: nx format:write update dirty files

* service portal test fix

---------

Co-authored-by: andes-it <builders@andes.is>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 .../admin-portal/smoke/endorsements.spec.ts   | 36 +++++++------------
 .../service-portal/smoke/endorsements.spec.ts | 25 ++++++++-----
 2 files changed, 29 insertions(+), 32 deletions(-)

diff --git a/apps/system-e2e/src/tests/islandis/admin-portal/smoke/endorsements.spec.ts b/apps/system-e2e/src/tests/islandis/admin-portal/smoke/endorsements.spec.ts
index a65263282b98..fc267ff21f34 100644
--- a/apps/system-e2e/src/tests/islandis/admin-portal/smoke/endorsements.spec.ts
+++ b/apps/system-e2e/src/tests/islandis/admin-portal/smoke/endorsements.spec.ts
@@ -3,6 +3,7 @@ import { icelandicAndNoPopupUrl, urls } from '../../../../support/urls'
 import { session } from '../../../../support/session'
 
 const homeUrl = `${urls.islandisBaseUrl}/stjornbord`
+const delegationTarget = 'text="65° ARTIC ehf."'
 test.use({ baseURL: urls.islandisBaseUrl })
 
 test.describe('Admin portal (Endorsements)', () => {
@@ -29,8 +30,8 @@ test.describe('Admin portal (Endorsements)', () => {
   test('Open old endorsement list and go back', async ({ page }) => {
     test.slow()
     await page.goto(icelandicAndNoPopupUrl(homeUrl))
-    await page.getByTestId('active-module-name').click()
-    await page.getByRole('link', { name: 'Undirskriftalistar' }).click()
+    await page.click(delegationTarget)
+    await page.click('[title="Undirskriftalistar"]')
 
     await page.getByRole('tab', { name: 'Liðnir listar' }).click()
     await page.getByRole('button', { name: 'Skoða lista' }).first().click()
@@ -41,6 +42,11 @@ test.describe('Admin portal (Endorsements)', () => {
   })
 
   test('Update old endorsement list', async ({ page }) => {
+    test.slow()
+    await page.goto(icelandicAndNoPopupUrl(homeUrl))
+    await page.click(delegationTarget)
+    await page.click('[title="Undirskriftalistar"]')
+
     await page.getByRole('tab', { name: 'Liðnir listar' }).click()
     await page.getByRole('button', { name: 'Skoða lista' }).first().click()
     await page.getByRole('button', { name: 'Uppfæra lista' }).click()
@@ -49,28 +55,12 @@ test.describe('Admin portal (Endorsements)', () => {
     ).toBeVisible()
   })
 
-  test.skip('See locked lists are present and locked', async ({ page }) => {
-    await page.getByRole('tab', { name: 'Læstir listar' }).click()
-    const lockedLists = page.getByRole('button', { name: 'Skoða lista' })
-    await expect(lockedLists).toHaveCountGreaterThan(1)
-    await lockedLists.first().click()
-    await expect(
-      page.getByRole('alert', { name: 'Listi er læstur' }),
-    ).toBeVisible()
-  })
-
-  test('Go back to overview', async ({ page }) => {
-    await page.getByTestId('active-module-name').click()
-    await page
-      .getByRole('menu', { name: 'Stjórnborðs valmynd' })
-      .getByRole('link', { name: 'Yfirlit' })
-      .click()
-    await expect(
-      page.getByRole('heading', { name: 'Stjórnborð Ísland.is' }),
-    ).toBeVisible()
-  })
-
   test('Access and edit a list', async ({ page }) => {
+    test.slow()
+    await page.goto(icelandicAndNoPopupUrl(homeUrl))
+    await page.click(delegationTarget)
+    await page.click('[title="Undirskriftalistar"]')
+
     // Setup
     await page.getByRole('tab', { name: 'Liðnir listar' }).click()
 
diff --git a/apps/system-e2e/src/tests/islandis/service-portal/smoke/endorsements.spec.ts b/apps/system-e2e/src/tests/islandis/service-portal/smoke/endorsements.spec.ts
index fa3940d1e428..a67b9e593bba 100644
--- a/apps/system-e2e/src/tests/islandis/service-portal/smoke/endorsements.spec.ts
+++ b/apps/system-e2e/src/tests/islandis/service-portal/smoke/endorsements.spec.ts
@@ -25,16 +25,23 @@ test.describe('Endorsements', () => {
     const page = await context.newPage()
     await disableI18n(page)
 
-    // Navigate to the specified page
-    await page.goto(icelandicAndNoPopupUrl('/minarsidur/min-gogn/listar'))
+    const timeout = 10000
 
-    // Check for ui things
-    await expect(
-      page.locator('button:text("Stofna nýjan lista")'),
-    ).toBeVisible()
+    await page.goto(icelandicAndNoPopupUrl('/minarsidur/min-gogn/listar'))
 
-    // check for tabs
-    await expect(page.locator('button:text("Virkir listar")')).toBeVisible()
-    await expect(page.locator('button:text("Liðnir listar")')).toBeVisible()
+    await Promise.all([
+      expect(
+        page.getByRole('button', { name: 'Stofna nýjan lista' }),
+      ).toBeVisible({ timeout }),
+      expect(
+        page.getByRole('link', { name: 'Almennir undirskriftalistar' }),
+      ).toBeVisible({ timeout }),
+      expect(page.getByRole('tab', { name: 'Virkir listar' })).toBeVisible({
+        timeout,
+      }),
+      expect(page.getByRole('tab', { name: 'Liðnir listar' })).toBeVisible({
+        timeout,
+      }),
+    ])
   })
 })

From 4023c21b10e2132683ecb6f44289fec3a526f139 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81sd=C3=ADs=20Erna=20Gu=C3=B0mundsd=C3=B3ttir?=
 <disa@hugsmidjan.is>
Date: Thu, 31 Oct 2024 14:59:17 +0000
Subject: [PATCH 03/12] fix(my-pages): wrap tag (#16675)

Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 .../core/src/components/ActionCard/ActionCard.tsx            | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libs/service-portal/core/src/components/ActionCard/ActionCard.tsx b/libs/service-portal/core/src/components/ActionCard/ActionCard.tsx
index 29c012e7cd48..236a75fd2269 100644
--- a/libs/service-portal/core/src/components/ActionCard/ActionCard.tsx
+++ b/libs/service-portal/core/src/components/ActionCard/ActionCard.tsx
@@ -11,11 +11,11 @@ import {
   TagVariant,
   Text,
 } from '@island.is/island-ui/core'
+import cn from 'classnames'
 import * as React from 'react'
 import { CardLoader, isExternalLink } from '../..'
-import * as styles from './ActionCard.css'
 import LinkResolver from '../LinkResolver/LinkResolver'
-import cn from 'classnames'
+import * as styles from './ActionCard.css'
 
 type ActionCardProps = {
   capitalizeHeading?: boolean
@@ -349,6 +349,7 @@ export const ActionCard: React.FC<React.PropsWithChildren<ActionCardProps>> = ({
             flexDirection="row"
             justifyContent="spaceBetween"
             alignItems={['flexStart', 'flexStart', 'flexEnd']}
+            flexWrap="wrap"
           >
             {heading && (
               <Box

From f0dd1e433238a746ed78ad1dbf89ef9339075347 Mon Sep 17 00:00:00 2001
From: brynjarorng <brynjarorng@gmail.com>
Date: Thu, 31 Oct 2024 15:13:46 +0000
Subject: [PATCH 04/12] fix: added missing grant to auth ids api for user
 notification (#16680)

* fix: added missing grant to auth ids api for user notification

* chore: nx format:write update dirty files

---------

Co-authored-by: andes-it <builders@andes.is>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 apps/services/auth/ids-api/infra/ids-api.ts |  1 +
 charts/identity-server/values.dev.yaml      | 15 +++++++++------
 charts/identity-server/values.prod.yaml     | 15 +++++++++------
 charts/identity-server/values.staging.yaml  | 15 +++++++++------
 4 files changed, 28 insertions(+), 18 deletions(-)

diff --git a/apps/services/auth/ids-api/infra/ids-api.ts b/apps/services/auth/ids-api/infra/ids-api.ts
index 14ac4f6c60bf..470a1765ecd1 100644
--- a/apps/services/auth/ids-api/infra/ids-api.ts
+++ b/apps/services/auth/ids-api/infra/ids-api.ts
@@ -122,6 +122,7 @@ export const serviceSetup = (): ServiceBuilder<'services-auth-ids-api'> => {
       min: 2,
       max: 15,
     })
+    .grantNamespaces('user-notification')
 }
 
 const cleanupId = 'services-auth-ids-api-cleanup'
diff --git a/charts/identity-server/values.dev.yaml b/charts/identity-server/values.dev.yaml
index c9f3dca4c65a..c7f2f34b4f1c 100644
--- a/charts/identity-server/values.dev.yaml
+++ b/charts/identity-server/values.dev.yaml
@@ -123,8 +123,9 @@ identity-server:
     SessionsApiSettings__BaseAddress: 'http://web-services-sessions.services-sessions.svc.cluster.local'
   files:
     - 'ids-signing.pfx'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -431,8 +432,9 @@ services-auth-ids-api:
     XROAD_TJODSKRA_MEMBER_CODE: '10001'
     XROAD_TLS_BASE_PATH: 'https://securityserver.dev01.devland.is'
     XROAD_TLS_BASE_PATH_WITH_ENV: 'https://securityserver.dev01.devland.is/r1/IS-DEV'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -533,8 +535,9 @@ services-auth-ids-api-cleanup:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=921 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: ''
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
diff --git a/charts/identity-server/values.prod.yaml b/charts/identity-server/values.prod.yaml
index 58e9d76a535b..39262957015d 100644
--- a/charts/identity-server/values.prod.yaml
+++ b/charts/identity-server/values.prod.yaml
@@ -121,8 +121,9 @@ identity-server:
     SessionsApiSettings__BaseAddress: 'https://sessions-api.internal.island.is'
   files:
     - 'ids-signing.pfx'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -428,8 +429,9 @@ services-auth-ids-api:
     XROAD_TJODSKRA_MEMBER_CODE: '6503760649'
     XROAD_TLS_BASE_PATH: 'https://securityserver.island.is'
     XROAD_TLS_BASE_PATH_WITH_ENV: 'https://securityserver.island.is/r1/IS'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -530,8 +532,9 @@ services-auth-ids-api-cleanup:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=921 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: 'driving-license-use-v1-endpoint-for-v2-comms'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
diff --git a/charts/identity-server/values.staging.yaml b/charts/identity-server/values.staging.yaml
index 07afb0776b4c..4ced0775ec0b 100644
--- a/charts/identity-server/values.staging.yaml
+++ b/charts/identity-server/values.staging.yaml
@@ -123,8 +123,9 @@ identity-server:
     SessionsApiSettings__BaseAddress: 'http://web-services-sessions.services-sessions.svc.cluster.local'
   files:
     - 'ids-signing.pfx'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -431,8 +432,9 @@ services-auth-ids-api:
     XROAD_TJODSKRA_MEMBER_CODE: '6503760649'
     XROAD_TLS_BASE_PATH: 'https://securityserver.staging01.devland.is'
     XROAD_TLS_BASE_PATH_WITH_ENV: 'https://securityserver.staging01.devland.is/r1/IS-TEST'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -533,8 +535,9 @@ services-auth-ids-api-cleanup:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=921 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: ''
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3

From 7adc95ab373562f9edca6fe46ea18ac5155ecdf7 Mon Sep 17 00:00:00 2001
From: birkirkristmunds <142495885+birkirkristmunds@users.noreply.github.com>
Date: Thu, 31 Oct 2024 15:30:29 +0000
Subject: [PATCH 05/12] fix(skilavottord): Improve error handling when creating
 access and companies (#16559)

* TS-931 Fix error handling when creating a new access and companies

* TS-931 Fix error handling when updating  access

* TS-931 Improve the error msg to the user

---------

Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 .../screens/AccessControl/AccessControl.tsx   |  6 +++++
 .../RecyclingCompanyCreate.tsx                |  3 +++
 .../accessControl/accessControl.resolver.ts   | 25 ++++++++++++++-----
 .../recyclingPartner.resolver.ts              |  2 +-
 4 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/apps/skilavottord/web/screens/AccessControl/AccessControl.tsx b/apps/skilavottord/web/screens/AccessControl/AccessControl.tsx
index aee25f9c033a..9f274e15eb52 100644
--- a/apps/skilavottord/web/screens/AccessControl/AccessControl.tsx
+++ b/apps/skilavottord/web/screens/AccessControl/AccessControl.tsx
@@ -135,6 +135,9 @@ const AccessControl: FC<React.PropsWithChildren<unknown>> = () => {
   const [createSkilavottordAccessControl] = useMutation(
     CreateSkilavottordAccessControlMutation,
     {
+      onError(_) {
+        // Hide Runtime error message. The error message is already shown to the user in toast.
+      },
       refetchQueries: [
         {
           query: SkilavottordAccessControlsQuery,
@@ -145,6 +148,9 @@ const AccessControl: FC<React.PropsWithChildren<unknown>> = () => {
   const [updateSkilavottordAccessControl] = useMutation(
     UpdateSkilavottordAccessControlMutation,
     {
+      onError(_) {
+        // Hide Runtime error message. The error message is already shown to the user in toast.
+      },
       refetchQueries: [
         {
           query: SkilavottordAccessControlsQuery,
diff --git a/apps/skilavottord/web/screens/RecyclingCompanies/RecyclingCompanyCreate/RecyclingCompanyCreate.tsx b/apps/skilavottord/web/screens/RecyclingCompanies/RecyclingCompanyCreate/RecyclingCompanyCreate.tsx
index 20908b593766..a3d6c84b134e 100644
--- a/apps/skilavottord/web/screens/RecyclingCompanies/RecyclingCompanyCreate/RecyclingCompanyCreate.tsx
+++ b/apps/skilavottord/web/screens/RecyclingCompanies/RecyclingCompanyCreate/RecyclingCompanyCreate.tsx
@@ -50,6 +50,9 @@ const RecyclingCompanyCreate: FC<React.PropsWithChildren<unknown>> = () => {
   const [createSkilavottordRecyclingPartner] = useMutation(
     CreateSkilavottordRecyclingPartnerMutation,
     {
+      onError: (_) => {
+        // Hide Runtime error message. The error message is already shown to the user in toast.
+      },
       refetchQueries: [
         {
           query: SkilavottordAllRecyclingPartnersQuery,
diff --git a/apps/skilavottord/ws/src/app/modules/accessControl/accessControl.resolver.ts b/apps/skilavottord/ws/src/app/modules/accessControl/accessControl.resolver.ts
index 666861e944ca..61dffa84992a 100644
--- a/apps/skilavottord/ws/src/app/modules/accessControl/accessControl.resolver.ts
+++ b/apps/skilavottord/ws/src/app/modules/accessControl/accessControl.resolver.ts
@@ -1,16 +1,20 @@
-import { Query, Resolver, Args, Mutation } from '@nestjs/graphql'
-import { NotFoundException, BadRequestException } from '@nestjs/common'
+import {
+  BadRequestException,
+  ConflictException,
+  NotFoundException,
+} from '@nestjs/common'
+import { Args, Mutation, Query, Resolver } from '@nestjs/graphql'
 import { ApolloError } from 'apollo-server-express'
 
-import { Authorize, CurrentUser, User, Role } from '../auth'
+import { Authorize, CurrentUser, Role, User } from '../auth'
 
-import { AccessControlModel } from './accessControl.model'
-import { AccessControlService } from './accessControl.service'
 import {
-  UpdateAccessControlInput,
   CreateAccessControlInput,
   DeleteAccessControlInput,
+  UpdateAccessControlInput,
 } from './accessControl.input'
+import { AccessControlModel } from './accessControl.model'
+import { AccessControlService } from './accessControl.service'
 
 @Authorize({
   roles: [Role.developer, Role.recyclingFund, Role.recyclingCompanyAdmin],
@@ -77,6 +81,15 @@ export class AccessControlResolver {
     this.verifyDeveloperAccess(user, input.role)
     this.verifyRecyclingCompanyAdminInput(input.role, user)
     this.verifyRecyclingCompanyInput(input)
+
+    const access = await this.accessControlService.findOne(input.nationalId)
+
+    if (access) {
+      throw new ConflictException(
+        `Access with the national id ${input.nationalId} already exists`,
+      )
+    }
+
     return this.accessControlService.createAccess(input)
   }
 
diff --git a/apps/skilavottord/ws/src/app/modules/recyclingPartner/recyclingPartner.resolver.ts b/apps/skilavottord/ws/src/app/modules/recyclingPartner/recyclingPartner.resolver.ts
index 9efc48c9c865..66fb91a354a4 100644
--- a/apps/skilavottord/ws/src/app/modules/recyclingPartner/recyclingPartner.resolver.ts
+++ b/apps/skilavottord/ws/src/app/modules/recyclingPartner/recyclingPartner.resolver.ts
@@ -56,7 +56,7 @@ export class RecyclingPartnerResolver {
 
     if (recyclingPartner) {
       throw new ConflictException(
-        'Recycling partner with that id already exists',
+        `Recycling partner with the id ${input.companyId} already exists`,
       )
     }
 

From d0c9471bef4360cf6134ae033378fd2d6ef8d760 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sn=C3=A6r=20Seljan=20=C3=9E=C3=B3roddsson?=
 <112904566+snaerseljan@users.noreply.github.com>
Date: Thu, 31 Oct 2024 16:12:24 +0000
Subject: [PATCH 06/12] feat(services-bff): BFF (Backend for Frontend) (#15835)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Initial bootstrap for bff

* environment audit not optional

* Add infra file for admin-portal

* Auth login controller and service implemented

* Updates to auth and user modules and services

* Update project readme

* Add secret

* Remove unnecessary config

* Fix env config for ids

* Remove unused util isString

* chore: nx format:write update dirty files

* Rename dto to queries

* Add logout flow

* Finalize logout logic

* Remove proxy

* Move type from service to type file

* chore: nx format:write update dirty files

* Delete libs/auth/react/src/lib/bff/BFFProvider.tsx

* Delete libs/auth/react/src/lib/bff/BFFContext.tsx

* Small refactor in auth service

* Small refactor in test

* Small refactor

* Fix esbuild

* Add scope

* chore: nx format:write update dirty files

* Updates to bff service and client. WIP

* chore: nx format:write update dirty files

* Finishing proxy handling by the bff

* Add scope to token response for backwards compatibility

* Encrypted tokens, hooks update for admin portal, switch user, proxy updated

* feat(proxy-api): Support for proxy api, hooks update, regulations download connection with bff

* Better naming env

* Rename secrets in infra

* Refactor after self review

* Fix test and env cleanup

* Fix user menu test

* Updates to environment and config

* Update infra allowed external api urls to be hard coded

* Simplify client urls with bff postfix in it

* Add ingress to project and remove logout redirect path in favour of client base url

* Add docker express to services bff

* update config simpler syntax

* chore: nx format:write update dirty files

* Update config and redis dev setup

* Update crypto service to include algorithm in the encryption, explain better in comments what encrypt/decrypt is doing and update crypto test to not use mock

* Remove CORS entirely in favour of client proxy config

* Update error handling in bff backend, refactor infra and handle error query param in client

* When proxy service errors then handle as unauthorized. Update targetUrl to be defensive, i.e. no undefined possible.

* Remove unnecessary Uint8Array conversion

* Simplify the BFFUser object to not have dateOfBirth and remove double scope field which was due to backwards compatibility

* Update cookies to share constants, update options to be more secure

* access token expire time latency by 5 sec

* remove omit

* Update user profile cache ttl

* update cache ttl again and rename baseUrl to issuerUrl in ids service

* reaname var

* remove params from cache attempt that where not used in the callback

* Clean up old session in login callback if it exists

* Fix login callback cache clean up and revoke refresh token

* Update logout flow to clean up, revoke tokens and better validation. Also deletes the logout callback

* remove unused import

* Simplify error in favour of enhanced fetch

* created enhanced fetch module, moved pkce service to services, updated proxy service and a little refactor

* par support flag not optional

* Fix typo

* Add better validation to crypto decryption function

* Update validate uri to be more secure, create test for validate uri. Update port range in environment

* Remove state param from logout to ensure it will not be passed to redirect uri

* Adding more tests and increasing security in the function

* Refactor after reading comments from coderabbit

* remove private from method for test

* Move portal scopes to shareable location.

* Remove unused import

* Add no_refresh query to user endpoint in backend

* Polling and broadcaster added to react spa bff library

* Enhanced security in pkce service.and improve error handling to be more secure

* Update usePolling to have better types and secure resumabiltiy.

* Refactor useBroadcaster.

* Add client logic to handle the case if bff server goes down

* Fix tests and builds

* Fix portal infra local vars

* DX infra setup for services-bff

* Remove error log from revokeRefreshToken since it is handled by enhancedFetch and update download service local url

* Rename cached toke fields to be prefixed with encrypted and fix where encryption was missing. Also fix for revoking wrong token

* Better handling on errors in auth service

* Update api requests formatting and handling to handle exceptions and errors better.

* Update apps/services/bff/src/app/bff.config.ts

simpler redis config

Co-authored-by: Eiríkur Heiðar Nilsson <eirikur@nilsson.is>

* cleanup after commit from github

* Update after our pull request AI suggested the change

* Remove broadcaster mocks

* Remove redundant timeout in favour of poller

* Fix portal config, fix redis cache module init, update bff provider to handle logout in before redirect

* Remove timeout in logout broadcasting and throw the error in postRequest if not successful plain text response

* Revert the timeout in the logout

* chore: charts update dirty files

* Rename queries to dto for consistency in monorepo and add log for logout callback

* Fix cli error that got merged from main

* Fix prettier formatting error

* chore: nx format:write update dirty files

* fix storybook build

* ci: trigger from levy user

* fix: use portals-admin, added portal-env test

* Revert manual validation and use library

* Use fetch instead of post in download url

* Fix type errors and add forward get proxy api request

* fix: main conflict

* chore: charts update dirty files

* fix: prettier issues

* chore: prettify

* chore: nx format:write update dirty files

* ci: add services-bff to helm chart

* Fix env vars for feature deploy

* Fix health check to be excluded from prefix

* update global prefix logic

* update bff services options

* Remove bff redis name env var

* Update bff config again

* Update portal env spec for feature branch

* chore: charts update dirty files

* Update validation error log

* Remove database healthcheck

* Revert globalprefix options and update liveness and readiness infra checks

* chore: charts update dirty files

* Add auth controller tests

* Add logout log for testing in feature deploy

* remove unused

* clean up auth controller test

* chore: nx format:write update dirty files

* Add tests for proxy controller

* Add ref to infra for api

* update charts

* add zed editor config to gitignore

* Add support for mocks

* chore: nx format:write update dirty files

* Fix portal env spec

* chore: charts update dirty files

* Update mocking server logic for portals

* update mock logic

* fix: public envs (#16493)

* fix: merge conflict

* fix: improved zod schema generation

* test: update portal-env test for service building

* fix: generate feature deploy urls

* fix: improve getEnvUrl func

* feat: integrated bff to ServiceBuilder

* fix: more abstraction to dsl

* fix: simplify and cleanup

* chore: remove unused file

* chore: cleanup dupes

* chore: nx format:write update dirty files

* chore: more cleanup

---------

Co-authored-by: andes-it <builders@andes.is>

* chore: remove nx-command impl (#16532)

* chore: move nx runcommand cli to a new PR

* chore: commit save point

* chore: commit save point

* Update infra setup

* fix tests

* chore: charts update dirty files

* fix infra url

* Removed un used import

* fix: revert secret type changes

* chore: nx format:write update dirty files

* chore: cleanup

* fix feature deployment url

* fix tests

* fix missing logger

* chore: nx format:write update dirty files

* update api graphql bff config env var

* fix tests

* fix tests

* chore: charts update dirty files

* chore: nx format:write update dirty files

* grantnamespaces

* chore: charts update dirty files

* disable global auth on dev

* chore: charts update dirty files

* Update double negation query param

* feat: Better error message when running infra cli without aws credentials.

* Adding agent to proxy for for managing connections efficiently

* Enable PAR support

* update tests

* chore: charts update dirty files

---------

Co-authored-by: andes-it <builders@andes.is>
Co-authored-by: Eiríkur Heiðar Nilsson <eirikur@nilsson.is>
Co-authored-by: Jón Levy <levy@andes.is>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 .gitignore                                    |   2 +
 .prettierignore                               |   2 +-
 .prettierrc                                   |   2 +-
 apps/api/infra/api.ts                         |  45 +-
 apps/api/src/app/environments/environment.ts  |   2 +
 apps/portals/admin/project.json               |  24 +-
 apps/portals/admin/proxy.config.json          |   6 +
 apps/portals/admin/src/app/App.tsx            |  28 +-
 apps/portals/admin/src/auth.ts                |  47 --
 apps/portals/admin/src/graphql.ts             |  12 +-
 apps/portals/admin/src/main.tsx               |   4 +-
 .../my-pages/src/components/Header/Header.tsx |   2 +-
 apps/services/bff/.eslintrc.json              |  18 +
 apps/services/bff/README.md                   |  39 ++
 apps/services/bff/docker-compose.yml          |  14 +
 apps/services/bff/esbuild.json                |  52 ++
 apps/services/bff/infra/admin-portal.infra.ts |  74 +++
 apps/services/bff/jest.config.ts              |  18 +
 apps/services/bff/project.json                |  61 ++
 apps/services/bff/src/app/app.module.ts       |  23 +
 apps/services/bff/src/app/bff.config.ts       | 120 ++++
 .../services/bff/src/app/constants/cookies.ts |   1 +
 apps/services/bff/src/app/constants/time.ts   |   1 +
 .../app/modules/auth/auth.controller.spec.ts  | 539 +++++++++++++++++
 .../src/app/modules/auth/auth.controller.ts   |  66 +++
 .../bff/src/app/modules/auth/auth.module.ts   |  13 +
 .../bff/src/app/modules/auth/auth.service.ts  | 545 ++++++++++++++++++
 .../bff/src/app/modules/auth/auth.types.ts    |  23 +
 .../modules/auth/dto/callback-login.dto.ts    |  25 +
 .../modules/auth/dto/callback-logout.dto.ts   |   7 +
 .../bff/src/app/modules/auth/dto/login.dto.ts |  15 +
 .../src/app/modules/auth/dto/logout.dto.ts    |   6 +
 .../bff/src/app/modules/cache/cache.module.ts |  38 ++
 .../src/app/modules/cache/cache.service.ts    |  65 +++
 .../enhancedFetch/enhanced-fetch.module.ts    |   9 +
 .../enhancedFetch/enhanced-fetch.provider.ts  |  17 +
 .../bff/src/app/modules/ids/ids.service.ts    | 202 +++++++
 .../bff/src/app/modules/ids/ids.types.ts      |  83 +++
 .../app/modules/proxy/dto/api-proxy.dto.ts    |   6 +
 .../modules/proxy/proxy.controller.spec.ts    | 246 ++++++++
 .../src/app/modules/proxy/proxy.controller.ts |  39 ++
 .../bff/src/app/modules/proxy/proxy.module.ts |  13 +
 .../src/app/modules/proxy/proxy.service.ts    | 219 +++++++
 .../bff/src/app/modules/proxy/proxy.types.ts  |   9 +
 .../src/app/modules/user/dto/get-user.dto.ts  |   7 +
 .../src/app/modules/user/user.controller.ts   |  25 +
 .../bff/src/app/modules/user/user.module.ts   |  13 +
 .../bff/src/app/modules/user/user.service.ts  |  82 +++
 .../src/app/services/crypto.service.spec.ts   |  92 +++
 .../bff/src/app/services/crypto.service.ts    | 107 ++++
 .../bff/src/app/services/pkce.service.spec.ts |  74 +++
 .../bff/src/app/services/pkce.service.ts      |  81 +++
 .../src/app/utils/create-error-query-str.ts   |  17 +
 .../app/utils/has-timestamp-expired-in-ms.ts  |   6 +
 .../bff/src/app/utils/qs-validation-pipe.ts   |   7 +
 .../src/app/utils/remove-trailing-slash.ts    |  13 +
 .../bff/src/app/utils/validate-uri.spec.ts    |  84 +++
 .../bff/src/app/utils/validate-uri.ts         |  45 ++
 .../bff/src/environment/environment.schema.ts |  27 +
 .../bff/src/environment/environment.ts        |  12 +
 apps/services/bff/src/environment/index.ts    |   1 +
 apps/services/bff/src/main.ts                 |  12 +
 apps/services/bff/test/setup.ts               |  21 +
 apps/services/bff/test/setupTestServer.ts     |   8 +
 apps/services/bff/test/sharedConstants.ts     |  53 ++
 apps/services/bff/tsconfig.app.json           |   9 +
 apps/services/bff/tsconfig.json               |  13 +
 apps/services/bff/tsconfig.spec.json          |   9 +
 charts/islandis/values.dev.yaml               |  89 ++-
 charts/islandis/values.prod.yaml              |  92 ++-
 charts/islandis/values.staging.yaml           |  90 ++-
 infra/helm/Chart.yaml                         |   4 +
 infra/package.json                            |   2 +
 infra/src/cli/cli.ts                          |   9 +-
 infra/src/cli/render-local-mocks.ts           |   2 +-
 infra/src/dsl/adapters/get-ssm-params.ts      |  12 +-
 infra/src/dsl/bff.ts                          |  83 +++
 infra/src/dsl/dsl.ts                          |  14 +-
 infra/src/dsl/feature-values.spec.ts          |  90 ++-
 infra/src/dsl/portal-env.spec.ts              | 238 ++++++++
 .../pre-process-service.ts                    |   1 -
 infra/src/dsl/types/input-types.ts            |  15 +
 .../dsl/value-files-generators/local-setup.ts |   9 +
 infra/src/feature-env.ts                      |   2 +-
 infra/src/uber-charts/islandis.ts             |  16 +-
 infra/yarn.lock                               | 294 +++++++++-
 libs/auth/scopes/src/index.ts                 |   2 +
 .../src/lib/clients/admin-portal-scopes.ts    |  23 +
 .../src/lib/clients/service-portal-scopes.ts  |  48 ++
 libs/infra-nest-server/src/lib/bootstrap.ts   |  10 +-
 libs/infra-nest-server/src/lib/types.ts       |   6 +
 libs/island-ui/storybook/config/main.ts       |   1 +
 .../admin/application-system/src/module.tsx   |   4 +-
 .../screens/Overview/InstitutionOverview.tsx  |   2 +-
 .../ids-admin/src/hooks/useSuperAdmin.tsx     |   4 +-
 .../src/components/DownloadDraftButton.tsx    |  70 +--
 .../regulations-admin/src/state/reducer.ts    |  19 +-
 .../service-desk/src/screens/Users/Users.tsx  |   4 +-
 .../core/src/components/PortalProvider.tsx    |  14 +-
 .../core/src/components/PortalRouter.tsx      |  18 +-
 libs/portals/core/src/hooks/useModuleProps.ts |   4 +-
 libs/portals/core/src/hooks/useNavigation.ts  |   4 +-
 libs/portals/core/src/index.ts                |   3 +
 libs/portals/core/src/mocks/index.ts          |   1 +
 .../portals/core/src/screens/AccessDenied.tsx |   4 +-
 libs/portals/core/src/screens/ModuleRoute.tsx |   4 +-
 libs/portals/core/src/types/portalCore.ts     |   6 +-
 libs/portals/core/src/utils/modules.ts        |   6 +-
 .../src/utils/router/prepareRouterData.ts     |   6 +-
 .../components/access/AccessConfirmModal.tsx  |   4 +-
 .../AccessDeleteModal/AccessDeleteModal.tsx   |  18 +-
 .../delegations/src/screens/AccessControl.tsx |  11 +-
 .../src/screens/GrantAccess/GrantAccess.tsx   |  24 +-
 libs/react-spa/bff/.babelrc                   |  12 +
 libs/react-spa/bff/.eslintrc.json             |  18 +
 libs/react-spa/bff/README.md                  |   7 +
 libs/react-spa/bff/jest.config.ts             |  11 +
 libs/react-spa/bff/project.json               |  19 +
 libs/react-spa/bff/src/index.ts               |   4 +
 libs/react-spa/bff/src/lib/BffContext.tsx     |  15 +
 libs/react-spa/bff/src/lib/BffPoller.tsx      |  97 ++++
 libs/react-spa/bff/src/lib/BffProvider.tsx    | 237 ++++++++
 .../bff/src/lib/BffSessionExpiredModal.tsx    |  40 ++
 libs/react-spa/bff/src/lib/ErrorScreen.css.ts |   5 +
 libs/react-spa/bff/src/lib/ErrorScreen.tsx    |  41 ++
 libs/react-spa/bff/src/lib/bff.hooks.ts       | 127 ++++
 libs/react-spa/bff/src/lib/bff.mocks.ts       |  19 +
 libs/react-spa/bff/src/lib/bff.state.ts       | 116 ++++
 libs/react-spa/bff/src/lib/bff.utils.ts       |  48 ++
 libs/react-spa/bff/tsconfig.json              |  20 +
 libs/react-spa/bff/tsconfig.lib.json          |  24 +
 libs/react-spa/bff/tsconfig.spec.json         |  20 +
 .../shared/src/hooks/useBroadcaster.ts        | 145 +++++
 .../react-spa/shared/src/hooks/usePolling.tsx | 113 ++++
 libs/react-spa/shared/src/index.ts            |   2 +
 libs/react/feature-flags/src/lib/context.tsx  |  10 +-
 .../UserOnboardingModal/components/Header.tsx |   2 +-
 .../service-portal/information/src/module.tsx |  13 +-
 .../src/auth/UserMenu/UserButton.tsx          |  14 +-
 .../src/auth/UserMenu/UserDelegations.tsx     |  15 +-
 .../src/auth/UserMenu/UserDropdown.tsx        |  37 +-
 .../auth/UserMenu/UserLanguageSwitcher.tsx    |   9 +-
 .../components/src/auth/UserMenu/UserMenu.tsx |   9 +-
 libs/shared/mocking/src/msw/startMocking.ts   |  24 +-
 libs/shared/types/src/index.ts                |   1 +
 libs/shared/types/src/lib/bff.ts              |  24 +
 libs/shared/utils/src/lib/isDelegation.ts     |   4 +-
 libs/testing/nest/src/lib/testServer.ts       |   5 +-
 tsconfig.base.json                            |   1 +
 149 files changed, 5961 insertions(+), 329 deletions(-)
 create mode 100644 apps/portals/admin/proxy.config.json
 delete mode 100644 apps/portals/admin/src/auth.ts
 create mode 100644 apps/services/bff/.eslintrc.json
 create mode 100644 apps/services/bff/README.md
 create mode 100644 apps/services/bff/docker-compose.yml
 create mode 100644 apps/services/bff/esbuild.json
 create mode 100644 apps/services/bff/infra/admin-portal.infra.ts
 create mode 100644 apps/services/bff/jest.config.ts
 create mode 100644 apps/services/bff/project.json
 create mode 100644 apps/services/bff/src/app/app.module.ts
 create mode 100644 apps/services/bff/src/app/bff.config.ts
 create mode 100644 apps/services/bff/src/app/constants/cookies.ts
 create mode 100644 apps/services/bff/src/app/constants/time.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/auth.controller.spec.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/auth.controller.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/auth.module.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/auth.service.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/auth.types.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/dto/callback-login.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/dto/callback-logout.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/dto/login.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/dto/logout.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/cache/cache.module.ts
 create mode 100644 apps/services/bff/src/app/modules/cache/cache.service.ts
 create mode 100644 apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.module.ts
 create mode 100644 apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.provider.ts
 create mode 100644 apps/services/bff/src/app/modules/ids/ids.service.ts
 create mode 100644 apps/services/bff/src/app/modules/ids/ids.types.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/dto/api-proxy.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/proxy.controller.spec.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/proxy.controller.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/proxy.module.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/proxy.service.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/proxy.types.ts
 create mode 100644 apps/services/bff/src/app/modules/user/dto/get-user.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/user/user.controller.ts
 create mode 100644 apps/services/bff/src/app/modules/user/user.module.ts
 create mode 100644 apps/services/bff/src/app/modules/user/user.service.ts
 create mode 100644 apps/services/bff/src/app/services/crypto.service.spec.ts
 create mode 100644 apps/services/bff/src/app/services/crypto.service.ts
 create mode 100644 apps/services/bff/src/app/services/pkce.service.spec.ts
 create mode 100644 apps/services/bff/src/app/services/pkce.service.ts
 create mode 100644 apps/services/bff/src/app/utils/create-error-query-str.ts
 create mode 100644 apps/services/bff/src/app/utils/has-timestamp-expired-in-ms.ts
 create mode 100644 apps/services/bff/src/app/utils/qs-validation-pipe.ts
 create mode 100644 apps/services/bff/src/app/utils/remove-trailing-slash.ts
 create mode 100644 apps/services/bff/src/app/utils/validate-uri.spec.ts
 create mode 100644 apps/services/bff/src/app/utils/validate-uri.ts
 create mode 100644 apps/services/bff/src/environment/environment.schema.ts
 create mode 100644 apps/services/bff/src/environment/environment.ts
 create mode 100644 apps/services/bff/src/environment/index.ts
 create mode 100644 apps/services/bff/src/main.ts
 create mode 100644 apps/services/bff/test/setup.ts
 create mode 100644 apps/services/bff/test/setupTestServer.ts
 create mode 100644 apps/services/bff/test/sharedConstants.ts
 create mode 100644 apps/services/bff/tsconfig.app.json
 create mode 100644 apps/services/bff/tsconfig.json
 create mode 100644 apps/services/bff/tsconfig.spec.json
 create mode 100644 infra/src/dsl/bff.ts
 create mode 100644 infra/src/dsl/portal-env.spec.ts
 create mode 100644 libs/auth/scopes/src/lib/clients/admin-portal-scopes.ts
 create mode 100644 libs/auth/scopes/src/lib/clients/service-portal-scopes.ts
 create mode 100644 libs/portals/core/src/mocks/index.ts
 create mode 100644 libs/react-spa/bff/.babelrc
 create mode 100644 libs/react-spa/bff/.eslintrc.json
 create mode 100644 libs/react-spa/bff/README.md
 create mode 100644 libs/react-spa/bff/jest.config.ts
 create mode 100644 libs/react-spa/bff/project.json
 create mode 100644 libs/react-spa/bff/src/index.ts
 create mode 100644 libs/react-spa/bff/src/lib/BffContext.tsx
 create mode 100644 libs/react-spa/bff/src/lib/BffPoller.tsx
 create mode 100644 libs/react-spa/bff/src/lib/BffProvider.tsx
 create mode 100644 libs/react-spa/bff/src/lib/BffSessionExpiredModal.tsx
 create mode 100644 libs/react-spa/bff/src/lib/ErrorScreen.css.ts
 create mode 100644 libs/react-spa/bff/src/lib/ErrorScreen.tsx
 create mode 100644 libs/react-spa/bff/src/lib/bff.hooks.ts
 create mode 100644 libs/react-spa/bff/src/lib/bff.mocks.ts
 create mode 100644 libs/react-spa/bff/src/lib/bff.state.ts
 create mode 100644 libs/react-spa/bff/src/lib/bff.utils.ts
 create mode 100644 libs/react-spa/bff/tsconfig.json
 create mode 100644 libs/react-spa/bff/tsconfig.lib.json
 create mode 100644 libs/react-spa/bff/tsconfig.spec.json
 create mode 100644 libs/react-spa/shared/src/hooks/useBroadcaster.ts
 create mode 100644 libs/react-spa/shared/src/hooks/usePolling.tsx
 create mode 100644 libs/shared/types/src/lib/bff.ts

diff --git a/.gitignore b/.gitignore
index 160c3874cac9..a97e5eec68f8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@ tmp/
 out-tsc/
 **/tsconfig.tsbuildinfo
 infra/mountebank-imposter-config.json
+mountebank-imposter-config.json
 infra/helm/**/*.tgz
 
 # dependencies
@@ -96,3 +97,4 @@ apps/**/index.html
 .next
 
 .nx/
+.zed/
diff --git a/.prettierignore b/.prettierignore
index 2619b48cd441..7d2cdb83591b 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -14,4 +14,4 @@
 /infra/helm/
 /.nx/cache
 /.nx/workspace-data
-apps/web/public/assets/pdf.worker.min.mjs
\ No newline at end of file
+apps/web/public/assets/pdf.worker.min.mjs
diff --git a/.prettierrc b/.prettierrc
index 90779c7c514d..0dc4fc2525df 100644
--- a/.prettierrc
+++ b/.prettierrc
@@ -3,7 +3,7 @@
   "semi": false,
   "trailingComma": "all",
   "arrowParens": "always",
-  "plugins": ["./scripts/prettier-plugins/sort-projects"],
+  "plugins": ["./scripts/prettier-plugins/sort-projects.js"],
   "endOfLine": "lf",
   "overrides": [
     {
diff --git a/apps/api/infra/api.ts b/apps/api/infra/api.ts
index bf069dfb98ce..586dfec4a2b0 100644
--- a/apps/api/infra/api.ts
+++ b/apps/api/infra/api.ts
@@ -1,55 +1,55 @@
 import { json, ref, service, ServiceBuilder } from '../../../infra/src/dsl/dsl'
 import {
   AdrAndMachine,
+  AircraftRegistry,
   Base,
   ChargeFjsV2,
-  EnergyFunds,
   Client,
   CriminalRecord,
+  DirectorateOfImmigration,
   Disability,
+  DistrictCommissionersLicenses,
+  DistrictCommissionersPCard,
   DrivingLicense,
   DrivingLicenseBook,
   Education,
+  EnergyFunds,
   Finance,
   Firearm,
   FishingLicense,
+  Frigg,
+  HealthDirectorateOrganDonation,
+  HealthDirectorateVaccination,
   HealthInsurance,
+  HousingBenefitCalculator,
+  Hunting,
+  IcelandicGovernmentInstitutionVacancies,
+  Inna,
+  IntellectualProperties,
   JudicialAdministration,
+  JudicialSystemServicePortal,
   Labor,
   MunicipalitiesFinancialAid,
   NationalRegistry,
   NationalRegistryB2C,
+  OccupationalLicenses,
+  OfficialJournalOfIceland,
+  OfficialJournalOfIcelandApplication,
   Passports,
   Payment,
   PaymentSchedule,
   Properties,
   RskCompanyInfo,
-  TransportAuthority,
-  Vehicles,
-  VehiclesMileage,
-  VehicleServiceFjsV1,
-  WorkMachines,
-  IcelandicGovernmentInstitutionVacancies,
   RskProcuring,
-  AircraftRegistry,
-  HousingBenefitCalculator,
-  OccupationalLicenses,
   ShipRegistry,
-  DistrictCommissionersPCard,
-  DistrictCommissionersLicenses,
-  DirectorateOfImmigration,
-  Hunting,
   SignatureCollection,
   SocialInsuranceAdministration,
-  IntellectualProperties,
-  Inna,
+  TransportAuthority,
   UniversityCareers,
-  OfficialJournalOfIceland,
-  OfficialJournalOfIcelandApplication,
-  JudicialSystemServicePortal,
-  Frigg,
-  HealthDirectorateOrganDonation,
-  HealthDirectorateVaccination,
+  Vehicles,
+  VehicleServiceFjsV1,
+  VehiclesMileage,
+  WorkMachines,
 } from '../../../infra/src/dsl/xroad'
 
 export const serviceSetup = (services: {
@@ -469,5 +469,6 @@ export const serviceSetup = (services: {
       'api-catalogue',
       'application-system',
       'consultation-portal',
+      'services-bff-portals-admin',
     )
 }
diff --git a/apps/api/src/app/environments/environment.ts b/apps/api/src/app/environments/environment.ts
index 588fbe19ccfe..2d5faa33b286 100644
--- a/apps/api/src/app/environments/environment.ts
+++ b/apps/api/src/app/environments/environment.ts
@@ -97,6 +97,7 @@ const prodConfig = () => ({
     basePath: process.env.ISLYKILL_SERVICE_BASEPATH,
   },
 })
+
 const devConfig = () => ({
   production: false,
   xroad: {
@@ -207,6 +208,7 @@ const devConfig = () => ({
     basePath: process.env.ISLYKILL_SERVICE_BASEPATH,
   },
 })
+
 export const getConfig =
   process.env.PROD_MODE === 'true' || process.env.NODE_ENV === 'production'
     ? prodConfig()
diff --git a/apps/portals/admin/project.json b/apps/portals/admin/project.json
index d7fc9572a5f0..53dda7697770 100644
--- a/apps/portals/admin/project.json
+++ b/apps/portals/admin/project.json
@@ -55,7 +55,8 @@
       "executor": "@nx/webpack:dev-server",
       "options": {
         "buildTarget": "portals-admin:build",
-        "hmr": true
+        "hmr": true,
+        "proxyConfig": "apps/portals/admin/proxy.config.json"
       },
       "configurations": {
         "production": {
@@ -92,11 +93,28 @@
         "parallel": false
       }
     },
+    "start-bff": {
+      "executor": "nx:run-commands",
+      "options": {
+        "commands": [
+          "node -r esbuild-register src/cli/cli.ts run-local-env services-bff-portals-admin"
+        ],
+        "cwd": "infra"
+      }
+    },
     "dev": {
       "executor": "nx:run-commands",
       "options": {
-        "commands": ["yarn start portals-admin"],
-        "parallel": true
+        "commands": [
+          "yarn nx run portals-admin:start-bff",
+          "yarn start portals-admin"
+        ]
+      }
+    },
+    "mockmode": {
+      "executor": "nx:run-commands",
+      "options": {
+        "commands": ["API_MOCKS=true yarn start portals-admin"]
       }
     },
     "docker-static": {
diff --git a/apps/portals/admin/proxy.config.json b/apps/portals/admin/proxy.config.json
new file mode 100644
index 000000000000..8f1d53118e19
--- /dev/null
+++ b/apps/portals/admin/proxy.config.json
@@ -0,0 +1,6 @@
+{
+  "/stjornbord/bff/*": {
+    "target": "http://localhost:3010",
+    "secure": false
+  }
+}
diff --git a/apps/portals/admin/src/app/App.tsx b/apps/portals/admin/src/app/App.tsx
index 918f04a4307c..1627e3b6aa17 100644
--- a/apps/portals/admin/src/app/App.tsx
+++ b/apps/portals/admin/src/app/App.tsx
@@ -1,20 +1,34 @@
 import { ApolloProvider } from '@apollo/client'
-import { AuthProvider } from '@island.is/auth/react'
 import { LocaleProvider } from '@island.is/localization'
-import { defaultLanguage } from '@island.is/shared/constants'
+import {
+  ApplicationErrorBoundary,
+  PortalRouter,
+  isMockMode,
+} from '@island.is/portals/core'
+import { BffProvider, createMockedInitialState } from '@island.is/react-spa/bff'
 import { FeatureFlagProvider } from '@island.is/react/feature-flags'
-import { ApplicationErrorBoundary, PortalRouter } from '@island.is/portals/core'
-import { modules } from '../lib/modules'
-import { client } from '../graphql'
+import { defaultLanguage } from '@island.is/shared/constants'
 import environment from '../environments/environment'
+import { client } from '../graphql'
+import { modules } from '../lib/modules'
 import { AdminPortalPaths } from '../lib/paths'
 import { createRoutes } from '../lib/routes'
+import { adminPortalScopes } from '@island.is/auth/scopes'
+
+const mockedInitialState = isMockMode
+  ? createMockedInitialState({
+      scopes: adminPortalScopes,
+    })
+  : undefined
 
 export const App = () => (
   <ApolloProvider client={client}>
     <LocaleProvider locale={defaultLanguage} messages={{}}>
       <ApplicationErrorBoundary>
-        <AuthProvider basePath={AdminPortalPaths.Base}>
+        <BffProvider
+          applicationBasePath={AdminPortalPaths.Base}
+          mockedInitialState={mockedInitialState}
+        >
           <FeatureFlagProvider sdkKey={environment.featureFlagSdkKey}>
             <PortalRouter
               modules={modules}
@@ -26,7 +40,7 @@ export const App = () => (
               }}
             />
           </FeatureFlagProvider>
-        </AuthProvider>
+        </BffProvider>
       </ApplicationErrorBoundary>
     </LocaleProvider>
   </ApolloProvider>
diff --git a/apps/portals/admin/src/auth.ts b/apps/portals/admin/src/auth.ts
deleted file mode 100644
index 944cdc454551..000000000000
--- a/apps/portals/admin/src/auth.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-import { configure, configureMock } from '@island.is/auth/react'
-import { AdminPortalScope } from '@island.is/auth/scopes'
-
-import environment from './environments/environment'
-
-const userMocked = process.env.API_MOCKS === 'true'
-
-if (userMocked) {
-  configureMock({
-    profile: { name: 'Mock', locale: 'is', nationalId: '0000000000' },
-    scopes: [],
-  })
-} else {
-  configure({
-    baseUrl: `${window.location.origin}/stjornbord`,
-    redirectPath: '/signin-oidc',
-    redirectPathSilent: '/silent/signin-oidc',
-    switchUserRedirectUrl: '/',
-    authority: environment.identityServer.authority,
-    client_id: '@admin.island.is/web',
-    scope: [
-      'openid',
-      'profile',
-      AdminPortalScope.delegations,
-      AdminPortalScope.airDiscountScheme,
-      AdminPortalScope.regulationAdmin,
-      AdminPortalScope.regulationAdminManage,
-      AdminPortalScope.icelandicNamesRegistry,
-      AdminPortalScope.applicationSystemAdmin,
-      AdminPortalScope.applicationSystemInstitution,
-      AdminPortalScope.documentProvider,
-      AdminPortalScope.idsAdmin,
-      AdminPortalScope.idsAdminSuperUser,
-      AdminPortalScope.petitionsAdmin,
-      AdminPortalScope.serviceDesk,
-      AdminPortalScope.explicitAirDiscountScheme,
-      AdminPortalScope.signatureCollectionManage,
-      AdminPortalScope.signatureCollectionProcess,
-      AdminPortalScope.formSystem,
-      AdminPortalScope.formSystemSuperUser,
-      AdminPortalScope.delegationSystem,
-      AdminPortalScope.delegationSystemAdmin,
-    ],
-    post_logout_redirect_uri: `${window.location.origin}`,
-    userStorePrefix: 'ap.',
-  })
-}
diff --git a/apps/portals/admin/src/graphql.ts b/apps/portals/admin/src/graphql.ts
index d20d4f3df080..9f31915d3166 100644
--- a/apps/portals/admin/src/graphql.ts
+++ b/apps/portals/admin/src/graphql.ts
@@ -8,16 +8,10 @@ import {
 import { onError } from '@apollo/client/link/error'
 import { RetryLink } from '@apollo/client/link/retry'
 
-import { authLink } from '@island.is/auth/react'
-
-const uri =
-  process.env.NODE_ENV === 'development'
-    ? 'http://localhost:4444/api/graphql'
-    : '/api/graphql'
-
 const httpLink = new HttpLink({
-  uri: ({ operationName }) => `${uri}?op=${operationName}`,
+  uri: ({ operationName }) => `/stjornbord/bff/api/graphql?op=${operationName}`,
   fetch,
+  credentials: 'include',
 })
 
 const retryLink = new RetryLink()
@@ -34,7 +28,7 @@ const errorLink = onError(({ graphQLErrors, networkError }) => {
 })
 
 export const client = new ApolloClient({
-  link: ApolloLink.from([retryLink, errorLink, authLink, httpLink]),
+  link: ApolloLink.from([retryLink, errorLink, httpLink]),
   cache: new InMemoryCache({
     typePolicies: {
       UserProfile: {
diff --git a/apps/portals/admin/src/main.tsx b/apps/portals/admin/src/main.tsx
index 0d8890a30cbb..4cca91a26a05 100644
--- a/apps/portals/admin/src/main.tsx
+++ b/apps/portals/admin/src/main.tsx
@@ -1,11 +1,11 @@
 import '@island.is/api/mocks'
+
 import { userMonitoring } from '@island.is/user-monitoring'
-import React, { StrictMode } from 'react'
+import { StrictMode } from 'react'
 import { createRoot } from 'react-dom/client'
 
 import { isRunningOnEnvironment } from '@island.is/shared/utils'
 
-import './auth'
 import environment from './environments/environment'
 import { App } from './app/App'
 
diff --git a/apps/portals/my-pages/src/components/Header/Header.tsx b/apps/portals/my-pages/src/components/Header/Header.tsx
index 21c913b99da0..f3d09e9f596d 100644
--- a/apps/portals/my-pages/src/components/Header/Header.tsx
+++ b/apps/portals/my-pages/src/components/Header/Header.tsx
@@ -130,7 +130,7 @@ export const Header = ({ position }: Props) => {
                         />
                       )}
 
-                      {user && <UserLanguageSwitcher user={user} />}
+                      {user && <UserLanguageSwitcher />}
 
                       <Box className={styles.overview} marginRight={[1, 1, 2]}>
                         <Button
diff --git a/apps/services/bff/.eslintrc.json b/apps/services/bff/.eslintrc.json
new file mode 100644
index 000000000000..3456be9b9036
--- /dev/null
+++ b/apps/services/bff/.eslintrc.json
@@ -0,0 +1,18 @@
+{
+  "extends": ["../../../.eslintrc.json"],
+  "ignorePatterns": ["!**/*"],
+  "overrides": [
+    {
+      "files": ["*.ts", "*.tsx", "*.js", "*.jsx"],
+      "rules": {}
+    },
+    {
+      "files": ["*.ts", "*.tsx"],
+      "rules": {}
+    },
+    {
+      "files": ["*.js", "*.jsx"],
+      "rules": {}
+    }
+  ]
+}
diff --git a/apps/services/bff/README.md b/apps/services/bff/README.md
new file mode 100644
index 000000000000..a2c7452afc20
--- /dev/null
+++ b/apps/services/bff/README.md
@@ -0,0 +1,39 @@
+# BFF (Backend for Frontend)
+
+## About
+
+The BFF (Backend for Frontend) service serves as an intermediary layer for multiple clients, such as the admin portal, service portal, and other applications. It is designed to centralize authentication and business logic, ensuring a secure and streamlined communication process between clients and backend resources.
+
+This service handles user authentication through our IdentityServer, facilitating secure access and session management. Once authenticated, the BFF proxies and manages requests to our GraphQL API, ensuring only authorized requests are processed.
+
+## Getting Started
+
+To set up and run the BFF service, use the following commands:
+
+### Start Development Server
+
+`yarn start services-bff`
+Starts the service on `localhost:3010`.
+
+### Build for Production
+
+`yarn nx build services-bff`
+Builds the service to `dist/apps/services/bff`.
+For production: `nx build services-bff --configuration=production`
+
+### Lint Code
+
+`yarn nx lint services-bff`
+
+### Run Tests
+
+`yarn nx test services-bff`
+Runs tests with Jest and outputs coverage to `coverage/apps/services/bff`.
+
+### Starts Redis server with Docker
+
+`yarn nx dev-services services-bff`
+
+## Code owners and maintainers
+
+- [Aranja](https://github.com/orgs/island-is/teams/aranja/members)
diff --git a/apps/services/bff/docker-compose.yml b/apps/services/bff/docker-compose.yml
new file mode 100644
index 000000000000..d6df1d4b1fc6
--- /dev/null
+++ b/apps/services/bff/docker-compose.yml
@@ -0,0 +1,14 @@
+version: '3.3'
+
+services:
+  redis-cluster:
+    container_name: bff_redis_cluster
+    image: docker.io/grokzen/redis-cluster:6.0.16
+    privileged: true
+    environment:
+      - IP=0.0.0.0
+    ports:
+      - '7000-7005:7000-7005'
+
+networks:
+  local:
diff --git a/apps/services/bff/esbuild.json b/apps/services/bff/esbuild.json
new file mode 100644
index 000000000000..3a039143f18e
--- /dev/null
+++ b/apps/services/bff/esbuild.json
@@ -0,0 +1,52 @@
+{
+  "platform": "node",
+  "external": [
+    "fsevents",
+    "@nestjs/microservices",
+    "class-transformer",
+    "cache-manager",
+    "@nestjs/websockets/socket-module",
+    "class-validator",
+    "class-transformer",
+    "@nestjs/microservices/microservices-module",
+    "apollo-server-fastify",
+    "@elastic/elasticsearch",
+    "fastify-swagger",
+    "@nestjs/mongoose",
+    "@nestjs/typeorm",
+    "dd-trace",
+    "express",
+    "http-errors",
+    "graphql",
+    "pg",
+    "winston",
+    "util-deprecate",
+    "source-map-resolve",
+    "atob",
+    "logform",
+    "pg-native",
+    "form-data",
+    "bull",
+    "ioredis",
+    "p-map",
+    "lru-cache",
+    "pdfkit",
+    "tslib",
+    "sequelize",
+    "configcat-node",
+    "@protobufjs/aspromise",
+    "@protobufjs/base64",
+    "@protobufjs/codegen",
+    "@protobufjs/eventemitter",
+    "@protobufjs/fetch",
+    "@protobufjs/float",
+    "@protobufjs/inquire",
+    "@protobufjs/path",
+    "@protobufjs/pool",
+    "@protobufjs/utf8",
+    "pseudomap",
+    "safer-buffer",
+    "@mikro-orm/core"
+  ],
+  "keepNames": true
+}
diff --git a/apps/services/bff/infra/admin-portal.infra.ts b/apps/services/bff/infra/admin-portal.infra.ts
new file mode 100644
index 000000000000..f04db09065bd
--- /dev/null
+++ b/apps/services/bff/infra/admin-portal.infra.ts
@@ -0,0 +1,74 @@
+/* eslint-disable @nx/enforce-module-boundaries */
+import { ServiceBuilder, json, service } from '../../../../infra/src/dsl/dsl'
+import { BffInfraServices } from '../../../../infra/src/dsl/types/input-types'
+
+const bffName = 'services-bff'
+const clientName = 'portals-admin'
+const serviceName = `${bffName}-${clientName}`
+const key = 'stjornbord'
+
+export const serviceSetup = (
+  services: BffInfraServices,
+): ServiceBuilder<typeof serviceName> =>
+  service(serviceName)
+    .namespace(clientName)
+    .image(bffName)
+    .redis()
+    .serviceAccount(bffName)
+    .env({
+      BFF_ALLOWED_EXTERNAL_API_URLS: {
+        local: json(['http://localhost:3377/download/v1']),
+        dev: json(['https://api.dev01.devland.is']),
+        staging: json(['https://api.staging01.devland.is']),
+        prod: json(['https://api.island.is']),
+      },
+    })
+    .bff({
+      key,
+      clientId: `@admin.island.is/bff-${key}`,
+      clientName,
+      services,
+    })
+    .readiness(`/${key}/bff/health/check`)
+    .liveness(`/${key}/bff/liveness`)
+    .replicaCount({
+      default: 2,
+      min: 2,
+      max: 10,
+    })
+    .resources({
+      limits: {
+        cpu: '400m',
+        memory: '512Mi',
+      },
+      requests: {
+        cpu: '100m',
+        memory: '256Mi',
+      },
+    })
+    .ingress({
+      primary: {
+        host: {
+          dev: ['beta'],
+          staging: ['beta'],
+          prod: ['', 'www.island.is'],
+        },
+        extraAnnotations: {
+          dev: {
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+          staging: {
+            'nginx.ingress.kubernetes.io/enable-global-auth': 'false',
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+          prod: {
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+        },
+        paths: ['/stjornbord/bff'],
+      },
+    })
+    .grantNamespaces('identity-server')
diff --git a/apps/services/bff/jest.config.ts b/apps/services/bff/jest.config.ts
new file mode 100644
index 000000000000..3564c051f849
--- /dev/null
+++ b/apps/services/bff/jest.config.ts
@@ -0,0 +1,18 @@
+/* eslint-disable */
+export default {
+  preset: './jest.preset.js',
+  rootDir: '../../..',
+  roots: [__dirname],
+  transform: {
+    '^.+\\.[tj]sx?$': [
+      'ts-jest',
+      { tsconfig: `${__dirname}/tsconfig.spec.json` },
+    ],
+  },
+  testEnvironment: 'node',
+  moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'html'],
+  coverageDirectory: '<rootDir>/coverage/apps/services/bff',
+  displayName: 'bff',
+  collectCoverageFrom: ['src/**/*.ts'],
+  setupFilesAfterEnv: [`${__dirname}/test/setup.ts`],
+}
diff --git a/apps/services/bff/project.json b/apps/services/bff/project.json
new file mode 100644
index 000000000000..f7639e9050f0
--- /dev/null
+++ b/apps/services/bff/project.json
@@ -0,0 +1,61 @@
+{
+  "name": "services-bff",
+  "$schema": "../../../node_modules/nx/schemas/project-schema.json",
+  "sourceRoot": "apps/services/bff/src",
+  "projectType": "application",
+  "prefix": "services-bff",
+  "tags": ["scope:services-bff"],
+  "targets": {
+    "build": {
+      "executor": "./tools/executors/node:build",
+      "options": {
+        "outputPath": "dist/apps/services/bff",
+        "main": "apps/services/bff/src/main.ts",
+        "tsConfig": "apps/services/bff/tsconfig.app.json",
+        "maxWorkers": 2
+      },
+      "configurations": {
+        "production": {
+          "optimization": true,
+          "extractLicenses": true,
+          "inspect": false
+        }
+      },
+      "outputs": ["{options.outputPath}"]
+    },
+    "serve": {
+      "executor": "@nx/js:node",
+      "options": {
+        "buildTarget": "services-bff:build"
+      }
+    },
+    "lint": {
+      "executor": "@nx/eslint:lint"
+    },
+    "test": {
+      "executor": "@nx/jest:jest",
+      "options": {
+        "jestConfig": "apps/services/bff/jest.config.ts",
+        "runInBand": true
+      },
+      "outputs": ["{workspaceRoot}/coverage/apps/services/bff"]
+    },
+    "dev-services": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "docker compose up -d",
+        "cwd": "apps/services/bff"
+      }
+    },
+    "dev": {
+      "executor": "nx:run-commands",
+      "options": {
+        "commands": ["yarn start services-bff"],
+        "parallel": true
+      }
+    },
+    "docker-express": {
+      "executor": "Intentionally left blank, only so this target is valid when using `nx show projects --with-target docker-express`"
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/app.module.ts b/apps/services/bff/src/app/app.module.ts
new file mode 100644
index 000000000000..923f19224d97
--- /dev/null
+++ b/apps/services/bff/src/app/app.module.ts
@@ -0,0 +1,23 @@
+import { ConfigModule } from '@island.is/nest/config'
+import { Module } from '@nestjs/common'
+import { BffConfig } from './bff.config'
+import { AuthModule as AppAuthModule } from './modules/auth/auth.module'
+import { CacheModule } from './modules/cache/cache.module'
+import { ProxyModule } from './modules/proxy/proxy.module'
+import { UserModule } from './modules/user/user.module'
+import { EnhancedFetchModule } from './modules/enhancedFetch/enhanced-fetch.module'
+
+@Module({
+  imports: [
+    CacheModule.register(),
+    ConfigModule.forRoot({
+      isGlobal: true,
+      load: [BffConfig],
+    }),
+    UserModule,
+    AppAuthModule,
+    ProxyModule,
+    EnhancedFetchModule,
+  ],
+})
+export class AppModule {}
diff --git a/apps/services/bff/src/app/bff.config.ts b/apps/services/bff/src/app/bff.config.ts
new file mode 100644
index 000000000000..a4fd95d97d40
--- /dev/null
+++ b/apps/services/bff/src/app/bff.config.ts
@@ -0,0 +1,120 @@
+import { defineConfig } from '@island.is/nest/config'
+
+import { z } from 'zod'
+import { removeTrailingSlash } from './utils/remove-trailing-slash'
+
+export const idsSchema = z.strictObject({
+  issuer: z.string(),
+  clientId: z.string(),
+  scopes: z.string().array(),
+  secret: z.string(),
+})
+
+const BffConfigSchema = z.object({
+  /**
+   * Redis configuration
+   */
+  redis: z.object({
+    name: z.string(),
+    nodes: z.array(z.string()),
+    ssl: z.boolean(),
+  }),
+  graphqlApiEndpoint: z.string(),
+  /**
+   * The URL to redirect to after logging out
+   */
+  logoutRedirectUri: z.string(),
+  /**
+   * Bff client base URL
+   */
+  clientBaseUrl: z.string(),
+  ids: idsSchema,
+  /**
+   * The base64 encoded secret used for encrypting and decrypting tokens.
+   */
+  tokenSecretBase64: z.string(),
+  /**
+   * Determines if the BFF should support the PAR (Pushed Authorization Requests) flow or normal login flow
+   */
+  parSupportEnabled: z.boolean(),
+  /**
+   * Allowed external API URLs that the BFF can proxy requests to
+   */
+  allowedExternalApiUrls: z.array(z.string()),
+  allowedRedirectUris: z.string().array(),
+  callbacksRedirectUris: z.strictObject({
+    login: z.string(),
+    logout: z.string(),
+  }),
+  /**
+   * Time-to-live (TTL) for caching the user profile, in milliseconds.
+   * This value determines how long the user profile will be cached before it is considered stale.
+   *
+   * Note: The TTL should be aligned with the lifespan of the Ids client refresh token.
+   *       We also subtract 5 seconds from the TTL to handle latency and clock drift.
+   */
+  cacheUserProfileTTLms: z.number(),
+  /**
+   * Time-to-live (TTL) for caching the login attempts, in milliseconds.
+   */
+  cacheLoginAttemptTTLms: z.number(),
+})
+
+export const BffConfig = defineConfig({
+  name: 'BffConfig',
+  schema: BffConfigSchema,
+  load(env) {
+    const callbacksBaseRedirectPath = removeTrailingSlash(
+      env.required('BFF_CALLBACKS_BASE_PATH'),
+    )
+    const bffName = env.required('BFF_NAME')
+
+    return {
+      parSupportEnabled: env.optionalJSON('BFF_PAR_SUPPORT_ENABLED') ?? false,
+      clientBaseUrl: env.required('BFF_CLIENT_BASE_URL'),
+      logoutRedirectUri: env.required('BFF_LOGOUT_REDIRECT_URI'),
+      /**
+       * Our main GraphQL API endpoint
+       */
+      graphqlApiEndpoint: env.required('BFF_PROXY_API_ENDPOINT'),
+      redis: {
+        name: `bff-${bffName}`,
+        // Redis nodes are only required in production
+        // In development, we can use a local Redis server or
+        // rely on the default in-memory cache provided by CacheModule
+        nodes: env.requiredJSON('REDIS_URL_NODE_01', []),
+        ssl: env.optionalJSON('BFF_REDIS_SSL', false) ?? true,
+      },
+      ids: {
+        issuer: env.required('IDENTITY_SERVER_ISSUER_URL'),
+        clientId: env.required('IDENTITY_SERVER_CLIENT_ID'),
+        secret: env.required('IDENTITY_SERVER_CLIENT_SECRET'),
+        scopes: env.requiredJSON('IDENTITY_SERVER_CLIENT_SCOPES'),
+      },
+      allowedRedirectUris: env.requiredJSON('BFF_ALLOWED_REDIRECT_URIS'),
+      callbacksRedirectUris: {
+        login: `${callbacksBaseRedirectPath}/login`,
+        logout: `${callbacksBaseRedirectPath}/logout`,
+      },
+      /**
+       * The base64 encoded secret used for encrypting and decrypting.
+       */
+      tokenSecretBase64: env.required('BFF_TOKEN_SECRET_BASE64'),
+      /**
+       * Allowed external API URLs that the BFF can proxy requests to
+       */
+      allowedExternalApiUrls: env.requiredJSON(
+        'BFF_ALLOWED_EXTERNAL_API_URLS',
+        [
+          // Download service local endpoint
+          'http://localhost:3377/download/v1/*',
+        ],
+      ),
+      /**
+       * Time-to-live (TTL) in milliseconds for caching.
+       */
+      cacheUserProfileTTLms: env.requiredJSON('BFF_CACHE_USER_PROFILE_TTL_MS'),
+      cacheLoginAttemptTTLms: env.requiredJSON('BFF_LOGIN_ATTEMPT_TTL_MS'),
+    }
+  },
+})
diff --git a/apps/services/bff/src/app/constants/cookies.ts b/apps/services/bff/src/app/constants/cookies.ts
new file mode 100644
index 000000000000..51f8292b554f
--- /dev/null
+++ b/apps/services/bff/src/app/constants/cookies.ts
@@ -0,0 +1 @@
+export const SESSION_COOKIE_NAME = 'sid'
diff --git a/apps/services/bff/src/app/constants/time.ts b/apps/services/bff/src/app/constants/time.ts
new file mode 100644
index 000000000000..6ed98a5e9b64
--- /dev/null
+++ b/apps/services/bff/src/app/constants/time.ts
@@ -0,0 +1 @@
+export const FIVE_SECONDS_IN_MS = 5 * 1000
diff --git a/apps/services/bff/src/app/modules/auth/auth.controller.spec.ts b/apps/services/bff/src/app/modules/auth/auth.controller.spec.ts
new file mode 100644
index 000000000000..ac2b1d951a9d
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/auth.controller.spec.ts
@@ -0,0 +1,539 @@
+import { ConfigType } from '@island.is/nest/config'
+import { CACHE_MANAGER } from '@nestjs/cache-manager'
+import { HttpStatus, INestApplication } from '@nestjs/common'
+import jwt from 'jsonwebtoken'
+import request from 'supertest'
+import { setupTestServer } from '../../../../test/setupTestServer'
+import {
+  mockedTokensResponse as tokensResponse,
+  SID_VALUE,
+  SESSION_COOKIE_NAME,
+  ALGORITM_TYPE,
+  getLoginSearchParmsFn,
+} from '../../../../test/sharedConstants'
+import { BffConfig } from '../../bff.config'
+import { IdsService } from '../ids/ids.service'
+import { ParResponse } from '../ids/ids.types'
+
+const KID = 'test-kid'
+const SECRET_KEY = 'mock_secret'
+
+jest.mock('uuid', () => ({
+  v4: jest.fn().mockReturnValue('fake_uuid'),
+}))
+
+const validSigningKey = {
+  kid: KID,
+  alg: ALGORITM_TYPE,
+  getPublicKey: jest.fn().mockReturnValue(SECRET_KEY),
+}
+
+const noMatchKidSigningKey = {
+  kid: 'invalid-kid',
+  alg: ALGORITM_TYPE,
+  getPublicKey: jest.fn().mockReturnValue(SECRET_KEY),
+}
+
+const mockedSigningKeys = jest.fn().mockReturnValue([validSigningKey])
+
+jest.mock('jwks-rsa', () => {
+  return jest.fn().mockImplementation(() => ({
+    getSigningKeys: mockedSigningKeys,
+  }))
+})
+
+const mockCacheStore = new Map()
+
+const mockCacheManagerValue = {
+  set: jest.fn((key, value) => mockCacheStore.set(key, value)),
+  get: jest.fn((key) => mockCacheStore.get(key)),
+  del: jest.fn((key) => mockCacheStore.delete(key)),
+}
+
+const parResponse: ParResponse = {
+  request_uri: 'urn:ietf:params:oauth:request_uri:abc123',
+  expires_in: 600,
+}
+
+const allowedTargetLinkUri = 'http://test-client.com/testclient'
+
+const mockIdsService = {
+  getPar: jest.fn().mockResolvedValue({
+    type: 'success',
+    data: parResponse,
+  }),
+  getTokens: jest.fn().mockResolvedValue({
+    type: 'success',
+    data: tokensResponse,
+  }),
+  revokeToken: jest.fn().mockResolvedValue({
+    type: 'success',
+  }),
+  getLoginSearchParams: jest.fn().mockImplementation(getLoginSearchParmsFn),
+}
+
+describe('AuthController', () => {
+  let app: INestApplication
+  let server: request.SuperTest<request.Test>
+  let mockConfig: ConfigType<typeof BffConfig>
+  let baseUrlWithKey: string
+
+  beforeAll(async () => {
+    const app = await setupTestServer({
+      override: (builder) =>
+        builder
+          .overrideProvider(CACHE_MANAGER)
+          .useValue(mockCacheManagerValue)
+          .overrideProvider(IdsService)
+          .useValue(mockIdsService),
+    })
+
+    mockConfig = app.get<ConfigType<typeof BffConfig>>(BffConfig.KEY)
+    baseUrlWithKey = `${mockConfig.clientBaseUrl}${process.env.BFF_CLIENT_KEY_PATH}`
+
+    server = request(app.getHttpServer())
+  })
+
+  afterEach(() => {
+    mockCacheStore.clear()
+    jest.clearAllMocks()
+  })
+
+  afterAll(async () => {
+    if (app) {
+      await app.close()
+    }
+  })
+
+  describe('GET /login', () => {
+    it('should cache the login attempt', async () => {
+      // Arrange
+      const setSpy = jest.spyOn(mockCacheManagerValue, 'set')
+
+      // Act
+      const res = await server
+        .get('/login')
+        .query({ target_link_uri: allowedTargetLinkUri })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(setSpy).toHaveBeenCalled()
+
+      const [key, value] = setSpy.mock.calls[0]
+
+      expect(key).toEqual(`attempt_${SID_VALUE}`)
+      expect(value).toMatchObject({
+        originUrl: baseUrlWithKey,
+        codeVerifier: expect.any(String),
+        targetLinkUri: allowedTargetLinkUri,
+      })
+    })
+
+    it('should call login endpoint with correct parameters', async () => {
+      // Arrange
+      const expectedParams = {
+        client_id: mockConfig.ids.clientId,
+        response_type: 'code',
+        response_mode: 'query',
+        scope: 'test_scope offline_access openid profile',
+        redirect_uri: mockConfig.callbacksRedirectUris.login,
+        code_challenge_method: 'test_code_challenge_method',
+      }
+
+      const unknownValueParams = ['state', 'code_challenge']
+
+      // Act
+      const res = await server.get('/login')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+
+      // Check if the location header starts with the issuer ID
+      expect(res.headers.location).toMatch(
+        new RegExp(`^${mockConfig.ids.issuer}?`),
+      )
+
+      const url = new URL(res.headers.location)
+
+      // Verify that each expected parameter is present
+      for (const [key, value] of Object.entries(expectedParams)) {
+        if (key === 'scope') {
+          for (const scope of value.split(' ')) {
+            expect(url.searchParams.get('scope')).toContain(scope)
+          }
+        } else {
+          expect(url.searchParams.get(key)).toEqual(value)
+        }
+      }
+
+      // Verify that each unknown value parameter is present
+      for (const key of unknownValueParams) {
+        expect(url.searchParams.get(key)).toBeDefined()
+      }
+    })
+
+    it('should validate the query string param "target_link_uri" if not allowed', async () => {
+      // Arrange
+      const invalidTargetLinkUri = 'http://test-client.com/invalid'
+
+      const searchParams = new URLSearchParams({
+        bff_error_code: '400',
+        bff_error_description: 'Login failed!',
+      })
+
+      const errorUrl = `${baseUrlWithKey}?${searchParams.toString()}`
+
+      // Act
+      const res = await server
+        .get('/login')
+        .query({ target_link_uri: invalidTargetLinkUri })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toMatch(errorUrl)
+    })
+
+    it('should validate the query string param "target_link_uri" if allowed', async () => {
+      // Act
+      const res = await server
+        .get('/login')
+        .query({ target_link_uri: allowedTargetLinkUri })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toMatch(
+        new RegExp(`^${mockConfig.ids.issuer}?`),
+      )
+    })
+
+    it('should support PAR (Pushed Authorization Request) when enabled in config', async () => {
+      // Arrange
+      const parResponse: ParResponse = {
+        request_uri: 'urn:ietf:params:oauth:request_uri:abc123',
+        expires_in: 600,
+      }
+
+      const expectedParams = {
+        request_uri: parResponse.request_uri,
+        client_id: mockConfig.ids.clientId,
+      }
+
+      const redirectUrlSearchParams = new URLSearchParams(expectedParams)
+
+      const app = await setupTestServer({
+        override: (builder) =>
+          builder
+            .overrideProvider(IdsService)
+            .useValue(mockIdsService)
+            .overrideProvider(BffConfig.KEY)
+            .useValue({
+              ...mockConfig,
+              parSupportEnabled: true,
+            }),
+      })
+
+      const newServer = request(app.getHttpServer())
+      const getParSpy = jest.spyOn(mockIdsService, 'getPar')
+
+      // Act
+      const res = await newServer.get('/login')
+
+      // Assert
+      expect(getParSpy).toHaveBeenCalled()
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toEqual(
+        `${
+          mockConfig.ids.issuer
+        }/connect/authorize?${redirectUrlSearchParams.toString()}`,
+      )
+    })
+  })
+
+  describe('GET /callbacks/login', () => {
+    it('should redirect with error if invalid_request is present', async () => {
+      // Arrange
+      const idsError = 'Invalid request'
+      const searchParams = new URLSearchParams({
+        bff_error_code: '500',
+        bff_error_description: idsError,
+      })
+
+      const errorUrl = `${baseUrlWithKey}?${searchParams.toString()}`
+
+      // Act
+      const res = await server.get('/callbacks/login').query({
+        invalid_request: idsError,
+      })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toMatch(errorUrl)
+    })
+
+    it('should validate query string params and redirect with error if invalid', async () => {
+      // Arrange
+      const searchParams = new URLSearchParams({
+        bff_error_code: '400',
+        bff_error_description: 'Login failed!',
+      })
+      const errorUrl = `${baseUrlWithKey}?${searchParams.toString()}`
+
+      // Act
+      const res = await server.get('/callbacks/login')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toMatch(errorUrl)
+    })
+
+    const scenarios = [
+      {
+        description:
+          'should successfully finish callback login and redirect to fallback originUrl',
+        targetLinkUri: undefined,
+        expectedLocation: 'http://test-client.com/testclient',
+      },
+      {
+        description:
+          'should successfully finish callback login and redirect to target_link_uri query param',
+        targetLinkUri: allowedTargetLinkUri,
+        expectedLocation: allowedTargetLinkUri,
+      },
+    ]
+
+    it.each(scenarios)(
+      '$description',
+      async ({ targetLinkUri, expectedLocation }) => {
+        // Arrange
+        const code = 'testcode'
+        const getTokensSpy = jest.spyOn(mockIdsService, 'getTokens')
+        const deleteCacheSpy = jest.spyOn(mockCacheManagerValue, 'del')
+        const setCacheSpy = jest.spyOn(mockCacheManagerValue, 'set')
+        const getCacheSpy = jest.spyOn(mockCacheManagerValue, 'get')
+
+        // Act - First request to cache the login attempt
+        await server
+          .get('/login')
+          .query(targetLinkUri ? { target_link_uri: targetLinkUri } : {})
+
+        const loginAttempt = setCacheSpy.mock.calls[0]
+
+        // Assert - First request should cache the login attempt
+        expect(setCacheSpy.mock.calls[0]).toContain(`attempt_${SID_VALUE}`)
+        expect(loginAttempt[1]).toMatchObject({
+          originUrl: baseUrlWithKey,
+          codeVerifier: expect.any(String),
+          targetLinkUri,
+        })
+
+        // Then make a callback to the login endpoint
+        const res = await server
+          .get('/callbacks/login')
+          .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+          .query({ code, state: SID_VALUE })
+
+        const currentLogin = setCacheSpy.mock.calls[1]
+
+        // Assert
+        expect(setCacheSpy).toHaveBeenCalled()
+
+        expect(currentLogin[0]).toContain(`current_${SID_VALUE}`)
+        // Check if the cache contains the correct values for the current login
+        expect(currentLogin[1]).toMatchObject(tokensResponse)
+
+        expect(getCacheSpy).toHaveBeenCalled()
+        expect(getTokensSpy).toHaveBeenCalled()
+        expect(deleteCacheSpy).toHaveBeenCalled()
+
+        expect(res.status).toEqual(HttpStatus.FOUND)
+
+        // Should redirect to the expected location
+        expect(res.headers.location).toEqual(expectedLocation)
+      },
+    )
+  })
+
+  describe('GET /logout', () => {
+    it('should throw bad request if no sid query string is found', async () => {
+      // Act
+      await server
+        .get('/login')
+        .query({ target_link_uri: allowedTargetLinkUri })
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+      const res = await server.get('/logout')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.BAD_REQUEST)
+    })
+
+    it('should validate if no session cookie is found', async () => {
+      // Act
+      const res = await server.get('/logout').query({ sid: SID_VALUE })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toEqual(mockConfig.logoutRedirectUri)
+    })
+
+    it('should redirect to logout redirect uri with error params if cookie and session state do not match', async () => {
+      // Arrange
+      const searchParams = new URLSearchParams({
+        bff_error_code: '400',
+        bff_error_description: 'Logout failed!',
+      })
+
+      const errorUrl = `${allowedTargetLinkUri}?${searchParams.toString()}`
+
+      // Act
+      const res = await server
+        .get('/logout')
+        .query({ sid: SID_VALUE })
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=invalid_uuid`])
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toMatch(errorUrl)
+    })
+
+    it('should successfully logout and redirect to logout redirect uri', async () => {
+      // Arrange
+      const deleteCacheSpy = jest.spyOn(mockCacheManagerValue, 'del')
+      const revokeRefreshTokenSpy = jest.spyOn(mockIdsService, 'revokeToken')
+      const searchParams = new URLSearchParams({
+        id_token_hint: tokensResponse.id_token,
+        post_logout_redirect_uri: mockConfig.logoutRedirectUri,
+      })
+
+      // Act
+      await server
+        .get('/login')
+        .query({ target_link_uri: allowedTargetLinkUri })
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .get('/logout')
+        .query({ sid: SID_VALUE })
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(revokeRefreshTokenSpy).toHaveBeenCalled()
+      expect(deleteCacheSpy).toHaveBeenCalled()
+      expect(res.status).toEqual(HttpStatus.FOUND)
+
+      expect(res.headers.location).toEqual(
+        `${
+          mockConfig.ids.issuer
+        }/connect/endsession?${searchParams.toString()}`,
+      )
+    })
+  })
+
+  describe('POST /callbacks/logout', () => {
+    let tokenPayload: object
+
+    beforeAll(() => {
+      tokenPayload = {
+        iss: mockConfig.ids.issuer,
+        sub: '1234567890',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+        sid: SID_VALUE,
+      }
+    })
+
+    it('should throw 400 if logout_token is missing from body', async () => {
+      // Act
+      const res = await await server.post('/callbacks/logout')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.BAD_REQUEST)
+      // Expect error to be
+      expect(res.body).toMatchObject({
+        statusCode: 400,
+        message: 'No param "logout_token" provided!',
+      })
+    })
+
+    it('should throw an error for a invalid logout_token, no matching key found for kid', async () => {
+      // Arrange
+      mockedSigningKeys.mockImplementationOnce(() => [noMatchKidSigningKey])
+
+      const invalidToken = jwt.sign(tokenPayload, SECRET_KEY, {
+        algorithm: ALGORITM_TYPE,
+        header: { kid: KID },
+      })
+
+      // Act
+      const res = await server
+        .post('/callbacks/logout')
+        .send({ logout_token: invalidToken })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.UNAUTHORIZED)
+    })
+
+    it('should throw an error for a invalid logout_token, no sid in the token', async () => {
+      // Arrange
+      const invalidToken = jwt.sign(
+        {
+          ...tokenPayload,
+          sid: undefined,
+        },
+        SECRET_KEY,
+        {
+          algorithm: ALGORITM_TYPE,
+          header: { kid: KID },
+        },
+      )
+
+      // Act
+      const res = await server
+        .post('/callbacks/logout')
+        .send({ logout_token: invalidToken })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.UNAUTHORIZED)
+    })
+
+    it('should return a 200 success response', async () => {
+      // Arrange
+      const validToken = jwt.sign(tokenPayload, SECRET_KEY, {
+        algorithm: ALGORITM_TYPE,
+        header: { kid: KID },
+      })
+
+      const getCacheSpy = jest.spyOn(mockCacheManagerValue, 'get')
+      const revokeRefreshTokenSpy = jest.spyOn(mockIdsService, 'revokeToken')
+
+      // Act
+      await server
+        .get('/login')
+        .query({ target_link_uri: allowedTargetLinkUri })
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .post('/callbacks/logout')
+        .send({ logout_token: validToken })
+
+      // Assert
+      expect(getCacheSpy).toHaveBeenCalled()
+      expect(revokeRefreshTokenSpy).toHaveBeenCalled()
+      expect(res.status).toEqual(HttpStatus.OK)
+      expect(res.body).toMatchObject({
+        status: 'success',
+        message: 'Logout successful!',
+      })
+    })
+  })
+})
diff --git a/apps/services/bff/src/app/modules/auth/auth.controller.ts b/apps/services/bff/src/app/modules/auth/auth.controller.ts
new file mode 100644
index 000000000000..4ea72c95a879
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/auth.controller.ts
@@ -0,0 +1,66 @@
+import {
+  Body,
+  Controller,
+  Get,
+  Post,
+  Query,
+  Req,
+  Res,
+  VERSION_NEUTRAL,
+} from '@nestjs/common'
+import { Request, Response } from 'express'
+import { qsValidationPipe } from '../../utils/qs-validation-pipe'
+import { AuthService } from './auth.service'
+import { CallbackLoginDto } from './dto/callback-login.dto'
+import { CallbackLogoutDto } from './dto/callback-logout.dto'
+import { LoginDto } from './dto/login.dto'
+import { LogoutDto } from './dto/logout.dto'
+
+@Controller({
+  version: [VERSION_NEUTRAL, '1'],
+})
+export class AuthController {
+  constructor(private authService: AuthService) {}
+
+  @Get('login')
+  async login(
+    @Res() res: Response,
+    @Query(qsValidationPipe)
+    query: LoginDto,
+  ): Promise<void> {
+    return this.authService.login({ res, query })
+  }
+
+  @Get('callbacks/login')
+  async callbackLogin(
+    @Req() req: Request,
+    @Res() res: Response,
+    @Query(qsValidationPipe)
+    query: CallbackLoginDto,
+  ): Promise<void> {
+    return this.authService.callbackLogin({ req, res, query })
+  }
+
+  @Get('logout')
+  async logout(
+    @Req() req: Request,
+    @Res() res: Response,
+    @Query(qsValidationPipe)
+    query: LogoutDto,
+  ): Promise<void> {
+    return this.authService.logout({ req, res, query })
+  }
+
+  @Post('callbacks/logout')
+  async callbackBackchannelLogout(
+    @Res() res: Response,
+    @Body() body: CallbackLogoutDto,
+  ): Promise<
+    Response<{
+      status: string
+      message: string
+    }>
+  > {
+    return this.authService.callbackLogout(res, body)
+  }
+}
diff --git a/apps/services/bff/src/app/modules/auth/auth.module.ts b/apps/services/bff/src/app/modules/auth/auth.module.ts
new file mode 100644
index 000000000000..9785e7063252
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/auth.module.ts
@@ -0,0 +1,13 @@
+import { Module } from '@nestjs/common'
+import { IdsService } from '../ids/ids.service'
+import { AuthController } from './auth.controller'
+import { AuthService } from './auth.service'
+import { PKCEService } from '../../services/pkce.service'
+import { CryptoService } from '../../services/crypto.service'
+
+@Module({
+  controllers: [AuthController],
+  providers: [AuthService, PKCEService, IdsService, CryptoService],
+  exports: [AuthService],
+})
+export class AuthModule {}
diff --git a/apps/services/bff/src/app/modules/auth/auth.service.ts b/apps/services/bff/src/app/modules/auth/auth.service.ts
new file mode 100644
index 000000000000..f9e0d6008d42
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/auth.service.ts
@@ -0,0 +1,545 @@
+import type { Logger } from '@island.is/logging'
+import { LOGGER_PROVIDER } from '@island.is/logging'
+import {
+  BadRequestException,
+  HttpStatus,
+  Inject,
+  Injectable,
+  InternalServerErrorException,
+  UnauthorizedException,
+} from '@nestjs/common'
+import { ConfigType } from '@nestjs/config'
+import { CookieOptions, Request, Response } from 'express'
+import jwksClient from 'jwks-rsa'
+import { jwtDecode } from 'jwt-decode'
+
+import { IdTokenClaims } from '@island.is/shared/types'
+import { decode, verify, Algorithm } from 'jsonwebtoken'
+import { v4 as uuid } from 'uuid'
+import { environment } from '../../../environment'
+import { BffConfig } from '../../bff.config'
+import { SESSION_COOKIE_NAME } from '../../constants/cookies'
+import { FIVE_SECONDS_IN_MS } from '../../constants/time'
+import { CryptoService } from '../../services/crypto.service'
+import { PKCEService } from '../../services/pkce.service'
+import {
+  CreateErrorQueryStrArgs,
+  createErrorQueryStr,
+} from '../../utils/create-error-query-str'
+import { validateUri } from '../../utils/validate-uri'
+import { CacheService } from '../cache/cache.service'
+import { IdsService } from '../ids/ids.service'
+import { LogoutTokenPayload, TokenResponse } from '../ids/ids.types'
+import { CachedTokenResponse } from './auth.types'
+import { CallbackLoginDto } from './dto/callback-login.dto'
+import { CallbackLogoutDto } from './dto/callback-logout.dto'
+import { LoginDto } from './dto/login.dto'
+import { LogoutDto } from './dto/logout.dto'
+
+@Injectable()
+export class AuthService {
+  private readonly baseUrl
+
+  constructor(
+    @Inject(LOGGER_PROVIDER)
+    private logger: Logger,
+
+    @Inject(BffConfig.KEY)
+    private readonly config: ConfigType<typeof BffConfig>,
+
+    private readonly pkceService: PKCEService,
+    private readonly cacheService: CacheService,
+    private readonly idsService: IdsService,
+    private readonly cryptoService: CryptoService,
+  ) {
+    this.baseUrl = this.config.ids.issuer
+  }
+
+  private getCookieOptions(): CookieOptions {
+    return {
+      httpOnly: true,
+      secure: true,
+      // The lax setting allows cookies to be sent on top-level navigations (such as redirects),
+      // while still providing some protection against CSRF attacks.
+      sameSite: 'lax',
+      path: environment.keyPath,
+    }
+  }
+
+  /**
+   * Creates the client base URL with the path appended.
+   */
+  private createClientBaseUrl() {
+    const baseUrl = new URL(this.config.clientBaseUrl)
+    baseUrl.pathname = `${baseUrl.pathname}${environment.keyPath}`
+      // Prevent potential issues with malformed URLs.
+      .replace('//', '/')
+
+    return baseUrl.toString()
+  }
+
+  /**
+   * Redirects the user to the client base URL with an error query string.
+   */
+  private createClientBaseUrlWithError(args: CreateErrorQueryStrArgs) {
+    return `${this.createClientBaseUrl()}?${createErrorQueryStr(args)}`
+  }
+
+  /**
+   * Redirects the user to the client base URL with an error query string.
+   */
+  private redirectWithError(
+    res: Response,
+    args?: Partial<CreateErrorQueryStrArgs>,
+  ) {
+    const code = args?.code || 500
+    const error = args?.error || 'Login failed!'
+
+    return res.redirect(this.createClientBaseUrlWithError({ code, error }))
+  }
+
+  /**
+   * Formats and updates the token cache with new token response data.
+   */
+  public async updateTokenCache(
+    tokenResponse: TokenResponse,
+  ): Promise<CachedTokenResponse> {
+    const userProfile: IdTokenClaims = jwtDecode(tokenResponse.id_token)
+
+    const value: CachedTokenResponse = {
+      ...tokenResponse,
+      // Encrypt the access and refresh tokens before saving them to the cache
+      // to prevent unauthorized access to the tokens if cached service is compromised.
+      encryptedAccessToken: this.cryptoService.encrypt(
+        tokenResponse.access_token,
+      ),
+      encryptedRefreshToken: this.cryptoService.encrypt(
+        tokenResponse.refresh_token,
+      ),
+      scopes: tokenResponse.scope.split(' '),
+      userProfile,
+      // Subtract 5 seconds from the token expiration time to account for latency.
+      accessTokenExp:
+        Date.now() + (tokenResponse.expires_in * 1000 - FIVE_SECONDS_IN_MS),
+    }
+
+    // Save the tokenResponse to the cache
+    await this.cacheService.save({
+      key: this.cacheService.createSessionKeyType('current', userProfile.sid),
+      value,
+      ttl: this.config.cacheUserProfileTTLms,
+    })
+
+    return value
+  }
+
+  /**
+   * Revoke the refresh token on the identity server, since we have a new session.
+   * We deliberately do not await this operation to make the login flow faster,
+   * since this operation is not critical part to await.
+   * We use .catch() to handle unhandled promise rejections.
+   *
+   * @param encryptedRefreshToken The encrypted refresh token to revoke
+   */
+  private revokeRefreshToken(encryptedRefreshToken: string) {
+    this.idsService
+      .revokeToken(encryptedRefreshToken, 'refresh_token')
+      .catch((error) => {
+        this.logger.warn('Failed to revoke refresh token:', error)
+      })
+  }
+
+  /**
+   * This method initiates the login flow.
+   * It validates the target_link_uri and generates a unique session id, for a login attempt.
+   * It also generates a code verifier and code challenge to enhance security.
+   * The login attempt data is saved in the cache and a PAR request is made to the identity server.
+   * The user is then redirected to the identity server login page.
+   */
+  async login({
+    res,
+    query: { target_link_uri: targetLinkUri, login_hint: loginHint, prompt },
+  }: {
+    res: Response
+    query: LoginDto
+  }) {
+    // Validate targetLinkUri if it is provided
+    if (
+      targetLinkUri &&
+      !validateUri(targetLinkUri, this.config.allowedRedirectUris)
+    ) {
+      this.logger.error(
+        `Invalid target_link_uri provided: ${targetLinkUri}. Allowed redirect uris: "${this.config.allowedRedirectUris.join(
+          ', ',
+        )}"`,
+      )
+
+      return this.redirectWithError(res, {
+        code: 400,
+      })
+    }
+
+    try {
+      // Generate a unique session id to be used as a login attempt,
+      // e.g. to store data in the cache with key 'attempt_sid' to be used in the callback login.
+      const attemptLoginId = uuid()
+
+      // Generate a code verifier and code challenge to enhance security
+      const codeVerifier = await this.pkceService.generateCodeVerifier()
+      const codeChallenge = await this.pkceService.generateCodeChallenge(
+        codeVerifier,
+      )
+
+      await this.cacheService.save({
+        key: this.cacheService.createSessionKeyType('attempt', attemptLoginId),
+        value: {
+          // Fallback if targetLinkUri is not provided
+          originUrl: this.createClientBaseUrl(),
+          // Code verifier to be used in the callback
+          codeVerifier,
+          targetLinkUri,
+        },
+        ttl: this.config.cacheLoginAttemptTTLms,
+      })
+
+      let searchParams: URLSearchParams
+
+      if (this.config.parSupportEnabled) {
+        const parResponse = await this.idsService.getPar({
+          sid: attemptLoginId,
+          codeChallenge,
+          loginHint,
+          prompt,
+        })
+
+        if (parResponse.type === 'error') {
+          throw parResponse.data
+        }
+
+        searchParams = new URLSearchParams({
+          request_uri: parResponse.data.request_uri,
+          client_id: this.config.ids.clientId,
+        })
+      } else {
+        searchParams = new URLSearchParams(
+          this.idsService.getLoginSearchParams({
+            sid: attemptLoginId,
+            codeChallenge,
+            loginHint,
+            prompt,
+          }),
+        )
+      }
+
+      return res.redirect(
+        `${this.baseUrl}/connect/authorize?${searchParams.toString()}`,
+      )
+    } catch (error) {
+      this.logger.error('Login failed: ', error)
+
+      return this.redirectWithError(res)
+    }
+  }
+
+  /**
+   * Callback for the login flow
+   * This method is called from the identity server after the user has logged in
+   * and the authorization code has been issued.
+   * The authorization code is then exchanged for tokens.
+   * We save the tokens and user information in the cache and create a session cookie.
+   * We also clean up cache keys not being used anymore.
+   * Finally, we redirect the user back to the original URL.
+   */
+  async callbackLogin({
+    req,
+    res,
+    query,
+  }: {
+    req: Request
+    res: Response
+    query: CallbackLoginDto
+  }) {
+    const idsError = query.invalid_request
+
+    // IDS might respond with an error if the request is missing a required parameter.
+    if (idsError) {
+      this.logger.error('Callback login IDS invalid request: ', idsError)
+
+      return this.redirectWithError(res, {
+        code: 500,
+        error: idsError,
+      })
+    }
+
+    // Validate query params
+    if (!query.code || !query.state) {
+      const missingParam = !query.code ? 'code' : 'state'
+      this.logger.error(
+        `Callback login failed: No query param "${missingParam}" provided.`,
+      )
+
+      return this.redirectWithError(res, {
+        code: 400,
+      })
+    }
+
+    try {
+      // Get login attempt from cache
+      const loginAttemptData = await this.cacheService.get<{
+        targetLinkUri?: string
+        codeVerifier: string
+        originUrl: string
+      }>(this.cacheService.createSessionKeyType('attempt', query.state))
+
+      // Get tokens and user information from the authorization code
+      const tokenResponse = await this.idsService.getTokens({
+        code: query.code,
+        codeVerifier: loginAttemptData.codeVerifier,
+      })
+
+      if (tokenResponse.type === 'error') {
+        throw tokenResponse.data
+      }
+
+      const updatedTokenResponse = await this.updateTokenCache(
+        tokenResponse.data,
+      )
+
+      // Clean up the login attempt from the cache since we have a successful login.
+      this.cacheService
+        .delete(this.cacheService.createSessionKeyType('attempt', query.state))
+        .catch((err) => {
+          this.logger.warn(err)
+        })
+
+      // Create session cookie with successful login session id
+      res.cookie(
+        SESSION_COOKIE_NAME,
+        updatedTokenResponse.userProfile.sid,
+        this.getCookieOptions(),
+      )
+
+      // Check if there is an old session cookie and clean up the cache
+      const oldSessionCookie = req.cookies[SESSION_COOKIE_NAME]
+
+      if (
+        oldSessionCookie &&
+        oldSessionCookie !== updatedTokenResponse.userProfile.sid
+      ) {
+        const oldSessionCacheKey = this.cacheService.createSessionKeyType(
+          'current',
+          oldSessionCookie,
+        )
+
+        const oldSessionData = await this.cacheService.get<CachedTokenResponse>(
+          oldSessionCacheKey,
+          // Do not throw an error if the key is not found
+          false,
+        )
+
+        if (oldSessionData) {
+          // Revoke the old session refresh token
+          this.revokeRefreshToken(oldSessionData.encryptedRefreshToken)
+
+          // Clean up the old session key from the cache.
+          // Use catch() to handle unhandled promise rejections
+          this.cacheService.delete(oldSessionCacheKey).catch((err) => {
+            this.logger.warn(err)
+          })
+        }
+      }
+
+      return res.redirect(
+        loginAttemptData.targetLinkUri || loginAttemptData.originUrl,
+      )
+    } catch (error) {
+      this.logger.error('Callback login failed: ', error)
+
+      return this.redirectWithError(res)
+    }
+  }
+
+  /**
+   * This method handles user logout. What it does:
+   *
+   * - Validates the session id in the query param and the session cookie
+   * - Cleans up the cache and cookies
+   * - Revokes the current session refresh token
+   * - Redirects the user to the identity server end session endpoint
+   */
+  async logout({
+    req,
+    res,
+    query,
+  }: {
+    req: Request
+    res: Response
+    query: LogoutDto
+  }) {
+    const sidCookie = req.cookies[SESSION_COOKIE_NAME]
+
+    if (!sidCookie) {
+      this.logger.error('Logout failed: No session cookie found')
+
+      return res.redirect(this.config.logoutRedirectUri)
+    }
+
+    if (sidCookie !== query.sid) {
+      this.logger.error(
+        `Logout failed: Cookie sid "${sidCookie}" does not match the session id in query param "${query.sid}"`,
+      )
+
+      return this.redirectWithError(res, {
+        code: 400,
+        error: 'Logout failed!',
+      })
+    }
+
+    const currentLoginCacheKey = this.cacheService.createSessionKeyType(
+      'current',
+      query.sid,
+    )
+
+    const cachedTokenResponse =
+      await this.cacheService.get<CachedTokenResponse>(
+        currentLoginCacheKey,
+        // Do not throw an error if the key is not found
+        false,
+      )
+
+    if (!cachedTokenResponse) {
+      this.logger.error(
+        `Logout failed: ${this.cacheService.createKeyError(
+          currentLoginCacheKey,
+        )}`,
+      )
+
+      return res.redirect(this.config.logoutRedirectUri)
+    }
+
+    /**
+     * Clean up!
+     *
+     * - Revoke the refresh token on the identity server
+     * - Delete the current login from the cache
+     * - Clear the session cookie
+     */
+    res.clearCookie(SESSION_COOKIE_NAME, this.getCookieOptions())
+
+    this.cacheService
+      .delete(currentLoginCacheKey)
+      // handle unhandled promise rejections
+      .catch((err) => {
+        this.logger.warn(err)
+      })
+    // Note! We deliberately do not await this operation to make the logout flow faster.
+    this.revokeRefreshToken(cachedTokenResponse.encryptedRefreshToken)
+
+    const searchParams = new URLSearchParams({
+      id_token_hint: cachedTokenResponse.id_token,
+      post_logout_redirect_uri: this.config.logoutRedirectUri,
+    })
+
+    return res.redirect(
+      `${this.baseUrl}/connect/endsession?${searchParams.toString()}`,
+    )
+  }
+
+  async validateLogoutToken(logoutToken: string): Promise<LogoutTokenPayload> {
+    try {
+      const secretClient = jwksClient({
+        cache: true,
+        rateLimit: true,
+        jwksUri: `${this.config.ids.issuer}/.well-known/openid-configuration/jwks`,
+      })
+
+      // Decode the token without verifying the signature
+      const decodedToken = decode(logoutToken, { complete: true })
+      const kid = decodedToken?.header?.kid
+
+      if (!kid) {
+        throw new Error('Invalid token header. No kid found in header.')
+      }
+
+      const signingKeys = await secretClient.getSigningKeys()
+
+      // Find the the correct signing key matching the headers kid
+      const signingKey = signingKeys.find((sk) => sk.kid === kid)
+
+      if (!signingKey) {
+        throw new Error(`No matching key found for kid "${kid}"`)
+      }
+
+      const publicKey = signingKey.getPublicKey()
+
+      // Verify the signature
+      const payload = verify(logoutToken, publicKey, {
+        algorithms: [signingKey.alg as Algorithm],
+        issuer: this.config.ids.issuer,
+      }) as LogoutTokenPayload
+
+      if (!payload.sid) {
+        throw new Error('No sid in the token')
+      }
+
+      return payload
+    } catch (error) {
+      this.logger.error('Error validating logout token: ', error)
+
+      throw new UnauthorizedException()
+    }
+  }
+
+  async callbackLogout(res: Response, body: CallbackLogoutDto) {
+    const logoutToken = body.logout_token
+
+    this.logger.info('Callback backchannel logout initiated', {
+      logoutToken,
+    })
+
+    if (!logoutToken) {
+      const errorMessage = 'No param "logout_token" provided!'
+      this.logger.error(errorMessage)
+
+      throw new BadRequestException(errorMessage)
+    }
+
+    try {
+      // Validate the logout token and extract payload
+      const payload = await this.validateLogoutToken(logoutToken)
+
+      // Create cache key and retrieve cached token response
+      const cacheKey = this.cacheService.createSessionKeyType(
+        'current',
+        payload.sid,
+      )
+      const cachedTokenResponse =
+        await this.cacheService.get<CachedTokenResponse>(
+          cacheKey,
+          false, // Do not throw an error if the key is not found
+        )
+
+      // Revoke refresh token and delete cache entry
+      if (cachedTokenResponse) {
+        this.revokeRefreshToken(cachedTokenResponse.encryptedRefreshToken)
+      }
+
+      await this.cacheService.delete(cacheKey)
+
+      return res.status(HttpStatus.OK).json({
+        status: 'success',
+        message: 'Logout successful!',
+      })
+    } catch (error) {
+      // Check if error is an UnauthorizedException and just throw it,
+      // since it is already being logged in the validateLogoutToken method.
+      if (error instanceof UnauthorizedException) {
+        throw error
+      }
+
+      this.logger.error('Callback backchannel logout failed: ', error)
+
+      throw new InternalServerErrorException()
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/modules/auth/auth.types.ts b/apps/services/bff/src/app/modules/auth/auth.types.ts
new file mode 100644
index 000000000000..e57e52298603
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/auth.types.ts
@@ -0,0 +1,23 @@
+import { IdTokenClaims } from '@island.is/shared/types'
+
+import { TokenResponse } from '../ids/ids.types'
+
+export type CachedTokenResponse = Omit<
+  TokenResponse,
+  'refresh_token' | 'access_token'
+> & {
+  scopes: string[]
+
+  /**
+   * Decoded id token claims
+   */
+  userProfile: IdTokenClaims
+
+  /**
+   * Expiration time of the access token
+   */
+  accessTokenExp: number
+
+  encryptedAccessToken: string
+  encryptedRefreshToken: string
+}
diff --git a/apps/services/bff/src/app/modules/auth/dto/callback-login.dto.ts b/apps/services/bff/src/app/modules/auth/dto/callback-login.dto.ts
new file mode 100644
index 000000000000..f8a22df32ff2
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/dto/callback-login.dto.ts
@@ -0,0 +1,25 @@
+import { IsOptional, IsString } from 'class-validator'
+
+export class CallbackLoginDto {
+  @IsOptional()
+  @IsString()
+  code?: string
+
+  @IsOptional()
+  @IsString()
+  scope?: string
+
+  @IsOptional()
+  @IsString()
+  state?: string
+
+  @IsOptional()
+  @IsString()
+  session_state?: string
+
+  // IDS responds with an error if the request is invalid
+  // @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
+  @IsOptional()
+  @IsString()
+  invalid_request?: string
+}
diff --git a/apps/services/bff/src/app/modules/auth/dto/callback-logout.dto.ts b/apps/services/bff/src/app/modules/auth/dto/callback-logout.dto.ts
new file mode 100644
index 000000000000..129b96ba83e3
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/dto/callback-logout.dto.ts
@@ -0,0 +1,7 @@
+import { IsOptional, IsString } from 'class-validator'
+
+export class CallbackLogoutDto {
+  @IsOptional()
+  @IsString()
+  logout_token?: string
+}
diff --git a/apps/services/bff/src/app/modules/auth/dto/login.dto.ts b/apps/services/bff/src/app/modules/auth/dto/login.dto.ts
new file mode 100644
index 000000000000..8132325aa029
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/dto/login.dto.ts
@@ -0,0 +1,15 @@
+import { IsOptional, IsString } from 'class-validator'
+
+export class LoginDto {
+  @IsOptional()
+  @IsString()
+  target_link_uri?: string
+
+  @IsOptional()
+  @IsString()
+  login_hint?: string
+
+  @IsOptional()
+  @IsString()
+  prompt?: string
+}
diff --git a/apps/services/bff/src/app/modules/auth/dto/logout.dto.ts b/apps/services/bff/src/app/modules/auth/dto/logout.dto.ts
new file mode 100644
index 000000000000..0462aa69fe9a
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/dto/logout.dto.ts
@@ -0,0 +1,6 @@
+import { IsString } from 'class-validator'
+
+export class LogoutDto {
+  @IsString()
+  sid!: string
+}
diff --git a/apps/services/bff/src/app/modules/cache/cache.module.ts b/apps/services/bff/src/app/modules/cache/cache.module.ts
new file mode 100644
index 000000000000..379db4ba8f83
--- /dev/null
+++ b/apps/services/bff/src/app/modules/cache/cache.module.ts
@@ -0,0 +1,38 @@
+import { createRedisCluster } from '@island.is/cache'
+import { CacheModule as NestCacheModule } from '@nestjs/cache-manager'
+import { DynamicModule, Global, Module } from '@nestjs/common'
+import { ConfigType } from '@nestjs/config'
+import { redisInsStore } from 'cache-manager-ioredis-yet'
+import { BffConfig } from '../../bff.config'
+import { CacheService } from './cache.service'
+
+@Global()
+@Module({})
+export class CacheModule {
+  static register(): DynamicModule {
+    const imports =
+      process.env.NODE_ENV === 'test'
+        ? [NestCacheModule.register()]
+        : [
+            NestCacheModule.registerAsync({
+              useFactory: ({ redis }: ConfigType<typeof BffConfig>) => {
+                const configHasRedis = redis.nodes.length > 0 && redis.name
+
+                return {
+                  store: configHasRedis
+                    ? redisInsStore(createRedisCluster(redis))
+                    : undefined,
+                }
+              },
+              inject: [BffConfig.KEY],
+            }),
+          ]
+
+    return {
+      module: CacheModule,
+      imports,
+      providers: [CacheService],
+      exports: [CacheService],
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/modules/cache/cache.service.ts b/apps/services/bff/src/app/modules/cache/cache.service.ts
new file mode 100644
index 000000000000..9e2f1b246c3b
--- /dev/null
+++ b/apps/services/bff/src/app/modules/cache/cache.service.ts
@@ -0,0 +1,65 @@
+import { Inject, Injectable } from '@nestjs/common'
+import { Cache as CacheManager } from 'cache-manager'
+
+import { CACHE_MANAGER } from '@nestjs/cache-manager'
+
+@Injectable()
+export class CacheService {
+  constructor(
+    @Inject(CACHE_MANAGER)
+    private readonly cacheManager: CacheManager,
+  ) {}
+
+  public createKeyError(key: string) {
+    return `Cache key "${key}" not found.`
+  }
+
+  /**
+   * Creates s unique key with session id.
+   * Type is either 'attempt' or 'current'.
+   * `attempt` represents the login attempt.
+   * `current` represents the current login session.
+   */
+  public createSessionKeyType(type: 'attempt' | 'current', sid: string) {
+    return `${type}_${sid}`
+  }
+
+  public async save({
+    key,
+    value,
+    ttl,
+  }: {
+    key: string
+    value: unknown
+    // Time to live in milliseconds
+    ttl?: number
+  }): Promise<void> {
+    await this.cacheManager.set(key, value, ttl)
+  }
+
+  /**
+   * Gets a value from the cache.
+   *
+   * @param key The key to get the value for.
+   * @param throwError If true, throws an error if the key is not found.
+   *
+   * @returns cache value
+   */
+  public async get<Value>(key: string, throwError = true): Promise<Value> {
+    const value = await this.cacheManager.get(key)
+
+    if (!value && throwError) {
+      throw new Error(this.createKeyError(key))
+    }
+
+    return value as Value
+  }
+
+  public async delete(key: string) {
+    try {
+      await this.cacheManager.del(key)
+    } catch (error) {
+      throw new Error(`Failed to delete key "${key}" from cache.`)
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.module.ts b/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.module.ts
new file mode 100644
index 000000000000..df6ef6c4c9fb
--- /dev/null
+++ b/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.module.ts
@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common'
+import { EnhancedFetchProvider } from './enhanced-fetch.provider'
+
+@Global()
+@Module({
+  providers: [EnhancedFetchProvider],
+  exports: [EnhancedFetchProvider],
+})
+export class EnhancedFetchModule {}
diff --git a/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.provider.ts b/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.provider.ts
new file mode 100644
index 000000000000..d935844ff506
--- /dev/null
+++ b/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.provider.ts
@@ -0,0 +1,17 @@
+import { Provider } from '@nestjs/common'
+
+import {
+  createEnhancedFetch,
+  type EnhancedFetchAPI,
+} from '@island.is/clients/middlewares'
+import { environment } from '../../../environment'
+
+export const ENHANCED_FETCH_PROVIDER_KEY = 'enhanced-fetch-provider'
+
+export const EnhancedFetchProvider: Provider<EnhancedFetchAPI> = {
+  provide: ENHANCED_FETCH_PROVIDER_KEY,
+  useFactory: () =>
+    createEnhancedFetch({
+      name: `bff-${environment.name}-service`,
+    }),
+}
diff --git a/apps/services/bff/src/app/modules/ids/ids.service.ts b/apps/services/bff/src/app/modules/ids/ids.service.ts
new file mode 100644
index 000000000000..77b744598e88
--- /dev/null
+++ b/apps/services/bff/src/app/modules/ids/ids.service.ts
@@ -0,0 +1,202 @@
+import { Inject, Injectable } from '@nestjs/common'
+import { ConfigType } from '@nestjs/config'
+
+import type { EnhancedFetchAPI } from '@island.is/clients/middlewares'
+import { BffConfig } from '../../bff.config'
+import { CryptoService } from '../../services/crypto.service'
+import { ENHANCED_FETCH_PROVIDER_KEY } from '../enhancedFetch/enhanced-fetch.provider'
+import {
+  ApiResponse,
+  ErrorRes,
+  GetLoginSearchParamsReturnValue,
+  ParResponse,
+  TokenResponse,
+} from './ids.types'
+
+@Injectable()
+export class IdsService {
+  private readonly issuerUrl: string
+
+  constructor(
+    @Inject(BffConfig.KEY)
+    private readonly config: ConfigType<typeof BffConfig>,
+
+    @Inject(ENHANCED_FETCH_PROVIDER_KEY)
+    private readonly enhancedFetch: EnhancedFetchAPI,
+
+    private readonly cryptoService: CryptoService,
+  ) {
+    this.issuerUrl = this.config.ids.issuer
+  }
+
+  /**
+   * Reusable fetch fn to make POST requests
+   */
+  private async postRequest<T>(
+    endpoint: string,
+    body: Record<string, string>,
+  ): Promise<ApiResponse<T>> {
+    try {
+      const response = await this.enhancedFetch(
+        `${this.issuerUrl}${endpoint}`,
+        {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+          },
+          body: new URLSearchParams(body).toString(),
+        },
+      )
+
+      const contentType = response.headers.get('content-type') || ''
+
+      if (contentType.includes('application/json')) {
+        const data = await response.json()
+
+        if (!response.ok) {
+          // If error response from Ids is not in the expected format, throw the data as is
+          if (!data.error || !data.error_description) {
+            throw data
+          }
+
+          return {
+            type: 'error',
+            data: {
+              error: data.error,
+              error_description: data.error_description,
+            },
+          } as ErrorRes
+        }
+
+        return {
+          type: 'success',
+          data: data as T,
+        }
+      }
+
+      // Handle plain text responses
+      const textResponse = await response.text()
+
+      if (!response.ok) {
+        throw textResponse
+      }
+
+      return {
+        type: 'success',
+        data: textResponse,
+      } as ApiResponse<T>
+    } catch (error) {
+      throw new Error(error)
+    }
+  }
+
+  public getLoginSearchParams({
+    sid,
+    codeChallenge,
+    loginHint,
+    prompt,
+  }: {
+    sid: string
+    codeChallenge: string
+    loginHint?: string
+    prompt?: string
+  }): GetLoginSearchParamsReturnValue {
+    const { ids } = this.config
+    return {
+      client_id: ids.clientId,
+      redirect_uri: this.config.callbacksRedirectUris.login,
+      response_type: 'code',
+      response_mode: 'query',
+      scope: [
+        'openid',
+        'profile',
+        // Allows us to get refresh tokens
+        'offline_access',
+        ...ids.scopes,
+      ].join(' '),
+      state: sid,
+      code_challenge: codeChallenge,
+      code_challenge_method: 'S256',
+      ...(loginHint && { login_hint: loginHint }),
+      ...(prompt && { prompt }),
+    }
+  }
+
+  /**
+   * Fetches the PAR (Pushed Authorization Requests) from the Ids
+   */
+  public async getPar(args: {
+    sid: string
+    codeChallenge: string
+    loginHint?: string
+    prompt?: string
+  }) {
+    return this.postRequest<ParResponse>('/connect/par', {
+      client_secret: this.config.ids.secret,
+      ...this.getLoginSearchParams(args),
+    })
+  }
+
+  /**
+   * Fetches the tokens from the Ids
+   *
+   * @param obj.code - The code from the Ids
+   * @param obj.codeVerifier - The code verifier from the Ids
+   */
+  public async getTokens({
+    code,
+    codeVerifier,
+  }: {
+    code: string
+    codeVerifier: string
+  }) {
+    const { ids } = this.config
+
+    return this.postRequest<TokenResponse>('/connect/token', {
+      grant_type: 'authorization_code',
+      code,
+      client_secret: ids.secret,
+      client_id: ids.clientId,
+      redirect_uri: this.config.callbacksRedirectUris.login,
+      code_verifier: codeVerifier,
+    })
+  }
+
+  /**
+   * Use the refresh token to get a new tokens
+   *
+   * @param refreshToken - The refresh token
+   */
+  public async refreshToken(refreshToken: string) {
+    const decryptedRefreshToken = this.cryptoService.decrypt(refreshToken)
+    const { ids } = this.config
+
+    return this.postRequest<TokenResponse>('/connect/token', {
+      grant_type: 'refresh_token',
+      refresh_token: decryptedRefreshToken,
+      client_secret: ids.secret,
+      client_id: ids.clientId,
+    })
+  }
+
+  /**
+   * This endpoint allows revoking access tokens (reference tokens only) and refresh token.
+   *
+   * @param token - The token to revoke
+   * @param tokenTypeHint - The type of token to revoke (access_token or refresh_token)
+   */
+  public async revokeToken(
+    token: string,
+    tokenTypeHint: 'access_token' | 'refresh_token',
+  ) {
+    const decryptedToken = this.cryptoService.decrypt(token)
+    const { ids } = this.config
+
+    return this.postRequest('/connect/revocation', {
+      token: decryptedToken,
+      token_type_hint: tokenTypeHint,
+      client_secret: ids.secret,
+      client_id: ids.clientId,
+    })
+  }
+}
diff --git a/apps/services/bff/src/app/modules/ids/ids.types.ts b/apps/services/bff/src/app/modules/ids/ids.types.ts
new file mode 100644
index 000000000000..8f88ced6f832
--- /dev/null
+++ b/apps/services/bff/src/app/modules/ids/ids.types.ts
@@ -0,0 +1,83 @@
+export type GetLoginSearchParamsReturnValue = {
+  client_id: string
+  redirect_uri: string
+  response_type: string
+  response_mode: string
+  scope: string
+  state: string
+  code_challenge: string
+  code_challenge_method: string
+  login_hint?: string
+  prompt?: string
+}
+
+export interface ErrorResponse {
+  // Error code, e.g. invalid_grant, invalid_request, ...
+  error: string
+
+  // Human-readable error description,
+  error_description: string
+}
+
+export type ParResponse = {
+  // An identifier for the authorization request, instead of sending the parameters that were just pushed
+  request_uri: string
+
+  // Time in seconds until the request_uri expires
+  expires_in: number
+}
+
+export type TokenResponse = {
+  // ID token issued by the authorization server
+  id_token: string
+
+  // Access token used to access protected resources
+  access_token: string
+
+  // Time in seconds until the access token expires
+  expires_in: number
+
+  // Type of the token issued, typically "Bearer"
+  token_type: string
+
+  // Refresh token used to obtain a new access token
+  refresh_token: string
+
+  // Scopes associated with the access token
+  scope: string
+}
+
+export interface SuccessResponse<T> {
+  type: 'success'
+  data: T
+}
+
+export interface ErrorRes {
+  type: 'error'
+  data: ErrorResponse
+}
+
+export type ApiResponse<T> = SuccessResponse<T> | ErrorRes
+
+export type LogoutTokenPayload = {
+  // Issuer of the token
+  iss: string
+
+  // Subject of the token
+  sub: string
+
+  // Audience of the token
+  aud: string
+
+  // Time when the token was issued
+  iat: number
+
+  // Time when the token expires
+  exp: number
+
+  // Session ID
+  sid: string
+
+  // Unique identifier for the token.
+  jti: string
+}
diff --git a/apps/services/bff/src/app/modules/proxy/dto/api-proxy.dto.ts b/apps/services/bff/src/app/modules/proxy/dto/api-proxy.dto.ts
new file mode 100644
index 000000000000..10085530d836
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/dto/api-proxy.dto.ts
@@ -0,0 +1,6 @@
+import { IsString } from 'class-validator'
+
+export class ApiProxyDto {
+  @IsString()
+  url!: string
+}
diff --git a/apps/services/bff/src/app/modules/proxy/proxy.controller.spec.ts b/apps/services/bff/src/app/modules/proxy/proxy.controller.spec.ts
new file mode 100644
index 000000000000..1e97fcbe39c8
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/proxy.controller.spec.ts
@@ -0,0 +1,246 @@
+import { ConfigType } from '@island.is/nest/config'
+import { CACHE_MANAGER } from '@nestjs/cache-manager'
+import { HttpStatus, INestApplication } from '@nestjs/common'
+import request from 'supertest'
+
+import { setupTestServer } from '../../../../test/setupTestServer'
+import {
+  SESSION_COOKIE_NAME,
+  SID_VALUE,
+  getLoginSearchParmsFn,
+  mockedTokensResponse as tokensResponse,
+} from '../../../../test/sharedConstants'
+import { BffConfig } from '../../bff.config'
+import { hasTimestampExpiredInMS } from '../../utils/has-timestamp-expired-in-ms'
+import { IdsService } from '../ids/ids.service'
+import { TokenResponse } from '../ids/ids.types'
+import { ProxyService } from './proxy.service'
+import { ExecuteStreamRequestArgs } from './proxy.types'
+
+jest.mock('uuid', () => ({
+  v4: jest.fn().mockReturnValue('fake_uuid'),
+}))
+
+const allowedExternalApiUrl = JSON.parse(
+  process.env.BFF_ALLOWED_EXTERNAL_API_URLS as unknown as string,
+)[0]
+
+const mockCacheStore = new Map()
+
+const mockCacheManagerValue = {
+  set: jest.fn((key, value) => mockCacheStore.set(key, value)),
+  get: jest.fn((key) => mockCacheStore.get(key)),
+  del: jest.fn((key) => mockCacheStore.delete(key)),
+}
+
+const EXPIRED_TOKEN_RESPONSE: TokenResponse = {
+  ...tokensResponse,
+  expires_in: 0,
+}
+
+const mockIdsService = {
+  refreshToken: jest.fn().mockResolvedValue({
+    type: 'success',
+    data: tokensResponse,
+  }),
+  getTokens: jest.fn().mockResolvedValue({
+    type: 'success',
+    data: tokensResponse,
+  }),
+  revokeToken: jest.fn().mockResolvedValue({
+    type: 'success',
+  }),
+  getLoginSearchParams: jest.fn().mockImplementation(getLoginSearchParmsFn),
+}
+
+const createTestProxyService = (
+  cb: (args: ExecuteStreamRequestArgs) => void,
+) => {
+  return class TestProxyService extends ProxyService {
+    async executeStreamRequest(args: ExecuteStreamRequestArgs): Promise<void> {
+      cb(args)
+    }
+  }
+}
+
+describe('ProxyController', () => {
+  let app: INestApplication
+  let server: request.SuperTest<request.Test>
+  let capturedArgs: ExecuteStreamRequestArgs
+  let mockConfig: ConfigType<typeof BffConfig>
+
+  beforeAll(async () => {
+    const app = await setupTestServer({
+      override: (builder) =>
+        builder
+          .overrideProvider(CACHE_MANAGER)
+          .useValue(mockCacheManagerValue)
+          .overrideProvider(IdsService)
+          .useValue(mockIdsService)
+          .overrideProvider(ProxyService)
+          .useClass(
+            createTestProxyService((args) => {
+              capturedArgs = args
+              args.res.status(HttpStatus.OK).json({ message: 'success' })
+            }),
+          ),
+    })
+
+    mockConfig = app.get<ConfigType<typeof BffConfig>>(BffConfig.KEY)
+    server = request(app.getHttpServer())
+  })
+
+  afterEach(() => {
+    mockCacheStore.clear()
+    jest.clearAllMocks()
+  })
+
+  afterAll(async () => {
+    if (app) {
+      await app.close()
+    }
+  })
+
+  describe('GET /api', () => {
+    it('should throw 400 bad request when url param is not provided', async () => {
+      // Act
+      const res = await server.get('/api')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.BAD_REQUEST)
+    })
+
+    it('should throw 400 bad request when url param is invalid', async () => {
+      // Act
+      const res = await server.get('/api').query({ url: 'http://example.com' })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.BAD_REQUEST)
+    })
+
+    it('should throw unauthorized exception when sid cookie is not provided', async () => {
+      // Act
+      const res = await server.get('/api').query({ url: allowedExternalApiUrl })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.UNAUTHORIZED)
+    })
+
+    it('should throw unauthorized exception when cache key is not found', async () => {
+      // Act
+      const res = await server
+        .get('/api')
+        .query({ url: allowedExternalApiUrl })
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.UNAUTHORIZED)
+    })
+
+    it('should successfully proxy api request', async () => {
+      // Act
+      await server.get('/login')
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .get('/api')
+        .query({ url: allowedExternalApiUrl })
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.OK)
+      expect(res.body).toEqual({ message: 'success' })
+    })
+  })
+
+  describe('GET /api/graphql', () => {
+    beforeEach(() => {
+      jest.clearAllMocks()
+      mockIdsService.getTokens.mockResolvedValue({
+        type: 'success',
+        data: tokensResponse,
+      })
+    })
+
+    it('should throw 401 unauthorized when not logged in', async () => {
+      // Act
+      const res = await server.post('/api/graphql')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.UNAUTHORIZED)
+    })
+
+    it('should successfully proxy graphql request', async () => {
+      // Act
+      await server.get('/login')
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .post('/api/graphql')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.OK)
+      expect(res.body).toEqual({ message: 'success' })
+    })
+
+    it('should append query string when proxing requests', async () => {
+      // Act
+      await server.get('/login')
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .post('/api/graphql?op=test')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.OK)
+      expect(capturedArgs.targetUrl).toEqual(
+        `${mockConfig.graphqlApiEndpoint}?op=test`,
+      )
+    })
+
+    it('should correctly identify that the token has expired', () => {
+      const isExpired = hasTimestampExpiredInMS(
+        EXPIRED_TOKEN_RESPONSE.expires_in,
+      )
+
+      expect(isExpired).toBe(true)
+    })
+
+    it('should call refreshToken and cache token response when access_token is expired', async () => {
+      // Arrange
+      mockIdsService.getTokens.mockResolvedValue({
+        type: 'success',
+        data: EXPIRED_TOKEN_RESPONSE,
+      })
+
+      // Act
+      await server.get('/login')
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .post('/api/graphql')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(mockIdsService.refreshToken).toHaveBeenCalled()
+      expect(res.status).toEqual(HttpStatus.OK)
+    })
+  })
+})
diff --git a/apps/services/bff/src/app/modules/proxy/proxy.controller.ts b/apps/services/bff/src/app/modules/proxy/proxy.controller.ts
new file mode 100644
index 000000000000..74af02361ec6
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/proxy.controller.ts
@@ -0,0 +1,39 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Query,
+  Req,
+  Res,
+  VERSION_NEUTRAL,
+} from '@nestjs/common'
+import { Request, Response } from 'express'
+import { qsValidationPipe } from '../../utils/qs-validation-pipe'
+import { ProxyService } from './proxy.service'
+import { ApiProxyDto } from './dto/api-proxy.dto'
+
+@Controller({
+  path: 'api',
+  version: [VERSION_NEUTRAL, '1'],
+})
+export class ProxyController {
+  constructor(private proxyService: ProxyService) {}
+
+  @Get()
+  async forwardGetApiRequest(
+    @Req() req: Request,
+    @Res() res: Response,
+    @Query(qsValidationPipe)
+    query: ApiProxyDto,
+  ): Promise<void> {
+    return this.proxyService.forwardGetApiRequest({ req, res, query })
+  }
+
+  @Post('/graphql')
+  async proxyGraphqlRequest(
+    @Req() req: Request,
+    @Res() res: Response,
+  ): Promise<void> {
+    return this.proxyService.proxyGraphQLRequest({ req, res })
+  }
+}
diff --git a/apps/services/bff/src/app/modules/proxy/proxy.module.ts b/apps/services/bff/src/app/modules/proxy/proxy.module.ts
new file mode 100644
index 000000000000..d767e6c014d6
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/proxy.module.ts
@@ -0,0 +1,13 @@
+import { Module } from '@nestjs/common'
+import { AuthModule } from '../auth/auth.module'
+import { IdsService } from '../ids/ids.service'
+import { ProxyController } from './proxy.controller'
+import { ProxyService } from './proxy.service'
+import { CryptoService } from '../../services/crypto.service'
+
+@Module({
+  imports: [AuthModule],
+  controllers: [ProxyController],
+  providers: [ProxyService, IdsService, CryptoService],
+})
+export class ProxyModule {}
diff --git a/apps/services/bff/src/app/modules/proxy/proxy.service.ts b/apps/services/bff/src/app/modules/proxy/proxy.service.ts
new file mode 100644
index 000000000000..57eee8cd0c9c
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/proxy.service.ts
@@ -0,0 +1,219 @@
+import type { Logger } from '@island.is/logging'
+import { LOGGER_PROVIDER } from '@island.is/logging'
+import {
+  BadRequestException,
+  Inject,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common'
+import { ConfigType } from '@nestjs/config'
+import Agent from 'agentkeepalive'
+import { Request, Response } from 'express'
+import fetch from 'node-fetch'
+import { BffConfig } from '../../bff.config'
+import { CryptoService } from '../../services/crypto.service'
+
+import {
+  AGENT_DEFAULT_FREE_SOCKET_TIMEOUT,
+  AGENT_DEFAULT_MAX_SOCKETS,
+} from '@island.is/shared/constants'
+import { hasTimestampExpiredInMS } from '../../utils/has-timestamp-expired-in-ms'
+import { validateUri } from '../../utils/validate-uri'
+import { AuthService } from '../auth/auth.service'
+import { CachedTokenResponse } from '../auth/auth.types'
+import { CacheService } from '../cache/cache.service'
+import { IdsService } from '../ids/ids.service'
+import { ApiProxyDto } from './dto/api-proxy.dto'
+
+const droppedResponseHeaders = ['access-control-allow-origin']
+
+/**
+ * A custom HTTP agent for managing connections efficiently.
+ * - Keeps connections alive for reuse, reducing connection setup time.
+ * - Configured with custom timeout and socket limits to optimize resource usage.
+ */
+const CUSTOM_AGENT = new Agent({
+  keepAlive: true,
+  timeout: 0,
+  freeSocketTimeout: AGENT_DEFAULT_FREE_SOCKET_TIMEOUT,
+  maxSockets: AGENT_DEFAULT_MAX_SOCKETS,
+})
+
+@Injectable()
+export class ProxyService {
+  constructor(
+    @Inject(LOGGER_PROVIDER)
+    private logger: Logger,
+
+    @Inject(BffConfig.KEY)
+    private readonly config: ConfigType<typeof BffConfig>,
+
+    private readonly cacheService: CacheService,
+    private readonly idsService: IdsService,
+    private readonly authService: AuthService,
+    private readonly cryptoService: CryptoService,
+  ) {}
+
+  /**
+   * This method gets access token from the cache by session ID(sid).
+   * - If the token is expired, it will attempt to update tokens with the refresh token from cache.
+   * - Then access token is decrypted and returned.
+   */
+  private async getAccessToken(req: Request) {
+    const sid = req.cookies['sid']
+
+    if (!sid) {
+      throw new UnauthorizedException()
+    }
+
+    try {
+      let cachedTokenResponse =
+        await this.cacheService.get<CachedTokenResponse>(
+          this.cacheService.createSessionKeyType('current', sid),
+        )
+
+      if (hasTimestampExpiredInMS(cachedTokenResponse.accessTokenExp)) {
+        const tokenResponse = await this.idsService.refreshToken(
+          cachedTokenResponse.encryptedRefreshToken,
+        )
+
+        if (tokenResponse.type === 'error') {
+          throw tokenResponse.data
+        }
+
+        cachedTokenResponse = await this.authService.updateTokenCache(
+          tokenResponse.data,
+        )
+      }
+
+      return this.cryptoService.decrypt(
+        cachedTokenResponse.encryptedAccessToken,
+      )
+    } catch (error) {
+      this.logger.error('Error getting access token:', error)
+
+      throw new UnauthorizedException()
+    }
+  }
+
+  /**
+   * This method proxies the request to the target URL and streams the response back to the client.
+   */
+  async executeStreamRequest({
+    targetUrl,
+    accessToken,
+    req,
+    res,
+    body,
+  }: {
+    targetUrl: string
+    accessToken: string
+    req: Request
+    res: Response
+    body?: Record<string, unknown>
+  }) {
+    try {
+      const reqHeaderContentType = req.headers['content-type']
+      const response = await fetch(targetUrl, {
+        method: 'POST',
+        headers: {
+          'Content-Type': reqHeaderContentType || 'application/json',
+          Authorization: `Bearer ${accessToken}`,
+        },
+        body: JSON.stringify(body ?? req.body),
+        agent: CUSTOM_AGENT,
+      })
+
+      // Set the status code of the response
+      res.status(response.status)
+
+      response.headers.forEach((value, key) => {
+        // Only set headers that are not in the droppedResponseHeaders array
+        if (!droppedResponseHeaders.includes(key.toLowerCase())) {
+          res.setHeader(key, value)
+        }
+      })
+
+      // Pipe the response body directly to the client
+      response.body.pipe(res)
+
+      response.body.on('error', (err) => {
+        this.logger.error('Proxy stream error:', err)
+
+        // This check ensures that `res.end()` is only called if the response has not already been ended.
+        if (!res.writableEnded) {
+          // Ensure the response is properly ended if an error occurs
+          res.end()
+        }
+      })
+
+      // Make sure to end the response when the stream ends,
+      // so that the client knows the request is complete.
+      response.body.on('end', () => {
+        if (!res.writableEnded) {
+          res.end()
+        }
+      })
+    } catch (error) {
+      this.logger.error('Error during proxy request processing: ', error)
+
+      res.status(error.status || 500).send('Failed to proxy request')
+    }
+  }
+
+  /**
+   * Proxies an incoming HTTP POST request to a target GraphQL API, handling authentication, token refresh,
+   * and response streaming.
+   */
+  public async proxyGraphQLRequest({
+    req,
+    res,
+  }: {
+    req: Request
+    res: Response
+  }): Promise<void> {
+    const accessToken = await this.getAccessToken(req)
+    const queryString = req.url.split('?')[1]
+    const targetUrl = `${this.config.graphqlApiEndpoint}${
+      queryString ? `?${queryString}` : ''
+    }`
+
+    this.executeStreamRequest({
+      accessToken,
+      targetUrl,
+      req,
+      res,
+    })
+  }
+
+  /**
+   * Forwards an incoming HTTP GET request to the specified URL (provided in the query string),
+   * managing authentication, refreshing tokens if needed, and streaming the response back to the client.
+   */
+  async forwardGetApiRequest({
+    req,
+    res,
+    query,
+  }: {
+    req: Request
+    res: Response
+    query: ApiProxyDto
+  }) {
+    const { url } = query
+
+    if (!validateUri(url, this.config.allowedExternalApiUrls)) {
+      this.logger.error('Invalid external api url provided:', url)
+
+      throw new BadRequestException('Proxing url failed!')
+    }
+
+    const accessToken = await this.getAccessToken(req)
+
+    this.executeStreamRequest({
+      accessToken,
+      targetUrl: url,
+      req,
+      res,
+    })
+  }
+}
diff --git a/apps/services/bff/src/app/modules/proxy/proxy.types.ts b/apps/services/bff/src/app/modules/proxy/proxy.types.ts
new file mode 100644
index 000000000000..1cde81d086e7
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/proxy.types.ts
@@ -0,0 +1,9 @@
+import { Request, Response } from 'express'
+
+export type ExecuteStreamRequestArgs = {
+  targetUrl: string
+  accessToken: string
+  req: Request
+  res: Response
+  body?: Record<string, unknown>
+}
diff --git a/apps/services/bff/src/app/modules/user/dto/get-user.dto.ts b/apps/services/bff/src/app/modules/user/dto/get-user.dto.ts
new file mode 100644
index 000000000000..e059374f7549
--- /dev/null
+++ b/apps/services/bff/src/app/modules/user/dto/get-user.dto.ts
@@ -0,0 +1,7 @@
+import { IsOptional, IsString } from 'class-validator'
+
+export class GetUserDto {
+  @IsOptional()
+  @IsString()
+  refresh?: string
+}
diff --git a/apps/services/bff/src/app/modules/user/user.controller.ts b/apps/services/bff/src/app/modules/user/user.controller.ts
new file mode 100644
index 000000000000..2e3045db2b67
--- /dev/null
+++ b/apps/services/bff/src/app/modules/user/user.controller.ts
@@ -0,0 +1,25 @@
+import type { Request } from 'express'
+
+import type { BffUser } from '@island.is/shared/types'
+import { Controller, Get, Query, Req, VERSION_NEUTRAL } from '@nestjs/common'
+
+import { qsValidationPipe } from '../../utils/qs-validation-pipe'
+import { GetUserDto } from './dto/get-user.dto'
+import { UserService } from './user.service'
+
+@Controller({
+  path: 'user',
+  version: [VERSION_NEUTRAL, '1'],
+})
+export class UserController {
+  constructor(private readonly userService: UserService) {}
+
+  @Get()
+  async getUser(
+    @Req() req: Request,
+    @Query(qsValidationPipe)
+    query: GetUserDto,
+  ): Promise<BffUser> {
+    return this.userService.getUser(req, query.refresh === 'true')
+  }
+}
diff --git a/apps/services/bff/src/app/modules/user/user.module.ts b/apps/services/bff/src/app/modules/user/user.module.ts
new file mode 100644
index 000000000000..6ad5d5368d65
--- /dev/null
+++ b/apps/services/bff/src/app/modules/user/user.module.ts
@@ -0,0 +1,13 @@
+import { Module } from '@nestjs/common'
+import { AuthModule } from '../auth/auth.module'
+import { IdsService } from '../ids/ids.service'
+import { UserController } from './user.controller'
+import { UserService } from './user.service'
+import { CryptoService } from '../../services/crypto.service'
+
+@Module({
+  imports: [AuthModule],
+  controllers: [UserController],
+  providers: [UserService, IdsService, CryptoService],
+})
+export class UserModule {}
diff --git a/apps/services/bff/src/app/modules/user/user.service.ts b/apps/services/bff/src/app/modules/user/user.service.ts
new file mode 100644
index 000000000000..c892586e9156
--- /dev/null
+++ b/apps/services/bff/src/app/modules/user/user.service.ts
@@ -0,0 +1,82 @@
+import type { Logger } from '@island.is/logging'
+import { LOGGER_PROVIDER } from '@island.is/logging'
+import { Inject, Injectable, UnauthorizedException } from '@nestjs/common'
+import { Request } from 'express'
+
+import { BffUser } from '@island.is/shared/types'
+import { SESSION_COOKIE_NAME } from '../../constants/cookies'
+import { CryptoService } from '../../services/crypto.service'
+
+import { hasTimestampExpiredInMS } from '../../utils/has-timestamp-expired-in-ms'
+import { AuthService } from '../auth/auth.service'
+import { CachedTokenResponse } from '../auth/auth.types'
+import { CacheService } from '../cache/cache.service'
+import { IdsService } from '../ids/ids.service'
+
+@Injectable()
+export class UserService {
+  constructor(
+    @Inject(LOGGER_PROVIDER)
+    private logger: Logger,
+
+    private readonly cryptoService: CryptoService,
+    private readonly cacheService: CacheService,
+    private readonly idsService: IdsService,
+    private readonly authService: AuthService,
+  ) {}
+
+  private mapToBffUser(value: CachedTokenResponse): BffUser {
+    return {
+      scopes: value.scopes,
+      profile: value.userProfile,
+    }
+  }
+
+  public async getUser(req: Request, refresh = true): Promise<BffUser> {
+    const sid = req.cookies[SESSION_COOKIE_NAME]
+
+    if (!sid) {
+      throw new UnauthorizedException()
+    }
+
+    try {
+      const cachedTokenResponse =
+        await this.cacheService.get<CachedTokenResponse>(
+          this.cacheService.createSessionKeyType('current', sid),
+          // Do not throw error if the key is not found
+          false,
+        )
+
+      if (!cachedTokenResponse) {
+        throw new UnauthorizedException()
+      }
+
+      const accessTokenHasExpired = hasTimestampExpiredInMS(
+        cachedTokenResponse.accessTokenExp,
+      )
+
+      if (accessTokenHasExpired && !refresh) {
+        // Get new token data with refresh token
+        const tokenResponse = await this.idsService.refreshToken(
+          cachedTokenResponse.encryptedRefreshToken,
+        )
+
+        if (tokenResponse.type === 'error') {
+          throw tokenResponse.data
+        }
+
+        // Update cache with new token data
+        const value: CachedTokenResponse =
+          await this.authService.updateTokenCache(tokenResponse.data)
+
+        return this.mapToBffUser(value)
+      }
+
+      return this.mapToBffUser(cachedTokenResponse)
+    } catch (error) {
+      this.logger.error('Get user error: ', error)
+
+      throw new UnauthorizedException()
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/services/crypto.service.spec.ts b/apps/services/bff/src/app/services/crypto.service.spec.ts
new file mode 100644
index 000000000000..87528e308640
--- /dev/null
+++ b/apps/services/bff/src/app/services/crypto.service.spec.ts
@@ -0,0 +1,92 @@
+import type { Logger } from '@island.is/logging'
+import { LOGGER_PROVIDER } from '@island.is/logging'
+import { Test, TestingModule } from '@nestjs/testing'
+import crypto from 'crypto'
+import { CryptoService } from './crypto.service'
+import { BffConfig } from '../bff.config'
+
+const DECRYPTED_TEXT = 'Hello, World!'
+
+Object.defineProperty(global, 'crypto', {
+  value: {
+    getRandomValues: (arr: Buffer) => crypto.randomBytes(arr.length),
+  },
+})
+
+const invalidConfig = {
+  tokenSecretBase64: 'shortkey',
+}
+
+const validConfig = {
+  // A valid 32-byte base64 key
+  tokenSecretBase64: 'ABHlmq6Ic6Ihip4OnTa1MeUXtHFex8IT/mFZrjhsme0=',
+}
+
+const mockLogger = {
+  error: jest.fn(),
+} as unknown as Logger
+
+const createModule = async (config = validConfig): Promise<TestingModule> => {
+  return Test.createTestingModule({
+    providers: [
+      CryptoService,
+      { provide: LOGGER_PROVIDER, useValue: mockLogger },
+      { provide: BffConfig.KEY, useValue: config },
+    ],
+  }).compile()
+}
+
+describe('CryptoService Constructor', () => {
+  it('should throw an error if "tokenSecretBase64" is not 32 bytes long', async () => {
+    try {
+      const module = await createModule(invalidConfig)
+      module.get<CryptoService>(CryptoService)
+      // Fail the test if no error is thrown
+      fail('Expected constructor to throw an error, but it did not.')
+    } catch (error) {
+      expect(error.message).toBe(
+        '"tokenSecretBase64" secret must be exactly 32 bytes (256 bits) long.',
+      )
+    }
+  })
+
+  it('should not throw an error if "tokenSecretBase64" is 32 bytes long', async () => {
+    try {
+      const module = await createModule()
+      module.get<CryptoService>(CryptoService)
+      // No error means the test passes
+    } catch (error) {
+      fail(`Expected no error, but received: ${error.message}`)
+    }
+  })
+})
+
+describe('CryptoService', () => {
+  let service: CryptoService
+
+  beforeEach(async () => {
+    const module = await createModule()
+    service = module.get<CryptoService>(CryptoService)
+  })
+
+  describe('encrypt', () => {
+    it('should encrypt and return a string containing IV and encrypted text', () => {
+      const encryptedText = service.encrypt(DECRYPTED_TEXT)
+      const [algorithm, ivBase64, encrypted] = encryptedText.split(':')
+
+      expect(algorithm).toEqual('aes-256-cbc')
+      // IV in base64 (16 bytes) should be 24 characters long
+      expect(ivBase64).toHaveLength(24)
+      expect(encrypted.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('decrypt', () => {
+    it('should decrypt an encrypted string and return the original text', () => {
+      const encryptedText = service.encrypt(DECRYPTED_TEXT)
+      const decryptedText = service.decrypt(encryptedText)
+
+      expect(decryptedText).toBe(DECRYPTED_TEXT)
+    })
+  })
+})
diff --git a/apps/services/bff/src/app/services/crypto.service.ts b/apps/services/bff/src/app/services/crypto.service.ts
new file mode 100644
index 000000000000..f5b39526b7c1
--- /dev/null
+++ b/apps/services/bff/src/app/services/crypto.service.ts
@@ -0,0 +1,107 @@
+import type { Logger } from '@island.is/logging'
+import { LOGGER_PROVIDER } from '@island.is/logging'
+import { Inject, Injectable } from '@nestjs/common'
+import { ConfigType } from '@nestjs/config'
+import * as crypto from 'crypto'
+import { BffConfig } from '../bff.config'
+
+@Injectable()
+export class CryptoService {
+  private readonly algorithm = 'aes-256-cbc'
+  private readonly key: Buffer
+
+  constructor(
+    @Inject(LOGGER_PROVIDER)
+    private logger: Logger,
+
+    @Inject(BffConfig.KEY)
+    private readonly config: ConfigType<typeof BffConfig>,
+  ) {
+    // Decode from base64 to binary
+    this.key = Buffer.from(this.config.tokenSecretBase64, 'base64')
+
+    // Ensure the key is exactly 32 bytes (256 bits) long
+    if (this.key.length !== 32) {
+      throw new Error(
+        '"tokenSecretBase64" secret must be exactly 32 bytes (256 bits) long.',
+      )
+    }
+  }
+
+  /**
+   * Encrypts a given text using the AES-256-CBC encryption algorithm.
+   *
+   * @param text The plain text to encrypt.
+   * @returns IV encrypted text for decryption
+   *
+   * @example
+   * const encrypted = cryptoService.encrypt('Hello, World!')
+   * Output: 'aes-256-cbc:Ghs8TV5veHqJkGthWklAAw==:YWJjZGVmMTIzNDU2Nzg5MGFiY2RlZjEyMzQ1Njc4OTA='
+   */
+  encrypt(text: string): string {
+    try {
+      // Generate a random 16-byte initialization vector (IV) for the encryption
+      // IV is a unique value used with the key to make each encryption unique, even with the same plaintext and key.
+      const iv = crypto.randomBytes(16)
+
+      // Create a Cipher object using the algorithm, encryption key, and initialization vector (IV)
+      const cipher = crypto.createCipheriv(this.algorithm, this.key, iv)
+
+      // Encrypt the text in 'utf8' format and encode the result as base64
+      let encrypted = cipher.update(text, 'utf8', 'base64')
+
+      // Finalize the encryption, appending any remaining data
+      encrypted += cipher.final('base64')
+
+      // Return the algorithm, IV, and the encrypted text, separated by colons
+      // The IV is used in decryption.
+      return `${this.algorithm}:${iv.toString('base64')}:${encrypted}`
+    } catch (error) {
+      this.logger.error('Error encrypting text:', { message: error.message })
+
+      throw new Error('Failed to encrypt the text.')
+    }
+  }
+
+  /**
+   * Decrypts a given text using the AES-256-CBC decryption algorithm.
+   *
+   * @param encryptedText The IV encrypted text to decrypt.
+   * @returns The original plain text.
+   *
+   * @example
+   * const decrypted = cryptoService.decrypt('aes-256-cbc:Ghs8TV5veHqJkGthWklAAw==:YWJjZGVmMTIzNDU2Nzg5MGFiY2RlZjEyMzQ1Njc4OTA=')
+   * Output: 'Hello, World!'
+   */
+  decrypt(encryptedText: string): string {
+    try {
+      // Split the input into the algorithm, IV (initialization vector), and the encrypted text
+      const [_algorithm, ivBase64, encrypted] = encryptedText.split(':')
+
+      // If encryptedText is malformed, this could lead to runtime errors or security vulnerabilities.
+      // This check ensures all parts are present before proceeding.
+      if (!ivBase64 || !encrypted) {
+        throw new Error('Invalid encrypted text format.')
+      }
+
+      // Convert the base64-encoded IV back into a Buffer
+      const iv = Buffer.from(ivBase64, 'base64')
+
+      // Create a Decipher object using the same algorithm, key, and IV
+      const decipher = crypto.createDecipheriv(this.algorithm, this.key, iv)
+
+      // Decrypt the encrypted text from base64 to utf8 format
+      let decrypted = decipher.update(encrypted, 'base64', 'utf8')
+
+      // Finalize the decryption, appending any remaining data
+      decrypted += decipher.final('utf8')
+
+      // Return the decrypted plaintext
+      return decrypted
+    } catch (error) {
+      this.logger.error('Error decrypting text:', { message: error.message })
+
+      throw new Error('Failed to decrypt the text.')
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/services/pkce.service.spec.ts b/apps/services/bff/src/app/services/pkce.service.spec.ts
new file mode 100644
index 000000000000..6b0431f45a7c
--- /dev/null
+++ b/apps/services/bff/src/app/services/pkce.service.spec.ts
@@ -0,0 +1,74 @@
+import { Test, TestingModule } from '@nestjs/testing'
+import { PKCEService } from './pkce.service'
+
+const ALLOWED_VERIFIER_CHARACTERS_REGEX = /^[a-zA-Z0-9-._~]+$/
+
+describe('PKCEService', () => {
+  let service: PKCEService
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [PKCEService],
+    }).compile()
+
+    service = module.get<PKCEService>(PKCEService)
+  })
+
+  describe('generateVerifier', () => {
+    const verifierTestCases = [
+      { length: 50, description: 'default length 50' },
+      { length: 64, description: 'specified length 64' },
+      { length: 43, description: 'minimum length 43' },
+      { length: 128, description: 'maximum length 128' },
+    ]
+
+    verifierTestCases.forEach(({ length, description }) => {
+      it(`should generate a verifier of ${description}`, async () => {
+        const verifier = await service.generateVerifier(length)
+        expect(verifier).toHaveLength(length)
+        // Check allowed characters
+        expect(verifier).toMatch(ALLOWED_VERIFIER_CHARACTERS_REGEX)
+      })
+    })
+
+    it('should throw an error if the length is less than 43', async () => {
+      await expect(service.generateVerifier(42)).rejects.toThrow(
+        'Length must be a positive integer between 43 and 128',
+      )
+    })
+
+    it('should throw an error if the length is greater than 128', async () => {
+      await expect(service.generateVerifier(129)).rejects.toThrow(
+        'Length must be a positive integer between 43 and 128',
+      )
+    })
+  })
+
+  describe('generateCodeVerifier', () => {
+    it('should generate a code verifier of default length 50', async () => {
+      const verifier = await service.generateCodeVerifier()
+      expect(verifier).toHaveLength(50)
+      // Check allowed characters
+      expect(verifier).toMatch(ALLOWED_VERIFIER_CHARACTERS_REGEX)
+    })
+  })
+
+  describe('generateCodeChallenge', () => {
+    it('should generate a valid code challenge from a given verifier', async () => {
+      const verifier = 'testVerifier123'
+      const challenge = await service.generateCodeChallenge(verifier)
+      expect(challenge).toBeDefined()
+      // Match base64url format
+      expect(challenge).toMatch(/^[a-zA-Z0-9-_]+$/)
+    })
+  })
+
+  describe('getRandomValues', () => {
+    it('should generate an array of random values of specified length', async () => {
+      const length = 10
+      const randomValues = await service.getRandomValues(length)
+      expect(randomValues).toBeInstanceOf(Uint8Array)
+      expect(randomValues).toHaveLength(length)
+    })
+  })
+})
diff --git a/apps/services/bff/src/app/services/pkce.service.ts b/apps/services/bff/src/app/services/pkce.service.ts
new file mode 100644
index 000000000000..96c2375b5b2c
--- /dev/null
+++ b/apps/services/bff/src/app/services/pkce.service.ts
@@ -0,0 +1,81 @@
+import { Injectable } from '@nestjs/common'
+import { promisify } from 'util'
+import * as crypto from 'crypto'
+
+const randomBytesAsync = promisify(crypto.randomBytes)
+
+@Injectable()
+export class PKCEService {
+  /**
+   * Creates an array of length "size" of random bytes
+   * @returns Array of random ints (0 to 255)
+   */
+  async getRandomValues(size: number): Promise<Uint8Array> {
+    const randomBytes = await randomBytesAsync(size)
+
+    return new Uint8Array(randomBytes)
+  }
+
+  /**
+   * Generate a PKCE code verifier
+   * Generates a 50-character long verifier by default
+   */
+  public async generateCodeVerifier(): Promise<string> {
+    return this.generateVerifier(50)
+  }
+
+  /**
+   * Generate a PKCE code challenge based on the verifier
+   * Uses SHA-256 hashing and Base64 URL encoding
+   */
+  public async generateCodeChallenge(codeVerifier: string): Promise<string> {
+    // Convert the verifier to a Uint8Array
+    const encoder = new TextEncoder()
+    const data = encoder.encode(codeVerifier)
+
+    // Use Web Crypto API for async hashing
+    const hashBuffer = await crypto.webcrypto.subtle.digest('SHA-256', data)
+
+    // and then Base64 URL encode
+    return this.base64UrlEncode(Buffer.from(hashBuffer))
+  }
+
+  /**
+   * Generate a PKCE challenge verifier
+   * Generates cryptographically strong random string
+   *
+   * @param length The length of the verifier to generate
+   *
+   * Note! According to the RFC from OAuth 2.0 PKCE RFC 7636, the PKCE code verifier must have a length between 43 and 128 characters.
+   */
+  async generateVerifier(length = 50): Promise<string> {
+    // Enforce PKCE length requirements: 43 <= length <= 128
+    if (!Number.isInteger(length) || length < 43 || length > 128) {
+      throw new Error(
+        'Length must be a positive integer between 43 and 128, inclusive',
+      )
+    }
+
+    const mask =
+      'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~'
+
+    let result = ''
+    const randomUints = await this.getRandomValues(length)
+
+    for (let i = 0; i < length; i++) {
+      // Cap the value of the randomIndex to mask.length - 1
+      const randomIndex = randomUints[i] % mask.length
+      result += mask[randomIndex]
+    }
+
+    return result
+  }
+
+  /**
+   * Base64 URL encode the buffer input
+   * This utility function converts a Buffer to a Base64 URL-safe string,
+   */
+  private base64UrlEncode(buffer: Buffer): string {
+    return buffer.toString('base64url')
+  }
+}
diff --git a/apps/services/bff/src/app/utils/create-error-query-str.ts b/apps/services/bff/src/app/utils/create-error-query-str.ts
new file mode 100644
index 000000000000..cf7a8b927e02
--- /dev/null
+++ b/apps/services/bff/src/app/utils/create-error-query-str.ts
@@ -0,0 +1,17 @@
+export type CreateErrorQueryStrArgs = {
+  code: number
+  error: string
+}
+
+/**
+ * This utility function creates a query string with the bff_error and bff_error_description parameters
+ */
+export const createErrorQueryStr = ({
+  code,
+  error,
+}: CreateErrorQueryStrArgs) => {
+  return new URLSearchParams({
+    bff_error_code: code.toString(),
+    bff_error_description: error,
+  }).toString()
+}
diff --git a/apps/services/bff/src/app/utils/has-timestamp-expired-in-ms.ts b/apps/services/bff/src/app/utils/has-timestamp-expired-in-ms.ts
new file mode 100644
index 000000000000..87762126c8c6
--- /dev/null
+++ b/apps/services/bff/src/app/utils/has-timestamp-expired-in-ms.ts
@@ -0,0 +1,6 @@
+/**
+ * Check if a Unix timestamp (in milliseconds) has expired
+ */
+export const hasTimestampExpiredInMS = (unixTimestampMs: number): boolean => {
+  return unixTimestampMs < Date.now()
+}
diff --git a/apps/services/bff/src/app/utils/qs-validation-pipe.ts b/apps/services/bff/src/app/utils/qs-validation-pipe.ts
new file mode 100644
index 000000000000..d53d89802b0f
--- /dev/null
+++ b/apps/services/bff/src/app/utils/qs-validation-pipe.ts
@@ -0,0 +1,7 @@
+import { ValidationPipe } from '@nestjs/common'
+
+export const qsValidationPipe = new ValidationPipe({
+  transform: true,
+  transformOptions: { enableImplicitConversion: true },
+  forbidNonWhitelisted: true,
+})
diff --git a/apps/services/bff/src/app/utils/remove-trailing-slash.ts b/apps/services/bff/src/app/utils/remove-trailing-slash.ts
new file mode 100644
index 000000000000..3a835b60cf3c
--- /dev/null
+++ b/apps/services/bff/src/app/utils/remove-trailing-slash.ts
@@ -0,0 +1,13 @@
+/**
+ * Remove trailing slash from a string
+ *
+ * @example
+ * removeTrailingSlash('https://example.com/') // 'https://example.com'
+ */
+export const removeTrailingSlash = (str: string) => {
+  if (!str || str === '/') {
+    return ''
+  }
+
+  return str.endsWith('/') ? str.slice(0, -1) : str
+}
diff --git a/apps/services/bff/src/app/utils/validate-uri.spec.ts b/apps/services/bff/src/app/utils/validate-uri.spec.ts
new file mode 100644
index 000000000000..cdb41687af6e
--- /dev/null
+++ b/apps/services/bff/src/app/utils/validate-uri.spec.ts
@@ -0,0 +1,84 @@
+import { validateUri } from './validate-uri'
+
+describe('validateUri', () => {
+  const allowedUris = [
+    'https://beta.dev01.devland.is/stjornbord',
+    'https://api.stjornbord.island.is',
+  ]
+
+  it('should return false if uri is not a string', () => {
+    expect(validateUri(123 as any, allowedUris)).toBe(false)
+  })
+
+  it('should return false if allowedUris is not an array', () => {
+    expect(
+      validateUri('https://beta.dev01.devland.is/stjornbord', {} as any),
+    ).toBe(false)
+  })
+
+  it('should return false if allowedUri is not a string', () => {
+    const invalidAllowedUris = [123 as any, 'https://api.stjornbord.island.is']
+    expect(
+      validateUri(
+        'https://beta.dev01.devland.is/stjornbord',
+        invalidAllowedUris,
+      ),
+    ).toBe(false)
+  })
+
+  it('should return true for URI with the same hostname in different caseing', () => {
+    expect(
+      validateUri('https://Beta.Dev01.Devland.Is/stjornbord', allowedUris),
+    ).toBe(true)
+  })
+
+  it('should return true for valid allowed URI', () => {
+    expect(
+      validateUri('https://beta.dev01.devland.is/stjornbord', allowedUris),
+    ).toBe(true)
+  })
+
+  it('should return false for subdomain attacks', () => {
+    expect(
+      validateUri(
+        // A subdomain that could pass if validation isn't strict
+        'https://beta.dev01.devland.is.evil.is/stjornbord',
+        allowedUris,
+      ),
+    ).toBe(false)
+  })
+
+  it('should return false for protocol mismatch', () => {
+    expect(
+      validateUri('http://beta.dev01.devland.is/stjornbord', allowedUris),
+    ).toBe(false)
+  })
+
+  it('should return false for path traversal', () => {
+    expect(
+      validateUri(
+        // Path traversal should fail
+        'https://beta.dev01.devland.is/stjornbord/../admin',
+        allowedUris,
+      ),
+    ).toBe(false)
+  })
+
+  it('should return false for invalid hostname', () => {
+    expect(
+      validateUri('https://malicious-site.com/stjornbord', allowedUris),
+    ).toBe(false)
+  })
+
+  it('should return true for another valid allowed URI', () => {
+    expect(validateUri('https://api.stjornbord.island.is', allowedUris)).toBe(
+      true,
+    )
+  })
+
+  it('should return false for partially matching but different path', () => {
+    expect(
+      validateUri('https://beta.dev01.devland.is/different-path', allowedUris),
+    ).toBe(false)
+  })
+})
diff --git a/apps/services/bff/src/app/utils/validate-uri.ts b/apps/services/bff/src/app/utils/validate-uri.ts
new file mode 100644
index 000000000000..0a084f35b005
--- /dev/null
+++ b/apps/services/bff/src/app/utils/validate-uri.ts
@@ -0,0 +1,45 @@
+import { URL } from 'url'
+
+/**
+ * Validates the URI against allowed URIs to block external URLs.
+ *
+ * Security Considerations:
+ * - Subdomain Attacks: Prevents bypassing validation via subdomains (e.g., `evil.example.com`).
+ * - Path Traversal: Prevents accessing unintended paths, e.g. https://island.is.evil.is/some-path could pass validation if https://island.is is the allowed URL when using startWith() for example.
+ * - Protocol Hijacking: Ensures the protocol (e.g., `https`) matches exactly.
+ *
+ * This function compares both the protocol, hostname, and optionally, the pathname.
+ *
+ * @param uri - The URI to validate.
+ * @param allowedUris - List of allowed URIs.
+ * @returns True if the URI is valid, false otherwise.
+ */
+export const validateUri = (uri: string, allowedUris: string[]): boolean => {
+  //  input validation for extra security
+  if (!uri || typeof uri !== 'string' || !Array.isArray(allowedUris)) {
+    return false
+  }
+
+  try {
+    // Normalize the URI to lowercase for case-insensitive comparison
+    const parsedUri = new URL(uri.trim().toLowerCase())
+
+    return allowedUris.some((allowedUri) => {
+      if (typeof allowedUri !== 'string') {
+        return false
+      }
+
+      const parsedAllowedUri = new URL(allowedUri.trim().toLowerCase())
+
+      const isSameProtocol = parsedUri.protocol === parsedAllowedUri.protocol
+      const isSameHostname = parsedUri.hostname === parsedAllowedUri.hostname
+      const isSamePathname =
+        parsedUri.pathname === parsedAllowedUri.pathname ||
+        parsedUri.pathname.startsWith(parsedAllowedUri.pathname)
+
+      return isSameProtocol && isSameHostname && isSamePathname
+    })
+  } catch {
+    return false
+  }
+}
diff --git a/apps/services/bff/src/environment/environment.schema.ts b/apps/services/bff/src/environment/environment.schema.ts
new file mode 100644
index 000000000000..c660cfd14845
--- /dev/null
+++ b/apps/services/bff/src/environment/environment.schema.ts
@@ -0,0 +1,27 @@
+import { z } from 'zod'
+
+const KEY_PATH_ENV_VAR = 'BFF_CLIENT_KEY_PATH'
+
+export const environmentSchema = z.strictObject({
+  production: z.boolean().default(false),
+  port: z.preprocess(
+    (val) => (val ? parseInt(val as string, 10) : 3010),
+    z
+      .number({ required_error: 'PORT must be a valid number' })
+      .min(1)
+      .max(65535),
+  ),
+  /**
+   * The global prefix for the API
+   */
+  keyPath: z
+    .string({
+      required_error: `${KEY_PATH_ENV_VAR} is required`,
+    })
+    .refine((val) => !val.endsWith('/bff'), {
+      message: `${KEY_PATH_ENV_VAR} must not end with /bff`,
+    }),
+  name: z.string({ required_error: 'BFF_NAME is required' }),
+})
+
+export type BffEnvironment = z.infer<typeof environmentSchema>
diff --git a/apps/services/bff/src/environment/environment.ts b/apps/services/bff/src/environment/environment.ts
new file mode 100644
index 000000000000..f98c1992f1dc
--- /dev/null
+++ b/apps/services/bff/src/environment/environment.ts
@@ -0,0 +1,12 @@
+import { BffEnvironment, environmentSchema } from './environment.schema'
+
+export const isProduction = process.env.NODE_ENV === 'production'
+
+const parsedEnvironment = environmentSchema.parse({
+  production: isProduction,
+  port: process.env.PORT,
+  keyPath: process.env.BFF_CLIENT_KEY_PATH,
+  name: process.env.BFF_NAME,
+})
+
+export const environment: BffEnvironment = parsedEnvironment
diff --git a/apps/services/bff/src/environment/index.ts b/apps/services/bff/src/environment/index.ts
new file mode 100644
index 000000000000..1953a2e9b9f0
--- /dev/null
+++ b/apps/services/bff/src/environment/index.ts
@@ -0,0 +1 @@
+export * from './environment'
diff --git a/apps/services/bff/src/main.ts b/apps/services/bff/src/main.ts
new file mode 100644
index 000000000000..2e68f2bcbc6e
--- /dev/null
+++ b/apps/services/bff/src/main.ts
@@ -0,0 +1,12 @@
+import { bootstrap } from '@island.is/infra-nest-server'
+
+import { AppModule } from './app/app.module'
+import { environment } from './environment'
+
+bootstrap({
+  appModule: AppModule,
+  name: 'bff',
+  port: environment.port,
+  globalPrefix: `${environment.keyPath}/bff`,
+  healthCheck: true,
+})
diff --git a/apps/services/bff/test/setup.ts b/apps/services/bff/test/setup.ts
new file mode 100644
index 000000000000..9c8cbeee3c85
--- /dev/null
+++ b/apps/services/bff/test/setup.ts
@@ -0,0 +1,21 @@
+process.env.PORT = '3010'
+process.env.BFF_NAME = 'testclient'
+process.env.BFF_CACHE_USER_PROFILE_TTL_MS = '3595000' // 1 hour - 5 seconds
+process.env.BFF_LOGIN_ATTEMPT_TTL_MS = '604800000' // 1 week
+process.env.IDENTITY_SERVER_CLIENT_SECRET = 'some secret'
+process.env.IDENTITY_SERVER_ISSUER_URL =
+  'https://identity-server.dev01.devland.is'
+process.env.IDENTITY_SERVER_CLIENT_SCOPES = '["testscope"]'
+process.env.IDENTITY_SERVER_CLIENT_ID = '@test_client_id'
+process.env.BFF_PAR_SUPPORT_ENABLED = 'false'
+
+process.env.BFF_CLIENT_KEY_PATH = '/testclient'
+process.env.BFF_CLIENT_BASE_URL = 'http://test-client.com'
+process.env.BFF_ALLOWED_REDIRECT_URIS = '["http://test-client.com/testclient"]'
+process.env.BFF_ALLOWED_EXTERNAL_API_URLS = '["https://api.external.com"]'
+process.env.BFF_CALLBACKS_BASE_PATH =
+  'http://localhost:3010/testclient/bff/callbacks'
+process.env.BFF_LOGOUT_REDIRECT_URI = 'http://localhost:4200/testclient'
+process.env.BFF_PROXY_API_ENDPOINT = 'http://localhost:4444/api/graphql'
+process.env.BFF_TOKEN_SECRET_BASE64 =
+  'Y0ROrC3mxDBnveN+EpAnLtSubttyjZZWcV43dyk7OQI='
diff --git a/apps/services/bff/test/setupTestServer.ts b/apps/services/bff/test/setupTestServer.ts
new file mode 100644
index 000000000000..db90e4f77a9a
--- /dev/null
+++ b/apps/services/bff/test/setupTestServer.ts
@@ -0,0 +1,8 @@
+import { testServer, TestServerOptions } from '@island.is/testing/nest'
+import { AppModule } from '../src/app/app.module'
+
+export const setupTestServer = async (options?: Partial<TestServerOptions>) =>
+  testServer({
+    appModule: AppModule,
+    ...options,
+  })
diff --git a/apps/services/bff/test/sharedConstants.ts b/apps/services/bff/test/sharedConstants.ts
new file mode 100644
index 000000000000..99ec6d196209
--- /dev/null
+++ b/apps/services/bff/test/sharedConstants.ts
@@ -0,0 +1,53 @@
+import jwt from 'jsonwebtoken'
+import {
+  TokenResponse,
+  GetLoginSearchParamsReturnValue,
+} from '../src/app/modules/ids/ids.types'
+
+export const SESSION_COOKIE_NAME = 'sid'
+export const ALGORITM_TYPE = 'HS256'
+export const SID_VALUE = 'fake_uuid'
+
+const ONE_HOUR_EXPIRATION = Math.floor(Date.now() / 1000) + 3600
+
+export const mockedTokensResponse: TokenResponse = {
+  access_token: jwt.sign(
+    {
+      exp: ONE_HOUR_EXPIRATION,
+    },
+    'mockSecret',
+    { algorithm: ALGORITM_TYPE },
+  ),
+  id_token: jwt.sign(
+    {
+      iss: 'https://example.com',
+      sub: '1234567890',
+      exp: ONE_HOUR_EXPIRATION,
+      sid: SID_VALUE,
+    },
+    'mockSecret',
+    { algorithm: ALGORITM_TYPE },
+  ),
+  refresh_token: 'mockRefreshToken1234567890',
+  scope: 'openid profile email',
+  token_type: 'Bearer',
+  expires_in: 3600,
+}
+
+export const getLoginSearchParmsFn = (args: {
+  sid: string
+  codeChallenge: string
+  loginHint?: string
+  prompt?: string
+}): GetLoginSearchParamsReturnValue => ({
+  client_id: '@test_client_id',
+  redirect_uri: 'http://localhost:3010/testclient/bff/callbacks/login',
+  response_type: 'code',
+  response_mode: 'query',
+  scope: 'test_scope offline_access openid profile',
+  state: SID_VALUE,
+  code_challenge: 'test_code_challenge',
+  code_challenge_method: 'test_code_challenge_method',
+  ...(args.loginHint && { login_hint: args.loginHint }),
+  ...(args.prompt && { prompt: args.prompt }),
+})
diff --git a/apps/services/bff/tsconfig.app.json b/apps/services/bff/tsconfig.app.json
new file mode 100644
index 000000000000..99bb983d6ee9
--- /dev/null
+++ b/apps/services/bff/tsconfig.app.json
@@ -0,0 +1,9 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../../dist/out-tsc",
+    "types": ["node"]
+  },
+  "exclude": ["**/*.spec.ts", "**/*.test.ts", "**/test/**", "jest.config.ts,"],
+  "include": ["**/*.ts"]
+}
diff --git a/apps/services/bff/tsconfig.json b/apps/services/bff/tsconfig.json
new file mode 100644
index 000000000000..25873177db3f
--- /dev/null
+++ b/apps/services/bff/tsconfig.json
@@ -0,0 +1,13 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "files": [],
+  "include": [],
+  "references": [
+    {
+      "path": "./tsconfig.app.json"
+    },
+    {
+      "path": "./tsconfig.spec.json"
+    }
+  ]
+}
diff --git a/apps/services/bff/tsconfig.spec.json b/apps/services/bff/tsconfig.spec.json
new file mode 100644
index 000000000000..2068b86d4f4a
--- /dev/null
+++ b/apps/services/bff/tsconfig.spec.json
@@ -0,0 +1,9 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../../dist/out-tsc",
+    "module": "commonjs",
+    "types": ["jest", "node"]
+  },
+  "include": ["**/*.spec.ts", "**/*.d.ts", "jest.config.ts"]
+}
diff --git a/charts/islandis/values.dev.yaml b/charts/islandis/values.dev.yaml
index 4d991db59816..345a86f5b2a9 100644
--- a/charts/islandis/values.dev.yaml
+++ b/charts/islandis/values.dev.yaml
@@ -418,6 +418,7 @@ api:
     - 'api-catalogue'
     - 'application-system'
     - 'consultation-portal'
+    - 'services-bff-portals-admin'
   grantNamespacesEnabled: true
   healthCheck:
     liveness:
@@ -1801,8 +1802,9 @@ portals-admin:
     SERVERSIDE_FEATURES_ON: ''
     SI_PUBLIC_ENVIRONMENT: 'dev'
     SI_PUBLIC_IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.dev01.devland.is'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -2279,6 +2281,89 @@ service-portal-api:
       eks.amazonaws.com/role-arn: 'arn:aws:iam::013313053092:role/service-portal-api'
     create: true
     name: 'service-portal-api'
+services-bff-portals-admin:
+  enabled: true
+  env:
+    BFF_ALLOWED_EXTERNAL_API_URLS: '["https://api.dev01.devland.is"]'
+    BFF_ALLOWED_REDIRECT_URIS: '["https://beta.dev01.devland.is"]'
+    BFF_CACHE_USER_PROFILE_TTL_MS: '3595000'
+    BFF_CALLBACKS_BASE_PATH: 'https://beta.dev01.devland.is/stjornbord/bff/callbacks'
+    BFF_CLIENT_BASE_URL: 'https://beta.dev01.devland.is'
+    BFF_CLIENT_KEY_PATH: '/stjornbord'
+    BFF_LOGIN_ATTEMPT_TTL_MS: '604800000'
+    BFF_LOGOUT_REDIRECT_URI: 'https://beta.dev01.devland.is'
+    BFF_NAME: 'stjornbord'
+    BFF_PAR_SUPPORT_ENABLED: 'true'
+    BFF_PROXY_API_ENDPOINT: 'http://web-api.islandis.svc.cluster.local/api/graphql'
+    IDENTITY_SERVER_CLIENT_ID: '@admin.island.is/bff-stjornbord'
+    IDENTITY_SERVER_CLIENT_SCOPES: '["@admin.island.is/delegations","@admin.island.is/ads","@admin.island.is/regulations","@admin.island.is/regulations:manage","@admin.island.is/icelandic-names-registry","@admin.island.is/application-system:admin","@admin.island.is/application-system:institution","@admin.island.is/document-provider","@admin.island.is/auth","@admin.island.is/auth:admin","@admin.island.is/petitions","@admin.island.is/service-desk","@admin.island.is/ads:explicit","@admin.island.is/signature-collection:manage","@admin.island.is/signature-collection:process","@admin.island.is/form-system","@admin.island.is/form-system:admin","@admin.island.is/delegation-system","@admin.island.is/delegation-system:admin"]'
+    IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.dev01.devland.is'
+    LOG_LEVEL: 'info'
+    NODE_OPTIONS: '--max-old-space-size=460 -r dd-trace/init'
+    REDIS_URL_NODE_01: '["clustercfg.general-redis-cluster-group.5fzau3.euw1.cache.amazonaws.com:6379"]'
+    SERVERSIDE_FEATURES_ON: ''
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
+  healthCheck:
+    liveness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/liveness'
+      timeoutSeconds: 3
+    readiness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/health/check'
+      timeoutSeconds: 3
+  hpa:
+    scaling:
+      metric:
+        cpuAverageUtilization: 90
+        nginxRequestsIrate: 5
+      replicas:
+        max: 10
+        min: 2
+  image:
+    repository: '821090935708.dkr.ecr.eu-west-1.amazonaws.com/services-bff'
+  ingress:
+    primary-alb:
+      annotations:
+        kubernetes.io/ingress.class: 'nginx-external-alb'
+        nginx.ingress.kubernetes.io/proxy-buffer-size: '8k'
+        nginx.ingress.kubernetes.io/proxy-buffering: 'on'
+        nginx.ingress.kubernetes.io/service-upstream: 'true'
+      hosts:
+        - host: 'beta.dev01.devland.is'
+          paths:
+            - '/stjornbord/bff'
+  namespace: 'portals-admin'
+  podDisruptionBudget:
+    maxUnavailable: 1
+  podSecurityContext:
+    fsGroup: 65534
+  pvcs: []
+  replicaCount:
+    default: 2
+    max: 10
+    min: 2
+  resources:
+    limits:
+      cpu: '400m'
+      memory: '512Mi'
+    requests:
+      cpu: '100m'
+      memory: '256Mi'
+  secrets:
+    BFF_TOKEN_SECRET_BASE64: '/k8s/services-bff/portals-admin/BFF_TOKEN_SECRET_BASE64'
+    CONFIGCAT_SDK_KEY: '/k8s/configcat/CONFIGCAT_SDK_KEY'
+    IDENTITY_SERVER_CLIENT_SECRET: '/k8s/services-bff/portals-admin/IDENTITY_SERVER_CLIENT_SECRET'
+  securityContext:
+    allowPrivilegeEscalation: false
+    privileged: false
+  serviceAccount:
+    annotations:
+      eks.amazonaws.com/role-arn: 'arn:aws:iam::013313053092:role/services-bff'
+    create: true
+    name: 'services-bff'
 services-documents:
   enabled: true
   env:
diff --git a/charts/islandis/values.prod.yaml b/charts/islandis/values.prod.yaml
index 80a445eaacc4..102030c1ca5b 100644
--- a/charts/islandis/values.prod.yaml
+++ b/charts/islandis/values.prod.yaml
@@ -406,6 +406,7 @@ api:
     - 'api-catalogue'
     - 'application-system'
     - 'consultation-portal'
+    - 'services-bff-portals-admin'
   grantNamespacesEnabled: true
   healthCheck:
     liveness:
@@ -1666,8 +1667,9 @@ portals-admin:
     SERVERSIDE_FEATURES_ON: 'driving-license-use-v1-endpoint-for-v2-comms'
     SI_PUBLIC_ENVIRONMENT: 'prod'
     SI_PUBLIC_IDENTITY_SERVER_ISSUER_URL: 'https://innskra.island.is'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -2149,6 +2151,92 @@ service-portal-api:
       eks.amazonaws.com/role-arn: 'arn:aws:iam::251502586493:role/service-portal-api'
     create: true
     name: 'service-portal-api'
+services-bff-portals-admin:
+  enabled: true
+  env:
+    BFF_ALLOWED_EXTERNAL_API_URLS: '["https://api.island.is"]'
+    BFF_ALLOWED_REDIRECT_URIS: 'https://island.is'
+    BFF_CACHE_USER_PROFILE_TTL_MS: '3595000'
+    BFF_CALLBACKS_BASE_PATH: 'https://island.is/stjornbord/bff/callbacks'
+    BFF_CLIENT_BASE_URL: 'https://island.is'
+    BFF_CLIENT_KEY_PATH: '/stjornbord'
+    BFF_LOGIN_ATTEMPT_TTL_MS: '604800000'
+    BFF_LOGOUT_REDIRECT_URI: 'https://island.is'
+    BFF_NAME: 'stjornbord'
+    BFF_PAR_SUPPORT_ENABLED: 'true'
+    BFF_PROXY_API_ENDPOINT: 'http://web-api.islandis.svc.cluster.local/api/graphql'
+    IDENTITY_SERVER_CLIENT_ID: '@admin.island.is/bff-stjornbord'
+    IDENTITY_SERVER_CLIENT_SCOPES: '["@admin.island.is/delegations","@admin.island.is/ads","@admin.island.is/regulations","@admin.island.is/regulations:manage","@admin.island.is/icelandic-names-registry","@admin.island.is/application-system:admin","@admin.island.is/application-system:institution","@admin.island.is/document-provider","@admin.island.is/auth","@admin.island.is/auth:admin","@admin.island.is/petitions","@admin.island.is/service-desk","@admin.island.is/ads:explicit","@admin.island.is/signature-collection:manage","@admin.island.is/signature-collection:process","@admin.island.is/form-system","@admin.island.is/form-system:admin","@admin.island.is/delegation-system","@admin.island.is/delegation-system:admin"]'
+    IDENTITY_SERVER_ISSUER_URL: 'https://innskra.island.is'
+    LOG_LEVEL: 'info'
+    NODE_OPTIONS: '--max-old-space-size=460 -r dd-trace/init'
+    REDIS_URL_NODE_01: '["clustercfg.general-redis-cluster-group.whakos.euw1.cache.amazonaws.com:6379"]'
+    SERVERSIDE_FEATURES_ON: 'driving-license-use-v1-endpoint-for-v2-comms'
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
+  healthCheck:
+    liveness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/liveness'
+      timeoutSeconds: 3
+    readiness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/health/check'
+      timeoutSeconds: 3
+  hpa:
+    scaling:
+      metric:
+        cpuAverageUtilization: 90
+        nginxRequestsIrate: 5
+      replicas:
+        max: 10
+        min: 2
+  image:
+    repository: '821090935708.dkr.ecr.eu-west-1.amazonaws.com/services-bff'
+  ingress:
+    primary-alb:
+      annotations:
+        kubernetes.io/ingress.class: 'nginx-external-alb'
+        nginx.ingress.kubernetes.io/proxy-buffer-size: '8k'
+        nginx.ingress.kubernetes.io/proxy-buffering: 'on'
+        nginx.ingress.kubernetes.io/service-upstream: 'true'
+      hosts:
+        - host: 'island.is'
+          paths:
+            - '/stjornbord/bff'
+        - host: 'www.island.is'
+          paths:
+            - '/stjornbord/bff'
+  namespace: 'portals-admin'
+  podDisruptionBudget:
+    maxUnavailable: 1
+  podSecurityContext:
+    fsGroup: 65534
+  pvcs: []
+  replicaCount:
+    default: 2
+    max: 10
+    min: 2
+  resources:
+    limits:
+      cpu: '400m'
+      memory: '512Mi'
+    requests:
+      cpu: '100m'
+      memory: '256Mi'
+  secrets:
+    BFF_TOKEN_SECRET_BASE64: '/k8s/services-bff/portals-admin/BFF_TOKEN_SECRET_BASE64'
+    CONFIGCAT_SDK_KEY: '/k8s/configcat/CONFIGCAT_SDK_KEY'
+    IDENTITY_SERVER_CLIENT_SECRET: '/k8s/services-bff/portals-admin/IDENTITY_SERVER_CLIENT_SECRET'
+  securityContext:
+    allowPrivilegeEscalation: false
+    privileged: false
+  serviceAccount:
+    annotations:
+      eks.amazonaws.com/role-arn: 'arn:aws:iam::251502586493:role/services-bff'
+    create: true
+    name: 'services-bff'
 services-documents:
   enabled: true
   env:
diff --git a/charts/islandis/values.staging.yaml b/charts/islandis/values.staging.yaml
index 421a729b6969..a63f051a0618 100644
--- a/charts/islandis/values.staging.yaml
+++ b/charts/islandis/values.staging.yaml
@@ -418,6 +418,7 @@ api:
     - 'api-catalogue'
     - 'application-system'
     - 'consultation-portal'
+    - 'services-bff-portals-admin'
   grantNamespacesEnabled: true
   healthCheck:
     liveness:
@@ -1539,8 +1540,9 @@ portals-admin:
     SERVERSIDE_FEATURES_ON: ''
     SI_PUBLIC_ENVIRONMENT: 'staging'
     SI_PUBLIC_IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.staging01.devland.is'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -2017,6 +2019,90 @@ service-portal-api:
       eks.amazonaws.com/role-arn: 'arn:aws:iam::261174024191:role/service-portal-api'
     create: true
     name: 'service-portal-api'
+services-bff-portals-admin:
+  enabled: true
+  env:
+    BFF_ALLOWED_EXTERNAL_API_URLS: '["https://api.staging01.devland.is"]'
+    BFF_ALLOWED_REDIRECT_URIS: '["https://beta.staging01.devland.is"]'
+    BFF_CACHE_USER_PROFILE_TTL_MS: '3595000'
+    BFF_CALLBACKS_BASE_PATH: 'https://beta.staging01.devland.is/stjornbord/bff/callbacks'
+    BFF_CLIENT_BASE_URL: 'https://beta.staging01.devland.is'
+    BFF_CLIENT_KEY_PATH: '/stjornbord'
+    BFF_LOGIN_ATTEMPT_TTL_MS: '604800000'
+    BFF_LOGOUT_REDIRECT_URI: 'https://beta.staging01.devland.is'
+    BFF_NAME: 'stjornbord'
+    BFF_PAR_SUPPORT_ENABLED: 'true'
+    BFF_PROXY_API_ENDPOINT: 'http://web-api.islandis.svc.cluster.local/api/graphql'
+    IDENTITY_SERVER_CLIENT_ID: '@admin.island.is/bff-stjornbord'
+    IDENTITY_SERVER_CLIENT_SCOPES: '["@admin.island.is/delegations","@admin.island.is/ads","@admin.island.is/regulations","@admin.island.is/regulations:manage","@admin.island.is/icelandic-names-registry","@admin.island.is/application-system:admin","@admin.island.is/application-system:institution","@admin.island.is/document-provider","@admin.island.is/auth","@admin.island.is/auth:admin","@admin.island.is/petitions","@admin.island.is/service-desk","@admin.island.is/ads:explicit","@admin.island.is/signature-collection:manage","@admin.island.is/signature-collection:process","@admin.island.is/form-system","@admin.island.is/form-system:admin","@admin.island.is/delegation-system","@admin.island.is/delegation-system:admin"]'
+    IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.staging01.devland.is'
+    LOG_LEVEL: 'info'
+    NODE_OPTIONS: '--max-old-space-size=460 -r dd-trace/init'
+    REDIS_URL_NODE_01: '["clustercfg.general-redis-cluster-group.ab9ckb.euw1.cache.amazonaws.com:6379"]'
+    SERVERSIDE_FEATURES_ON: ''
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
+  healthCheck:
+    liveness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/liveness'
+      timeoutSeconds: 3
+    readiness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/health/check'
+      timeoutSeconds: 3
+  hpa:
+    scaling:
+      metric:
+        cpuAverageUtilization: 90
+        nginxRequestsIrate: 5
+      replicas:
+        max: 10
+        min: 2
+  image:
+    repository: '821090935708.dkr.ecr.eu-west-1.amazonaws.com/services-bff'
+  ingress:
+    primary-alb:
+      annotations:
+        kubernetes.io/ingress.class: 'nginx-external-alb'
+        nginx.ingress.kubernetes.io/enable-global-auth: 'false'
+        nginx.ingress.kubernetes.io/proxy-buffer-size: '8k'
+        nginx.ingress.kubernetes.io/proxy-buffering: 'on'
+        nginx.ingress.kubernetes.io/service-upstream: 'true'
+      hosts:
+        - host: 'beta.staging01.devland.is'
+          paths:
+            - '/stjornbord/bff'
+  namespace: 'portals-admin'
+  podDisruptionBudget:
+    maxUnavailable: 1
+  podSecurityContext:
+    fsGroup: 65534
+  pvcs: []
+  replicaCount:
+    default: 2
+    max: 10
+    min: 2
+  resources:
+    limits:
+      cpu: '400m'
+      memory: '512Mi'
+    requests:
+      cpu: '100m'
+      memory: '256Mi'
+  secrets:
+    BFF_TOKEN_SECRET_BASE64: '/k8s/services-bff/portals-admin/BFF_TOKEN_SECRET_BASE64'
+    CONFIGCAT_SDK_KEY: '/k8s/configcat/CONFIGCAT_SDK_KEY'
+    IDENTITY_SERVER_CLIENT_SECRET: '/k8s/services-bff/portals-admin/IDENTITY_SERVER_CLIENT_SECRET'
+  securityContext:
+    allowPrivilegeEscalation: false
+    privileged: false
+  serviceAccount:
+    annotations:
+      eks.amazonaws.com/role-arn: 'arn:aws:iam::261174024191:role/services-bff'
+    create: true
+    name: 'services-bff'
 services-documents:
   enabled: true
   env:
diff --git a/infra/helm/Chart.yaml b/infra/helm/Chart.yaml
index 047a1ad4d13d..94d71d036217 100644
--- a/infra/helm/Chart.yaml
+++ b/infra/helm/Chart.yaml
@@ -158,5 +158,9 @@ dependencies:
     repository: file://libs/api-template
     version: 0.0.1
     alias: services-university-gateway-worker
+  - name: api-template
+    repository: file://libs/api-template
+    version: 0.0.1
+    alias: services-bff
 type: application
 version: 0.0.9
diff --git a/infra/package.json b/infra/package.json
index db86f28487b8..bf6322a2da85 100644
--- a/infra/package.json
+++ b/infra/package.json
@@ -30,6 +30,8 @@
     "aws-sdk": "^2.1003.0",
     "glob": "10.3.3",
     "js-yaml": "4.0.0",
+    "json-refs": "3.0.15",
+    "json-schema-to-zod": "2.4.1",
     "lodash": "4.17.21",
     "yargs": "17.7.2"
   },
diff --git a/infra/src/cli/cli.ts b/infra/src/cli/cli.ts
index 3abc1c808dc9..b806dcecdd97 100644
--- a/infra/src/cli/cli.ts
+++ b/infra/src/cli/cli.ts
@@ -83,15 +83,13 @@ const cli = yargs(process.argv.slice(2))
       )
     },
     async (argv) => {
-      const services = await renderLocalServices({
+      await renderLocalServices({
         services: argv.services,
         dryRun: argv.dry,
         json: argv.json,
         print: true,
         noUpdateSecrets: argv['no-update-secrets'],
       })
-
-      return
     },
   )
   .command(
@@ -131,7 +129,7 @@ const cli = yargs(process.argv.slice(2))
           })
       )
     },
-    async (argv) =>
+    async (argv) => {
       await runLocalServices(argv.services, argv.dependencies, {
         dryRun: argv.dry,
         json: argv.json,
@@ -139,7 +137,8 @@ const cli = yargs(process.argv.slice(2))
         noUpdateSecrets: argv['no-update-secrets'],
         print: argv.print,
         startProxies: argv.proxies,
-      }),
+      })
+    },
   )
   .demandCommand(1)
   .parse()
diff --git a/infra/src/cli/render-local-mocks.ts b/infra/src/cli/render-local-mocks.ts
index 97a14e4cdf01..9c328c497217 100644
--- a/infra/src/cli/render-local-mocks.ts
+++ b/infra/src/cli/render-local-mocks.ts
@@ -87,7 +87,7 @@ export async function runLocalServices(
     noUpdateSecrets,
   })
 
-  // Verify tat all dependencies exist in the rendered dependency list
+  // Verify that all dependencies exist in the rendered dependency list
   for (const dependency of dependencies) {
     if (!renderedLocalServices.services[dependency]) {
       throw new Error(`Dependency ${dependency} not found`)
diff --git a/infra/src/dsl/adapters/get-ssm-params.ts b/infra/src/dsl/adapters/get-ssm-params.ts
index da57630634e5..d44e255ff07c 100644
--- a/infra/src/dsl/adapters/get-ssm-params.ts
+++ b/infra/src/dsl/adapters/get-ssm-params.ts
@@ -20,7 +20,7 @@ export async function getSsmParams(
     chunks.map((Names) =>
       client.getParameters({ Names, WithDecryption: true }),
     ),
-  )
+  ).catch(handleCredentialsProviderError)
   const params = allParams
     .map(({ Parameters }) =>
       Object.fromEntries(Parameters!.map((p) => [p.Name, p.Value])),
@@ -35,3 +35,13 @@ export async function getSsmParams(
   })
   return params
 }
+
+function handleCredentialsProviderError(err: Error): never {
+  if (err.name === 'CredentialsProviderError') {
+    console.error(
+      'Could not load AWS credentials from any providers. Did you forget to configure environment variables, aws profile or run `aws sso login`?',
+    )
+    process.exit(1)
+  }
+  throw err
+}
diff --git a/infra/src/dsl/bff.ts b/infra/src/dsl/bff.ts
new file mode 100644
index 000000000000..95b05e5f3b03
--- /dev/null
+++ b/infra/src/dsl/bff.ts
@@ -0,0 +1,83 @@
+import { json, ref } from './dsl'
+import { BffInfo, Context, PortalKeys } from './types/input-types'
+
+import {
+  adminPortalScopes,
+  servicePortalScopes,
+} from '../../../libs/auth/scopes/src/index'
+
+export const getScopes = (key: PortalKeys) => {
+  switch (key) {
+    case 'minarsidur':
+      return servicePortalScopes
+    case 'stjornbord':
+      return adminPortalScopes
+    default:
+      throw new Error('Invalid BFF client')
+  }
+}
+
+export const bffConfig = ({ key, services, clientName, clientId }: BffInfo) => {
+  const getBaseUrl = (ctx: Context) =>
+    ctx.featureDeploymentName
+      ? `${ctx.featureDeploymentName}-beta.${ctx.env.domain}`
+      : ctx.env.type === 'prod'
+      ? ctx.env.domain
+      : `beta.${ctx.env.domain}`
+
+  return {
+    env: {
+      IDENTITY_SERVER_CLIENT_SCOPES: json(getScopes(key)),
+      IDENTITY_SERVER_CLIENT_ID: clientId,
+      IDENTITY_SERVER_ISSUER_URL: {
+        dev: 'https://identity-server.dev01.devland.is',
+        staging: 'https://identity-server.staging01.devland.is',
+        prod: 'https://innskra.island.is',
+      },
+      BFF_NAME: {
+        local: key,
+        dev: key,
+        staging: key,
+        prod: key,
+      },
+      BFF_CLIENT_KEY_PATH: `/${key}`,
+      BFF_PAR_SUPPORT_ENABLED: 'true',
+      BFF_CLIENT_BASE_URL: {
+        local: 'http://localhost:4200',
+        dev: ref((ctx) => ctx.svc(`https://${getBaseUrl(ctx)}`)),
+        staging: ref((ctx) => ctx.svc(`https://${getBaseUrl(ctx)}`)),
+        prod: 'https://island.is',
+      },
+      BFF_ALLOWED_REDIRECT_URIS: {
+        local: json([`http://localhost:4200/${key}`]),
+        dev: ref((ctx) => json([`https://${getBaseUrl(ctx)}`])),
+        staging: ref((ctx) => json([`https://${getBaseUrl(ctx)}`])),
+        prod: 'https://island.is',
+      },
+      BFF_LOGOUT_REDIRECT_URI: {
+        local: `http://localhost:4200/${key}`,
+        dev: ref((ctx) => `https://${getBaseUrl(ctx)}`),
+        staging: ref((ctx) => `https://${getBaseUrl(ctx)}`),
+        prod: 'https://island.is',
+      },
+      BFF_CALLBACKS_BASE_PATH: {
+        local: `http://localhost:3010/${key}/bff/callbacks`,
+        dev: ref((c) => `https://${getBaseUrl(c)}/${key}/bff/callbacks`),
+        staging: ref((c) => `https://${getBaseUrl(c)}/${key}/bff/callbacks`),
+        prod: ref((c) => `https://${getBaseUrl(c)}/${key}/bff/callbacks`),
+      },
+      BFF_PROXY_API_ENDPOINT: {
+        local: 'http://localhost:4444/api/graphql',
+        dev: ref((ctx) => `http://${ctx.svc(services.api)}/api/graphql`),
+        staging: ref((ctx) => `http://${ctx.svc(services.api)}/api/graphql`),
+        prod: ref((ctx) => `http://${ctx.svc(services.api)}/api/graphql`),
+      },
+      BFF_CACHE_USER_PROFILE_TTL_MS: (60 * 60 * 1000 - 5000).toString(),
+      BFF_LOGIN_ATTEMPT_TTL_MS: (60 * 60 * 1000 * 24 * 7).toString(),
+    },
+    secrets: {
+      BFF_TOKEN_SECRET_BASE64: `/k8s/services-bff/${clientName}/BFF_TOKEN_SECRET_BASE64`,
+      IDENTITY_SERVER_CLIENT_SECRET: `/k8s/services-bff/${clientName}/IDENTITY_SERVER_CLIENT_SECRET`,
+    },
+  }
+}
diff --git a/infra/src/dsl/dsl.ts b/infra/src/dsl/dsl.ts
index b56a0c9125df..0427e7f0e29d 100644
--- a/infra/src/dsl/dsl.ts
+++ b/infra/src/dsl/dsl.ts
@@ -5,7 +5,6 @@ import {
   ExtraValues,
   Features,
   HealthProbe,
-  Ingress,
   InitContainers,
   MountedFile,
   PersistentVolumeClaim,
@@ -18,7 +17,9 @@ import {
   XroadConfig,
   PodDisruptionBudget,
   IngressMapping,
+  BffInfo,
 } from './types/input-types'
+import { bffConfig } from './bff'
 import { logger } from '../logging'
 import { COMMON_SECRETS } from './consts'
 
@@ -184,6 +185,15 @@ export class ServiceBuilder<ServiceType extends string> {
     return this
   }
 
+  bff(config: BffInfo) {
+    this.serviceDef.env = { ...bffConfig(config).env, ...this.serviceDef.env }
+    this.serviceDef.secrets = {
+      ...bffConfig(config).secrets,
+      ...this.serviceDef.secrets,
+    }
+    return this
+  }
+
   /**
    * X-Road configuration blocks to inject to the container. Types of XroadConfig can contain environment variables and/or secrets that define how to contact an external service through X-Road.
    * @param ...configs - X-road configs
@@ -337,7 +347,7 @@ export class ServiceBuilder<ServiceType extends string> {
   /**
    * Initializes a container with optional parameters and checks for unique container names.
    * If the 'withDB' flag is set or if the 'postgres' property is present in the input object,
-   * it grants database access to the container.
+   * it grants database access toethe container.
    * Maps to a Pod specification for an [initContainer](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/).
    *
    * @param ic - The initial container configuration.
diff --git a/infra/src/dsl/feature-values.spec.ts b/infra/src/dsl/feature-values.spec.ts
index 9ee13cb2f03d..d9b72b3d3f03 100644
--- a/infra/src/dsl/feature-values.spec.ts
+++ b/infra/src/dsl/feature-values.spec.ts
@@ -1,17 +1,18 @@
-import { ServiceBuilder, ref, service } from './dsl'
+import { getScopes } from './bff'
+import { ServiceBuilder, json, ref, service } from './dsl'
+import { getFeatureAffectedServices } from './feature-deployments'
 import { Kubernetes } from './kubernetes-runtime'
+import { generateOutput } from './processing/rendering-pipeline'
 import { EnvironmentConfig } from './types/charts'
-import { getFeatureAffectedServices } from './feature-deployments'
 import { HelmValueFile } from './types/output-types'
-import { getHelmValueFile } from './value-files-generators/helm-value-file'
 import { renderers } from './upstream-dependencies'
-import { generateOutput } from './processing/rendering-pipeline'
+import { getHelmValueFile } from './value-files-generators/helm-value-file'
 
 const getEnvironment = (
   options: EnvironmentConfig = {
     auroraHost: 'a',
     redisHost: 'b',
-    domain: 'staging01.devland.is',
+    domain: 'dev01.devland.is',
     type: 'dev',
     featuresOn: [],
     defaultMaxReplicas: 3,
@@ -49,8 +50,7 @@ describe('Feature-deployment support', () => {
     const dependencyA = service('service-a').namespace('A')
     const dependencyB = service('service-b')
     const dependencyC = service('service-c')
-
-    const apiService = service('graphql')
+    const apiService = service('api')
       .env({
         A: ref((h) => `${h.svc(dependencyA)}`),
         B: ref(
@@ -76,10 +76,26 @@ describe('Feature-deployment support', () => {
       })
       .db()
 
+    const bff = service('services-bff-portals-admin')
+      .bff({
+        key: 'stjornbord',
+        clientId: '@admin.island.is/bff-stjornbord',
+        clientName: 'portals-admin',
+        services: { api: apiService },
+      })
+      .env({
+        BFF_ALLOWED_EXTERNAL_API_URLS: {
+          local: json(['http://localhost:3377/download/v1']),
+          dev: json(['https://api.dev01.devland.is']),
+          staging: json(['https://api.staging01.devland.is']),
+          prod: json(['https://api.island.is']),
+        },
+      })
+      .redis()
     dev = getEnvironment()
     const services1 = await getFeatureAffectedServices(
-      [apiService, dependencyA, dependencyB],
-      [dependencyA, dependencyC],
+      [apiService, dependencyA, dependencyB, bff],
+      [dependencyA, dependencyC, bff],
       [dependencyC],
       dev,
     )
@@ -87,11 +103,11 @@ describe('Feature-deployment support', () => {
   })
 
   it('dynamic service name generation', () => {
-    expect(values.services.graphql.env).toEqual({
+    expect(values.services.api.env).toEqual({
       A: 'web-service-a',
       B: 'feature-web-service-b.islandis.svc.cluster.local',
-      DB_USER: 'feature_feature_A_graphql',
-      DB_NAME: 'feature_feature_A_graphql',
+      DB_USER: 'feature_feature_A_api',
+      DB_NAME: 'feature_feature_A_api',
       DB_HOST: 'a',
       DB_REPLICAS_HOST: 'a',
       NODE_OPTIONS: '--max-old-space-size=230 -r dd-trace/init',
@@ -100,8 +116,32 @@ describe('Feature-deployment support', () => {
       DB_EXTENSIONS: 'foo',
     })
   })
+  it('bff feature env urls', () => {
+    expect(values.services['services-bff-portals-admin'].env).toEqual({
+      IDENTITY_SERVER_CLIENT_SCOPES: json(getScopes('stjornbord')),
+      IDENTITY_SERVER_CLIENT_ID: `@admin.island.is/bff-stjornbord`,
+      IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.dev01.devland.is',
+      BFF_NAME: 'stjornbord',
+      BFF_CLIENT_KEY_PATH: `/stjornbord`,
+      BFF_PAR_SUPPORT_ENABLED: 'true',
+      BFF_ALLOWED_REDIRECT_URIS: json([
+        'https://feature-A-beta.dev01.devland.is',
+      ]),
+      BFF_CLIENT_BASE_URL: 'https://feature-A-beta.dev01.devland.is',
+      BFF_LOGOUT_REDIRECT_URI: 'https://feature-A-beta.dev01.devland.is',
+      BFF_CALLBACKS_BASE_PATH: `https://feature-A-beta.dev01.devland.is/stjornbord/bff/callbacks`,
+      BFF_PROXY_API_ENDPOINT: 'http://web-api/api/graphql',
+      BFF_ALLOWED_EXTERNAL_API_URLS: json(['https://api.dev01.devland.is']),
+      BFF_CACHE_USER_PROFILE_TTL_MS: '3595000',
+      BFF_LOGIN_ATTEMPT_TTL_MS: '604800000',
+      NODE_OPTIONS: '--max-old-space-size=230 -r dd-trace/init',
+      SERVERSIDE_FEATURES_ON: '',
+      LOG_LEVEL: 'info',
+      REDIS_URL_NODE_01: 'b',
+    })
+  })
   it('db extensions are set', () => {
-    expect(values.services.graphql.initContainer?.env).toEqual(
+    expect(values.services.api.initContainer?.env).toEqual(
       expect.objectContaining({
         DB_EXTENSIONS: 'foo',
       }),
@@ -109,27 +149,27 @@ describe('Feature-deployment support', () => {
   })
 
   it('dynamic secrets path', () => {
-    expect(values.services.graphql.secrets).toHaveProperty('DB_PASS')
-    expect(values.services.graphql.secrets!.DB_PASS).toEqual(
-      '/k8s/feature-feature-A-graphql/DB_PASSWORD',
+    expect(values.services.api.secrets).toHaveProperty('DB_PASS')
+    expect(values.services.api.secrets!.DB_PASS).toEqual(
+      '/k8s/feature-feature-A-api/DB_PASSWORD',
     )
   })
 
   it('dynamic secrets path', () => {
-    expect(values.services.graphql.initContainer?.secrets).toHaveProperty(
-      'DB_PASS',
-    )
-    expect(values.services.graphql.initContainer?.secrets!.DB_PASS).toEqual(
-      '/k8s/feature-feature-A-graphql/DB_PASSWORD',
+    expect(values.services.api.initContainer?.secrets).toHaveProperty('DB_PASS')
+    expect(values.services.api.initContainer?.secrets!.DB_PASS).toEqual(
+      '/k8s/feature-feature-A-api/DB_PASSWORD',
     )
   })
 
   it('feature deployment namespaces', () => {
     expect(Object.keys(values.services).sort()).toEqual([
-      'graphql',
+      'api',
       'service-a',
+      'services-bff-portals-admin',
     ])
-    expect(values.services['graphql'].namespace).toEqual(
+    expect(values.services['api'].namespace).toEqual(`feature-${dev.feature}`)
+    expect(values.services['services-bff-portals-admin'].namespace).toEqual(
       `feature-${dev.feature}`,
     )
     expect(values.services['service-a'].namespace).toEqual(
@@ -138,7 +178,7 @@ describe('Feature-deployment support', () => {
   })
 
   it('feature deployment ingress', () => {
-    expect(values.services.graphql.ingress).toEqual({
+    expect(values.services.api.ingress).toEqual({
       'primary-alb': {
         annotations: {
           'kubernetes.io/ingress.class': 'nginx-external-alb',
@@ -146,7 +186,7 @@ describe('Feature-deployment support', () => {
         },
         hosts: [
           {
-            host: 'feature-A-a.staging01.devland.is',
+            host: 'feature-A-a.dev01.devland.is',
             paths: ['/'],
           },
         ],
diff --git a/infra/src/dsl/portal-env.spec.ts b/infra/src/dsl/portal-env.spec.ts
new file mode 100644
index 000000000000..fe20cab1fd80
--- /dev/null
+++ b/infra/src/dsl/portal-env.spec.ts
@@ -0,0 +1,238 @@
+import { json, service } from './dsl'
+import { Kubernetes } from './kubernetes-runtime'
+import { generateOutputOne } from './processing/rendering-pipeline'
+import { EnvironmentConfig } from './types/charts'
+import { HelmService, SerializeSuccess } from './types/output-types'
+import { renderers } from './upstream-dependencies'
+
+import { adminPortalScopes } from '../../../libs/auth/scopes/src/index'
+
+import { FIVE_SECONDS_IN_MS } from '../../../apps/services/bff/src/app/constants/time'
+const ONE_HOUR_IN_MS = 60 * 60 * 1000
+const ONE_WEEK_IN_MS = ONE_HOUR_IN_MS * 24 * 7
+
+const bffName = 'services-bff'
+const clientName = 'portals-admin'
+const serviceName = `${bffName}-${clientName}`
+const key = 'stjornbord'
+
+const Dev: EnvironmentConfig = {
+  auroraHost: 'a',
+  redisHost: 'b',
+  domain: 'dev01.devland.is',
+  type: 'dev',
+  featuresOn: [],
+  defaultMaxReplicas: 3,
+  defaultMinReplicas: 2,
+  releaseName: 'web',
+  awsAccountId: '111111',
+  awsAccountRegion: 'eu-west-1',
+  global: {},
+}
+
+const services = {
+  api: service('api'),
+}
+
+describe('BFF PortalEnv serialization', () => {
+  const services = { api: service('api') }
+  const sut = service(serviceName)
+    .namespace(clientName)
+    .image(bffName)
+    .redis()
+    .serviceAccount(bffName)
+    .env({
+      BFF_ALLOWED_EXTERNAL_API_URLS: {
+        local: json(['http://localhost:3377/download/v1']),
+        dev: json(['https://api.dev01.devland.is']),
+        staging: json(['https://api.staging01.devland.is']),
+        prod: json(['https://api.island.is']),
+      },
+    })
+    .bff({
+      key: 'stjornbord',
+      clientId: `@admin.island.is/bff-stjornbord`,
+      clientName,
+      services,
+    })
+    .command('node')
+    .args('main.js')
+    .readiness(`/${key}/bff/health/check`)
+    .liveness(`/${key}/bff/liveness`)
+    .replicaCount({
+      default: 2,
+      min: 2,
+      max: 3,
+    })
+    .resources({
+      limits: {
+        cpu: '400m',
+        memory: '512Mi',
+      },
+      requests: {
+        cpu: '100m',
+        memory: '256Mi',
+      },
+    })
+    .ingress({
+      primary: {
+        host: {
+          dev: ['beta'],
+          staging: ['beta'],
+          prod: ['', 'www.island.is'],
+        },
+        extraAnnotations: {
+          dev: {
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+          staging: {
+            'nginx.ingress.kubernetes.io/enable-global-auth': 'false',
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+          prod: {
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+        },
+        paths: [`/${key}/bff`],
+      },
+    })
+  let result: SerializeSuccess<HelmService>
+  beforeEach(async () => {
+    result = (await generateOutputOne({
+      outputFormat: renderers.helm,
+      service: sut,
+      runtime: new Kubernetes(Dev),
+      env: Dev,
+    })) as SerializeSuccess<HelmService>
+  })
+
+  it('basic props', () => {
+    expect(result.serviceDef[0].enabled).toBe(true)
+    expect(result.serviceDef[0].namespace).toBe(clientName)
+  })
+
+  it('image and repo', () => {
+    expect(result.serviceDef[0].image.repository).toBe(
+      `821090935708.dkr.ecr.eu-west-1.amazonaws.com/${bffName}`,
+    )
+  })
+
+  it('command and args', () => {
+    expect(result.serviceDef[0].command).toStrictEqual(['node'])
+    expect(result.serviceDef[0].args).toStrictEqual(['main.js'])
+  })
+  it('network policies', () => {
+    expect(result.serviceDef[0].grantNamespaces).toStrictEqual([])
+    expect(result.serviceDef[0].grantNamespacesEnabled).toBe(false)
+  })
+
+  it('resources', () => {
+    expect(result.serviceDef[0].resources).toStrictEqual({
+      limits: {
+        cpu: '400m',
+        memory: '512Mi',
+      },
+      requests: {
+        cpu: '100m',
+        memory: '256Mi',
+      },
+    })
+  })
+  it('replica count', () => {
+    expect(result.serviceDef[0].replicaCount).toStrictEqual({
+      min: 2,
+      max: 3,
+      default: 2,
+    })
+  })
+
+  it('environment variables', () => {
+    expect(result.serviceDef[0].env).toEqual({
+      IDENTITY_SERVER_CLIENT_SCOPES: json(adminPortalScopes),
+      IDENTITY_SERVER_CLIENT_ID: `@admin.island.is/bff-${key}`,
+      IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.dev01.devland.is',
+      // BFF
+      BFF_NAME: 'stjornbord',
+      BFF_CLIENT_KEY_PATH: `/${key}`,
+      BFF_PAR_SUPPORT_ENABLED: 'true',
+      BFF_ALLOWED_REDIRECT_URIS: json(['https://beta.dev01.devland.is']),
+      BFF_CLIENT_BASE_URL: 'https://beta.dev01.devland.is',
+      BFF_LOGOUT_REDIRECT_URI: 'https://beta.dev01.devland.is',
+      BFF_CALLBACKS_BASE_PATH: `https://beta.dev01.devland.is/${key}/bff/callbacks`,
+      BFF_PROXY_API_ENDPOINT:
+        'http://web-api.islandis.svc.cluster.local/api/graphql',
+      BFF_ALLOWED_EXTERNAL_API_URLS: json(['https://api.dev01.devland.is']),
+      BFF_CACHE_USER_PROFILE_TTL_MS: (
+        ONE_HOUR_IN_MS - FIVE_SECONDS_IN_MS
+      ).toString(),
+      BFF_LOGIN_ATTEMPT_TTL_MS: ONE_WEEK_IN_MS.toString(),
+      NODE_OPTIONS: '--max-old-space-size=460 -r dd-trace/init',
+      SERVERSIDE_FEATURES_ON: '',
+      LOG_LEVEL: 'info',
+      REDIS_URL_NODE_01: 'b',
+    })
+  })
+
+  it('secrets', () => {
+    expect(result.serviceDef[0].secrets).toEqual({
+      BFF_TOKEN_SECRET_BASE64: `/k8s/${bffName}/${clientName}/BFF_TOKEN_SECRET_BASE64`,
+      IDENTITY_SERVER_CLIENT_SECRET: `/k8s/${bffName}/${clientName}/IDENTITY_SERVER_CLIENT_SECRET`,
+      CONFIGCAT_SDK_KEY: '/k8s/configcat/CONFIGCAT_SDK_KEY',
+    })
+  })
+
+  it('service account', () => {
+    expect(result.serviceDef[0].podSecurityContext).toEqual({
+      fsGroup: 65534,
+    })
+    expect(result.serviceDef[0].serviceAccount).toEqual({
+      annotations: {
+        'eks.amazonaws.com/role-arn': `arn:aws:iam::111111:role/${bffName}`,
+      },
+      create: true,
+      name: bffName,
+    })
+  })
+
+  it('ingress', () => {
+    expect(result.serviceDef[0].ingress).toEqual({
+      'primary-alb': {
+        annotations: {
+          'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+          'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          'kubernetes.io/ingress.class': 'nginx-external-alb',
+          'nginx.ingress.kubernetes.io/service-upstream': 'true',
+        },
+        hosts: [
+          {
+            host: 'beta.dev01.devland.is',
+            paths: ['/stjornbord/bff'],
+          },
+        ],
+      },
+    })
+  })
+})
+
+describe('Env definition defaults', () => {
+  const sut = service('api').namespace('islandis').image(bffName)
+  let result: SerializeSuccess<HelmService>
+  beforeEach(async () => {
+    result = (await generateOutputOne({
+      outputFormat: renderers.helm,
+      service: sut,
+      runtime: new Kubernetes(Dev),
+      env: Dev,
+    })) as SerializeSuccess<HelmService>
+  })
+  it('replica max count', () => {
+    expect(result.serviceDef[0].replicaCount).toStrictEqual({
+      min: 2,
+      max: 3,
+      default: 2,
+    })
+  })
+})
diff --git a/infra/src/dsl/service-to-environment/pre-process-service.ts b/infra/src/dsl/service-to-environment/pre-process-service.ts
index 6533fa196c6b..cf90cbb5cde9 100644
--- a/infra/src/dsl/service-to-environment/pre-process-service.ts
+++ b/infra/src/dsl/service-to-environment/pre-process-service.ts
@@ -335,7 +335,6 @@ function addFeaturesConfig(
       secrets: v.secrets,
     }
   })
-
   return {
     envs: featureEnvs.reduce(
       (acc, feature) => ({ ...acc, ...feature.envs }),
diff --git a/infra/src/dsl/types/input-types.ts b/infra/src/dsl/types/input-types.ts
index 43232dd01562..04b75ad4f20e 100644
--- a/infra/src/dsl/types/input-types.ts
+++ b/infra/src/dsl/types/input-types.ts
@@ -16,6 +16,16 @@ export type ValueSource = string | ((e: Context) => string)
 export type ValueType = MissingSettingType | ValueSource
 // See https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes for more info
 export type AccessModes = 'ReadWrite' | 'ReadOnly'
+
+export type BffInfo = {
+  key: PortalKeys
+  clientId: string
+  clientName: string
+  services: BffInfraServices
+  env?: EnvironmentVariables
+  secrets?: Secrets
+}
+
 export type PostgresInfo = {
   host?: {
     [env in OpsEnv]: string
@@ -79,6 +89,11 @@ export type Feature = {
 
 export type Features = { [name in FeatureNames]: Feature }
 export type MountedFile = { filename: string; env: string }
+export type PortalKeys = 'stjornbord' | 'minarsidur'
+
+export interface BffInfraServices {
+  api: ServiceBuilder<string> | string
+}
 
 export type ServiceDefinitionCore = {
   liveness: HealthProbe
diff --git a/infra/src/dsl/value-files-generators/local-setup.ts b/infra/src/dsl/value-files-generators/local-setup.ts
index 2770615a561e..4073157cebe8 100644
--- a/infra/src/dsl/value-files-generators/local-setup.ts
+++ b/infra/src/dsl/value-files-generators/local-setup.ts
@@ -16,6 +16,14 @@ const mapServiceToNXname = async (serviceName: string) => {
   const projects = globSync(['apps/*/project.json', 'apps/*/*/project.json'], {
     cwd: projectRootPath,
   })
+
+  // This is a hack to make sure we are running `services-bff` project with the desired infra config.
+  // We have multiple infra files under the `services-bff` project, e.g. `services-bff-admin-portal`, `services-bff-my-pages-portal`, etc.
+  // For the project to run correctly, we need to run the `services-bff` project.
+  if (serviceName.startsWith('services-bff-')) {
+    serviceName = 'services-bff'
+  }
+
   const nxName = (
     await Promise.all(
       projects.map(async (path) => {
@@ -69,6 +77,7 @@ export const getLocalrunValueFile = async (
       ? { PORT: runtime.ports[name].toString() }
       : {}
     const serviceNXName = await mapServiceToNXname(name)
+
     logger.debug('Process service', { name, service, serviceNXName })
     dockerComposeServices[name] = {
       env: Object.assign(
diff --git a/infra/src/feature-env.ts b/infra/src/feature-env.ts
index 790d98d4a190..678f02fdf490 100644
--- a/infra/src/feature-env.ts
+++ b/infra/src/feature-env.ts
@@ -18,7 +18,7 @@ import {
   renderHelmValueFileContent,
 } from './dsl/exports/helm'
 import { ServiceBuilder } from './dsl/dsl'
-import { logger } from './common'
+import { logger } from './logging'
 
 type ChartName = 'islandis' | 'identity-server'
 
diff --git a/infra/src/uber-charts/islandis.ts b/infra/src/uber-charts/islandis.ts
index 548a918b3613..28bd6f521aaa 100644
--- a/infra/src/uber-charts/islandis.ts
+++ b/infra/src/uber-charts/islandis.ts
@@ -10,10 +10,15 @@ import {
 } from '../../../apps/application-system/api/infra/application-system-api'
 import { serviceSetup as appSystemFormSetup } from '../../../apps/application-system/form/infra/application-system-form'
 
+// Portals
 import { serviceSetup as servicePortalApiSetup } from '../../../apps/services/user-profile/infra/service-portal-api'
 import { serviceSetup as servicePortalSetup } from '../../../apps/portals/my-pages/infra/portals-my-pages'
 
 import { serviceSetup as adminPortalSetup } from '../../../apps/portals/admin/infra/portals-admin'
+
+// Bff's
+import { serviceSetup as bffAdminPortalServiceSetup } from '../../../apps/services/bff/infra/admin-portal.infra'
+
 import { serviceSetup as consultationPortalSetup } from '../../../apps/consultation-portal/infra/samradsgatt'
 import { serviceSetup as xroadCollectorSetup } from '../../../apps/services/xroad-collector/infra/xroad-collector'
 
@@ -112,13 +117,15 @@ const api = apiSetup({
   universityGatewayApi: universityGatewayService,
   userNotificationService,
 })
+
 const servicePortal = servicePortalSetup({ graphql: api })
-const appSystemForm = appSystemFormSetup({ api: api })
-const web = webSetup({ api: api })
+const bffAdminPortalService = bffAdminPortalServiceSetup({ api })
+const appSystemForm = appSystemFormSetup({ api })
+const web = webSetup({ api })
 const searchIndexer = searchIndexerSetup()
 const contentfulEntryTagger = contentfulEntryTaggerSetup()
 const contentfulApps = contentfulAppsSetup()
-const consultationPortal = consultationPortalSetup({ api: api })
+const consultationPortal = consultationPortalSetup({ api })
 
 const xroadCollector = xroadCollectorSetup()
 
@@ -174,6 +181,7 @@ export const Services: EnvironmentServices = {
     universityGatewayWorker,
     contentfulApps,
     contentfulEntryTagger,
+    bffAdminPortalService,
   ],
   staging: [
     appSystemApi,
@@ -207,6 +215,7 @@ export const Services: EnvironmentServices = {
     sessionsCleanupWorker,
     universityGatewayService,
     universityGatewayWorker,
+    bffAdminPortalService,
   ],
   dev: [
     appSystemApi,
@@ -244,6 +253,7 @@ export const Services: EnvironmentServices = {
     contentfulApps,
     universityGatewayService,
     universityGatewayWorker,
+    bffAdminPortalService,
   ],
 }
 
diff --git a/infra/yarn.lock b/infra/yarn.lock
index c97ff807bf19..b8110816e3e0 100644
--- a/infra/yarn.lock
+++ b/infra/yarn.lock
@@ -4108,6 +4108,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"asap@npm:^2.0.0":
+  version: 2.0.6
+  resolution: "asap@npm:2.0.6"
+  checksum: b296c92c4b969e973260e47523207cd5769abd27c245a68c26dc7a0fe8053c55bb04360237cb51cab1df52be939da77150ace99ad331fb7fb13b3423ed73ff3d
+  languageName: node
+  linkType: hard
+
 "assign-symbols@npm:^1.0.0":
   version: 1.0.0
   resolution: "assign-symbols@npm:1.0.0"
@@ -4623,6 +4630,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"call-bind@npm:^1.0.7":
+  version: 1.0.7
+  resolution: "call-bind@npm:1.0.7"
+  dependencies:
+    es-define-property: ^1.0.0
+    es-errors: ^1.3.0
+    function-bind: ^1.1.2
+    get-intrinsic: ^1.2.4
+    set-function-length: ^1.2.1
+  checksum: 295c0c62b90dd6522e6db3b0ab1ce26bdf9e7404215bda13cfee25b626b5ff1a7761324d58d38b1ef1607fc65aca2d06e44d2e18d0dfc6c14b465b00d8660029
+  languageName: node
+  linkType: hard
+
 "callsites@npm:^3.0.0":
   version: 3.1.0
   resolution: "callsites@npm:3.1.0"
@@ -4888,6 +4908,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"commander@npm:~4.1.1":
+  version: 4.1.1
+  resolution: "commander@npm:4.1.1"
+  checksum: d7b9913ff92cae20cb577a4ac6fcc121bd6223319e54a40f51a14740a681ad5c574fd29a57da478a5f234a6fa6c52cbf0b7c641353e03c648b1ae85ba670b977
+  languageName: node
+  linkType: hard
+
 "component-emitter@npm:^1.2.1":
   version: 1.3.0
   resolution: "component-emitter@npm:1.3.0"
@@ -4895,6 +4922,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"component-emitter@npm:^1.3.0":
+  version: 1.3.1
+  resolution: "component-emitter@npm:1.3.1"
+  checksum: 94550aa462c7bd5a61c1bc480e28554aa306066930152d1b1844a0dd3845d4e5db7e261ddec62ae184913b3e59b55a2ad84093b9d3596a8f17c341514d6c483d
+  languageName: node
+  linkType: hard
+
 "concat-map@npm:0.0.1":
   version: 0.0.1
   resolution: "concat-map@npm:0.0.1"
@@ -4932,6 +4966,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cookiejar@npm:^2.1.3":
+  version: 2.1.4
+  resolution: "cookiejar@npm:2.1.4"
+  checksum: c4442111963077dc0e5672359956d6556a195d31cbb35b528356ce5f184922b99ac48245ac05ed86cf993f7df157c56da10ab3efdadfed79778a0d9b1b092d5b
+  languageName: node
+  linkType: hard
+
 "copy-descriptor@npm:^0.1.0":
   version: 0.1.1
   resolution: "copy-descriptor@npm:0.1.1"
@@ -5071,6 +5112,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"debug@npm:^4.3.4":
+  version: 4.3.7
+  resolution: "debug@npm:4.3.7"
+  dependencies:
+    ms: ^2.1.3
+  peerDependenciesMeta:
+    supports-color:
+      optional: true
+  checksum: 822d74e209cd910ef0802d261b150314bbcf36c582ccdbb3e70f0894823c17e49a50d3e66d96b633524263975ca16b6a833f3e3b7e030c157169a5fabac63160
+  languageName: node
+  linkType: hard
+
 "decimal.js@npm:^10.2.1":
   version: 10.4.3
   resolution: "decimal.js@npm:10.4.3"
@@ -5119,6 +5172,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"define-data-property@npm:^1.1.4":
+  version: 1.1.4
+  resolution: "define-data-property@npm:1.1.4"
+  dependencies:
+    es-define-property: ^1.0.0
+    es-errors: ^1.3.0
+    gopd: ^1.0.1
+  checksum: 8068ee6cab694d409ac25936eb861eea704b7763f7f342adbdfe337fc27c78d7ae0eff2364b2917b58c508d723c7a074326d068eef2e45c4edcd85cf94d0313b
+  languageName: node
+  linkType: hard
+
 "define-lazy-prop@npm:^2.0.0":
   version: 2.0.0
   resolution: "define-lazy-prop@npm:2.0.0"
@@ -5205,6 +5269,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"dezalgo@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "dezalgo@npm:1.0.4"
+  dependencies:
+    asap: ^2.0.0
+    wrappy: 1
+  checksum: 895389c6aead740d2ab5da4d3466d20fa30f738010a4d3f4dcccc9fc645ca31c9d10b7e1804ae489b1eb02c7986f9f1f34ba132d409b043082a86d9a4e745624
+  languageName: node
+  linkType: hard
+
 "diff-sequences@npm:^26.6.2":
   version: 26.6.2
   resolution: "diff-sequences@npm:26.6.2"
@@ -5373,6 +5447,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"es-define-property@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "es-define-property@npm:1.0.0"
+  dependencies:
+    get-intrinsic: ^1.2.4
+  checksum: f66ece0a887b6dca71848fa71f70461357c0e4e7249696f81bad0a1f347eed7b31262af4a29f5d726dc026426f085483b6b90301855e647aa8e21936f07293c6
+  languageName: node
+  linkType: hard
+
+"es-errors@npm:^1.3.0":
+  version: 1.3.0
+  resolution: "es-errors@npm:1.3.0"
+  checksum: ec1414527a0ccacd7f15f4a3bc66e215f04f595ba23ca75cdae0927af099b5ec865f9f4d33e9d7e86f512f252876ac77d4281a7871531a50678132429b1271b5
+  languageName: node
+  linkType: hard
+
 "esbuild-android-64@npm:0.14.39":
   version: 0.14.39
   resolution: "esbuild-android-64@npm:0.14.39"
@@ -5813,6 +5903,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fast-safe-stringify@npm:^2.1.1":
+  version: 2.1.1
+  resolution: "fast-safe-stringify@npm:2.1.1"
+  checksum: a851cbddc451745662f8f00ddb622d6766f9bd97642dabfd9a405fb0d646d69fc0b9a1243cbf67f5f18a39f40f6fa821737651ff1bceeba06c9992ca2dc5bd3d
+  languageName: node
+  linkType: hard
+
 "fast-xml-parser@npm:3.19.0":
   version: 3.19.0
   resolution: "fast-xml-parser@npm:3.19.0"
@@ -5956,6 +6053,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"formidable@npm:^2.0.1":
+  version: 2.1.2
+  resolution: "formidable@npm:2.1.2"
+  dependencies:
+    dezalgo: ^1.0.4
+    hexoid: ^1.0.0
+    once: ^1.4.0
+    qs: ^6.11.0
+  checksum: 81c8e5d89f5eb873e992893468f0de22c01678ca3d315db62be0560f9de1c77d4faefc9b1f4575098eb2263b3c81ba1024833a9fc3206297ddbac88a4f69b7a8
+  languageName: node
+  linkType: hard
+
 "fragment-cache@npm:^0.2.1":
   version: 0.2.1
   resolution: "fragment-cache@npm:0.2.1"
@@ -6085,6 +6194,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"get-intrinsic@npm:^1.2.4":
+  version: 1.2.4
+  resolution: "get-intrinsic@npm:1.2.4"
+  dependencies:
+    es-errors: ^1.3.0
+    function-bind: ^1.1.2
+    has-proto: ^1.0.1
+    has-symbols: ^1.0.3
+    hasown: ^2.0.0
+  checksum: 414e3cdf2c203d1b9d7d33111df746a4512a1aa622770b361dadddf8ed0b5aeb26c560f49ca077e24bfafb0acb55ca908d1f709216ccba33ffc548ec8a79a951
+  languageName: node
+  linkType: hard
+
 "get-package-type@npm:^0.1.0":
   version: 0.1.0
   resolution: "get-package-type@npm:0.1.0"
@@ -6231,6 +6353,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"graphlib@npm:^2.1.8":
+  version: 2.1.8
+  resolution: "graphlib@npm:2.1.8"
+  dependencies:
+    lodash: ^4.17.15
+  checksum: 1e0db4dea1c8187d59103d5582ecf32008845ebe2103959a51d22cb6dae495e81fb9263e22c922bca3aaecb56064a45cd53424e15a4626cfb5a0c52d0aff61a8
+  languageName: node
+  linkType: hard
+
 "has-flag@npm:^3.0.0":
   version: 3.0.0
   resolution: "has-flag@npm:3.0.0"
@@ -6263,6 +6394,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"has-property-descriptors@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "has-property-descriptors@npm:1.0.2"
+  dependencies:
+    es-define-property: ^1.0.0
+  checksum: fcbb246ea2838058be39887935231c6d5788babed499d0e9d0cc5737494c48aba4fe17ba1449e0d0fbbb1e36175442faa37f9c427ae357d6ccb1d895fbcd3de3
+  languageName: node
+  linkType: hard
+
 "has-proto@npm:^1.0.1":
   version: 1.0.1
   resolution: "has-proto@npm:1.0.1"
@@ -6350,6 +6490,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"hexoid@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "hexoid@npm:1.0.0"
+  checksum: 27a148ca76a2358287f40445870116baaff4a0ed0acc99900bf167f0f708ffd82e044ff55e9949c71963852b580fc024146d3ac6d5d76b508b78d927fa48ae2d
+  languageName: node
+  linkType: hard
+
 "hosted-git-info@npm:^7.0.0":
   version: 7.0.1
   resolution: "hosted-git-info@npm:7.0.1"
@@ -6542,6 +6689,8 @@ __metadata:
     glob: 10.3.3
     jest: 27.2.4
     js-yaml: 4.0.0
+    json-refs: 3.0.15
+    json-schema-to-zod: 2.4.1
     lodash: 4.17.21
     typescript: 4.6.4
     yargs: 17.7.2
@@ -7678,6 +7827,33 @@ __metadata:
   languageName: node
   linkType: hard
 
+"json-refs@npm:3.0.15":
+  version: 3.0.15
+  resolution: "json-refs@npm:3.0.15"
+  dependencies:
+    commander: ~4.1.1
+    graphlib: ^2.1.8
+    js-yaml: ^3.13.1
+    lodash: ^4.17.15
+    native-promise-only: ^0.8.1
+    path-loader: ^1.0.10
+    slash: ^3.0.0
+    uri-js: ^4.2.2
+  bin:
+    json-refs: ./bin/json-refs
+  checksum: ad77ac11eb0c6992ac870691eeb97a43663224ab32d41b02af500d253c49ea902a4c8792ebb8f1ec6df9c2369c99a62038a0ebe45ef7d3610f984ca6f32e4927
+  languageName: node
+  linkType: hard
+
+"json-schema-to-zod@npm:2.4.1":
+  version: 2.4.1
+  resolution: "json-schema-to-zod@npm:2.4.1"
+  bin:
+    json-schema-to-zod: dist/cjs/cli.js
+  checksum: acfb05c2fab8f7fd87238aa7da8e219a256d910571f82b9d9a548f44d5eb223f71c25f2bac2444776ccaa35e109c4f257a0a1a48c4f63d2dbd4ce31397a8d0e4
+  languageName: node
+  linkType: hard
+
 "json5@npm:^2.1.2":
   version: 2.1.3
   resolution: "json5@npm:2.1.3"
@@ -7803,7 +7979,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash@npm:4.17.21, lodash@npm:^4.17.19, lodash@npm:^4.7.0":
+"lodash@npm:4.17.21, lodash@npm:^4.17.15, lodash@npm:^4.17.19, lodash@npm:^4.7.0":
   version: 4.17.21
   resolution: "lodash@npm:4.17.21"
   checksum: eb835a2e51d381e561e508ce932ea50a8e5a68f4ebdd771ea240d3048244a8d13658acbd502cd4829768c56f2e16bdd4340b9ea141297d472517b83868e677f7
@@ -7947,6 +8123,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"methods@npm:^1.1.2":
+  version: 1.1.2
+  resolution: "methods@npm:1.1.2"
+  checksum: 0917ff4041fa8e2f2fda5425a955fe16ca411591fbd123c0d722fcf02b73971ed6f764d85f0a6f547ce49ee0221ce2c19a5fa692157931cecb422984f1dcd13a
+  languageName: node
+  linkType: hard
+
 "micromatch@npm:^3.1.4":
   version: 3.1.10
   resolution: "micromatch@npm:3.1.10"
@@ -8004,6 +8187,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"mime@npm:2.6.0":
+  version: 2.6.0
+  resolution: "mime@npm:2.6.0"
+  bin:
+    mime: cli.js
+  checksum: 1497ba7b9f6960694268a557eae24b743fd2923da46ec392b042469f4b901721ba0adcf8b0d3c2677839d0e243b209d76e5edcbd09cfdeffa2dfb6bb4df4b862
+  languageName: node
+  linkType: hard
+
 "mimic-fn@npm:^2.1.0":
   version: 2.1.0
   resolution: "mimic-fn@npm:2.1.0"
@@ -8187,7 +8379,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ms@npm:^2.0.0":
+"ms@npm:^2.0.0, ms@npm:^2.1.3":
   version: 2.1.3
   resolution: "ms@npm:2.1.3"
   checksum: aa92de608021b242401676e35cfa5aa42dd70cbdc082b916da7fb925c542173e36bce97ea3e804923fe92c0ad991434e4a38327e15a1b5b5f945d66df615ae6d
@@ -8213,6 +8405,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"native-promise-only@npm:^0.8.1":
+  version: 0.8.1
+  resolution: "native-promise-only@npm:0.8.1"
+  checksum: bb4d8416c47d1b2cef0d4eb2c7f3442a9ed04d3734287f4037dfb7ff25948612976928e5baed105081927d5337d3f657e3a42ad2e8cca38a6428a81b32cd6dc4
+  languageName: node
+  linkType: hard
+
 "natural-compare@npm:^1.4.0":
   version: 1.4.0
   resolution: "natural-compare@npm:1.4.0"
@@ -8481,6 +8680,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"object-inspect@npm:^1.13.1":
+  version: 1.13.2
+  resolution: "object-inspect@npm:1.13.2"
+  checksum: 9f850b3c045db60e0e97746e809ee4090d6ce62195af17dd1e9438ac761394a7d8ec4f7906559aea5424eaf61e35d3e53feded2ccd5f62fcc7d9670d3c8eb353
+  languageName: node
+  linkType: hard
+
 "object-keys@npm:^1.1.1":
   version: 1.1.1
   resolution: "object-keys@npm:1.1.1"
@@ -8667,6 +8873,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"path-loader@npm:^1.0.10":
+  version: 1.0.12
+  resolution: "path-loader@npm:1.0.12"
+  dependencies:
+    native-promise-only: ^0.8.1
+    superagent: ^7.1.6
+  checksum: 50ff3bb331fc997ca817396b86b79f2adae857e6cb226bd5ddaa97b4b1a3b903502ad3e0a59cd48847d0ed15b662a8bd5ceb21b2176380727d37a64c7b8dd3c1
+  languageName: node
+  linkType: hard
+
 "path-parse@npm:^1.0.6, path-parse@npm:^1.0.7":
   version: 1.0.7
   resolution: "path-parse@npm:1.0.7"
@@ -8850,13 +9066,22 @@ __metadata:
   languageName: node
   linkType: hard
 
-"punycode@npm:^2.1.1":
+"punycode@npm:^2.1.0, punycode@npm:^2.1.1":
   version: 2.3.1
   resolution: "punycode@npm:2.3.1"
   checksum: bb0a0ceedca4c3c57a9b981b90601579058903c62be23c5e8e843d2c2d4148a3ecf029d5133486fb0e1822b098ba8bba09e89d6b21742d02fa26bda6441a6fb2
   languageName: node
   linkType: hard
 
+"qs@npm:^6.10.3, qs@npm:^6.11.0":
+  version: 6.13.0
+  resolution: "qs@npm:6.13.0"
+  dependencies:
+    side-channel: ^1.0.6
+  checksum: e9404dc0fc2849245107108ce9ec2766cde3be1b271de0bf1021d049dc5b98d1a2901e67b431ac5509f865420a7ed80b7acb3980099fe1c118a1c5d2e1432ad8
+  languageName: node
+  linkType: hard
+
 "querystring@npm:0.2.0":
   version: 0.2.0
   resolution: "querystring@npm:0.2.0"
@@ -9298,6 +9523,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"semver@npm:^7.3.7":
+  version: 7.6.3
+  resolution: "semver@npm:7.6.3"
+  bin:
+    semver: bin/semver.js
+  checksum: 4110ec5d015c9438f322257b1c51fe30276e5f766a3f64c09edd1d7ea7118ecbc3f379f3b69032bacf13116dc7abc4ad8ce0d7e2bd642e26b0d271b56b61a7d8
+  languageName: node
+  linkType: hard
+
 "set-blocking@npm:^2.0.0":
   version: 2.0.0
   resolution: "set-blocking@npm:2.0.0"
@@ -9318,6 +9552,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"set-function-length@npm:^1.2.1":
+  version: 1.2.2
+  resolution: "set-function-length@npm:1.2.2"
+  dependencies:
+    define-data-property: ^1.1.4
+    es-errors: ^1.3.0
+    function-bind: ^1.1.2
+    get-intrinsic: ^1.2.4
+    gopd: ^1.0.1
+    has-property-descriptors: ^1.0.2
+  checksum: a8248bdacdf84cb0fab4637774d9fb3c7a8e6089866d04c817583ff48e14149c87044ce683d7f50759a8c50fb87c7a7e173535b06169c87ef76f5fb276dfff72
+  languageName: node
+  linkType: hard
+
 "set-value@npm:^2.0.0, set-value@npm:^2.0.1":
   version: 2.0.1
   resolution: "set-value@npm:2.0.1"
@@ -9362,6 +9610,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"side-channel@npm:^1.0.6":
+  version: 1.0.6
+  resolution: "side-channel@npm:1.0.6"
+  dependencies:
+    call-bind: ^1.0.7
+    es-errors: ^1.3.0
+    get-intrinsic: ^1.2.4
+    object-inspect: ^1.13.1
+  checksum: bfc1afc1827d712271453e91b7cd3878ac0efd767495fd4e594c4c2afaa7963b7b510e249572bfd54b0527e66e4a12b61b80c061389e129755f34c493aad9b97
+  languageName: node
+  linkType: hard
+
 "signal-exit@npm:^3.0.0, signal-exit@npm:^3.0.7":
   version: 3.0.7
   resolution: "signal-exit@npm:3.0.7"
@@ -9700,6 +9960,25 @@ __metadata:
   languageName: node
   linkType: hard
 
+"superagent@npm:^7.1.6":
+  version: 7.1.6
+  resolution: "superagent@npm:7.1.6"
+  dependencies:
+    component-emitter: ^1.3.0
+    cookiejar: ^2.1.3
+    debug: ^4.3.4
+    fast-safe-stringify: ^2.1.1
+    form-data: ^4.0.0
+    formidable: ^2.0.1
+    methods: ^1.1.2
+    mime: 2.6.0
+    qs: ^6.10.3
+    readable-stream: ^3.6.0
+    semver: ^7.3.7
+  checksum: b73316836003219f1a4886a6d77dd28551a6784c30e871009fb7bad699fae772b20370d39d2ccb5a543c9335ce12b43a76b959a3ca983f1d6365cb4b5682c08f
+  languageName: node
+  linkType: hard
+
 "supports-color@npm:^5.3.0":
   version: 5.5.0
   resolution: "supports-color@npm:5.5.0"
@@ -10116,6 +10395,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"uri-js@npm:^4.2.2":
+  version: 4.4.1
+  resolution: "uri-js@npm:4.4.1"
+  dependencies:
+    punycode: ^2.1.0
+  checksum: 7167432de6817fe8e9e0c9684f1d2de2bb688c94388f7569f7dbdb1587c9f4ca2a77962f134ec90be0cc4d004c939ff0d05acc9f34a0db39a3c797dada262633
+  languageName: node
+  linkType: hard
+
 "urix@npm:^0.1.0":
   version: 0.1.0
   resolution: "urix@npm:0.1.0"
diff --git a/libs/auth/scopes/src/index.ts b/libs/auth/scopes/src/index.ts
index acd201a8186e..ddb61ffe1938 100644
--- a/libs/auth/scopes/src/index.ts
+++ b/libs/auth/scopes/src/index.ts
@@ -24,3 +24,5 @@ export * from './lib/recycling-fund.scope'
 export * from './lib/universityGateway.scope'
 export * from './lib/mms.scope'
 export * from './lib/judicial-system.scope'
+export * from './lib/clients/admin-portal-scopes'
+export * from './lib/clients/service-portal-scopes'
diff --git a/libs/auth/scopes/src/lib/clients/admin-portal-scopes.ts b/libs/auth/scopes/src/lib/clients/admin-portal-scopes.ts
new file mode 100644
index 000000000000..252f4457ef38
--- /dev/null
+++ b/libs/auth/scopes/src/lib/clients/admin-portal-scopes.ts
@@ -0,0 +1,23 @@
+import { AdminPortalScope } from '../admin-portal.scope'
+
+export const adminPortalScopes = [
+  AdminPortalScope.delegations,
+  AdminPortalScope.airDiscountScheme,
+  AdminPortalScope.regulationAdmin,
+  AdminPortalScope.regulationAdminManage,
+  AdminPortalScope.icelandicNamesRegistry,
+  AdminPortalScope.applicationSystemAdmin,
+  AdminPortalScope.applicationSystemInstitution,
+  AdminPortalScope.documentProvider,
+  AdminPortalScope.idsAdmin,
+  AdminPortalScope.idsAdminSuperUser,
+  AdminPortalScope.petitionsAdmin,
+  AdminPortalScope.serviceDesk,
+  AdminPortalScope.explicitAirDiscountScheme,
+  AdminPortalScope.signatureCollectionManage,
+  AdminPortalScope.signatureCollectionProcess,
+  AdminPortalScope.formSystem,
+  AdminPortalScope.formSystemSuperUser,
+  AdminPortalScope.delegationSystem,
+  AdminPortalScope.delegationSystemAdmin,
+]
diff --git a/libs/auth/scopes/src/lib/clients/service-portal-scopes.ts b/libs/auth/scopes/src/lib/clients/service-portal-scopes.ts
new file mode 100644
index 000000000000..a92a6a77914e
--- /dev/null
+++ b/libs/auth/scopes/src/lib/clients/service-portal-scopes.ts
@@ -0,0 +1,48 @@
+import { ApiScope } from '../api.scope'
+import { ApplicationScope } from '../application.scope'
+import { AuthScope } from '../auth.scope'
+import { DocumentsScope } from '../documents.scope'
+import { EndorsementsScope } from '../endorsements.scope'
+import { NationalRegistryScope } from '../nationalRegistry.scope'
+import { UserProfileScope } from '../userProfile.scope'
+
+export const servicePortalScopes = [
+  'api_resource.scope',
+  ApplicationScope.read,
+  ApplicationScope.write,
+  UserProfileScope.read,
+  UserProfileScope.write,
+  AuthScope.actorDelegations,
+  AuthScope.delegations,
+  AuthScope.consents,
+  NationalRegistryScope.individuals,
+  DocumentsScope.main,
+  EndorsementsScope.main,
+  EndorsementsScope.admin,
+  ApiScope.intellectualProperties,
+  ApiScope.assets,
+  ApiScope.education,
+  ApiScope.educationLicense,
+  ApiScope.financeOverview,
+  ApiScope.financeSalary,
+  ApiScope.financeSchedule,
+  ApiScope.financeLoans,
+  ApiScope.internal,
+  ApiScope.internalProcuring,
+  ApiScope.meDetails,
+  ApiScope.licenses,
+  ApiScope.licensesVerify,
+  ApiScope.company,
+  ApiScope.vehicles,
+  ApiScope.workMachines,
+  ApiScope.healthPayments,
+  ApiScope.healthMedicines,
+  ApiScope.healthAssistiveAndNutrition,
+  ApiScope.healthTherapies,
+  ApiScope.healthHealthcare,
+  ApiScope.healthRightsStatus,
+  ApiScope.healthDentists,
+  ApiScope.healthOrganDonation,
+  ApiScope.healthVaccinations,
+  ApiScope.signatureCollection,
+]
diff --git a/libs/infra-nest-server/src/lib/bootstrap.ts b/libs/infra-nest-server/src/lib/bootstrap.ts
index 01a442e76f77..686fe5cfe07c 100644
--- a/libs/infra-nest-server/src/lib/bootstrap.ts
+++ b/libs/infra-nest-server/src/lib/bootstrap.ts
@@ -50,6 +50,10 @@ export const createApp = async ({
     app.enableVersioning()
   }
 
+  if (options.enableCors) {
+    app.enableCors(options.enableCors)
+  }
+
   // Configure "X-Requested-For" handling.
   // Internal services should trust the X-Forwarded-For header (EXPRESS_TRUST_PROXY=1)
   // Public services (eg API Gateway) should trust our own reverse proxies
@@ -66,8 +70,10 @@ export const createApp = async ({
     }),
   )
 
-  if (options.globalPrefix) {
-    app.setGlobalPrefix(options.globalPrefix)
+  const globalPrefix = options.globalPrefix
+
+  if (globalPrefix) {
+    app.setGlobalPrefix(globalPrefix)
   }
 
   if (options.collectMetrics !== false) {
diff --git a/libs/infra-nest-server/src/lib/types.ts b/libs/infra-nest-server/src/lib/types.ts
index 7e37851701ff..8426a6d00cf4 100644
--- a/libs/infra-nest-server/src/lib/types.ts
+++ b/libs/infra-nest-server/src/lib/types.ts
@@ -2,6 +2,7 @@ import { INestApplication, NestInterceptor, Type } from '@nestjs/common'
 import { OpenAPIObject } from '@nestjs/swagger'
 import { Server } from 'http'
 
+import { CorsOptions } from '@nestjs/common/interfaces/external/cors-options.interface'
 import { HealthCheckOptions } from './infra/health/types'
 
 export type RunServerOptions = {
@@ -74,6 +75,11 @@ export type RunServerOptions = {
    */
   healthCheck?: boolean | HealthCheckOptions
 
+  /**
+   * Enables CORS (Cross-Origin Resource Sharing)
+   */
+  enableCors?: CorsOptions
+
   /**
    * Hook to run before app is initialized.
    */
diff --git a/libs/island-ui/storybook/config/main.ts b/libs/island-ui/storybook/config/main.ts
index 3cd410158982..3c9e5ccccacd 100644
--- a/libs/island-ui/storybook/config/main.ts
+++ b/libs/island-ui/storybook/config/main.ts
@@ -96,6 +96,7 @@ const config: StorybookConfig = {
         ),
         '@island.is/feature-flags': rootDir('../../../feature-flags/src'),
         '@island.is/react-spa/shared': rootDir('../../../react-spa/shared/src'),
+        '@island.is/react-spa/bff': rootDir('../../../react-spa/bff/src'),
       },
     }
     return config
diff --git a/libs/portals/admin/application-system/src/module.tsx b/libs/portals/admin/application-system/src/module.tsx
index 908f7350de91..23cf6281bc34 100644
--- a/libs/portals/admin/application-system/src/module.tsx
+++ b/libs/portals/admin/application-system/src/module.tsx
@@ -19,7 +19,7 @@ const allowedScopes: string[] = [
   AdminPortalScope.applicationSystemInstitution,
 ]
 const getScreen = ({ userInfo }: PortalModuleRoutesProps): React.ReactNode => {
-  if (userInfo.scope?.includes(AdminPortalScope.applicationSystemInstitution)) {
+  if (userInfo.scopes.includes(AdminPortalScope.applicationSystemInstitution)) {
     return <InstitutionOverview />
   }
   return <Overview />
@@ -51,7 +51,7 @@ export const applicationSystemAdminModule: PortalModule = {
           name: m.statistics,
           path: ApplicationSystemPaths.Statistics,
           element: <Statistics />,
-          enabled: props.userInfo.scope?.includes(
+          enabled: props.userInfo.scopes.includes(
             AdminPortalScope.applicationSystemAdmin,
           ),
         },
diff --git a/libs/portals/admin/application-system/src/screens/Overview/InstitutionOverview.tsx b/libs/portals/admin/application-system/src/screens/Overview/InstitutionOverview.tsx
index 4baa487414de..904561742ebd 100644
--- a/libs/portals/admin/application-system/src/screens/Overview/InstitutionOverview.tsx
+++ b/libs/portals/admin/application-system/src/screens/Overview/InstitutionOverview.tsx
@@ -19,7 +19,7 @@ import { ApplicationFilters, MultiChoiceFilter } from '../../types/filters'
 import { Organization } from '@island.is/shared/types'
 import { institutionMapper } from '@island.is/application/types'
 import { AdminApplication } from '../../types/adminApplication'
-import { useUserInfo } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import endOfDay from 'date-fns/endOfDay'
 
 const defaultFilters: ApplicationFilters = {
diff --git a/libs/portals/admin/ids-admin/src/hooks/useSuperAdmin.tsx b/libs/portals/admin/ids-admin/src/hooks/useSuperAdmin.tsx
index 9dd93708336e..ef18544a3726 100644
--- a/libs/portals/admin/ids-admin/src/hooks/useSuperAdmin.tsx
+++ b/libs/portals/admin/ids-admin/src/hooks/useSuperAdmin.tsx
@@ -1,8 +1,8 @@
-import { useAuth } from '@island.is/auth/react'
 import { AdminPortalScope } from '@island.is/auth/scopes'
+import { useUserInfo } from '@island.is/react-spa/bff'
 
 export const useSuperAdmin = () => {
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
 
   const isSuperAdmin = userInfo?.scopes.includes(
     AdminPortalScope.idsAdminSuperUser,
diff --git a/libs/portals/admin/regulations-admin/src/components/DownloadDraftButton.tsx b/libs/portals/admin/regulations-admin/src/components/DownloadDraftButton.tsx
index 50ddeee88fe1..5e4054aad9ed 100644
--- a/libs/portals/admin/regulations-admin/src/components/DownloadDraftButton.tsx
+++ b/libs/portals/admin/regulations-admin/src/components/DownloadDraftButton.tsx
@@ -1,13 +1,13 @@
-import { useEffect } from 'react'
 import { gql, useLazyQuery } from '@apollo/client'
 import { Query } from '@island.is/api/schema'
+import { useEffect, useState } from 'react'
 
 import { Button, toast } from '@island.is/island-ui/core'
 
 import { useLocale } from '@island.is/localization'
-import { editorMsgs, reviewMessages } from '../lib/messages'
+import { useBffUrlGenerator } from '@island.is/react-spa/bff'
 import type { RegulationDraftId } from '@island.is/regulations/admin'
-import { useAuth } from '@island.is/auth/react'
+import { editorMsgs, reviewMessages } from '../lib/messages'
 
 type Props = {
   draftId: RegulationDraftId
@@ -23,40 +23,21 @@ const DownloadRegulationDraftQuery = gql`
   }
 `
 
-function formSubmit(url: string, token: string) {
-  // Create form elements
-  const form = document.createElement('form')
-  const tokenInput = document.createElement('input')
-
-  form.appendChild(tokenInput)
-
-  // Form values
-  form.method = 'post'
-  form.action = url
-  form.target = '_blank'
-
-  // National Id values
-  tokenInput.type = 'hidden'
-  tokenInput.name = '__accessToken'
-  tokenInput.value = token
-
-  document.body.appendChild(form)
-  form.submit()
-  document.body.removeChild(form)
-}
-
-export function DownloadDraftButton({ draftId, reviewButton }: Props) {
-  const userInfo = useAuth().userInfo
+export const DownloadDraftButton = ({ draftId, reviewButton }: Props) => {
+  const bffUrlGenerator = useBffUrlGenerator()
+  const [isFetchingFile, setIsFetchingFile] = useState(false)
   const t = useLocale().formatMessage
-  const [downloadRegulation, { called, loading, error, data }] =
-    useLazyQuery<Query>(DownloadRegulationDraftQuery, {
+  const [downloadRegulation, { loading, error, data }] = useLazyQuery<Query>(
+    DownloadRegulationDraftQuery,
+    {
       variables: {
         input: {
           draftId,
         },
       },
       fetchPolicy: 'no-cache',
-    })
+    },
+  )
 
   useEffect(() => {
     if (error) {
@@ -65,27 +46,30 @@ export function DownloadDraftButton({ draftId, reviewButton }: Props) {
   }, [t, error])
 
   useEffect(() => {
-    if (called && data) {
-      const response = data.getDraftRegulationPdfDownload
-      const url = response?.url
-
-      if (url && userInfo) {
-        formSubmit(url, userInfo.access_token)
-      } else {
-        toast.error(t(editorMsgs.signedDocumentDownloadFreshError))
-      }
+    const url = data?.getDraftRegulationPdfDownload?.url
+
+    if (url && !isFetchingFile) {
+      window.open(
+        bffUrlGenerator('/api', {
+          url,
+        }),
+        '_blank',
+      )
+    } else if (data && !url) {
+      toast.error(t(editorMsgs.signedDocumentDownloadFreshError))
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [called, data, userInfo?.access_token])
+  }, [data])
 
   const onClick = async () => {
     downloadRegulation()
   }
 
+  const isLoading = loading || isFetchingFile
+
   if (reviewButton) {
     return (
       <Button
-        loading={loading}
+        loading={isLoading}
         as="button"
         onClick={onClick}
         icon="download"
@@ -99,7 +83,7 @@ export function DownloadDraftButton({ draftId, reviewButton }: Props) {
   }
 
   return (
-    <Button loading={loading} onClick={onClick} icon="download">
+    <Button loading={isLoading} onClick={onClick} icon="download">
       {t(editorMsgs.signedDocumentDownloadFresh)}
     </Button>
   )
diff --git a/libs/portals/admin/regulations-admin/src/state/reducer.ts b/libs/portals/admin/regulations-admin/src/state/reducer.ts
index 3771f45b70f7..1b03eb072486 100644
--- a/libs/portals/admin/regulations-admin/src/state/reducer.ts
+++ b/libs/portals/admin/regulations-admin/src/state/reducer.ts
@@ -1,14 +1,14 @@
+import { AdminPortalScope } from '@island.is/auth/scopes'
+import { useUserInfo } from '@island.is/react-spa/bff'
+import { LawChapter, MinistryList } from '@island.is/regulations'
+import { DraftImpactId, RegulationDraft } from '@island.is/regulations/admin'
+import { produce, setAutoFreeze } from 'immer'
 import { Reducer, useReducer } from 'react'
 import { RegulationDraftTypes, Step } from '../types'
-import { LawChapter, MinistryList } from '@island.is/regulations'
+import { actionHandlers } from './actionHandlers'
+import { makeDraftForm, stepsAmending, stepsBase } from './makeFields'
 import { Action, DraftingState, RegDraftFormSimpleProps } from './types'
-import { produce, setAutoFreeze } from 'immer'
-import { DraftImpactId, RegulationDraft } from '@island.is/regulations/admin'
-import { useAuth } from '@island.is/auth/react'
-import { AdminPortalScope } from '@island.is/auth/scopes'
 import { derivedUpdates, validateState } from './validations'
-import { makeDraftForm, stepsAmending, stepsBase } from './makeFields'
-import { actionHandlers } from './actionHandlers'
 
 const draftingStateReducer: Reducer<DraftingState, Action> = (
   state,
@@ -40,9 +40,8 @@ export const useEditDraftReducer = (inputs: StateInputs) => {
   const { regulationDraft, ministries, lawChapters, stepName } = inputs
 
   const isEditor =
-    useAuth().userInfo?.scopes?.includes(
-      AdminPortalScope.regulationAdminManage,
-    ) || false
+    useUserInfo()?.scopes?.includes(AdminPortalScope.regulationAdminManage) ||
+    false
 
   const makeInitialState = () => {
     const draft = makeDraftForm(regulationDraft)
diff --git a/libs/portals/admin/service-desk/src/screens/Users/Users.tsx b/libs/portals/admin/service-desk/src/screens/Users/Users.tsx
index 6e66784fba2a..d78b0fa1b1cc 100644
--- a/libs/portals/admin/service-desk/src/screens/Users/Users.tsx
+++ b/libs/portals/admin/service-desk/src/screens/Users/Users.tsx
@@ -10,7 +10,7 @@ import {
 import { formatNationalId, IntroHeader } from '@island.is/portals/core'
 import { maskString } from '@island.is/shared/utils'
 import { useLocale } from '@island.is/localization'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { replaceParams, useSubmitting } from '@island.is/react-spa/shared'
 
 import * as styles from '../Companies/Companies.css'
@@ -26,7 +26,7 @@ const Users = () => {
   const actionData = useActionData() as GetUserProfilesResult
   const { formatMessage } = useLocale()
   const navigate = useNavigate()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const { isSubmitting, isLoading } = useSubmitting()
   const users = actionData?.data?.data
   const [error, setError] = useState({ hasError: false, message: '' })
diff --git a/libs/portals/core/src/components/PortalProvider.tsx b/libs/portals/core/src/components/PortalProvider.tsx
index 5aff6abb53a8..6c2159127d72 100644
--- a/libs/portals/core/src/components/PortalProvider.tsx
+++ b/libs/portals/core/src/components/PortalProvider.tsx
@@ -1,13 +1,13 @@
-import { useLocale } from '@island.is/localization'
-import { createContext, useContext, useMemo } from 'react'
-import { useLocation, matchPath, Outlet } from 'react-router-dom'
-import { PortalModule, PortalRoute, PortalType } from '../types/portalCore'
-import { useAuth } from '@island.is/auth/react'
 import {
   ApolloClient,
-  useApolloClient,
   NormalizedCacheObject,
+  useApolloClient,
 } from '@apollo/client'
+import { useLocale } from '@island.is/localization'
+import { useUserInfo } from '@island.is/react-spa/bff'
+import { createContext, useContext, useMemo } from 'react'
+import { Outlet, matchPath, useLocation } from 'react-router-dom'
+import { PortalModule, PortalRoute, PortalType } from '../types/portalCore'
 
 export type PortalMeta = {
   portalType: PortalType
@@ -44,7 +44,7 @@ export const PortalProvider = ({
   routes,
 }: PortalProviderProps) => {
   const { pathname } = useLocation()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const { formatMessage } = useLocale()
   const client = useApolloClient() as ApolloClient<NormalizedCacheObject>
 
diff --git a/libs/portals/core/src/components/PortalRouter.tsx b/libs/portals/core/src/components/PortalRouter.tsx
index 38038aa1a0c1..d85ec65d0837 100644
--- a/libs/portals/core/src/components/PortalRouter.tsx
+++ b/libs/portals/core/src/components/PortalRouter.tsx
@@ -1,24 +1,24 @@
-import React, { useEffect, useState, useRef } from 'react'
+import React, { useEffect, useRef, useState } from 'react'
 import {
-  createBrowserRouter,
   RouteObject,
   RouterProvider,
+  createBrowserRouter,
 } from 'react-router-dom'
 
 import {
-  useApolloClient,
   ApolloClient,
   NormalizedCacheObject,
+  useApolloClient,
 } from '@apollo/client'
 import { useLocale } from '@island.is/localization'
-import { useFeatureFlagClient } from '@island.is/react/feature-flags'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { LoadingScreen } from '@island.is/react/components'
-import { createModuleRoutes } from '../utils/router/createModuleRoutes'
+import { useFeatureFlagClient } from '@island.is/react/feature-flags'
+import { m } from '../lib/messages'
 import { PortalModule, PortalRoute } from '../types/portalCore'
-import { PortalMeta, PortalProvider } from './PortalProvider'
+import { createModuleRoutes } from '../utils/router/createModuleRoutes'
 import { prepareRouterData } from '../utils/router/prepareRouterData'
-import { m } from '../lib/messages'
+import { PortalMeta, PortalProvider } from './PortalProvider'
 
 type PortalRouterProps = {
   modules: PortalModule[]
@@ -37,7 +37,7 @@ export const PortalRouter = ({
   const { formatMessage } = useLocale()
   const router = useRef<ReturnType<typeof createBrowserRouter>>()
   const [error, setError] = useState<Error | null>(null)
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const featureFlagClient = useFeatureFlagClient()
   const [routerData, setRouterData] = useState<{
     modules: PortalModule[]
diff --git a/libs/portals/core/src/hooks/useModuleProps.ts b/libs/portals/core/src/hooks/useModuleProps.ts
index a6e18220c078..895bc5744f57 100644
--- a/libs/portals/core/src/hooks/useModuleProps.ts
+++ b/libs/portals/core/src/hooks/useModuleProps.ts
@@ -3,10 +3,10 @@ import {
   ApolloClient,
   NormalizedCacheObject,
 } from '@apollo/client'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 
 export const useModuleProps = () => {
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const client = useApolloClient() as ApolloClient<NormalizedCacheObject>
 
   if (userInfo === null) {
diff --git a/libs/portals/core/src/hooks/useNavigation.ts b/libs/portals/core/src/hooks/useNavigation.ts
index fe7156246abe..344ec5840b6c 100644
--- a/libs/portals/core/src/hooks/useNavigation.ts
+++ b/libs/portals/core/src/hooks/useNavigation.ts
@@ -1,6 +1,6 @@
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { useMemo } from 'react'
 import { useLocation } from 'react-router-dom'
-import { useAuth } from '@island.is/auth/react'
 import { useRoutes } from '../components/PortalProvider'
 import { PortalNavigationItem } from '../types/portalCore'
 import { filterNavigationTree } from '../utils/filterNavigationTree/filterNavigationTree'
@@ -9,7 +9,7 @@ export const useNavigation = (
   navigation: PortalNavigationItem,
   dynamicRouteArray?: string[],
 ) => {
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const routes = useRoutes()
   const { pathname } = useLocation()
 
diff --git a/libs/portals/core/src/index.ts b/libs/portals/core/src/index.ts
index 398eba645449..228aa2fa7539 100644
--- a/libs/portals/core/src/index.ts
+++ b/libs/portals/core/src/index.ts
@@ -1,3 +1,6 @@
+// mocks
+export * from './mocks'
+
 // libs
 export * from './lib/paths'
 export * from './lib/messages'
diff --git a/libs/portals/core/src/mocks/index.ts b/libs/portals/core/src/mocks/index.ts
new file mode 100644
index 000000000000..2d1618cb1f70
--- /dev/null
+++ b/libs/portals/core/src/mocks/index.ts
@@ -0,0 +1 @@
+export const isMockMode = process.env.API_MOCKS === 'true'
diff --git a/libs/portals/core/src/screens/AccessDenied.tsx b/libs/portals/core/src/screens/AccessDenied.tsx
index ac7b5b5854c4..8ae9d5caa7dd 100644
--- a/libs/portals/core/src/screens/AccessDenied.tsx
+++ b/libs/portals/core/src/screens/AccessDenied.tsx
@@ -1,5 +1,5 @@
 import { useLocale } from '@island.is/localization'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { checkDelegation } from '@island.is/shared/utils'
 
 import { m } from '../lib/messages'
@@ -7,7 +7,7 @@ import { Problem } from '@island.is/react-spa/shared'
 
 export const AccessDenied = () => {
   const { formatMessage } = useLocale()
-  const { userInfo: user } = useAuth()
+  const user = useUserInfo()
   const isDelegation = user && checkDelegation(user)
 
   return (
diff --git a/libs/portals/core/src/screens/ModuleRoute.tsx b/libs/portals/core/src/screens/ModuleRoute.tsx
index ef37780576d7..156082b039f1 100644
--- a/libs/portals/core/src/screens/ModuleRoute.tsx
+++ b/libs/portals/core/src/screens/ModuleRoute.tsx
@@ -5,7 +5,7 @@ import { PortalRoute } from '../types/portalCore'
 import { usePortalMeta } from '../components/PortalProvider'
 import { plausiblePageviewDetail } from '../utils/plausible'
 import { Box } from '@island.is/island-ui/core'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 
 type ModuleRouteProps = {
   route: PortalRoute
@@ -14,7 +14,7 @@ type ModuleRouteProps = {
 export const ModuleRoute = React.memo(({ route }: ModuleRouteProps) => {
   const location = useLocation()
   const { basePath, portalTitle } = usePortalMeta()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const { formatMessage } = useLocale()
 
   useEffect(() => {
diff --git a/libs/portals/core/src/types/portalCore.ts b/libs/portals/core/src/types/portalCore.ts
index 5dc5375c089d..fb426c2a1890 100644
--- a/libs/portals/core/src/types/portalCore.ts
+++ b/libs/portals/core/src/types/portalCore.ts
@@ -6,7 +6,7 @@ import { RouteObject } from 'react-router-dom'
 
 import type { Features } from '@island.is/react/feature-flags'
 import { IconProps } from '@island.is/island-ui/core'
-import { User } from '@island.is/shared/types'
+import { BffUser } from '@island.is/shared/types'
 import { OrganizationSlugType } from '@island.is/shared/constants'
 
 /**
@@ -79,7 +79,7 @@ export interface PortalNavigationItem {
  * The props provided to a  portal module
  */
 export interface PortalModuleProps {
-  userInfo: User
+  userInfo: BffUser
 }
 
 export interface PortalModuleRoutesProps extends PortalModuleProps {
@@ -166,7 +166,7 @@ export interface PortalModule {
   /**
    * Indicates if module is enabled or not
    */
-  enabled?: (props: { userInfo: User; isCompany: boolean }) => boolean
+  enabled?: (props: { userInfo: BffUser; isCompany: boolean }) => boolean
 
   /**
    * The layout type of the module
diff --git a/libs/portals/core/src/utils/modules.ts b/libs/portals/core/src/utils/modules.ts
index 33c3b6449df2..09b85d297fb3 100644
--- a/libs/portals/core/src/utils/modules.ts
+++ b/libs/portals/core/src/utils/modules.ts
@@ -1,6 +1,6 @@
 import { FormatMessage } from '@island.is/localization'
 import flatten from 'lodash/flatten'
-import type { User } from '@island.is/shared/types'
+import type { BffUser } from '@island.is/shared/types'
 import { FeatureFlagClient } from '@island.is/react/feature-flags'
 import type { PortalModule, PortalRoute } from '../types/portalCore'
 import { ApolloClient, NormalizedCacheObject } from '@apollo/client'
@@ -8,7 +8,7 @@ import { ApolloClient, NormalizedCacheObject } from '@apollo/client'
 interface FilterEnabledModulesArgs {
   modules: PortalModule[]
   featureFlagClient: FeatureFlagClient
-  userInfo: User
+  userInfo: BffUser
 }
 
 export const filterEnabledModules = async ({
@@ -41,7 +41,7 @@ export const filterEnabledModules = async ({
 }
 
 interface ArrangeRoutesArgs {
-  userInfo: User
+  userInfo: BffUser
   modules: PortalModule[]
   featureFlagClient: FeatureFlagClient
   client: ApolloClient<NormalizedCacheObject>
diff --git a/libs/portals/core/src/utils/router/prepareRouterData.ts b/libs/portals/core/src/utils/router/prepareRouterData.ts
index 7534f0de5233..d0959b3d9cb8 100644
--- a/libs/portals/core/src/utils/router/prepareRouterData.ts
+++ b/libs/portals/core/src/utils/router/prepareRouterData.ts
@@ -2,11 +2,11 @@ import { ApolloClient, NormalizedCacheObject } from '@apollo/client'
 import { FormatMessage } from '@island.is/localization'
 import { arrangeRoutes, filterEnabledModules } from '../modules'
 import { FeatureFlagClient } from '@island.is/feature-flags'
-import { User } from '@island.is/shared/types'
+import { BffUser } from '@island.is/shared/types'
 import { PortalModule, PortalRoute } from '../../types/portalCore'
 
 export type PrepareRouterDataProps = {
-  userInfo: User
+  userInfo: BffUser
   featureFlagClient: FeatureFlagClient
   modules: PortalModule[]
   client: ApolloClient<NormalizedCacheObject>
@@ -16,7 +16,7 @@ export type PrepareRouterDataProps = {
 export type PrepareRouterDataReturnType = {
   modules: PortalModule[]
   routes: PortalRoute[]
-  userInfo: User
+  userInfo: BffUser
   formatMessage: FormatMessage
 }
 
diff --git a/libs/portals/shared-modules/delegations/src/components/access/AccessConfirmModal.tsx b/libs/portals/shared-modules/delegations/src/components/access/AccessConfirmModal.tsx
index 740c1f015906..dbb8f00a3c9e 100644
--- a/libs/portals/shared-modules/delegations/src/components/access/AccessConfirmModal.tsx
+++ b/libs/portals/shared-modules/delegations/src/components/access/AccessConfirmModal.tsx
@@ -1,6 +1,6 @@
 import { isDefined } from '@island.is/shared/utils'
 import { AuthDelegationScope } from '@island.is/api/schema'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { Box, useBreakpoint } from '@island.is/island-ui/core'
 import { useLocale } from '@island.is/localization'
 import { formatNationalId, m as coreMessages } from '@island.is/portals/core'
@@ -37,7 +37,7 @@ export const AccessConfirmModal = ({
   ...rest
 }: AccessConfirmModalProps) => {
   const { formatMessage } = useLocale()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const { md } = useBreakpoint()
   const [error, setError] = useState(formError ?? false)
 
diff --git a/libs/portals/shared-modules/delegations/src/components/access/AccessDeleteModal/AccessDeleteModal.tsx b/libs/portals/shared-modules/delegations/src/components/access/AccessDeleteModal/AccessDeleteModal.tsx
index 81903fff5335..1ae08d68f59a 100644
--- a/libs/portals/shared-modules/delegations/src/components/access/AccessDeleteModal/AccessDeleteModal.tsx
+++ b/libs/portals/shared-modules/delegations/src/components/access/AccessDeleteModal/AccessDeleteModal.tsx
@@ -1,24 +1,24 @@
 import { useEffect, useState } from 'react'
 
-import { useAuth } from '@island.is/auth/react'
 import { Box, toast, useBreakpoint } from '@island.is/island-ui/core'
 import { useLocale } from '@island.is/localization'
 import { formatNationalId } from '@island.is/portals/core'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { Problem } from '@island.is/react-spa/shared'
 import { Modal, ModalProps } from '@island.is/react/components'
 import { AuthDelegationType } from '@island.is/shared/types'
 
-import { DelegationsFormFooter } from '../../delegations/DelegationsFormFooter'
-import { IdentityCard } from '../../IdentityCard/IdentityCard'
-import { AccessListContainer } from '../AccessList/AccessListContainer/AccessListContainer'
-import { useAuthScopeTreeLazyQuery } from '../AccessList/AccessListContainer/AccessListContainer.generated'
-import { useDeleteAuthDelegationMutation } from './AccessDeleteModal.generated'
+import { useDynamicShadow } from '../../../hooks/useDynamicShadow'
+import { m } from '../../../lib/messages'
 import {
   AuthCustomDelegation,
   AuthCustomDelegationOutgoing,
 } from '../../../types/customDelegation'
-import { m } from '../../../lib/messages'
-import { useDynamicShadow } from '../../../hooks/useDynamicShadow'
+import { IdentityCard } from '../../IdentityCard/IdentityCard'
+import { DelegationsFormFooter } from '../../delegations/DelegationsFormFooter'
+import { AccessListContainer } from '../AccessList/AccessListContainer/AccessListContainer'
+import { useAuthScopeTreeLazyQuery } from '../AccessList/AccessListContainer/AccessListContainer.generated'
+import { useDeleteAuthDelegationMutation } from './AccessDeleteModal.generated'
 
 type AccessDeleteModalProps = Pick<ModalProps, 'onClose' | 'isVisible'> & {
   delegation?: AuthCustomDelegation
@@ -32,7 +32,7 @@ export const AccessDeleteModal = ({
   ...rest
 }: AccessDeleteModalProps) => {
   const { formatMessage, lang } = useLocale()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const { md } = useBreakpoint()
   const [error, setError] = useState(false)
   const [deleteAuthDelegation, { loading }] = useDeleteAuthDelegationMutation()
diff --git a/libs/portals/shared-modules/delegations/src/screens/AccessControl.tsx b/libs/portals/shared-modules/delegations/src/screens/AccessControl.tsx
index bda0137d5844..ea32968da1da 100644
--- a/libs/portals/shared-modules/delegations/src/screens/AccessControl.tsx
+++ b/libs/portals/shared-modules/delegations/src/screens/AccessControl.tsx
@@ -1,11 +1,10 @@
-import React from 'react'
-import { useNavigate } from 'react-router-dom'
-import { useLocation } from 'react-use'
 import { Box, Button, GridColumn, Tabs } from '@island.is/island-ui/core'
-import { IntroHeader, usePortalMeta } from '@island.is/portals/core'
 import { useLocale, useNamespaces } from '@island.is/localization'
-import { useAuth } from '@island.is/auth/react'
+import { IntroHeader, usePortalMeta } from '@island.is/portals/core'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { isDefined } from '@island.is/shared/utils'
+import { useNavigate } from 'react-router-dom'
+import { useLocation } from 'react-use'
 import { DelegationsIncoming } from '../components/delegations/incoming/DelegationsIncoming'
 import { DelegationsOutgoing } from '../components/delegations/outgoing/DelegationsOutgoing'
 import { m } from '../lib/messages'
@@ -18,7 +17,7 @@ const AccessControl = () => {
   useNamespaces(['sp.access-control-delegations'])
 
   const { formatMessage } = useLocale()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const navigate = useNavigate()
   const location = useLocation()
   const { basePath } = usePortalMeta()
diff --git a/libs/portals/shared-modules/delegations/src/screens/GrantAccess/GrantAccess.tsx b/libs/portals/shared-modules/delegations/src/screens/GrantAccess/GrantAccess.tsx
index b9244ccbbabd..60b74e5bd3d0 100644
--- a/libs/portals/shared-modules/delegations/src/screens/GrantAccess/GrantAccess.tsx
+++ b/libs/portals/shared-modules/delegations/src/screens/GrantAccess/GrantAccess.tsx
@@ -1,36 +1,38 @@
 import cn from 'classnames'
 import * as kennitala from 'kennitala'
-import get from 'lodash/get'
 import React, { useEffect, useState } from 'react'
-import { defineMessage } from 'react-intl'
 import { Control, FormProvider, useForm } from 'react-hook-form'
+import { defineMessage } from 'react-intl'
 import { useNavigate } from 'react-router-dom'
 
-import { useUserInfo } from '@island.is/auth/react'
 import {
   Box,
-  Input,
   Icon,
-  toast,
-  Text,
+  Input,
   SkeletonLoader,
+  Text,
+  toast,
   useBreakpoint,
 } from '@island.is/island-ui/core'
 import { useLocale, useNamespaces } from '@island.is/localization'
-import { IntroHeader } from '@island.is/portals/core'
-import { formatNationalId, m as coreMessages } from '@island.is/portals/core'
+import {
+  IntroHeader,
+  m as coreMessages,
+  formatNationalId,
+} from '@island.is/portals/core'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { Problem } from '@island.is/react-spa/shared'
 import {
   InputController,
   SelectController,
 } from '@island.is/shared/form-fields'
 
-import { DelegationsFormFooter } from '../../components/delegations/DelegationsFormFooter'
 import { IdentityCard } from '../../components/IdentityCard/IdentityCard'
-import { DomainOption, useDomains } from '../../hooks/useDomains/useDomains'
+import { DelegationsFormFooter } from '../../components/delegations/DelegationsFormFooter'
 import { ALL_DOMAINS } from '../../constants/domain'
-import { DelegationPaths } from '../../lib/paths'
+import { DomainOption, useDomains } from '../../hooks/useDomains/useDomains'
 import { m } from '../../lib/messages'
+import { DelegationPaths } from '../../lib/paths'
 import {
   useCreateAuthDelegationMutation,
   useIdentityLazyQuery,
diff --git a/libs/react-spa/bff/.babelrc b/libs/react-spa/bff/.babelrc
new file mode 100644
index 000000000000..1ea870ead410
--- /dev/null
+++ b/libs/react-spa/bff/.babelrc
@@ -0,0 +1,12 @@
+{
+  "presets": [
+    [
+      "@nx/react/babel",
+      {
+        "runtime": "automatic",
+        "useBuiltIns": "usage"
+      }
+    ]
+  ],
+  "plugins": []
+}
diff --git a/libs/react-spa/bff/.eslintrc.json b/libs/react-spa/bff/.eslintrc.json
new file mode 100644
index 000000000000..75b85077debb
--- /dev/null
+++ b/libs/react-spa/bff/.eslintrc.json
@@ -0,0 +1,18 @@
+{
+  "extends": ["plugin:@nx/react", "../../../.eslintrc.json"],
+  "ignorePatterns": ["!**/*"],
+  "overrides": [
+    {
+      "files": ["*.ts", "*.tsx", "*.js", "*.jsx"],
+      "rules": {}
+    },
+    {
+      "files": ["*.ts", "*.tsx"],
+      "rules": {}
+    },
+    {
+      "files": ["*.js", "*.jsx"],
+      "rules": {}
+    }
+  ]
+}
diff --git a/libs/react-spa/bff/README.md b/libs/react-spa/bff/README.md
new file mode 100644
index 000000000000..53a6d1e6ec85
--- /dev/null
+++ b/libs/react-spa/bff/README.md
@@ -0,0 +1,7 @@
+# React SPA BFF
+
+This library is intended to be used by a React SPA application. It handles authentication with a BFF(Backend For Frontend) server.
+
+## Running unit tests
+
+Run `nx test react-spa-bff` to execute the unit tests via [Jest](https://jestjs.io).
diff --git a/libs/react-spa/bff/jest.config.ts b/libs/react-spa/bff/jest.config.ts
new file mode 100644
index 000000000000..46183d6c70f0
--- /dev/null
+++ b/libs/react-spa/bff/jest.config.ts
@@ -0,0 +1,11 @@
+/* eslint-disable */
+export default {
+  displayName: 'bff',
+  preset: '../../../jest.preset.js',
+  transform: {
+    '^(?!.*\\.(js|jsx|ts|tsx|css|json)$)': '@nx/react/plugins/jest',
+    '^.+\\.[tj]sx?$': ['babel-jest', { presets: ['@nx/react/babel'] }],
+  },
+  moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx'],
+  coverageDirectory: '../../../coverage/libs/react-spa/bff',
+}
diff --git a/libs/react-spa/bff/project.json b/libs/react-spa/bff/project.json
new file mode 100644
index 000000000000..252e6f2aab94
--- /dev/null
+++ b/libs/react-spa/bff/project.json
@@ -0,0 +1,19 @@
+{
+  "name": "react-spa-bff",
+  "$schema": "../../../node_modules/nx/schemas/project-schema.json",
+  "sourceRoot": "libs/react-spa/bff/src",
+  "projectType": "library",
+  "tags": ["lib:react-spa", "scope:react-spa"],
+  "targets": {
+    "lint": {
+      "executor": "@nx/eslint:lint"
+    },
+    "test": {
+      "executor": "@nx/jest:jest",
+      "outputs": ["{workspaceRoot}/coverage/{projectRoot}"],
+      "options": {
+        "jestConfig": "libs/react-spa/bff/jest.config.ts"
+      }
+    }
+  }
+}
diff --git a/libs/react-spa/bff/src/index.ts b/libs/react-spa/bff/src/index.ts
new file mode 100644
index 000000000000..d535a9f34f45
--- /dev/null
+++ b/libs/react-spa/bff/src/index.ts
@@ -0,0 +1,4 @@
+export * from './lib/BffProvider'
+export * from './lib/bff.hooks'
+export * from './lib/bff.utils'
+export * from './lib/bff.mocks'
diff --git a/libs/react-spa/bff/src/lib/BffContext.tsx b/libs/react-spa/bff/src/lib/BffContext.tsx
new file mode 100644
index 000000000000..dc8657b37e92
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/BffContext.tsx
@@ -0,0 +1,15 @@
+import { createContext } from 'react'
+
+import { BffReducerState } from './bff.state'
+
+export type BffContextType = BffReducerState & {
+  signIn(): void
+  signOut(): void
+  switchUser(nationalId?: string): void
+  bffUrlGenerator(
+    relativePath?: string,
+    params?: Record<string, string>,
+  ): string
+}
+
+export const BffContext = createContext<BffContextType | undefined>(undefined)
diff --git a/libs/react-spa/bff/src/lib/BffPoller.tsx b/libs/react-spa/bff/src/lib/BffPoller.tsx
new file mode 100644
index 000000000000..223640bcdaf8
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/BffPoller.tsx
@@ -0,0 +1,97 @@
+import { usePolling } from '@island.is/react-spa/shared'
+import { BffUser } from '@island.is/shared/types'
+import { ReactNode, useCallback, useEffect, useMemo } from 'react'
+import {
+  BffBroadcastEvents,
+  useBff,
+  useBffBroadcaster,
+  useUserInfo,
+} from './bff.hooks'
+import { isNewSession } from './bff.utils'
+
+type BffPollerProps = {
+  children: ReactNode
+  newSessionCb(): void
+  pollIntervalMS?: number
+}
+
+/**
+ * BffPoller component continuously polls the user's session
+ * information from the backend and broadcasts session changes across tabs
+ * or windows using the BroadcastChannel API. It checks for changes in the
+ * user's session data and triggers appropriate actions like displaying a
+ * session expired modal when necessary.
+ *
+ * Features:
+ * - Polls the backend at a specified interval to fetch user session data.
+ * - If the user's session expires or the backend returns an error, it
+ *   automatically triggers a sign-in process.
+ * - If a change in user session (e.g., a new session ID) is detected, it
+ *   broadcasts a message to all open tabs/windows and triggers the provided
+ *   `newSessionCb` callback to handle the current tab/window.
+ *
+ * @param newSessionCb - Callback function to be called when a new session is detected.
+ * @param pollIntervalMS - Polling interval in milliseconds. Default is 10000ms.
+ *
+ * @usage:
+ * Wrap your application's root component with BffPoller to continuously
+ * monitor the user's session and keep session state synchronized across
+ * multiple tabs/windows.
+ */
+export const BffPoller = ({
+  children,
+  newSessionCb,
+  pollIntervalMS = 10000,
+}: BffPollerProps) => {
+  const { signIn, bffUrlGenerator } = useBff()
+  const userInfo = useUserInfo()
+  const { postMessage } = useBffBroadcaster()
+
+  const url = useMemo(
+    () => bffUrlGenerator('/user', { refresh: 'true' }),
+    [bffUrlGenerator],
+  )
+
+  const fetchUser = useCallback(async () => {
+    const res = await fetch(url, {
+      credentials: 'include',
+    })
+
+    if (!res.ok) {
+      signIn()
+
+      return
+    }
+
+    return res.json() as Promise<BffUser>
+  }, [url, signIn])
+
+  // Poll user data every 10 seconds
+  const { data: newUser, error } = usePolling({
+    fetcher: fetchUser,
+    intervalMs: pollIntervalMS,
+    waitToStartMS: 5000,
+  })
+
+  useEffect(() => {
+    if (error) {
+      // If user polling fails, likely due to 401, then sign in.
+      signIn()
+    } else if (newUser) {
+      // If session has changed (e.g. delegation switch), then notifiy tabs/windows/iframes and execute the callback.
+      if (isNewSession(newUser, userInfo)) {
+        // Note! The tab, window, or iframe that sends this message will not receive it.
+        // This is because the BroadcastChannel API does not broadcast messages to the sender.
+        // Therefore we need to manually handle the new session in the current tab/window, by calling the newSessionCb().
+        postMessage({
+          type: BffBroadcastEvents.NEW_SESSION,
+          userInfo: newUser,
+        })
+
+        newSessionCb()
+      }
+    }
+  }, [newUser, error, userInfo, signIn, postMessage, newSessionCb])
+
+  return children
+}
diff --git a/libs/react-spa/bff/src/lib/BffProvider.tsx b/libs/react-spa/bff/src/lib/BffProvider.tsx
new file mode 100644
index 000000000000..b04a1a6143be
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/BffProvider.tsx
@@ -0,0 +1,237 @@
+import { useEffectOnce } from '@island.is/react-spa/shared'
+import { ReactNode, useCallback, useEffect, useReducer, useState } from 'react'
+
+import { LoadingScreen } from '@island.is/react/components'
+import { BffContext } from './BffContext'
+import { BffPoller } from './BffPoller'
+import { BffSessionExpiredModal } from './BffSessionExpiredModal'
+import { ErrorScreen } from './ErrorScreen'
+import { BffBroadcastEvents, useBffBroadcaster } from './bff.hooks'
+import { ActionType, LoggedInState, initialState, reducer } from './bff.state'
+import { createBffUrlGenerator, isNewSession } from './bff.utils'
+
+const BFF_SERVER_UNAVAILABLE = 'BFF_SERVER_UNAVAILABLE'
+
+type BffProviderProps = {
+  children: ReactNode
+  /**
+   * The base path of the application.
+   */
+  applicationBasePath: string
+  mockedInitialState?: LoggedInState
+}
+
+export const BffProvider = ({
+  children,
+  applicationBasePath,
+  mockedInitialState,
+}: BffProviderProps) => {
+  const [showSessionExpiredScreen, setSessionExpiredScreen] = useState(false)
+  const bffUrlGenerator = createBffUrlGenerator(applicationBasePath)
+  const [state, dispatch] = useReducer(
+    reducer,
+    mockedInitialState ?? initialState,
+  )
+
+  const { authState } = state
+  const showErrorScreen = authState === 'error'
+  const showLoadingScreen =
+    authState === 'loading' ||
+    authState === 'switching' ||
+    authState === 'logging-out'
+  const isLoggedIn = authState === 'logged-in'
+
+  const { postMessage } = useBffBroadcaster((event) => {
+    if (
+      isLoggedIn &&
+      event.data.type === BffBroadcastEvents.NEW_SESSION &&
+      isNewSession(state.userInfo, event.data.userInfo)
+    ) {
+      setSessionExpiredScreen(true)
+    } else if (event.data.type === BffBroadcastEvents.LOGOUT) {
+      // We will wait 1 seconds before we dispatch logout action.
+      // The reason is that IDS will not log the user out immediately.
+      // Note! The bff poller may have triggered logout by that time anyways.
+      setTimeout(() => {
+        dispatch({
+          type: ActionType.LOGGED_OUT,
+        })
+
+        signIn()
+      }, 1000)
+    }
+  })
+
+  useEffect(() => {
+    if (isLoggedIn) {
+      // Broadcast to all tabs/windows/iframes that a new session has started
+      postMessage({
+        type: BffBroadcastEvents.NEW_SESSION,
+        userInfo: state.userInfo,
+      })
+    }
+  }, [postMessage, state.userInfo, isLoggedIn])
+
+  const checkLogin = async (noRefresh = false) => {
+    dispatch({
+      type: ActionType.SIGNIN_START,
+    })
+
+    try {
+      const url = bffUrlGenerator('/user', {
+        refresh: noRefresh.toString(),
+      })
+
+      const res = await fetch(url, {
+        credentials: 'include',
+      })
+
+      if (!res.ok) {
+        // Bff server is down
+        if (res.status >= 500) {
+          throw new Error(BFF_SERVER_UNAVAILABLE)
+        }
+
+        // For other none ok responses, like 401/403, proceed with sign-in redirect.
+        signIn()
+
+        return
+      }
+
+      const user = await res.json()
+
+      dispatch({
+        type: ActionType.SIGNIN_SUCCESS,
+        payload: user,
+      })
+    } catch (error) {
+      dispatch({
+        type: ActionType.ERROR,
+        payload: error,
+      })
+    }
+  }
+
+  const signIn = useCallback(() => {
+    dispatch({
+      type: ActionType.SIGNIN_START,
+    })
+
+    window.location.href = bffUrlGenerator('/login', {
+      target_link_uri: window.location.href,
+    })
+  }, [bffUrlGenerator])
+
+  const signOut = useCallback(() => {
+    if (!state.userInfo) {
+      return
+    }
+
+    dispatch({
+      type: ActionType.LOGGING_OUT,
+    })
+
+    // Broadcast to all tabs/windows/iframes that the user is logging out
+    postMessage({
+      type: BffBroadcastEvents.LOGOUT,
+    })
+
+    window.location.href = bffUrlGenerator('/logout', {
+      sid: state.userInfo.profile.sid,
+    })
+  }, [bffUrlGenerator, postMessage, state.userInfo])
+
+  const switchUser = (nationalId?: string) => {
+    dispatch({
+      type: ActionType.SWITCH_USER,
+    })
+
+    window.location.href = bffUrlGenerator(
+      '/login',
+      nationalId
+        ? {
+            login_hint: nationalId,
+          }
+        : {
+            prompt: 'select_account',
+          },
+    )
+  }
+
+  const checkQueryStringError = () => {
+    const urlParams = new URLSearchParams(window.location.search)
+    const error = urlParams.get('bff_error_code')
+    const errorDescription = urlParams.get('bff_error_description')
+
+    if (error) {
+      dispatch({
+        type: ActionType.ERROR,
+        payload: new Error(`${error}: ${errorDescription}`),
+      })
+    }
+
+    // Returns true if there is an error
+    return !!error
+  }
+
+  useEffectOnce(() => {
+    const hasError = checkQueryStringError()
+
+    if (!hasError && !isLoggedIn) {
+      checkLogin()
+    }
+  })
+
+  const newSessionCb = useCallback(() => {
+    setSessionExpiredScreen(true)
+  }, [])
+
+  const onRetry = () => {
+    window.location.href = applicationBasePath
+  }
+
+  const renderContent = () => {
+    if (mockedInitialState) {
+      return children
+    }
+
+    if (showErrorScreen) {
+      return (
+        <ErrorScreen
+          onRetry={onRetry}
+          {...(state?.error?.message === BFF_SERVER_UNAVAILABLE && {
+            title: 'Þjónusta liggur niðri',
+          })}
+        />
+      )
+    }
+
+    if (showLoadingScreen) {
+      return <LoadingScreen ariaLabel="Er að vinna í innskráningu" />
+    }
+
+    if (showSessionExpiredScreen) {
+      return <BffSessionExpiredModal onLogin={signIn} />
+    }
+
+    if (isLoggedIn) {
+      return <BffPoller newSessionCb={newSessionCb}>{children}</BffPoller>
+    }
+
+    return null
+  }
+
+  return (
+    <BffContext.Provider
+      value={{
+        ...state,
+        signIn,
+        signOut,
+        switchUser,
+        bffUrlGenerator,
+      }}
+    >
+      {renderContent()}
+    </BffContext.Provider>
+  )
+}
diff --git a/libs/react-spa/bff/src/lib/BffSessionExpiredModal.tsx b/libs/react-spa/bff/src/lib/BffSessionExpiredModal.tsx
new file mode 100644
index 000000000000..0e7e5545568c
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/BffSessionExpiredModal.tsx
@@ -0,0 +1,40 @@
+import { Box, Button, ProblemTemplate } from '@island.is/island-ui/core'
+import { fullScreen } from './ErrorScreen.css'
+
+type BffSessionExpiredModalProps = {
+  /**
+   * Login callback
+   */
+  onLogin(): void
+}
+
+/**
+ * This screen is unfortunately not translated because at this point we don't have a user locale.
+ */
+export const BffSessionExpiredModal = ({
+  onLogin,
+}: BffSessionExpiredModalProps) => (
+  <Box
+    display="flex"
+    justifyContent="center"
+    alignItems="center"
+    padding={[0, 6]}
+    className={fullScreen}
+  >
+    <ProblemTemplate
+      variant="warning"
+      expand
+      tag=""
+      title="Innskráning útrunnin"
+      message={
+        <>
+          Þú hefur skráð þig inn í öðru umboði. Viltu{' '}
+          <Button variant="text" onClick={onLogin}>
+            skrá þig
+          </Button>{' '}
+          aftur inn?
+        </>
+      }
+    />
+  </Box>
+)
diff --git a/libs/react-spa/bff/src/lib/ErrorScreen.css.ts b/libs/react-spa/bff/src/lib/ErrorScreen.css.ts
new file mode 100644
index 000000000000..62d600b0be1b
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/ErrorScreen.css.ts
@@ -0,0 +1,5 @@
+import { style } from '@vanilla-extract/css'
+
+export const fullScreen = style({
+  height: '100vh',
+})
diff --git a/libs/react-spa/bff/src/lib/ErrorScreen.tsx b/libs/react-spa/bff/src/lib/ErrorScreen.tsx
new file mode 100644
index 000000000000..dbb6b48f1ed4
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/ErrorScreen.tsx
@@ -0,0 +1,41 @@
+import { Box, Button, ProblemTemplate } from '@island.is/island-ui/core'
+import { fullScreen } from './ErrorScreen.css'
+
+type ErrorScreenProps = {
+  title?: string
+  /**
+   * Retry callback
+   */
+  onRetry(): void
+}
+
+/**
+ * This screen is unfortunately not translated because at this point we don't have a user locale.
+ */
+export const ErrorScreen = ({
+  title = 'Innskráning mistókst',
+  onRetry,
+}: ErrorScreenProps) => (
+  <Box
+    display="flex"
+    justifyContent="center"
+    alignItems="center"
+    padding={[0, 6]}
+    className={fullScreen}
+  >
+    <ProblemTemplate
+      variant="error"
+      expand
+      tag="Villa"
+      title={title}
+      message={
+        <>
+          Vinsamlegast reyndu aftur síðar.{' '}
+          <Button variant="text" onClick={onRetry}>
+            Reyna aftur
+          </Button>
+        </>
+      }
+    />
+  </Box>
+)
diff --git a/libs/react-spa/bff/src/lib/bff.hooks.ts b/libs/react-spa/bff/src/lib/bff.hooks.ts
new file mode 100644
index 000000000000..b1cf35fa4281
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/bff.hooks.ts
@@ -0,0 +1,127 @@
+import { AuthContext } from '@island.is/auth/react'
+import { BffUser, User } from '@island.is/shared/types'
+import { useContext } from 'react'
+import { BffContext, BffContextType } from './BffContext'
+import { createBroadcasterHook } from '@island.is/react-spa/shared'
+
+/**
+ * Maps an object to a BffUser type.
+ */
+export const mapToBffUser = (input: User): BffUser => {
+  const {
+    profile: {
+      sid,
+      birthdate,
+      nationalId,
+      name,
+      idp,
+      actor,
+      subjectType,
+      delegationType,
+      locale,
+    },
+    scopes,
+  } = input
+
+  // Return a mapped BffUser object
+  return {
+    scopes: scopes || [],
+    profile: {
+      sid: sid || '',
+      birthdate,
+      nationalId,
+      name,
+      idp,
+      actor,
+      subjectType,
+      delegationType,
+      locale,
+    },
+  }
+}
+
+/**
+ * Dynamic hook to get the bff context.
+ */
+export const useDynamicBffHook = (hookName: string): BffContextType => {
+  const bffContext = useContext(BffContext)
+
+  if (!bffContext) {
+    throw new Error(`${hookName} must be used within a BffProvider`)
+  }
+
+  return bffContext
+}
+
+/**
+ * This hook is used to get the BFF authentication context.
+ * It has backward compatibility with AuthContext.
+ */
+export const useAuth = () => {
+  const bffContext = useContext(BffContext)
+  const authContext = useContext(AuthContext)
+
+  if (bffContext) {
+    return bffContext
+  }
+
+  if (authContext) {
+    return authContext
+  }
+
+  const errorMsg = (providerStr: string) =>
+    `useAuth must be used within a ${providerStr}`
+
+  if (!authContext) {
+    throw new Error(errorMsg('AuthProvider'))
+  }
+
+  throw new Error(errorMsg('BffProvider'))
+}
+
+/**
+ * This hook is used to get user information.
+ * It will determine what context to use based on the context that is available.
+ * We will remove support for AuthContext when other clients transition over to BFF.
+ * If AuthContext is being used then we will map the user info to the BffUser type.
+ */
+export const useUserInfo = (): BffUser => {
+  const bffContext = useContext(BffContext)
+  const authContext = useContext(AuthContext)
+
+  if (bffContext?.userInfo) {
+    return bffContext.userInfo
+  } else if (authContext?.userInfo) {
+    return mapToBffUser(authContext.userInfo)
+  }
+
+  throw new Error('User info is not available. Is the user authenticated?')
+}
+
+/**
+ * This hook is used to get the bff url generator.
+ * The bff url generator is used to generate urls for the Bff in a conveinent way.
+ */
+export const useBffUrlGenerator = () =>
+  useDynamicBffHook(useBffUrlGenerator.name).bffUrlGenerator
+
+export const useBff = () => useDynamicBffHook(useBff.name)
+
+export enum BffBroadcastEvents {
+  NEW_SESSION = 'NEW_SESSION',
+  LOGOUT = 'LOGOUT',
+}
+
+type NewSessionEvent = {
+  type: BffBroadcastEvents.NEW_SESSION
+  userInfo: BffUser
+}
+
+type LogoutEvent = {
+  type: BffBroadcastEvents.LOGOUT
+}
+
+export type BffBroadcastEvent = NewSessionEvent | LogoutEvent
+
+export const useBffBroadcaster =
+  createBroadcasterHook<BffBroadcastEvent>('bff_auth_channel')
diff --git a/libs/react-spa/bff/src/lib/bff.mocks.ts b/libs/react-spa/bff/src/lib/bff.mocks.ts
new file mode 100644
index 000000000000..2af096c1b055
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/bff.mocks.ts
@@ -0,0 +1,19 @@
+import { BffUser } from '@island.is/shared/types'
+import { LoggedInState } from './bff.state'
+
+export const createMockedInitialState = (
+  user?: Partial<BffUser>,
+): LoggedInState => ({
+  userInfo: {
+    profile: {
+      name: 'Mock',
+      locale: 'is',
+      nationalId: '0000000000',
+      ...user?.profile,
+    } as BffUser['profile'],
+    scopes: user?.scopes ?? [],
+  },
+  authState: 'logged-in',
+  isAuthenticated: true,
+  error: null,
+})
diff --git a/libs/react-spa/bff/src/lib/bff.state.ts b/libs/react-spa/bff/src/lib/bff.state.ts
new file mode 100644
index 000000000000..d23dfd4b4f30
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/bff.state.ts
@@ -0,0 +1,116 @@
+import { BffUser } from '@island.is/shared/types'
+
+// Defining the possible states for authentication
+export type BffState =
+  | 'logged-out'
+  | 'loading'
+  | 'logged-in'
+  | 'switching'
+  | 'logging-out'
+  | 'error'
+
+export enum ActionType {
+  SIGNIN_START = 'SIGNIN_START',
+  SIGNIN_SUCCESS = 'SIGNIN_SUCCESS',
+  LOGGING_OUT = 'LOGGING_OUT',
+  LOGGED_OUT = 'LOGGED_OUT',
+  SWITCH_USER = 'SWITCH_USER',
+  ERROR = 'ERROR',
+}
+
+type NonLoggedInAuthState = Exclude<BffState, 'logged-in'>
+
+export interface BffReducerStateBase {
+  authState: BffState
+  isAuthenticated: boolean
+  error?: Error | null
+}
+
+// State when the user is not logged in
+export interface NonLoggedInState extends BffReducerStateBase {
+  authState: NonLoggedInAuthState
+  userInfo: null
+}
+
+// State when the user is logged in
+export interface LoggedInState extends BffReducerStateBase {
+  authState: 'logged-in'
+  userInfo: BffUser
+  isAuthenticated: true
+}
+
+export type BffReducerState = NonLoggedInState | LoggedInState
+
+export const initialState: NonLoggedInState = {
+  userInfo: null,
+  authState: 'logged-out',
+  isAuthenticated: false,
+  error: null,
+}
+
+export type Action =
+  | {
+      type:
+        | ActionType.SIGNIN_START
+        | ActionType.LOGGING_OUT
+        | ActionType.LOGGED_OUT
+        | ActionType.SWITCH_USER
+    }
+  | { type: ActionType.SIGNIN_SUCCESS; payload: BffUser }
+  | { type: ActionType.ERROR; payload: Error }
+
+/**
+ * Helper function to reset user-related state when switching users or logging out
+ */
+const resetState = (authState: NonLoggedInAuthState): NonLoggedInState => ({
+  userInfo: null,
+  authState,
+  isAuthenticated: false,
+  error: null,
+})
+
+/**
+ * Reducer function to handle state transitions based on actions
+ */
+export const reducer = (
+  state: BffReducerState,
+  action: Action,
+): BffReducerState => {
+  switch (action.type) {
+    case ActionType.SIGNIN_START:
+      return {
+        ...state,
+        authState: 'loading',
+        userInfo: null,
+      }
+
+    case ActionType.SIGNIN_SUCCESS:
+      return {
+        ...state,
+        userInfo: action.payload,
+        authState: 'logged-in',
+        isAuthenticated: true,
+        error: null,
+      }
+
+    case ActionType.LOGGING_OUT:
+      return resetState('logging-out')
+
+    case ActionType.SWITCH_USER:
+      return resetState('switching')
+
+    case ActionType.ERROR:
+      return {
+        ...state,
+        error: action.payload,
+        authState: 'error',
+        userInfo: null,
+      }
+
+    case ActionType.LOGGED_OUT:
+      return initialState
+
+    default:
+      return state
+  }
+}
diff --git a/libs/react-spa/bff/src/lib/bff.utils.ts b/libs/react-spa/bff/src/lib/bff.utils.ts
new file mode 100644
index 000000000000..1c7ce0f0e1d9
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/bff.utils.ts
@@ -0,0 +1,48 @@
+import { BffUser } from '@island.is/shared/types'
+
+/**
+ * Creates a function that can generate a BFF URLs.
+ *
+ * @usage
+ * const bffBaseUrl = createBffUrlGenerator('/myapplication')
+ * const userUrl = bffBaseUrl('/user') // http://localhost:3010/myapplication/bff/user
+ * const userUrlWithParams = bffBaseUrl('/user', { id: '123' }) // http://localhost:3010/myapplication/bff/user?id=123
+ */
+export const createBffUrlGenerator = (basePath: string) => {
+  const sanitizedBasePath = sanitizePath(basePath)
+  const baseUrl = `${window.location.origin}/${sanitizedBasePath}/bff`
+
+  return (relativePath = '', params?: Record<string, string>) => {
+    const url = `${baseUrl}${relativePath}`
+
+    if (params) {
+      const qs = createQueryStr(params)
+
+      return `${url}${qs ? `?${qs}` : ''}`
+    }
+
+    return url
+  }
+}
+
+/**
+ * Trim any leading and trailing slashes
+ */
+const sanitizePath = (path: string) => path.replace(/^\/+|\/+$/g, '')
+
+/**
+ * Creates a query string from an object
+ */
+export const createQueryStr = (params: Record<string, string>) => {
+  return new URLSearchParams(params).toString()
+}
+
+/**
+ *  This method checks if the user has a new session
+ */
+export const isNewSession = (oldUser: BffUser, newUser: BffUser) => {
+  const oldSid = oldUser.profile.sid
+  const newSid = newUser.profile.sid
+
+  return oldSid && newSid && oldSid !== newSid
+}
diff --git a/libs/react-spa/bff/tsconfig.json b/libs/react-spa/bff/tsconfig.json
new file mode 100644
index 000000000000..4daaf45cd328
--- /dev/null
+++ b/libs/react-spa/bff/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "jsx": "react-jsx",
+    "allowJs": false,
+    "esModuleInterop": false,
+    "allowSyntheticDefaultImports": true,
+    "strict": true
+  },
+  "files": [],
+  "include": [],
+  "references": [
+    {
+      "path": "./tsconfig.lib.json"
+    },
+    {
+      "path": "./tsconfig.spec.json"
+    }
+  ],
+  "extends": "../../../tsconfig.base.json"
+}
diff --git a/libs/react-spa/bff/tsconfig.lib.json b/libs/react-spa/bff/tsconfig.lib.json
new file mode 100644
index 000000000000..21799b3e6ba3
--- /dev/null
+++ b/libs/react-spa/bff/tsconfig.lib.json
@@ -0,0 +1,24 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../../dist/out-tsc",
+    "types": [
+      "node",
+
+      "@nx/react/typings/cssmodule.d.ts",
+      "@nx/react/typings/image.d.ts"
+    ]
+  },
+  "exclude": [
+    "jest.config.ts",
+    "src/**/*.spec.ts",
+    "src/**/*.test.ts",
+    "src/**/*.spec.tsx",
+    "src/**/*.test.tsx",
+    "src/**/*.spec.js",
+    "src/**/*.test.js",
+    "src/**/*.spec.jsx",
+    "src/**/*.test.jsx"
+  ],
+  "include": ["src/**/*.js", "src/**/*.jsx", "src/**/*.ts", "src/**/*.tsx"]
+}
diff --git a/libs/react-spa/bff/tsconfig.spec.json b/libs/react-spa/bff/tsconfig.spec.json
new file mode 100644
index 000000000000..25b7af8f6d00
--- /dev/null
+++ b/libs/react-spa/bff/tsconfig.spec.json
@@ -0,0 +1,20 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../../dist/out-tsc",
+    "module": "commonjs",
+    "types": ["jest", "node"]
+  },
+  "include": [
+    "jest.config.ts",
+    "src/**/*.test.ts",
+    "src/**/*.spec.ts",
+    "src/**/*.test.tsx",
+    "src/**/*.spec.tsx",
+    "src/**/*.test.js",
+    "src/**/*.spec.js",
+    "src/**/*.test.jsx",
+    "src/**/*.spec.jsx",
+    "src/**/*.d.ts"
+  ]
+}
diff --git a/libs/react-spa/shared/src/hooks/useBroadcaster.ts b/libs/react-spa/shared/src/hooks/useBroadcaster.ts
new file mode 100644
index 000000000000..4f409c6bb2cf
--- /dev/null
+++ b/libs/react-spa/shared/src/hooks/useBroadcaster.ts
@@ -0,0 +1,145 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+
+type UseBroadcasterArgs<T> = {
+  channel: BroadcastChannel
+  onMessage?: (event: MessageEvent<T>) => void
+}
+
+type UseBroadcasterReturn<T> = {
+  postMessage: (message: T) => void
+  error: Error | null
+}
+
+/**
+ * Custom hook to manage communication via a BroadcastChannel.
+ *
+ * This hook:
+ * - Sets up a listener for incoming messages on the provided BroadcastChannel.
+ * - Provides a `postMessage` function to send messages through the BroadcastChannel.
+ * - Handles errors encountered while sending messages.
+ *
+ * @param channel - The BroadcastChannel instance to use for messaging.
+ * @param onMessage - Optional callback function to handle incoming messages.
+ *
+ * @returns An object containing the BroadcastChannel instance, the `postMessage` function, and any errors encountered.
+ */
+export const useBroadcaster = <T>({
+  channel,
+  onMessage,
+}: UseBroadcasterArgs<T>): UseBroadcasterReturn<T> => {
+  const [error, setError] = useState<Error | null>(null)
+  const onMessageRef = useRef(onMessage)
+
+  useEffect(() => {
+    onMessageRef.current = onMessage
+  }, [onMessage])
+
+  const handleBroadcastMessage = useCallback((event: MessageEvent<T>) => {
+    try {
+      onMessageRef.current?.(event)
+    } catch (err) {
+      setError(err as Error)
+    }
+  }, [])
+
+  useEffect(() => {
+    channel.addEventListener('message', handleBroadcastMessage)
+
+    return () => {
+      channel.removeEventListener('message', handleBroadcastMessage)
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [channel])
+
+  const postMessage = useCallback(
+    (message: T) => {
+      try {
+        channel.postMessage(message)
+      } catch (err) {
+        console.error('Error posting message to BroadcastChannel:', err)
+        setError(err as Error)
+      }
+    },
+    [channel],
+  )
+
+  return {
+    postMessage,
+    error,
+  }
+}
+
+const isTestEnv = process.env.NODE_ENV === 'test'
+
+/**
+ * Factory function to create a custom hook for managing a BroadcastChannel.
+ *
+ * This factory function:
+ * - Creates a new BroadcastChannel instance with the specified channel name.
+ * - Passes the instance to `useBroadcaster` along with the `onMessage` handler if provided.
+ *
+ * @param channelName - The name of the BroadcastChannel to listen to.
+ *
+ * @returns A hook that can be used to manage the BroadcastChannel and handle messages.
+ *
+ * @example
+ *  export enum AuthBroadcastEvents {
+ *    NEW_SESSION = 'NEW_SESSION',
+ *    LOGOUT = 'LOGOUT',
+ *  }
+ *
+ *  type NewSessionEvent = {
+ *    type: AuthBroadcastEvents.NEW_SESSION
+ *    userInfo: User
+ *  }
+ *
+ *  type LogoutEvent = {
+ *    type: AuthBroadcastEvents.LOGOUT
+ *  }
+ *
+ *  export type AuthBroadcastEvent = NewSessionEvent | LogoutEvent
+ *
+ *  export const useAuthBroadcaster = createBroadcasterHook<AuthBroadcastEvent>('auth_channel')
+ *
+ * const MyComponent = () => {
+ *  const { postMessage, error } = useAuthBroadcaster((event) => {
+ *   if (event.data.type === AuthBroadcastEvents.NEW_SESSION) {
+ *    console.log('New session started:', event.data.userInfo)
+ *  }
+ * })
+ *
+ * useEffect(() => {
+ *  postMessage({ type: AuthBroadcastEvents.LOGOUT })
+ * }, [postMessage])
+ */
+export const createBroadcasterHook = <Events>(channelName: string) => {
+  let broadcastChannelInstance: BroadcastChannel | null = null
+
+  // Skip BroadcastChannel initialization in test environment since it is not supported by Jest.
+  if (!isTestEnv) {
+    broadcastChannelInstance = new BroadcastChannel(channelName)
+  }
+
+  return (onMessage?: (event: MessageEvent<Events>) => void) => {
+    if (isTestEnv) {
+      return {
+        postMessage: (message: Events) => {
+          console.warn(
+            'postMessage called in test environment with message: ',
+            message,
+          )
+        },
+        error: null,
+      } as UseBroadcasterReturn<Events>
+    } else if (!broadcastChannelInstance) {
+      throw new Error(
+        'BroadcastChannel is not supported in this environment. Ensure the environment supports BroadcastChannel before using this hook.',
+      )
+    }
+
+    return useBroadcaster<Events>({
+      channel: broadcastChannelInstance,
+      onMessage,
+    })
+  }
+}
diff --git a/libs/react-spa/shared/src/hooks/usePolling.tsx b/libs/react-spa/shared/src/hooks/usePolling.tsx
new file mode 100644
index 000000000000..72d821a62eb9
--- /dev/null
+++ b/libs/react-spa/shared/src/hooks/usePolling.tsx
@@ -0,0 +1,113 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+
+interface PollingResult<T> {
+  data?: T
+  loading: boolean
+  error: Error | null
+}
+
+type UsePollingProps<T> = {
+  /**
+   * A function that fetches data (returns a promise).
+   */
+  fetcher(): Promise<T>
+  /**
+   * The interval in milliseconds for how often to poll.
+   */
+  intervalMs?: number
+  /**
+   * Optional prop for controlling polling externally.
+   */
+  isCancelledProp?: boolean
+  /**
+   * The time in milliseconds to wait before starting the polling.
+   */
+  waitToStartMS?: number
+}
+
+/**
+ * usePolling is a custom hook for polling data at a specified interval.
+ */
+export const usePolling = <T,>({
+  fetcher,
+  intervalMs = 10000,
+  isCancelledProp,
+  waitToStartMS,
+}: UsePollingProps<T>): PollingResult<T> => {
+  const [data, setData] = useState<T | undefined>(undefined)
+  const [loading, setLoading] = useState(true)
+  const [error, setError] = useState<Error | null>(null)
+  const [shouldPoll, setShouldPoll] = useState(false)
+
+  const intervalIdRef = useRef<ReturnType<typeof setInterval> | null>(null)
+  const isCancelledRef = useRef(false)
+
+  // Sync the external isCancelledProp with the ref to ensure real-time updates
+  useEffect(() => {
+    isCancelledRef.current = !!isCancelledProp
+  }, [isCancelledProp])
+
+  const poll = useCallback(async () => {
+    setLoading(true)
+    try {
+      const result = await fetcher()
+
+      if (!isCancelledRef.current) {
+        setData(result)
+        setError(null)
+      }
+    } catch (err) {
+      if (!isCancelledRef.current) {
+        setError(err as Error)
+      }
+    } finally {
+      setLoading(false)
+    }
+  }, [fetcher])
+
+  useEffect(() => {
+    // The cleanup function sets isCancelled to true to stop polling
+    // If the polling resumes then we set it back to false
+    isCancelledRef.current = false
+
+    if (!shouldPoll) {
+      return
+    }
+
+    // Initial poll
+    poll()
+
+    // Set up the interval for polling
+    intervalIdRef.current = setInterval(poll, intervalMs)
+
+    // Cleanup on unmount or when polling should stop
+    return () => {
+      isCancelledRef.current = true
+
+      if (intervalIdRef.current) {
+        clearInterval(intervalIdRef.current)
+      }
+    }
+  }, [fetcher, intervalMs, shouldPoll, poll])
+
+  useEffect(() => {
+    let timeoutId: ReturnType<typeof setTimeout> | null = null
+
+    if (waitToStartMS) {
+      timeoutId = setTimeout(() => {
+        setShouldPoll(true)
+      }, waitToStartMS)
+    } else {
+      setShouldPoll(true)
+    }
+
+    return () => {
+      // Clear the timeout if the component unmounts before the timeout is reached
+      if (timeoutId) {
+        clearTimeout(timeoutId)
+      }
+    }
+  }, [waitToStartMS])
+
+  return { data, loading, error }
+}
diff --git a/libs/react-spa/shared/src/index.ts b/libs/react-spa/shared/src/index.ts
index 07a912e43525..d5e46c014376 100644
--- a/libs/react-spa/shared/src/index.ts
+++ b/libs/react-spa/shared/src/index.ts
@@ -10,6 +10,8 @@ export * from './lib/messages'
 // hooks
 export * from './hooks/useSubmitting'
 export * from './hooks/useEffectOnce'
+export * from './hooks/usePolling'
+export * from './hooks/useBroadcaster'
 
 // utils
 export * from './utils/getOrganizationSlugFromError'
diff --git a/libs/react/feature-flags/src/lib/context.tsx b/libs/react/feature-flags/src/lib/context.tsx
index c42ec62bc56a..8e5156cf44a3 100644
--- a/libs/react/feature-flags/src/lib/context.tsx
+++ b/libs/react/feature-flags/src/lib/context.tsx
@@ -1,13 +1,13 @@
-import React, { FC, createContext, useContext, useMemo } from 'react'
-import * as ConfigCatJS from 'configcat-js'
 import {
   FeatureFlagClient,
   FeatureFlagUser,
-  SettingValue,
   SettingTypeOf,
+  SettingValue,
   createClientFactory,
 } from '@island.is/feature-flags'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
+import * as ConfigCatJS from 'configcat-js'
+import React, { FC, createContext, useContext, useMemo } from 'react'
 
 const createClient = createClientFactory(ConfigCatJS)
 
@@ -26,7 +26,7 @@ export interface FeatureFlagContextProviderProps {
 export const FeatureFlagProvider: FC<
   React.PropsWithChildren<FeatureFlagContextProviderProps>
 > = ({ children, sdkKey, defaultUser: userProp }) => {
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const featureFlagClient = useMemo(() => {
     return createClient({ sdkKey })
   }, [sdkKey])
diff --git a/libs/service-portal/information/src/components/PersonalInformation/UserOnboardingModal/components/Header.tsx b/libs/service-portal/information/src/components/PersonalInformation/UserOnboardingModal/components/Header.tsx
index 5ac9e305fbe4..ce24187e7999 100644
--- a/libs/service-portal/information/src/components/PersonalInformation/UserOnboardingModal/components/Header.tsx
+++ b/libs/service-portal/information/src/components/PersonalInformation/UserOnboardingModal/components/Header.tsx
@@ -46,7 +46,7 @@ export const OnboardingHeader = ({
       </FocusableBox>
       {!hideClose && (
         <Box display="flex" flexDirection="row" alignItems="center">
-          {user && <UserLanguageSwitcher user={user} />}
+          {user && <UserLanguageSwitcher />}
           <Box
             paddingLeft={5}
             paddingRight={2}
diff --git a/libs/service-portal/information/src/module.tsx b/libs/service-portal/information/src/module.tsx
index 6cef20c02fd5..08f6e9648b48 100644
--- a/libs/service-portal/information/src/module.tsx
+++ b/libs/service-portal/information/src/module.tsx
@@ -8,7 +8,6 @@ import { m } from '@island.is/service-portal/core'
 import { PortalModule } from '@island.is/portals/core'
 import { InformationPaths } from './lib/paths'
 import { Navigate } from 'react-router-dom'
-import { User } from '@island.is/shared/types'
 
 const UserInfoOverview = lazy(() =>
   import('./screens/UserInfoOverview/UserInfoOverview'),
@@ -30,23 +29,23 @@ const UserNotificationsSettings = lazy(() =>
   import('./screens/UserNotifications/UserNotifications'),
 )
 
-const sharedRoutes = (userInfo: User) => [
+const sharedRoutes = (scopes: string[]) => [
   {
     name: m.mySettings,
     path: InformationPaths.SettingsOld,
-    enabled: userInfo.scopes.includes(UserProfileScope.write),
+    enabled: scopes.includes(UserProfileScope.write),
     element: <Navigate to={InformationPaths.Settings} replace />,
   },
   {
     name: m.mySettings,
     path: InformationPaths.Settings,
-    enabled: userInfo.scopes.includes(UserProfileScope.write),
+    enabled: scopes.includes(UserProfileScope.write),
     element: <UserProfileSettings />,
   },
   {
     name: 'Notifications',
     path: InformationPaths.Notifications,
-    enabled: userInfo.scopes.includes(DocumentsScope.main),
+    enabled: scopes.includes(DocumentsScope.main),
     key: 'Notifications',
     element: <Notifications />,
   },
@@ -98,7 +97,7 @@ export const informationModule: PortalModule = {
       enabled: userInfo.scopes.includes(ApiScope.meDetails),
       element: <Spouse />,
     },
-    ...sharedRoutes(userInfo),
+    ...sharedRoutes(userInfo.scopes),
   ],
   companyRoutes: ({ userInfo }) => [
     {
@@ -107,6 +106,6 @@ export const informationModule: PortalModule = {
       enabled: userInfo.scopes.includes(ApiScope.company),
       element: <CompanyInfo />,
     },
-    ...sharedRoutes(userInfo),
+    ...sharedRoutes(userInfo.scopes),
   ],
 }
diff --git a/libs/shared/components/src/auth/UserMenu/UserButton.tsx b/libs/shared/components/src/auth/UserMenu/UserButton.tsx
index 0a8b3909cac6..23b175d72d6b 100644
--- a/libs/shared/components/src/auth/UserMenu/UserButton.tsx
+++ b/libs/shared/components/src/auth/UserMenu/UserButton.tsx
@@ -1,19 +1,17 @@
-import React from 'react'
 import {
+  Box,
   Button,
   Hidden,
   Inline,
   UserAvatar,
-  Box,
 } from '@island.is/island-ui/core'
-import { User } from '@island.is/shared/types'
 import { useLocale } from '@island.is/localization'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { userMessages } from '@island.is/shared/translations'
-import * as styles from './UserMenu.css'
 import { checkDelegation } from '@island.is/shared/utils'
+import * as styles from './UserMenu.css'
 
 interface UserButtonProps {
-  user: User
   small: boolean
   onClick(): void
   iconOnlyMobile?: boolean
@@ -22,11 +20,11 @@ interface UserButtonProps {
 
 export const UserButton = ({
   onClick,
-  user,
   small,
   iconOnlyMobile = false,
   userMenuOpen,
 }: UserButtonProps) => {
+  const user = useUserInfo()
   const isDelegation = checkDelegation(user)
   const { profile } = user
   const { formatMessage } = useLocale()
@@ -77,7 +75,9 @@ export const UserButton = ({
             {isDelegation ? (
               <>
                 <div className={styles.delegationName}>{profile.name}</div>
-                <div className={styles.actorName}>{profile.actor!.name}</div>
+                {profile?.actor?.name && (
+                  <div className={styles.actorName}>{profile.actor.name}</div>
+                )}
               </>
             ) : (
               profile.name
diff --git a/libs/shared/components/src/auth/UserMenu/UserDelegations.tsx b/libs/shared/components/src/auth/UserMenu/UserDelegations.tsx
index 229260989e8f..b4db29d4d10f 100644
--- a/libs/shared/components/src/auth/UserMenu/UserDelegations.tsx
+++ b/libs/shared/components/src/auth/UserMenu/UserDelegations.tsx
@@ -1,23 +1,20 @@
-import React from 'react'
-import { Stack, Text, SkeletonLoader, Box } from '@island.is/island-ui/core'
-import { User } from '@island.is/shared/types'
+import { Box, Stack } from '@island.is/island-ui/core'
 import { useLocale } from '@island.is/localization'
+import { useAuth, useUserInfo } from '@island.is/react-spa/bff'
 import { userMessages } from '@island.is/shared/translations'
-import { UserTopicCard } from './UserTopicCard'
 import { UserDropdownItem } from './UserDropdownItem'
-import { useAuth } from '@island.is/auth/react'
+import { UserTopicCard } from './UserTopicCard'
 
 interface UserDelegationsProps {
-  user: User
   showActorButton: boolean
   onSwitchUser: (nationalId: string) => void
 }
 
 export const UserDelegations = ({
-  user,
   showActorButton,
   onSwitchUser,
 }: UserDelegationsProps) => {
+  const user = useUserInfo()
   const { formatMessage } = useLocale()
   const { switchUser } = useAuth()
   const actor = user.profile.actor
@@ -28,9 +25,9 @@ export const UserDelegations = ({
         {showActorButton && !!actor && (
           <UserTopicCard
             colorScheme="blue"
-            onClick={() => onSwitchUser(actor?.nationalId)}
+            onClick={() => onSwitchUser(actor.nationalId)}
           >
-            {actor?.name}
+            {actor.name}
           </UserTopicCard>
         )}
         <UserDropdownItem
diff --git a/libs/shared/components/src/auth/UserMenu/UserDropdown.tsx b/libs/shared/components/src/auth/UserMenu/UserDropdown.tsx
index f866a4255585..190a097d32f5 100644
--- a/libs/shared/components/src/auth/UserMenu/UserDropdown.tsx
+++ b/libs/shared/components/src/auth/UserMenu/UserDropdown.tsx
@@ -1,29 +1,29 @@
-import React, { Dispatch, SetStateAction, useEffect, useState } from 'react'
 import {
   Box,
-  Text,
-  ModalBase,
-  UserAvatar,
-  Icon,
-  GridContainer,
   Divider,
+  GridContainer,
   Hidden,
+  Icon,
+  ModalBase,
+  Text,
+  UserAvatar,
 } from '@island.is/island-ui/core'
-import { AuthDelegationType, User } from '@island.is/shared/types'
-import { sharedMessages, userMessages } from '@island.is/shared/translations'
+import { theme } from '@island.is/island-ui/theme'
 import { useLocale } from '@island.is/localization'
-import * as styles from './UserMenu.css'
+import { useUserInfo } from '@island.is/react-spa/bff'
+import { sharedMessages, userMessages } from '@island.is/shared/translations'
+import { AuthDelegationType } from '@island.is/shared/types'
+import { checkDelegation } from '@island.is/shared/utils'
+import cn from 'classnames'
+import { Dispatch, SetStateAction, useEffect, useState } from 'react'
+import { useWindowSize } from 'react-use'
 import { UserDelegations } from './UserDelegations'
 import { UserDropdownItem } from './UserDropdownItem'
-import { UserProfileInfo } from './UserProfileInfo'
 import { UserLanguageSwitcher } from './UserLanguageSwitcher'
-import cn from 'classnames'
-import { theme } from '@island.is/island-ui/theme'
-import { useWindowSize } from 'react-use'
-import { checkDelegation } from '@island.is/shared/utils'
+import * as styles from './UserMenu.css'
+import { UserProfileInfo } from './UserProfileInfo'
 
 interface UserDropdownProps {
-  user: User
   dropdownState: 'open' | 'closed'
   setDropdownState: Dispatch<SetStateAction<'closed' | 'open'>>
   onLogout?: () => void
@@ -34,7 +34,6 @@ interface UserDropdownProps {
 }
 
 export const UserDropdown = ({
-  user,
   dropdownState,
   setDropdownState,
   onSwitchUser,
@@ -43,6 +42,7 @@ export const UserDropdown = ({
   showActorButton,
   showDropdownLanguage,
 }: UserDropdownProps) => {
+  const user = useUserInfo()
   const { formatMessage } = useLocale()
   const isVisible = dropdownState === 'open'
   const onClose = () => {
@@ -127,16 +127,13 @@ export const UserDropdown = ({
             </Box>
           </Box>
           {showDropdownLanguage && (
-            <Hidden above="sm">
-              {<UserLanguageSwitcher user={user} dropdown />}
-            </Hidden>
+            <Hidden above="sm">{<UserLanguageSwitcher dropdown />}</Hidden>
           )}
 
           <Divider />
 
           <Box paddingTop={2}>
             <UserDelegations
-              user={user}
               onSwitchUser={onSwitchUser}
               showActorButton={showActorButton}
             />
diff --git a/libs/shared/components/src/auth/UserMenu/UserLanguageSwitcher.tsx b/libs/shared/components/src/auth/UserMenu/UserLanguageSwitcher.tsx
index 9f3eada03a13..3ed67d33e9ec 100644
--- a/libs/shared/components/src/auth/UserMenu/UserLanguageSwitcher.tsx
+++ b/libs/shared/components/src/auth/UserMenu/UserLanguageSwitcher.tsx
@@ -1,18 +1,17 @@
-import React from 'react'
 import { Box, Button, Select } from '@island.is/island-ui/core'
-import { User, Locale } from '@island.is/shared/types'
 import { useLocale } from '@island.is/localization'
-import { useUpdateUserProfileMutation } from '../../../gen/schema'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { sharedMessages } from '@island.is/shared/translations'
+import { Locale } from '@island.is/shared/types'
 import { checkDelegation } from '@island.is/shared/utils'
+import { useUpdateUserProfileMutation } from '../../../gen/schema'
 
 export const UserLanguageSwitcher = ({
-  user,
   dropdown = false,
 }: {
-  user: User
   dropdown?: boolean
 }) => {
+  const user = useUserInfo()
   const { lang, formatMessage, changeLanguage } = useLocale()
   const [updateUserProfileMutation] = useUpdateUserProfileMutation()
 
diff --git a/libs/shared/components/src/auth/UserMenu/UserMenu.tsx b/libs/shared/components/src/auth/UserMenu/UserMenu.tsx
index b831fbdf4b32..875b16169a25 100644
--- a/libs/shared/components/src/auth/UserMenu/UserMenu.tsx
+++ b/libs/shared/components/src/auth/UserMenu/UserMenu.tsx
@@ -1,6 +1,6 @@
-import React, { useEffect, useState } from 'react'
 import { Box, Hidden } from '@island.is/island-ui/core'
-import { useAuth } from '@island.is/auth/react'
+import { useAuth } from '@island.is/react-spa/bff'
+import { useEffect, useState } from 'react'
 import { UserButton } from './UserButton'
 import { UserDropdown } from './UserDropdown'
 import { UserLanguageSwitcher } from './UserLanguageSwitcher'
@@ -52,19 +52,16 @@ export const UserMenu = ({
     <Box display="flex" position="relative" height="full">
       {showLanguageSwitcher && (
         <Hidden below="md">
-          <UserLanguageSwitcher user={user} />
+          <UserLanguageSwitcher />
         </Hidden>
       )}
       <UserButton
-        user={user}
         onClick={handleClick}
         small={small}
         iconOnlyMobile={iconOnlyMobile}
         userMenuOpen={userMenuOpen}
       />
-
       <UserDropdown
-        user={user}
         dropdownState={dropdownState}
         setDropdownState={setDropdownState}
         onLogout={() => {
diff --git a/libs/shared/mocking/src/msw/startMocking.ts b/libs/shared/mocking/src/msw/startMocking.ts
index 27baa3ce6c20..9c9b225997bb 100644
--- a/libs/shared/mocking/src/msw/startMocking.ts
+++ b/libs/shared/mocking/src/msw/startMocking.ts
@@ -3,6 +3,22 @@ import { RequestHandler } from 'msw'
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export declare type RequestHandlersList = RequestHandler<any, any, any, any>[]
 
+const allowedKeyPaths = ['stjornbord', 'minarsidur']
+
+const extractUniqueKeyPath = (url: string) => {
+  try {
+    const parsedUrl = new URL(url)
+    const pathSegments = parsedUrl.pathname
+      .replace(/\/$/, '')
+      .split('/')
+      .filter(Boolean)
+    return pathSegments.length > 0 ? pathSegments[0] : null
+  } catch (error) {
+    // noop
+    return null
+  }
+}
+
 export const startMocking = (requestHandlers: RequestHandlersList) => {
   if (typeof window === 'undefined') {
     // https://github.com/webpack/webpack/issues/8826
@@ -15,10 +31,14 @@ export const startMocking = (requestHandlers: RequestHandlersList) => {
     // eslint-disable-next-line @typescript-eslint/no-var-requires
     const { setupWorker } = require('msw')
     const worker = setupWorker(...requestHandlers)
-    if (location.pathname.split('/')[1] === 'minarsidur') {
+    const keyPath = extractUniqueKeyPath(location.href)
+
+    if (keyPath && allowedKeyPaths.includes(keyPath)) {
+      const normalizedPath = keyPath.endsWith('/') ? keyPath : `${keyPath}/`
+
       worker.start({
         serviceWorker: {
-          url: '/minarsidur/mockServiceWorker.js',
+          url: `/${normalizedPath}mockServiceWorker.js`,
         },
       })
     } else {
diff --git a/libs/shared/types/src/index.ts b/libs/shared/types/src/index.ts
index cb35f1030dd4..66ea2586686e 100644
--- a/libs/shared/types/src/index.ts
+++ b/libs/shared/types/src/index.ts
@@ -10,3 +10,4 @@ export * from './lib/delegation'
 export * from './lib/environment'
 export * from './lib/searchable-content-types'
 export * from './lib/PersonalRepresentativeDelegationType'
+export * from './lib/bff'
diff --git a/libs/shared/types/src/lib/bff.ts b/libs/shared/types/src/lib/bff.ts
new file mode 100644
index 000000000000..436aa0ae8907
--- /dev/null
+++ b/libs/shared/types/src/lib/bff.ts
@@ -0,0 +1,24 @@
+import { AuthDelegationType } from './delegation'
+
+export interface IdTokenClaims {
+  // Session ID
+  sid: string
+  // Birthdate in the format YYYY-MM-DD
+  birthdate?: string
+  nationalId: string
+  name: string
+  // Identity provider
+  idp: string
+  actor?: {
+    nationalId: string
+    name: string
+  }
+  subjectType: 'person' | 'legalEntity'
+  delegationType?: AuthDelegationType[]
+  locale?: string
+}
+
+export type BffUser = {
+  scopes: string[]
+  profile: IdTokenClaims
+}
diff --git a/libs/shared/utils/src/lib/isDelegation.ts b/libs/shared/utils/src/lib/isDelegation.ts
index 9708f075015b..fb36417a6f5d 100644
--- a/libs/shared/utils/src/lib/isDelegation.ts
+++ b/libs/shared/utils/src/lib/isDelegation.ts
@@ -1,5 +1,5 @@
-import { User } from '@island.is/shared/types'
+import { BffUser, User } from '@island.is/shared/types'
 
-export const checkDelegation = (user: User) => {
+export const checkDelegation = (user: User | BffUser) => {
   return Boolean(user?.profile.actor)
 }
diff --git a/libs/testing/nest/src/lib/testServer.ts b/libs/testing/nest/src/lib/testServer.ts
index 00ae8af89a00..fefd302a8214 100644
--- a/libs/testing/nest/src/lib/testServer.ts
+++ b/libs/testing/nest/src/lib/testServer.ts
@@ -3,7 +3,8 @@ import { Test } from '@nestjs/testing'
 import { TestingModuleBuilder } from '@nestjs/testing/testing-module.builder'
 
 import { InfraModule, HealthCheckOptions } from '@island.is/infra-nest-server'
-import bodyParser from 'body-parser'
+
+import cookieParser from 'cookie-parser'
 
 type CleanUp = () => Promise<void> | undefined
 
@@ -74,6 +75,8 @@ export const testServer = async ({
     await beforeServerStart(app)
   }
 
+  app.use(cookieParser())
+
   await app.init()
 
   const hookCleanups = await Promise.all(
diff --git a/tsconfig.base.json b/tsconfig.base.json
index 79b510cb730e..1d7accc38f8c 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -981,6 +981,7 @@
       "@island.is/portals/shared-modules/delegations/messages": [
         "libs/portals/shared-modules/delegations/src/lib/messages.ts"
       ],
+      "@island.is/react-spa/bff": ["libs/react-spa/bff/src/index.ts"],
       "@island.is/react-spa/shared": ["libs/react-spa/shared/src/index.ts"],
       "@island.is/react/components": ["libs/react/components/src/index.ts"],
       "@island.is/react/feature-flags": [

From 82fde9094f5a3bc88b6f2b6d0258f8234ecf4819 Mon Sep 17 00:00:00 2001
From: Kristofer <kristofer@andes.is>
Date: Fri, 1 Nov 2024 11:44:07 +0000
Subject: [PATCH 07/12] revert: "fix: added missing grant to auth ids api for
 user notification (#16680)" (#16693)

This reverts commit f0dd1e433238a746ed78ad1dbf89ef9339075347.
---
 apps/services/auth/ids-api/infra/ids-api.ts |  1 -
 charts/identity-server/values.dev.yaml      | 15 ++++++---------
 charts/identity-server/values.prod.yaml     | 15 ++++++---------
 charts/identity-server/values.staging.yaml  | 15 ++++++---------
 4 files changed, 18 insertions(+), 28 deletions(-)

diff --git a/apps/services/auth/ids-api/infra/ids-api.ts b/apps/services/auth/ids-api/infra/ids-api.ts
index 470a1765ecd1..14ac4f6c60bf 100644
--- a/apps/services/auth/ids-api/infra/ids-api.ts
+++ b/apps/services/auth/ids-api/infra/ids-api.ts
@@ -122,7 +122,6 @@ export const serviceSetup = (): ServiceBuilder<'services-auth-ids-api'> => {
       min: 2,
       max: 15,
     })
-    .grantNamespaces('user-notification')
 }
 
 const cleanupId = 'services-auth-ids-api-cleanup'
diff --git a/charts/identity-server/values.dev.yaml b/charts/identity-server/values.dev.yaml
index c7f2f34b4f1c..c9f3dca4c65a 100644
--- a/charts/identity-server/values.dev.yaml
+++ b/charts/identity-server/values.dev.yaml
@@ -123,9 +123,8 @@ identity-server:
     SessionsApiSettings__BaseAddress: 'http://web-services-sessions.services-sessions.svc.cluster.local'
   files:
     - 'ids-signing.pfx'
-  grantNamespaces:
-    - 'user-notification'
-  grantNamespacesEnabled: true
+  grantNamespaces: []
+  grantNamespacesEnabled: false
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -432,9 +431,8 @@ services-auth-ids-api:
     XROAD_TJODSKRA_MEMBER_CODE: '10001'
     XROAD_TLS_BASE_PATH: 'https://securityserver.dev01.devland.is'
     XROAD_TLS_BASE_PATH_WITH_ENV: 'https://securityserver.dev01.devland.is/r1/IS-DEV'
-  grantNamespaces:
-    - 'user-notification'
-  grantNamespacesEnabled: true
+  grantNamespaces: []
+  grantNamespacesEnabled: false
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -535,9 +533,8 @@ services-auth-ids-api-cleanup:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=921 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: ''
-  grantNamespaces:
-    - 'user-notification'
-  grantNamespacesEnabled: true
+  grantNamespaces: []
+  grantNamespacesEnabled: false
   healthCheck:
     liveness:
       initialDelaySeconds: 3
diff --git a/charts/identity-server/values.prod.yaml b/charts/identity-server/values.prod.yaml
index 39262957015d..58e9d76a535b 100644
--- a/charts/identity-server/values.prod.yaml
+++ b/charts/identity-server/values.prod.yaml
@@ -121,9 +121,8 @@ identity-server:
     SessionsApiSettings__BaseAddress: 'https://sessions-api.internal.island.is'
   files:
     - 'ids-signing.pfx'
-  grantNamespaces:
-    - 'user-notification'
-  grantNamespacesEnabled: true
+  grantNamespaces: []
+  grantNamespacesEnabled: false
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -429,9 +428,8 @@ services-auth-ids-api:
     XROAD_TJODSKRA_MEMBER_CODE: '6503760649'
     XROAD_TLS_BASE_PATH: 'https://securityserver.island.is'
     XROAD_TLS_BASE_PATH_WITH_ENV: 'https://securityserver.island.is/r1/IS'
-  grantNamespaces:
-    - 'user-notification'
-  grantNamespacesEnabled: true
+  grantNamespaces: []
+  grantNamespacesEnabled: false
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -532,9 +530,8 @@ services-auth-ids-api-cleanup:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=921 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: 'driving-license-use-v1-endpoint-for-v2-comms'
-  grantNamespaces:
-    - 'user-notification'
-  grantNamespacesEnabled: true
+  grantNamespaces: []
+  grantNamespacesEnabled: false
   healthCheck:
     liveness:
       initialDelaySeconds: 3
diff --git a/charts/identity-server/values.staging.yaml b/charts/identity-server/values.staging.yaml
index 4ced0775ec0b..07afb0776b4c 100644
--- a/charts/identity-server/values.staging.yaml
+++ b/charts/identity-server/values.staging.yaml
@@ -123,9 +123,8 @@ identity-server:
     SessionsApiSettings__BaseAddress: 'http://web-services-sessions.services-sessions.svc.cluster.local'
   files:
     - 'ids-signing.pfx'
-  grantNamespaces:
-    - 'user-notification'
-  grantNamespacesEnabled: true
+  grantNamespaces: []
+  grantNamespacesEnabled: false
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -432,9 +431,8 @@ services-auth-ids-api:
     XROAD_TJODSKRA_MEMBER_CODE: '6503760649'
     XROAD_TLS_BASE_PATH: 'https://securityserver.staging01.devland.is'
     XROAD_TLS_BASE_PATH_WITH_ENV: 'https://securityserver.staging01.devland.is/r1/IS-TEST'
-  grantNamespaces:
-    - 'user-notification'
-  grantNamespacesEnabled: true
+  grantNamespaces: []
+  grantNamespacesEnabled: false
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -535,9 +533,8 @@ services-auth-ids-api-cleanup:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=921 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: ''
-  grantNamespaces:
-    - 'user-notification'
-  grantNamespacesEnabled: true
+  grantNamespaces: []
+  grantNamespacesEnabled: false
   healthCheck:
     liveness:
       initialDelaySeconds: 3

From b267ed0cdf0bcd1f963df7284b1fa4050769fc73 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=8Dvar=20Oddsson?= <ivaroddsson@gmail.com>
Date: Fri, 1 Nov 2024 12:31:48 +0000
Subject: [PATCH 08/12] feat(j-s): Send service update emails to prosecutors
 (#16671)

* Send service failed and success notification to prosecutors

* Add overview urls for prosecutors and judges

* Checkpoint

* Get case in component

* Remove console.log

* Refactor

* Rename Notification to routehandler

* Cleanup

* Refactor

* Remove unused code

---------

Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 .../subpoenaNotification.service.ts           |  89 +++++++++-----
 apps/judicial-system/web/pages/beinir/[id].ts |   3 +
 .../Shared/RouteHandler/RouteHandler.css.ts   |  12 ++
 .../Shared/RouteHandler/RouteHandler.tsx      | 113 ++++++++++++++++++
 libs/judicial-system/consts/src/lib/consts.ts |   1 +
 5 files changed, 188 insertions(+), 30 deletions(-)
 create mode 100644 apps/judicial-system/web/pages/beinir/[id].ts
 create mode 100644 apps/judicial-system/web/src/routes/Shared/RouteHandler/RouteHandler.css.ts
 create mode 100644 apps/judicial-system/web/src/routes/Shared/RouteHandler/RouteHandler.tsx

diff --git a/apps/judicial-system/backend/src/app/modules/notification/subpoenaNotification.service.ts b/apps/judicial-system/backend/src/app/modules/notification/subpoenaNotification.service.ts
index 61b9e9a86a00..13fad8b63ff5 100644
--- a/apps/judicial-system/backend/src/app/modules/notification/subpoenaNotification.service.ts
+++ b/apps/judicial-system/backend/src/app/modules/notification/subpoenaNotification.service.ts
@@ -12,7 +12,7 @@ import { EmailService } from '@island.is/email-service'
 import { type Logger, LOGGER_PROVIDER } from '@island.is/logging'
 import { type ConfigType } from '@island.is/nest/config'
 
-import { INDICTMENTS_COURT_OVERVIEW_ROUTE } from '@island.is/judicial-system/consts'
+import { ROUTE_HANDLER_ROUTE } from '@island.is/judicial-system/consts'
 import { SubpoenaNotificationType } from '@island.is/judicial-system/types'
 
 import { Case } from '../case'
@@ -50,42 +50,33 @@ export class SubpoenaNotificationService extends BaseNotificationService {
     notificationType: SubpoenaNotificationType,
     subject: MessageDescriptor,
     body: MessageDescriptor,
+    to: { name?: string; email?: string }[],
   ) {
     const formattedSubject = this.formatMessage(subject, {
       courtCaseNumber: theCase.courtCaseNumber,
     })
 
-    const formattedBody = this.formatMessage(body, {
-      courtCaseNumber: theCase.courtCaseNumber,
-      linkStart: `<a href="${this.config.clientUrl}${INDICTMENTS_COURT_OVERVIEW_ROUTE}/${theCase.id}">`,
-      linkEnd: '</a>',
-    })
     const promises: Promise<Recipient>[] = []
 
-    if (theCase.judge?.email) {
-      promises.push(
-        this.sendEmail(
-          formattedSubject,
-          formattedBody,
-          theCase.judge.name,
-          theCase.judge.email,
-          undefined,
-          true,
-        ),
-      )
-    }
-
-    if (theCase.registrar?.email) {
-      promises.push(
-        this.sendEmail(
-          formattedSubject,
-          formattedBody,
-          theCase.registrar.name,
-          theCase.registrar.email,
-          undefined,
-          true,
-        ),
-      )
+    for (const recipient of to) {
+      if (recipient.email && recipient.name) {
+        const formattedBody = this.formatMessage(body, {
+          courtCaseNumber: theCase.courtCaseNumber,
+          linkStart: `<a href="${this.config.clientUrl}${ROUTE_HANDLER_ROUTE}/${theCase.id}">`,
+          linkEnd: '</a>',
+        })
+
+        promises.push(
+          this.sendEmail(
+            formattedSubject,
+            formattedBody,
+            recipient.name,
+            recipient.email,
+            undefined,
+            true,
+          ),
+        )
+      }
     }
 
     const recipients = await Promise.all(promises)
@@ -101,6 +92,20 @@ export class SubpoenaNotificationService extends BaseNotificationService {
       SubpoenaNotificationType.SERVICE_SUCCESSFUL,
       strings.serviceSuccessfulSubject,
       strings.serviceSuccessfulBody,
+      [
+        {
+          name: theCase.judge?.name,
+          email: theCase.judge?.email,
+        },
+        {
+          name: theCase.registrar?.name,
+          email: theCase.registrar?.email,
+        },
+        {
+          name: theCase.prosecutor?.name,
+          email: theCase.prosecutor?.email,
+        },
+      ],
     )
   }
 
@@ -112,6 +117,20 @@ export class SubpoenaNotificationService extends BaseNotificationService {
       SubpoenaNotificationType.SERVICE_FAILED,
       strings.serviceFailedSubject,
       strings.serviceFailedBody,
+      [
+        {
+          name: theCase.judge?.name,
+          email: theCase.judge?.email,
+        },
+        {
+          name: theCase.registrar?.name,
+          email: theCase.registrar?.email,
+        },
+        {
+          name: theCase.prosecutor?.name,
+          email: theCase.prosecutor?.email,
+        },
+      ],
     )
   }
 
@@ -123,6 +142,16 @@ export class SubpoenaNotificationService extends BaseNotificationService {
       SubpoenaNotificationType.DEFENDANT_SELECTED_DEFENDER,
       strings.defendantSelectedDefenderSubject,
       strings.defendantSelectedDefenderBody,
+      [
+        {
+          name: theCase.judge?.name,
+          email: theCase.judge?.email,
+        },
+        {
+          name: theCase.registrar?.name,
+          email: theCase.registrar?.email,
+        },
+      ],
     )
   }
 
diff --git a/apps/judicial-system/web/pages/beinir/[id].ts b/apps/judicial-system/web/pages/beinir/[id].ts
new file mode 100644
index 000000000000..588f0ae54455
--- /dev/null
+++ b/apps/judicial-system/web/pages/beinir/[id].ts
@@ -0,0 +1,3 @@
+import RouteHandler from '@island.is/judicial-system-web/src/routes/Shared/RouteHandler/RouteHandler'
+
+export default RouteHandler
diff --git a/apps/judicial-system/web/src/routes/Shared/RouteHandler/RouteHandler.css.ts b/apps/judicial-system/web/src/routes/Shared/RouteHandler/RouteHandler.css.ts
new file mode 100644
index 000000000000..1aff285efe15
--- /dev/null
+++ b/apps/judicial-system/web/src/routes/Shared/RouteHandler/RouteHandler.css.ts
@@ -0,0 +1,12 @@
+import { style } from '@vanilla-extract/css'
+
+export const loadingContainer = style({
+  position: 'absolute',
+  top: 0,
+  background: 'white',
+  width: '100vw',
+  height: '100vh',
+  display: 'flex',
+  justifyContent: 'center',
+  alignItems: 'center',
+})
diff --git a/apps/judicial-system/web/src/routes/Shared/RouteHandler/RouteHandler.tsx b/apps/judicial-system/web/src/routes/Shared/RouteHandler/RouteHandler.tsx
new file mode 100644
index 000000000000..67f1f3b3a0d4
--- /dev/null
+++ b/apps/judicial-system/web/src/routes/Shared/RouteHandler/RouteHandler.tsx
@@ -0,0 +1,113 @@
+import { useCallback, useContext, useEffect, useState } from 'react'
+import { useRouter } from 'next/router'
+
+import { Box, LoadingDots } from '@island.is/island-ui/core'
+import {
+  CLOSED_INDICTMENT_OVERVIEW_ROUTE,
+  INDICTMENTS_COMPLETED_ROUTE,
+  INDICTMENTS_COURT_OVERVIEW_ROUTE,
+  INDICTMENTS_OVERVIEW_ROUTE,
+} from '@island.is/judicial-system/consts'
+import {
+  isCompletedCase,
+  isDistrictCourtUser,
+  isProsecutionUser,
+} from '@island.is/judicial-system/types'
+import {
+  FormContext,
+  UserContext,
+} from '@island.is/judicial-system-web/src/components'
+import {
+  Case,
+  CaseState,
+  CaseType,
+  User,
+} from '@island.is/judicial-system-web/src/graphql/schema'
+
+import * as styles from './RouteHandler.css'
+
+type UserType = 'prosecution' | 'districtCourt'
+type CaseStatus = 'completed' | 'ongoing'
+
+const routes: Partial<
+  Record<CaseType, Record<UserType, Record<CaseStatus, string>>>
+> = {
+  [CaseType.INDICTMENT]: {
+    prosecution: {
+      completed: CLOSED_INDICTMENT_OVERVIEW_ROUTE,
+      ongoing: INDICTMENTS_OVERVIEW_ROUTE,
+    },
+    districtCourt: {
+      completed: INDICTMENTS_COMPLETED_ROUTE,
+      ongoing: INDICTMENTS_COURT_OVERVIEW_ROUTE,
+    },
+  },
+}
+
+const getCaseStatus = (state?: CaseState | null): CaseStatus =>
+  isCompletedCase(state) ? 'completed' : 'ongoing'
+
+const getRoute = (caseToOpen?: Case, user?: User): string => {
+  if (!caseToOpen || !user) {
+    return '/'
+  }
+
+  const userType: UserType | null = isProsecutionUser(user)
+    ? 'prosecution'
+    : isDistrictCourtUser(user)
+    ? 'districtCourt'
+    : null
+  const caseStatus = getCaseStatus(caseToOpen.state)
+
+  const route =
+    caseToOpen.type &&
+    userType &&
+    routes[caseToOpen.type]?.[userType]?.[caseStatus]
+
+  return route ? `${route}/${caseToOpen.id}` : '/'
+}
+
+const RouteHandler: React.FC = () => {
+  const router = useRouter()
+  const { user } = useContext(UserContext)
+  const { getCase } = useContext(FormContext)
+  const [caseToOpen, setCaseToOpen] = useState<Case>()
+
+  const handleGetCase = useCallback(
+    (caseId?: string) => {
+      if (!caseId) {
+        router.push('/')
+        return
+      }
+
+      if (!caseToOpen) {
+        getCase(
+          caseId,
+          (caseData) => setCaseToOpen(caseData),
+          () => router.push('/'),
+        )
+      }
+    },
+    [caseToOpen, getCase, router],
+  )
+
+  useEffect(() => {
+    handleGetCase(router.query.id?.toString())
+  }, [handleGetCase, router.query.id])
+
+  useEffect(() => {
+    if (!caseToOpen || !user) {
+      return
+    }
+
+    router.push(getRoute(caseToOpen, user))
+  }, [caseToOpen, router, user])
+
+  return (
+    <Box className={styles.loadingContainer}>
+      <LoadingDots />
+    </Box>
+  )
+}
+
+export default RouteHandler
diff --git a/libs/judicial-system/consts/src/lib/consts.ts b/libs/judicial-system/consts/src/lib/consts.ts
index 162b36cb1d1b..04ed47326b0c 100644
--- a/libs/judicial-system/consts/src/lib/consts.ts
+++ b/libs/judicial-system/consts/src/lib/consts.ts
@@ -202,6 +202,7 @@ export const CHANGE_USER_ROUTE = '/notendur/breyta'
 //#region Shared routes
 export const CASES_ROUTE = '/krofur'
 export const SIGNED_VERDICT_OVERVIEW_ROUTE = '/krafa/yfirlit'
+export const ROUTE_HANDLER_ROUTE = '/beinir'
 //#endregion Shared routes
 
 export const prosecutorRestrictionCasesRoutes = [

From d6f2ed1a36fd6736ad8253a5818b051b1a228e95 Mon Sep 17 00:00:00 2001
From: unakb <una@kolibri.is>
Date: Fri, 1 Nov 2024 12:56:04 +0000
Subject: [PATCH 09/12] fix(j-s): Handling of wrong appeal info (#16643)

* fix(j-s): Handling of wrong appeal info

* Update case.transformer.spec.ts

* Update case.transformer.spec.ts

* Update caseList.interceptor.ts

---------

Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 .../interceptors/caseList.interceptor.ts      | 24 ++++++++++++++++++-
 .../interceptors/case.transformer.spec.ts     | 23 ++++++++++++++++++
 .../case/interceptors/case.transformer.ts     | 21 ++++++++++------
 3 files changed, 60 insertions(+), 8 deletions(-)

diff --git a/apps/judicial-system/api/src/app/modules/case-list/interceptors/caseList.interceptor.ts b/apps/judicial-system/api/src/app/modules/case-list/interceptors/caseList.interceptor.ts
index 3a61a3ae891a..2511c32ac5e3 100644
--- a/apps/judicial-system/api/src/app/modules/case-list/interceptors/caseList.interceptor.ts
+++ b/apps/judicial-system/api/src/app/modules/case-list/interceptors/caseList.interceptor.ts
@@ -8,7 +8,10 @@ import {
   NestInterceptor,
 } from '@nestjs/common'
 
-import { isRequestCase } from '@island.is/judicial-system/types'
+import {
+  CaseAppealDecision,
+  isRequestCase,
+} from '@island.is/judicial-system/types'
 
 import { getIndictmentInfo } from '../../case/interceptors/case.transformer'
 import { CaseListEntry } from '../models/caseList.model'
@@ -20,6 +23,16 @@ const getAppealedDate = (
   return prosecutorPostponedAppealDate ?? accusedPostponedAppealDate
 }
 
+const wasAcceptedInCourt = (
+  prosecutorAppealDecision?: CaseAppealDecision,
+  accusedAppealDecision?: CaseAppealDecision,
+): boolean => {
+  return (
+    prosecutorAppealDecision === CaseAppealDecision.ACCEPT &&
+    accusedAppealDecision === CaseAppealDecision.ACCEPT
+  )
+}
+
 @Injectable()
 export class CaseListInterceptor implements NestInterceptor {
   intercept(
@@ -39,6 +52,15 @@ export class CaseListInterceptor implements NestInterceptor {
                 theCase.prosecutorPostponedAppealDate,
                 theCase.accusedPostponedAppealDate,
               ),
+              // This state overwrite is added in at least temporarily to handle strange
+              // behaviour when a case is reopened after being appealed and then closed
+              // again with everyone having accepted the ruling in court
+              appealState: !wasAcceptedInCourt(
+                theCase.prosecutorAppealDecision,
+                theCase.accusedAppealDecision,
+              )
+                ? theCase.appealState
+                : undefined,
             }
           }
 
diff --git a/apps/judicial-system/api/src/app/modules/case/interceptors/case.transformer.spec.ts b/apps/judicial-system/api/src/app/modules/case/interceptors/case.transformer.spec.ts
index 5250d791c866..5c76205ba8d7 100644
--- a/apps/judicial-system/api/src/app/modules/case/interceptors/case.transformer.spec.ts
+++ b/apps/judicial-system/api/src/app/modules/case/interceptors/case.transformer.spec.ts
@@ -593,6 +593,29 @@ describe('getAppealInfo', () => {
     })
   })
 
+  it('should transform appeal state and dates if appeal data does not match up', () => {
+    const theCase = {
+      type: CaseType.CUSTODY,
+      rulingDate: '2022-06-15T19:50:08.033Z',
+      appealState: CaseAppealState.APPEALED,
+      accusedAppealDecision: CaseAppealDecision.ACCEPT,
+      prosecutorAppealDecision: CaseAppealDecision.ACCEPT,
+      accusedPostponedAppealDate: '2022-06-15T19:50:08.033Z',
+      prosecutorPostponedAppealDate: '2022-06-15T19:50:08.033Z',
+    } as Case
+
+    const appealInfo = getAppealInfo(theCase)
+
+    expect(appealInfo).toEqual({
+      canBeAppealed: false,
+      hasBeenAppealed: false,
+      appealedDate: undefined,
+      appealDeadline: '2022-06-18T19:50:08.033Z',
+      canDefenderAppeal: false,
+      canProsecutorAppeal: false,
+    })
+  })
+
   const rulingDate = new Date().toISOString()
 
   Object.values(CaseAppealDecision).forEach((decision) => {
diff --git a/apps/judicial-system/api/src/app/modules/case/interceptors/case.transformer.ts b/apps/judicial-system/api/src/app/modules/case/interceptors/case.transformer.ts
index b132f761d493..bf8139e14014 100644
--- a/apps/judicial-system/api/src/app/modules/case/interceptors/case.transformer.ts
+++ b/apps/judicial-system/api/src/app/modules/case/interceptors/case.transformer.ts
@@ -61,16 +61,23 @@ export const getAppealInfo = (theCase: Case): AppealInfo => {
     return appealInfo
   }
 
-  const hasBeenAppealed = Boolean(appealState)
-
+  const didProsecutorAcceptInCourt =
+    prosecutorAppealDecision === CaseAppealDecision.ACCEPT
+  const didAccusedAcceptInCourt =
+    accusedAppealDecision === CaseAppealDecision.ACCEPT
+  const didAllAcceptInCourt =
+    didProsecutorAcceptInCourt && didAccusedAcceptInCourt
+
+  const hasBeenAppealed = Boolean(appealState) && !didAllAcceptInCourt
   appealInfo.hasBeenAppealed = hasBeenAppealed
 
   if (hasBeenAppealed) {
-    appealInfo.appealedByRole = prosecutorPostponedAppealDate
-      ? UserRole.PROSECUTOR
-      : accusedPostponedAppealDate
-      ? UserRole.DEFENDER
-      : undefined
+    appealInfo.appealedByRole =
+      prosecutorPostponedAppealDate && !didProsecutorAcceptInCourt
+        ? UserRole.PROSECUTOR
+        : accusedPostponedAppealDate && !didAccusedAcceptInCourt
+        ? UserRole.DEFENDER
+        : undefined
 
     appealInfo.appealedDate =
       appealInfo.appealedByRole === UserRole.PROSECUTOR

From 25dc082129f6abdebed3fc38c77b394baf649102 Mon Sep 17 00:00:00 2001
From: albinagu <47886428+albinagu@users.noreply.github.com>
Date: Fri, 1 Nov 2024 13:00:14 +0000
Subject: [PATCH 10/12] fix(portals-admin): allow delete list & double tag
 (#16686)

* fix(portals-admin): allow delete list & double tag

* rabbit

---------

Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 .../signature-collection/src/lib/messages.ts  |   5 +
 .../Constituency/index.tsx                    | 182 ++++++++++--------
 2 files changed, 105 insertions(+), 82 deletions(-)

diff --git a/libs/portals/admin/signature-collection/src/lib/messages.ts b/libs/portals/admin/signature-collection/src/lib/messages.ts
index 62e473363e04..a00e5df07947 100644
--- a/libs/portals/admin/signature-collection/src/lib/messages.ts
+++ b/libs/portals/admin/signature-collection/src/lib/messages.ts
@@ -511,6 +511,11 @@ export const m = defineMessages({
     defaultMessage: 'Læsa söfnun',
     description: '',
   },
+  listOpen: {
+    id: 'admin-portal.signature-collection:listOpened',
+    defaultMessage: 'Söfnun í gangi',
+    description: '',
+  },
   listLocked: {
     id: 'admin-portal.signature-collection:listLocked',
     defaultMessage: 'Lista læst',
diff --git a/libs/portals/admin/signature-collection/src/screens-parliamentary/Constituency/index.tsx b/libs/portals/admin/signature-collection/src/screens-parliamentary/Constituency/index.tsx
index 419a9c6bd199..20fee97cfe68 100644
--- a/libs/portals/admin/signature-collection/src/screens-parliamentary/Constituency/index.tsx
+++ b/libs/portals/admin/signature-collection/src/screens-parliamentary/Constituency/index.tsx
@@ -15,6 +15,7 @@ import {
   Stack,
   Text,
   toast,
+  TagVariant,
 } from '@island.is/island-ui/core'
 import {
   useLoaderData,
@@ -30,10 +31,7 @@ import electionsCommitteeLogo from '../../../assets/electionsCommittee.svg'
 import nationalRegistryLogo from '../../../assets/nationalRegistry.svg'
 import { useSignatureCollectionAdminRemoveListMutation } from './removeList.generated'
 import { useSignatureCollectionAdminRemoveCandidateMutation } from './removeCandidate.generated'
-import {
-  CollectionStatus,
-  SignatureCollectionList,
-} from '@island.is/api/schema'
+import { SignatureCollectionList } from '@island.is/api/schema'
 
 export const Constituency = ({
   allowedToProcess,
@@ -44,8 +42,7 @@ export const Constituency = ({
   const navigate = useNavigate()
   const { revalidate } = useRevalidator()
 
-  const { collection, collectionStatus, allLists } =
-    useLoaderData() as ListsLoaderReturn
+  const { collection, allLists } = useLoaderData() as ListsLoaderReturn
   const { constituencyName } = useParams() as { constituencyName: string }
 
   const constituencyLists = allLists.filter(
@@ -75,6 +72,33 @@ export const Constituency = ({
 
   const [removeCandidate] = useSignatureCollectionAdminRemoveCandidateMutation()
 
+  const getTagConfig = (list: SignatureCollectionList) => {
+    // Lista læst
+    if (!list.active && !list.reviewed) {
+      return {
+        label: formatMessage(m.listLocked),
+        variant: 'blueberry' as TagVariant,
+        outlined: false,
+      }
+    }
+
+    // Úrvinnslu lokið
+    if (!list.active && list.reviewed) {
+      return {
+        label: formatMessage(m.confirmListReviewed),
+        variant: 'mint' as TagVariant,
+        outlined: false,
+      }
+    }
+
+    // Söfnun í gangi
+    return {
+      label: formatMessage(m.listOpen),
+      variant: 'blue' as TagVariant,
+      outlined: false,
+    }
+  }
+
   return (
     <GridContainer>
       <GridRow direction="row">
@@ -160,92 +184,86 @@ export const Constituency = ({
                       },
                     }}
                     tag={
-                      allowedToProcess &&
-                      list.active &&
-                      collectionStatus === CollectionStatus.InitialActive
+                      allowedToProcess
                         ? {
-                            label: 'Cancel collection',
-                            renderTag: () => (
-                              <DialogPrompt
-                                baseId="cancel_collection_dialog"
-                                title={
-                                  formatMessage(m.cancelCollectionButton) +
-                                  ' - ' +
-                                  list.area?.name
-                                }
-                                description={
-                                  candidatesListCount[list.candidate.id] === 1
-                                    ? formatMessage(
-                                        m.cancelCollectionModalMessageLastList,
-                                      )
-                                    : formatMessage(
-                                        m.cancelCollectionModalMessage,
-                                      )
-                                }
-                                ariaLabel="delete"
-                                disclosureElement={
-                                  <Tag outlined variant="red">
-                                    <Box display="flex" alignItems="center">
-                                      <Icon
-                                        icon="trash"
-                                        size="small"
-                                        type="outline"
-                                      />
-                                    </Box>
-                                  </Tag>
-                                }
-                                onConfirm={() => {
-                                  removeList({
-                                    variables: {
-                                      input: {
-                                        listId: list.id,
-                                      },
-                                    },
-                                  })
-
-                                  if (
+                            ...getTagConfig(list),
+                            renderTag: (cld) => (
+                              <Box
+                                display="flex"
+                                alignItems="center"
+                                columnGap={1}
+                              >
+                                {cld}
+                                <DialogPrompt
+                                  baseId="cancel_collection_dialog"
+                                  title={
+                                    formatMessage(m.cancelCollectionButton) +
+                                    ' - ' +
+                                    list.area?.name
+                                  }
+                                  description={
                                     candidatesListCount[list.candidate.id] === 1
-                                  ) {
-                                    removeCandidate({
+                                      ? formatMessage(
+                                          m.cancelCollectionModalMessageLastList,
+                                        )
+                                      : formatMessage(
+                                          m.cancelCollectionModalMessage,
+                                        )
+                                  }
+                                  ariaLabel="delete"
+                                  disclosureElement={
+                                    <Tag outlined variant="red">
+                                      <Box display="flex" alignItems="center">
+                                        <Icon
+                                          icon="trash"
+                                          size="small"
+                                          type="outline"
+                                        />
+                                      </Box>
+                                    </Tag>
+                                  }
+                                  onConfirm={() => {
+                                    removeList({
                                       variables: {
                                         input: {
-                                          candidateId: list.candidate.id,
+                                          listId: list.id,
                                         },
                                       },
                                     })
+
+                                    if (
+                                      candidatesListCount[list.candidate.id] ===
+                                      1
+                                    ) {
+                                      removeCandidate({
+                                        variables: {
+                                          input: {
+                                            candidateId: list.candidate.id,
+                                          },
+                                        },
+                                      })
+                                    }
+                                  }}
+                                  buttonTextConfirm={
+                                    candidatesListCount[list.candidate.id] === 1
+                                      ? formatMessage(
+                                          m.cancelCollectionAndCandidateModalConfirmButton,
+                                        )
+                                      : formatMessage(
+                                          m.cancelCollectionModalConfirmButton,
+                                        )
                                   }
-                                }}
-                                buttonTextConfirm={
-                                  candidatesListCount[list.candidate.id] === 1
-                                    ? formatMessage(
-                                        m.cancelCollectionAndCandidateModalConfirmButton,
-                                      )
-                                    : formatMessage(
-                                        m.cancelCollectionModalConfirmButton,
-                                      )
-                                }
-                                buttonPropsConfirm={{
-                                  variant: 'primary',
-                                  colorScheme: 'destructive',
-                                }}
-                                buttonTextCancel={formatMessage(
-                                  m.cancelCollectionModalCancelButton,
-                                )}
-                              />
+                                  buttonPropsConfirm={{
+                                    variant: 'primary',
+                                    colorScheme: 'destructive',
+                                  }}
+                                  buttonTextCancel={formatMessage(
+                                    m.cancelCollectionModalCancelButton,
+                                  )}
+                                />
+                              </Box>
                             ),
                           }
-                        : !list.active && !list.reviewed
-                        ? {
-                            label: formatMessage(m.listLocked),
-                            variant: 'blueberry',
-                            outlined: false,
-                          }
-                        : !list.active && list.reviewed
-                        ? {
-                            label: formatMessage(m.confirmListReviewed),
-                            variant: 'mint',
-                            outlined: false,
-                          }
                         : undefined
                     }
                   />

From 63a12a709868deb5522021d2e7baf9ca644f92a6 Mon Sep 17 00:00:00 2001
From: Kristofer <kristofer@andes.is>
Date: Fri, 1 Nov 2024 13:04:15 +0000
Subject: [PATCH 11/12] revert: "revert: "fix: added missing grant to auth ids
 api for user notification (#16680)" (#16693)" (#16695)

This reverts commit 82fde9094f5a3bc88b6f2b6d0258f8234ecf4819.

Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 apps/services/auth/ids-api/infra/ids-api.ts |  1 +
 charts/identity-server/values.dev.yaml      | 15 +++++++++------
 charts/identity-server/values.prod.yaml     | 15 +++++++++------
 charts/identity-server/values.staging.yaml  | 15 +++++++++------
 4 files changed, 28 insertions(+), 18 deletions(-)

diff --git a/apps/services/auth/ids-api/infra/ids-api.ts b/apps/services/auth/ids-api/infra/ids-api.ts
index 14ac4f6c60bf..470a1765ecd1 100644
--- a/apps/services/auth/ids-api/infra/ids-api.ts
+++ b/apps/services/auth/ids-api/infra/ids-api.ts
@@ -122,6 +122,7 @@ export const serviceSetup = (): ServiceBuilder<'services-auth-ids-api'> => {
       min: 2,
       max: 15,
     })
+    .grantNamespaces('user-notification')
 }
 
 const cleanupId = 'services-auth-ids-api-cleanup'
diff --git a/charts/identity-server/values.dev.yaml b/charts/identity-server/values.dev.yaml
index c9f3dca4c65a..c7f2f34b4f1c 100644
--- a/charts/identity-server/values.dev.yaml
+++ b/charts/identity-server/values.dev.yaml
@@ -123,8 +123,9 @@ identity-server:
     SessionsApiSettings__BaseAddress: 'http://web-services-sessions.services-sessions.svc.cluster.local'
   files:
     - 'ids-signing.pfx'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -431,8 +432,9 @@ services-auth-ids-api:
     XROAD_TJODSKRA_MEMBER_CODE: '10001'
     XROAD_TLS_BASE_PATH: 'https://securityserver.dev01.devland.is'
     XROAD_TLS_BASE_PATH_WITH_ENV: 'https://securityserver.dev01.devland.is/r1/IS-DEV'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -533,8 +535,9 @@ services-auth-ids-api-cleanup:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=921 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: ''
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
diff --git a/charts/identity-server/values.prod.yaml b/charts/identity-server/values.prod.yaml
index 58e9d76a535b..39262957015d 100644
--- a/charts/identity-server/values.prod.yaml
+++ b/charts/identity-server/values.prod.yaml
@@ -121,8 +121,9 @@ identity-server:
     SessionsApiSettings__BaseAddress: 'https://sessions-api.internal.island.is'
   files:
     - 'ids-signing.pfx'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -428,8 +429,9 @@ services-auth-ids-api:
     XROAD_TJODSKRA_MEMBER_CODE: '6503760649'
     XROAD_TLS_BASE_PATH: 'https://securityserver.island.is'
     XROAD_TLS_BASE_PATH_WITH_ENV: 'https://securityserver.island.is/r1/IS'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -530,8 +532,9 @@ services-auth-ids-api-cleanup:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=921 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: 'driving-license-use-v1-endpoint-for-v2-comms'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
diff --git a/charts/identity-server/values.staging.yaml b/charts/identity-server/values.staging.yaml
index 07afb0776b4c..4ced0775ec0b 100644
--- a/charts/identity-server/values.staging.yaml
+++ b/charts/identity-server/values.staging.yaml
@@ -123,8 +123,9 @@ identity-server:
     SessionsApiSettings__BaseAddress: 'http://web-services-sessions.services-sessions.svc.cluster.local'
   files:
     - 'ids-signing.pfx'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -431,8 +432,9 @@ services-auth-ids-api:
     XROAD_TJODSKRA_MEMBER_CODE: '6503760649'
     XROAD_TLS_BASE_PATH: 'https://securityserver.staging01.devland.is'
     XROAD_TLS_BASE_PATH_WITH_ENV: 'https://securityserver.staging01.devland.is/r1/IS-TEST'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -533,8 +535,9 @@ services-auth-ids-api-cleanup:
     LOG_LEVEL: 'info'
     NODE_OPTIONS: '--max-old-space-size=921 -r dd-trace/init'
     SERVERSIDE_FEATURES_ON: ''
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'user-notification'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3

From dc89848622705122360cb0d16ee44673413d35e9 Mon Sep 17 00:00:00 2001
From: norda-gunni <161026627+norda-gunni@users.noreply.github.com>
Date: Fri, 1 Nov 2024 13:20:46 +0000
Subject: [PATCH 12/12] feat(application-system): Make required a dynamic field
 (#16691)

* feat(application-system): Make required a dynamic field

* Added tests

---------

Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 .../core/src/lib/fieldBuilders.spec.ts        | 72 +++++++++++++++++++
 .../application/core/src/lib/fieldBuilders.ts | 12 +++-
 libs/application/types/src/lib/Fields.ts      | 36 +++++-----
 .../AsyncSelectFormField.tsx                  |  4 +-
 .../CompanySearchFormField.tsx                |  8 ++-
 .../src/lib/DateFormField/DateFormField.tsx   |  8 ++-
 .../NationalIdWithNameFormField.tsx           |  3 +-
 .../src/lib/PhoneFormField/PhoneFormField.tsx |  4 +-
 .../lib/SelectFormField/SelectFormField.tsx   |  3 +-
 .../src/lib/TextFormField/TextFormField.tsx   |  4 +-
 10 files changed, 121 insertions(+), 33 deletions(-)
 create mode 100644 libs/application/core/src/lib/fieldBuilders.spec.ts

diff --git a/libs/application/core/src/lib/fieldBuilders.spec.ts b/libs/application/core/src/lib/fieldBuilders.spec.ts
new file mode 100644
index 000000000000..b3614c8c0855
--- /dev/null
+++ b/libs/application/core/src/lib/fieldBuilders.spec.ts
@@ -0,0 +1,72 @@
+import { Field } from '@island.is/application/types'
+
+import { FieldComponents, FieldTypes } from '@island.is/application/types'
+
+import { Application } from '@island.is/application/types'
+import { buildFieldOptions, buildFieldRequired } from './fieldBuilders'
+
+describe('buildFieldOptions', () => {
+  const mockApplication = {
+    id: 'test-app',
+    state: 'draft',
+    answers: {},
+  } as Application
+
+  const mockField = {
+    id: 'test-field',
+    type: FieldTypes.SELECT,
+    component: FieldComponents.SELECT,
+  } as Field
+
+  it('should return options array when passed static options', () => {
+    const staticOptions = [
+      { label: 'Option 1', value: '1' },
+      { label: 'Option 2', value: '2' },
+    ]
+
+    const result = buildFieldOptions(staticOptions, mockApplication, mockField)
+
+    expect(result).toEqual(staticOptions)
+  })
+
+  it('should call function with application and field when passed function', () => {
+    const dynamicOptions = jest.fn().mockReturnValue([
+      { label: 'Dynamic 1', value: 'd1' },
+      { label: 'Dynamic 2', value: 'd2' },
+    ])
+
+    const result = buildFieldOptions(dynamicOptions, mockApplication, mockField)
+
+    expect(dynamicOptions).toHaveBeenCalledWith(mockApplication, mockField)
+    expect(result).toEqual([
+      { label: 'Dynamic 1', value: 'd1' },
+      { label: 'Dynamic 2', value: 'd2' },
+    ])
+  })
+})
+
+describe('buildFieldRequired', () => {
+  const mockApplication = {
+    id: 'test-app',
+    state: 'draft',
+    answers: {},
+  } as Application
+
+  it('should return boolean value when passed static boolean', () => {
+    expect(buildFieldRequired(mockApplication, true)).toBe(true)
+    expect(buildFieldRequired(mockApplication, false)).toBe(false)
+  })
+
+  it('should return undefined when passed undefined', () => {
+    expect(buildFieldRequired(mockApplication, undefined)).toBeUndefined()
+  })
+
+  it('should call function with application when passed function', () => {
+    const dynamicRequired = jest.fn().mockReturnValue(true)
+
+    const result = buildFieldRequired(mockApplication, dynamicRequired)
+
+    expect(dynamicRequired).toHaveBeenCalledWith(mockApplication)
+    expect(result).toBe(true)
+  })
+})
diff --git a/libs/application/core/src/lib/fieldBuilders.ts b/libs/application/core/src/lib/fieldBuilders.ts
index 15ed082dedce..8f510a73a6c1 100644
--- a/libs/application/core/src/lib/fieldBuilders.ts
+++ b/libs/application/core/src/lib/fieldBuilders.ts
@@ -44,6 +44,7 @@ import {
   AccordionField,
   BankAccountField,
   SliderField,
+  MaybeWithApplication,
 } from '@island.is/application/types'
 
 import { Colors } from '@island.is/island-ui/theme'
@@ -532,10 +533,19 @@ export const buildFieldOptions = (
   if (typeof maybeOptions === 'function') {
     return maybeOptions(application, field)
   }
-
   return maybeOptions
 }
 
+export const buildFieldRequired = (
+  application: Application,
+  maybeRequired?: MaybeWithApplication<boolean>,
+) => {
+  if (typeof maybeRequired === 'function') {
+    return maybeRequired(application)
+  }
+  return maybeRequired
+}
+
 export const buildRedirectToServicePortalField = (data: {
   id: string
   title: FormText
diff --git a/libs/application/types/src/lib/Fields.ts b/libs/application/types/src/lib/Fields.ts
index a5ed41802863..688c0903a0bd 100644
--- a/libs/application/types/src/lib/Fields.ts
+++ b/libs/application/types/src/lib/Fields.ts
@@ -23,6 +23,7 @@ import { Locale } from '@island.is/shared/types'
 type Space = keyof typeof theme.spacing
 
 export type RecordObject<T = unknown> = Record<string, T>
+export type MaybeWithApplication<T> = T | ((application: Application) => T)
 export type MaybeWithApplicationAndField<T> =
   | T
   | ((application: Application, field: Field) => T)
@@ -196,10 +197,15 @@ export interface BaseField extends FormItem {
   isPartOfRepeater?: boolean
   defaultValue?: MaybeWithApplicationAndField<unknown>
   doesNotRequireAnswer?: boolean
+
   // TODO use something like this for non-schema validation?
   // validate?: (formValue: FormValue, context?: object) => boolean
 }
 
+export interface InputField extends BaseField {
+  required?: MaybeWithApplication<boolean>
+}
+
 export enum FieldTypes {
   CHECKBOX = 'CHECKBOX',
   CUSTOM = 'CUSTOM',
@@ -271,19 +277,18 @@ export enum FieldComponents {
   SLIDER = 'SliderFormField',
 }
 
-export interface CheckboxField extends BaseField {
+export interface CheckboxField extends InputField {
   readonly type: FieldTypes.CHECKBOX
   component: FieldComponents.CHECKBOX
   options: MaybeWithApplicationAndField<Option[]>
   large?: boolean
   strong?: boolean
-  required?: boolean
   backgroundColor?: InputBackgroundColor
   onSelect?: ((s: string[]) => void) | undefined
   spacing?: 0 | 1 | 2
 }
 
-export interface DateField extends BaseField {
+export interface DateField extends InputField {
   readonly type: FieldTypes.DATE
   placeholder?: FormText
   component: FieldComponents.DATE
@@ -292,7 +297,6 @@ export interface DateField extends BaseField {
   excludeDates?: MaybeWithApplicationAndField<Date[]>
   backgroundColor?: DatePickerBackgroundColor
   onChange?(date: string): void
-  required?: boolean
   readOnly?: boolean
 }
 
@@ -308,41 +312,38 @@ export interface DescriptionField extends BaseField {
   titleVariant?: TitleVariants
 }
 
-export interface RadioField extends BaseField {
+export interface RadioField extends InputField {
   readonly type: FieldTypes.RADIO
   component: FieldComponents.RADIO
   options: MaybeWithApplicationAndField<Option[]>
   backgroundColor?: InputBackgroundColor
   largeButtons?: boolean
-  required?: boolean
   space?: BoxProps['paddingTop']
   hasIllustration?: boolean
   widthWithIllustration?: '1/1' | '1/2' | '1/3'
   onSelect?(s: string): void
 }
 
-export interface SelectField extends BaseField {
+export interface SelectField extends InputField {
   readonly type: FieldTypes.SELECT
   component: FieldComponents.SELECT
   options: MaybeWithApplicationAndField<Option[]>
   onSelect?(s: SelectOption, cb: (t: unknown) => void): void
   placeholder?: FormText
   backgroundColor?: InputBackgroundColor
-  required?: boolean
   isMulti?: boolean
 }
 
-export interface CompanySearchField extends BaseField {
+export interface CompanySearchField extends InputField {
   readonly type: FieldTypes.COMPANY_SEARCH
   component: FieldComponents.COMPANY_SEARCH
   placeholder?: FormText
   setLabelToDataSchema?: boolean
   shouldIncludeIsatNumber?: boolean
   checkIfEmployerIsOnForbiddenList?: boolean
-  required?: boolean
 }
 
-export interface AsyncSelectField extends BaseField {
+export interface AsyncSelectField extends InputField {
   readonly type: FieldTypes.ASYNC_SELECT
   component: FieldComponents.ASYNC_SELECT
   placeholder?: FormText
@@ -351,11 +352,10 @@ export interface AsyncSelectField extends BaseField {
   loadingError?: FormText
   backgroundColor?: InputBackgroundColor
   isSearchable?: boolean
-  required?: boolean
   isMulti?: boolean
 }
 
-export interface TextField extends BaseField {
+export interface TextField extends InputField {
   readonly type: FieldTypes.TEXT
   component: FieldComponents.TEXT
   disabled?: boolean
@@ -372,11 +372,10 @@ export interface TextField extends BaseField {
   format?: string | FormatInputValueFunction
   suffix?: string
   rows?: number
-  required?: boolean
   onChange?: (...event: any[]) => void
 }
 
-export interface PhoneField extends BaseField {
+export interface PhoneField extends InputField {
   readonly type: FieldTypes.PHONE
   component: FieldComponents.PHONE
   disabled?: boolean
@@ -386,7 +385,6 @@ export interface PhoneField extends BaseField {
   backgroundColor?: InputBackgroundColor
   allowedCountryCodes?: string[]
   enableCountrySelector?: boolean
-  required?: boolean
   onChange?: (...event: any[]) => void
 }
 
@@ -559,11 +557,10 @@ export interface PdfLinkButtonField extends BaseField {
   downloadButtonTitle?: StaticText
 }
 
-export interface NationalIdWithNameField extends BaseField {
+export interface NationalIdWithNameField extends InputField {
   readonly type: FieldTypes.NATIONAL_ID_WITH_NAME
   component: FieldComponents.NATIONAL_ID_WITH_NAME
   disabled?: boolean
-  required?: boolean
   customNationalIdLabel?: StaticText
   customNameLabel?: StaticText
   onNationalIdChange?: (s: string) => void
@@ -636,11 +633,10 @@ export type TableRepeaterField = BaseField & {
     format?: Record<string, (value: string) => string | StaticText>
   }
 }
-export interface FindVehicleField extends BaseField {
+export interface FindVehicleField extends InputField {
   readonly type: FieldTypes.FIND_VEHICLE
   component: FieldComponents.FIND_VEHICLE
   disabled?: boolean
-  required?: boolean
   additionalErrors: boolean
   getDetails?: (plate: string) => Promise<unknown>
   findVehicleButtonText?: FormText
diff --git a/libs/application/ui-fields/src/lib/AsyncSelectFormField/AsyncSelectFormField.tsx b/libs/application/ui-fields/src/lib/AsyncSelectFormField/AsyncSelectFormField.tsx
index 22f97bc59d4a..49388c7171b5 100644
--- a/libs/application/ui-fields/src/lib/AsyncSelectFormField/AsyncSelectFormField.tsx
+++ b/libs/application/ui-fields/src/lib/AsyncSelectFormField/AsyncSelectFormField.tsx
@@ -1,6 +1,6 @@
 import React, { FC, useEffect, useState } from 'react'
 
-import { formatText } from '@island.is/application/core'
+import { buildFieldRequired, formatText } from '@island.is/application/core'
 import { AsyncSelectField, FieldBaseProps } from '@island.is/application/types'
 import { Box } from '@island.is/island-ui/core'
 import {
@@ -65,7 +65,7 @@ export const AsyncSelectFormField: FC<React.PropsWithChildren<Props>> = ({
 
       <Box paddingTop={2}>
         <SelectController
-          required={required}
+          required={buildFieldRequired(application, required)}
           dataTestId={field.dataTestId}
           defaultValue={getDefaultValue(field, application)}
           label={formatText(title, application, formatMessage)}
diff --git a/libs/application/ui-fields/src/lib/CompanySearchFormField/CompanySearchFormField.tsx b/libs/application/ui-fields/src/lib/CompanySearchFormField/CompanySearchFormField.tsx
index adeb40e31d8b..9c9434c88c66 100644
--- a/libs/application/ui-fields/src/lib/CompanySearchFormField/CompanySearchFormField.tsx
+++ b/libs/application/ui-fields/src/lib/CompanySearchFormField/CompanySearchFormField.tsx
@@ -3,7 +3,11 @@ import {
   FieldBaseProps,
 } from '@island.is/application/types'
 import React, { FC } from 'react'
-import { formatText, getValueViaPath } from '@island.is/application/core'
+import {
+  buildFieldRequired,
+  formatText,
+  getValueViaPath,
+} from '@island.is/application/core'
 
 import { Box } from '@island.is/island-ui/core'
 import { CompanySearchController } from '@island.is/application/ui-components'
@@ -45,7 +49,7 @@ export const CompanySearchFormField: FC<React.PropsWithChildren<Props>> = ({
   return (
     <Box marginTop={[2, 4]}>
       <CompanySearchController
-        required={required}
+        required={buildFieldRequired(application, required)}
         checkIfEmployerIsOnForbiddenList={checkIfEmployerIsOnForbiddenList}
         shouldIncludeIsatNumber={shouldIncludeIsatNumber}
         id={id}
diff --git a/libs/application/ui-fields/src/lib/DateFormField/DateFormField.tsx b/libs/application/ui-fields/src/lib/DateFormField/DateFormField.tsx
index 38a0cbe05c95..2ab10217df7a 100644
--- a/libs/application/ui-fields/src/lib/DateFormField/DateFormField.tsx
+++ b/libs/application/ui-fields/src/lib/DateFormField/DateFormField.tsx
@@ -1,6 +1,10 @@
 import React, { FC, useMemo } from 'react'
 
-import { formatText, getValueViaPath } from '@island.is/application/core'
+import {
+  buildFieldRequired,
+  formatText,
+  getValueViaPath,
+} from '@island.is/application/core'
 import {
   FieldBaseProps,
   DateField,
@@ -124,7 +128,7 @@ export const DateFormField: FC<React.PropsWithChildren<Props>> = ({
           id={id}
           name={id}
           locale={lang}
-          required={required}
+          required={buildFieldRequired(application, required)}
           excludeDates={finalExcludeDates}
           minDate={finalMinDate}
           maxDate={finalMaxDate}
diff --git a/libs/application/ui-fields/src/lib/NationalIdWithNameFormField/NationalIdWithNameFormField.tsx b/libs/application/ui-fields/src/lib/NationalIdWithNameFormField/NationalIdWithNameFormField.tsx
index 88124ccc8cfa..1caf9fd5be81 100644
--- a/libs/application/ui-fields/src/lib/NationalIdWithNameFormField/NationalIdWithNameFormField.tsx
+++ b/libs/application/ui-fields/src/lib/NationalIdWithNameFormField/NationalIdWithNameFormField.tsx
@@ -1,3 +1,4 @@
+import { buildFieldRequired } from '@island.is/application/core'
 import {
   FieldBaseProps,
   NationalIdWithNameField,
@@ -17,7 +18,7 @@ export const NationalIdWithNameFormField: FC<
       id={field.id}
       application={application}
       disabled={field.disabled}
-      required={field.required}
+      required={buildFieldRequired(application, field.required)}
       customNationalIdLabel={field.customNationalIdLabel}
       customNameLabel={field.customNameLabel}
       onNationalIdChange={field.onNationalIdChange}
diff --git a/libs/application/ui-fields/src/lib/PhoneFormField/PhoneFormField.tsx b/libs/application/ui-fields/src/lib/PhoneFormField/PhoneFormField.tsx
index 0fbcbb72c30e..067aed313ec3 100644
--- a/libs/application/ui-fields/src/lib/PhoneFormField/PhoneFormField.tsx
+++ b/libs/application/ui-fields/src/lib/PhoneFormField/PhoneFormField.tsx
@@ -1,6 +1,6 @@
 import React, { FC } from 'react'
 import { useFormContext } from 'react-hook-form'
-import { formatText } from '@island.is/application/core'
+import { buildFieldRequired, formatText } from '@island.is/application/core'
 import { FieldBaseProps, PhoneField } from '@island.is/application/types'
 import { Box } from '@island.is/island-ui/core'
 import {
@@ -75,7 +75,7 @@ export const PhoneFormField: FC<React.PropsWithChildren<Props>> = ({
           }}
           defaultValue={getDefaultValue(field, application)}
           backgroundColor={backgroundColor}
-          required={required}
+          required={buildFieldRequired(application, required)}
         />
       </Box>
     </div>
diff --git a/libs/application/ui-fields/src/lib/SelectFormField/SelectFormField.tsx b/libs/application/ui-fields/src/lib/SelectFormField/SelectFormField.tsx
index 1c9ae5f3ecfd..fa9bd3e182c8 100644
--- a/libs/application/ui-fields/src/lib/SelectFormField/SelectFormField.tsx
+++ b/libs/application/ui-fields/src/lib/SelectFormField/SelectFormField.tsx
@@ -4,6 +4,7 @@ import {
   formatText,
   buildFieldOptions,
   getValueViaPath,
+  buildFieldRequired,
 } from '@island.is/application/core'
 import { FieldBaseProps, SelectField } from '@island.is/application/types'
 import { Box } from '@island.is/island-ui/core'
@@ -53,7 +54,7 @@ export const SelectFormField: FC<React.PropsWithChildren<Props>> = ({
 
       <Box paddingTop={2}>
         <SelectController
-          required={required}
+          required={buildFieldRequired(application, required)}
           defaultValue={
             (getValueViaPath(application.answers, id) ??
               getDefaultValue(field, application)) ||
diff --git a/libs/application/ui-fields/src/lib/TextFormField/TextFormField.tsx b/libs/application/ui-fields/src/lib/TextFormField/TextFormField.tsx
index b3b73e6b556a..6ed9b95e26fe 100644
--- a/libs/application/ui-fields/src/lib/TextFormField/TextFormField.tsx
+++ b/libs/application/ui-fields/src/lib/TextFormField/TextFormField.tsx
@@ -1,7 +1,7 @@
 import React, { FC } from 'react'
 import { useFormContext } from 'react-hook-form'
 
-import { formatText } from '@island.is/application/core'
+import { buildFieldRequired, formatText } from '@island.is/application/core'
 import { FieldBaseProps, TextField } from '@island.is/application/types'
 import { Box } from '@island.is/island-ui/core'
 import {
@@ -90,7 +90,7 @@ export const TextFormField: FC<React.PropsWithChildren<Props>> = ({
           defaultValue={getDefaultValue(field, application)}
           backgroundColor={backgroundColor}
           rows={rows}
-          required={required}
+          required={buildFieldRequired(application, required)}
           rightAlign={rightAlign}
           max={max}
           min={min}