feat(keycloak): add tenant-context client scope + M7.1 test users #41

Merged

sharang merged 1 commits from feat/m7.1-realm-claims into main 2026-06-04 14:38:24 +00:00

Conversation 0 Commits 1 Files Changed 1

+202 -6

sharang commented 2026-05-20 15:21:19 +00:00

Owner

Copy Link

Copy Source

Summary

Adds the breakpilot platform multi-tenancy claims to the dev realm so M7.x products (starting with compliance-scanner-agent) can authenticate against the local CERTifAI stack end-to-end.

• New tenant-context client scope, default on all three clients
• 6 protocol mappers: tenant_id, tenant_slug, tenant_status, plan (strings); org_roles, products (multi-valued)
• 5 test users covering every tenant_status branch:
  • admin@certifai.local (acme, active, IT_ADMIN + CXO)
  • user@certifai.local (acme, active, USER)
  • trial@acme.local (trialco, trial)
  • frozen@acme.local (frozenco, frozen) -> 402 on writes
  • archived@acme.local (archiveco, archived) -> 410 always
• directAccessGrantsEnabled: true on certifai-dashboard for scripted local testing

Test plan

• docker compose up -d keycloak boots cleanly
• Password grant against each user decodes a token with all 6 claims correctly
• Compliance-scanner-agent (PR #82) validates each token, gates writes for frozen, blocks archived

Notes

This is the dev realm only — KC_DB: dev-mem, in-memory, recreated on every container start. Production realms are not affected.

## Summary Adds the breakpilot platform multi-tenancy claims to the dev realm so M7.x products (starting with `compliance-scanner-agent`) can authenticate against the local CERTifAI stack end-to-end. - New `tenant-context` client scope, default on all three clients - 6 protocol mappers: `tenant_id`, `tenant_slug`, `tenant_status`, `plan` (strings); `org_roles`, `products` (multi-valued) - 5 test users covering every `tenant_status` branch: - `admin@certifai.local` (acme, active, IT_ADMIN + CXO) - `user@certifai.local` (acme, active, USER) - `trial@acme.local` (trialco, trial) - `frozen@acme.local` (frozenco, frozen) -> 402 on writes - `archived@acme.local` (archiveco, archived) -> 410 always - `directAccessGrantsEnabled: true` on `certifai-dashboard` for scripted local testing ## Test plan - [x] `docker compose up -d keycloak` boots cleanly - [x] Password grant against each user decodes a token with all 6 claims correctly - [x] Compliance-scanner-agent (PR #82) validates each token, gates writes for frozen, blocks archived ## Notes This is the dev realm only — `KC_DB: dev-mem`, in-memory, recreated on every container start. Production realms are not affected.

sharang added 1 commit 2026-05-20 15:21:19 +00:00

feat(keycloak): add tenant-context client scope + M7.1 test users ... bd6d4572e0

Adds the breakpilot platform multi-tenancy claims to the dev realm
so M7.x products (starting with compliance-scanner-agent) can
authenticate against the local CERTifAI stack end-to-end.

New tenant-context client scope, included by default on all three
clients, with six protocol mappers backed by user attributes:

  tenant_id, tenant_slug, tenant_status, plan (strings)
  org_roles, products (multi-valued)

Five test users cover every tenant_status branch:

  admin@certifai.local  (acme, active, IT_ADMIN + CXO)
  user@certifai.local   (acme, active, USER)
  trial@acme.local      (trialco, trial)
  frozen@acme.local     (frozenco, frozen)   -> 402 on writes
  archived@acme.local   (archiveco, archived) -> 410 always

Enables Direct Access Grants on certifai-dashboard so password-
grant requests work for local API testing. This is the dev realm
only (KC_DB: dev-mem); prod realms inherit nothing from this file.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

sharang merged commit 8b8ec1fc9f into main 2026-06-04 14:38:24 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

sharang (Sharang Parnerkar)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/certifai#41