pal-e-docs

Phase 4: Keycloak Realm + Auth

phase-mcd-tracker-4-keycloak-auth Phase

phase
Project
Goal: Dedicated Keycloak realm with user/admin roles, JWT validation in API, protected endpoints ready for Phase 5 routes.
Owner: Dev agent
Repo: forgejo_admin/mcd-tracker-api
Depends on: Phase 3 (COMPLETED — models + DB live)

Scope

  • Create mcd-tracker realm in Keycloak via admin API:
  • Add src/mcd_tracker_api/auth.py — copy basketball-api pattern:
  • Add config: MCD_TRACKER_KEYCLOAK_REALM_URL
  • Update kustomize deployment-patch.yaml with Keycloak env var (pal-e-deployments)
  • Create test user + admin user in realm
  • Add auth tests: valid token → 200, no token → 401, wrong role → 403

Architecture Touch

arch-dataflow-mcd-tracker#auth-flow-keycloak-oidc — this phase implements the auth flow sequence diagram. Two OIDC clients (web confidential + iOS public/PKCE) as designed.

Verification

  • Keycloak realm mcd-tracker accessible at https://keycloak.tail5b443a.ts.net/realms/mcd-tracker
  • Unauthenticated request to protected endpoint → 401
  • Authenticated request with valid JWT → 200
  • Wrong role → 403
  • CI tests pass

  • pending
  • plan-mcd-tracker — parent plan
  • phase-mcd-tracker-3-data-model — depends on
  • arch-dataflow-mcd-tracker — auth flow diagram