pal-e-docs

Phase 2: MinIO API with Keycloak Auth

phase-minio-mobile-2-api-auth Phase

phase
Project
Goal: FastAPI service exposing MinIO SDK operations with Keycloak token validation and tenant-scoped access (stakeholders see only their prefix).
Owner: Dev agent
Repo: forgejo_admin/minio-api (to be created)
Depends on: phase-pal-e-platform-24-minio-sdk (SDK published), phase-minio-mobile-1-playground-auth (auth flow approved)

Scope

  • FastAPI service wrapping all SDK operations as JSON REST endpoints
  • Keycloak OIDC token validation middleware — every request must have valid Bearer token
  • Tenant scoping: Keycloak group claims map to MinIO bucket prefixes (e.g., group westside → prefix assets/westside/)
  • Admin role bypasses scoping — sees all buckets and prefixes
  • Presigned URL generation — frontend uploads/downloads directly to MinIO
  • OpenAPI docs at /docs (Swagger UI) and /openapi.json
  • Dockerfile + Woodpecker CI + Harbor + k8s deployment

Supersedes

phase-pal-e-platform-25-minio-api (deferred on platform) — same API design but now includes Keycloak auth + tenant scoping.

Deliverables

  • Filled after completion
  • plan-minio-mobile — parent plan
  • phase-pal-e-platform-25-minio-api — superseded platform phase
  • phase-pal-e-platform-24-minio-sdk — SDK dependency