pal-e-docs
Project not found.

Phase F5: Keycloak OIDC Auth for pal-e-app

phase-pal-e-docs-frontend-auth Phase

Project
Goal: Add Keycloak OIDC authentication to pal-e-app. Write operations (Quick-Jot) require login. Read operations remain public. Reuse the proven westside-app Auth.js pattern.
Owner: Dev-Frontend agent
Repo: forgejo_admin/pal-e-app
Depends on: None — Keycloak is deployed, OIDC flow proven in westside-app (PR #9).

Scope

  • Add Auth.js (SvelteKit) with Keycloak OIDC provider — reuse pattern from westside-app/src/auth.ts
  • Create pal-e-app client in Keycloak realm (or reuse existing client)
  • SOPS-encrypt client secret, deploy to pal-e-app namespace k8s secret
  • Protect write routes: POST /api/notes requires authenticated session
  • Quick-Jot FAB: show only when authenticated, prompt login when not
  • Add sign-in/sign-out routes (/signin, /signout)
  • Nav bar: show user name + sign out when authenticated, sign in button when not
  • Read routes (/notes, /boards, /search, /dashboard) remain public — no auth required
  • Session cookie: HttpOnly, Secure, SameSite=Lax

Deliverables

  • TBD — filled after completion
  • plan-pal-e-docs — parent plan
  • phase-pal-e-docs-quick-jot — Phase F3 (write capability that needs auth)
  • phase-pal-e-docs-private-notes — Phase F6 (private notes depend on auth)