pal-e-docs

Phase 2: Keycloak Auth

phase-wkq-2-keycloak-auth Phase

phase
Project
Goal: Full OIDC authentication chain — Keycloak realm, Auth.js in SvelteKit, role-based access, admin user management.
Owner: Dev agent
Repo: forgejo_admin/basketball-api, forgejo_admin/westside-app
Depends on: phase-wkq-1-foundation

Scope

  • Keycloak realm (westside-basketball) with OIDC client
  • Auth.js integration — session management, JWT role extraction
  • Three roles: admin, coach, player — enforced in API and frontend
  • Admin user management page (/admin/users) — create accounts, assign roles, reset passwords
  • Batch account creation script (create_keycloak_accounts.py)
  • secureCookie fix — getToken() auto-detects HTTPS __Secure- prefix
  • Access token kept server-side only (event.locals)

Deliverables

  • Keycloak realm live, 50 accounts created (48 parents + Marcus + ldraney)
  • Full OIDC chain operational end-to-end
  • Admin user management page deployed

Known Issues

  • create_keycloak_accounts.py missing firstName/lastName — see TODO. BLOCKER for Phase 11.
  • @ts-ignore for session.roles — needs Auth.js type extension

Provenance

Phase 5 (Keycloak IdP) from original tryout prep plan. Sub-phases 5a–5d.