pal-e-docs

Review: Enable Keycloak auth in dev environment (docker-compose + terraform redirect URI)

review-1383-2026-06-07-r2 Review

review ready
Project

Verdict: APPROVED

RE-REVIEW. All three issues from the previous review (review-1383-2026-06-07) have been addressed. The ticket is well-scoped with clear implementation details and verifiable acceptance criteria.

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — standalone, discovered during auth strategy spike (#159)
  • [x] Repo — ldraney/landscaping-assistant
  • [x] User Story — developer wants auth parity with prod
  • [x] Context — explains current state, dev setup, and what needs to change
  • [x] File Targets — docker-compose.yml, .env.example, cross-repo terraform
  • [x] Implementation Mechanism — new section with full code examples (env_file pattern)
  • [x] Feature Flag — none (infrastructure config, appropriate)
  • [x] Acceptance Criteria — 7 criteria, all testable
  • [x] Test Expectations — existing specs + manual verification
  • [x] Constraints — clear boundaries, secret handling, terraform workflow
  • [x] Checklist — includes both repos + terraform apply + manual verification
  • [x] Related — project page, upstream spike, auth doc, original terraform PR

Traceability

  • [x] story:auth label — "Auth" user story (All roles: Log in with Keycloak, see role-appropriate tabs and features)
  • [x] story note verified — found in project-landscaping-assistant user-stories section (key: auth)
  • [x] arch:rails-app label — board categorization label (Constraints section clarifies no dedicated arch note required)
  • [x] arch:platform label — board categorization label (Constraints section clarifies no dedicated arch note required)
  • [x] Forgejo issue — ldraney/landscaping-assistant#164, state: open

File Targets

  • [x] docker-compose.yml — verified: exists, web service present (lines 10-28), no env_file directive yet (change needed)
  • [x] .env.example — verified: does not exist yet (creation target), appropriate
  • [x] .gitignore — verified: already contains /.env* pattern (line 11), no change needed
  • [x] app/controllers/application_controller.rb — verified: graceful degradation via keycloak_configured? (line 66-67), correctly listed as DO NOT TOUCH
  • [x] config/initializers/omniauth.rb — verified: reads KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID, KEYCLOAK_CLIENT_SECRET from ENV
  • [ ] terraform/k3s.tfvars (pal-e-services) — cannot verify from this repo; cross-repo target acknowledged in Checklist

Repo Placement

Correct. Issue is filed on landscaping-assistant where the docker-compose and .env.example changes live. Cross-repo terraform change in pal-e-services is documented in File Targets and Checklist with separate PR expected. Both repos identified.

Dependencies

  • Phase 1 Keycloak login (#115, board #1337) — done. Prerequisite satisfied.
  • Auth strategy spike (#159, board #1382) — in backlog, but already completed (lineage reference). No blocker.
  • Phase 2 role-based auth (#157, board #1373) — in QA. Not a blocker for dev environment enablement.
  • Crew tab (#117, board #1339) — in_progress. Not a blocker; independent feature that already works with prod auth.
  • No undocumented dependencies found.

Acceptance Criteria

All 7 criteria are agent-verifiable or manually testable. Criteria cover the happy path (auth works), callback URI, role extraction, graceful degradation (opt-out), secret safety (.gitignore), and terraform apply. Test command provided: docker compose exec web bundle exec rspec. The manual login test is appropriately flagged as manual since it requires a running Keycloak instance.

Blast Radius

Low. The change adds an optional env_file directive — when .env is absent, behavior is unchanged. No other services in the docker-compose are affected. The terraform change only adds a redirect URI to an existing client (additive, no breaking changes). The .env.example is documentation-only. Graceful degradation means the change is effectively opt-in per developer.

Decomposition Assessment

2 file targets in this repo + 2 cross-repo targets = 4 files across 2 repos. 7 acceptance criteria. However, the this-repo changes are minimal (add 1 line to docker-compose, create 1 new file) and the cross-repo change is a single URI addition. Estimated agent work: ~3 minutes for the primary repo, separate PR for pal-e-services. Fits within 5-minute rule per repo. No decomposition needed.

Recommendation

No action needed. Ticket is ready for implementation.