Review: Keycloak: Enable player self-registration on westside-basketball realm

Verdict: APPROVED

Template Completeness

• [x] Type -- Feature
• [x] Lineage -- gap discovered during Sprint 6 decomposition
• [x] Repo -- ldraney/pal-e-services
• [x] User Story -- WS-S38
• [x] Context -- thorough, includes two options with recommendation
• [x] File Targets -- 3 targets listed (see verification below)
• [x] Feature Flag -- none (correct for IaC-only change)
• [x] Acceptance Criteria -- 5 criteria, all testable
• [x] Test Expectations -- 3 tests + terraform plan command
• [x] Constraints -- 5 constraints including blast radius (SMTP), dependency on #152
• [x] Checklist -- standard 3 items
• [x] Related -- 6 references including arch note, downstream tickets, dependency

Traceability

• [x] story:WS-S38 label -- "As a parent, I want to create an account, log in through the iOS app, and be routed to my subscription status page so I can manage payments and see where I stand"
• [x] story note verified -- WS-S38 found in project-westside-basketball user-stories section under Parent
• [x] arch:app-store label -- App Store Billing architecture
• [x] arch note verified -- arch-app-store note exists in pal-e-docs (ID 2224, slug "arch-app-store")
• [x] Forgejo issue -- pal-e-services#154, state: open

File Targets

• [x] terraform/k3s.tfvars -- verified: file is gitignored (actual config lives in ~/secrets/pal-e-services/k3s.tfvars), but this is the correct target. The .example file is tracked in repo. Agent will modify the real tfvars. The westside-basketball realm entry already exists in the live config with roles [admin, coach, player]. Setting registration_allowed = true here is correct.
• [x] terraform/keycloak.tf -- verified: realm resource at line 28 already wires registration_allowed and reset_password_allowed from the variable schema (lines 36, 39). No changes needed to keycloak.tf itself unless adding the default_roles resource. Minor clarification: the registration settings change is in tfvars, not keycloak.tf.
• [~] keycloak_default_roles resource -- CLARIFICATION: This resource does not currently exist in keycloak.tf. The mrparkers/keycloak v5 provider does support keycloak_default_roles as a resource type, so it can be created. The issue frames it as an existing resource to modify, when it is actually a new resource to add. The implementing agent should add a new keycloak_default_roles resource block to keycloak.tf that assigns the player role as default for the westside-basketball realm. This is a minor framing issue, not a blocker -- the intent is clear and the path forward is unambiguous.

Repo Placement

Dependencies

• Upstream: pal-e-services#152 (drop stale basketball DB role + update Keycloak westside-ror references) -- currently OPEN. Issue correctly identifies this as a prerequisite. #152 cleans up stale westside-ror references that could conflict with realm changes. Dependency is documented in the Constraints section.
• Downstream: Two board items depend on #154:

Acceptance Criteria

• AC1 (self-reg enabled) -- verifiable via terraform plan output showing registration_allowed = true
• AC2 (default player role) -- verifiable via terraform plan showing new keycloak_default_roles resource with player role
• AC3 (registration page renders) -- requires manual verification post-apply (theme already exists)
• AC4 (existing admin unaffected) -- verifiable via terraform plan showing no changes to existing users
• AC5 (reset_password decision) -- issue asks agent to decide; the Constraints section already answers this: do NOT enable until SMTP is resolved

Blast Radius

Decomposition Assessment

• 2 file targets in 1 repo (under threshold of 3 files / 2 repos)
• 5 acceptance criteria (at threshold but manageable)
• Estimated agent work: ~3 minutes (set tfvars value + add one new resource block + terraform plan)
• Single-repo, single-concern change

Recommendation

• The keycloak_default_roles resource does not exist yet in keycloak.tf -- create it as a new resource block, do not look for an existing one to modify
• Set reset_password_allowed = false explicitly per the SMTP constraint
• Ensure #152 has merged before starting this work