pal-e-docs

Review: Add Keycloak realm + OIDC client

review-1768-2026-07-04 Review

review approved
Project

Verdict: APPROVED

Board item #1768 -- Add Keycloak realm + OIDC client. Forgejo issue: ldraney/pal-e-services#171. Previous review incorrectly flagged arch-keycloak as missing; it exists and is confirmed.

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- Standalone, references PR #63
  • [x] Repo -- ldraney/pal-e-services
  • [x] User Story -- present
  • [x] Context -- explains OmniAuth is merged but realm/client not provisioned
  • [x] File Targets -- terraform/k3s.tfvars (modify), terraform/keycloak.tf (do not touch)
  • [x] Feature Flag -- none (extra section, acceptable)
  • [x] Acceptance Criteria -- 4 criteria, all machine-verifiable
  • [x] Test Expectations -- tofu plan
  • [x] Constraints -- model after landscaping-assistant, localhost redirect, roles, refresh tokens
  • [x] Checklist -- present
  • [x] Related -- prediction-assistant project

Traceability

  • [x] story:app-experience label -- App Experience story
  • [x] story note verified -- found in project-prediction-assistant user-stories section (links to story-prediction-assistant-app-experience)
  • [x] arch:keycloak label -- Keycloak architecture component
  • [x] arch note verified -- arch-keycloak note exists in pal-e-docs (id: 1728, title: "Architecture: Keycloak")
  • [x] Forgejo issue -- ldraney/pal-e-services#171, state: open

File Targets

  • [x] terraform/k3s.tfvars -- verified: gitignored by convention (*.tfvars in .gitignore), k3s.tfvars.example is tracked and contains keycloak_realms (line 21) and keycloak_clients (line 123) maps with existing entries (landscaping-assistant at lines 232-256 as model)
  • [x] terraform/keycloak.tf -- verified exists (9520 bytes), correctly marked as do-not-touch (for_each loops handle everything)

Repo Placement

Correct. Keycloak realm/client config lives in pal-e-services terraform. Issue filed on pal-e-services. Single repo affected.

Dependencies

  • Item #1767 "Add prediction-assistant to services terraform" (sprint:9, backlog) -- sibling infra ticket, independent. Keycloak config can be added before or after broader terraform onboarding.
  • Item #1693 "Keycloak realm, client, users, and login theme" (sprint:1, validation) -- historical predecessor for kalshi-assistant. Pattern already established.
  • No items in in_progress block this ticket.

Acceptance Criteria

All 4 criteria are machine-verifiable: realm entry check, client entry check, redirect URI check, tofu plan clean. Test command is real (cd terraform && tofu plan). No missing criteria.

Blast Radius

Small. Adding entries to existing HCL map variables (keycloak_realms, keycloak_clients). The for_each pattern in keycloak.tf handles provisioning. No downstream consumers affected -- this creates new resources, does not modify existing ones.

Decomposition Assessment

1 file target, 1 repo, 4 acceptance criteria. Estimated agent work well under 5 minutes. No decomposition needed.

Recommendation

No action needed. Scope is solid, traceability complete, file targets verified. Previous review verdict of NEEDS_REFINEMENT was incorrect -- the arch-keycloak note exists.