Validation: Keycloak OIDC auth (Twitch login)
Verdict: PARTIAL
Ticket
Issue #10 — Keycloak OIDC auth with PKCE for Twitch login. Board item #796.
Environment
Vite dev server at
https://playme2k-dev.tail5b443a.ts.net. Keycloak env vars (KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID) not configured in dev overlay.Checks
| # | Criterion | How Verified | Result | Evidence |
|---|---|---|---|---|
| 1 | "Login with Twitch" button exists and is clickable | Playwright click | PASS | Button at ref=e9 with Twitch icon, cursor:pointer. Click navigates to /auth/login. |
| 2 | /auth/login route exists | Playwright navigate + code read | PASS | src/routes/auth/login/+server.ts exists. GET handler generates PKCE verifier+challenge, sets httpOnly cookies, redirects to Keycloak authorize URL. |
| 3 | /auth/callback route exists | Filesystem check | PASS | src/routes/auth/callback/+server.ts present |
| 4 | /auth/logout route exists | Filesystem check | PASS | src/routes/auth/logout/+server.ts present |
| 5 | auth.ts OIDC helpers complete | File read | PASS | 211 lines. Full PKCE flow: generateCodeVerifier (RFC 7636), generateCodeChallenge (S256), generateState, buildAuthorizeUrl, exchangeCode, fetchUserInfo, decodeJwtPayload, session encode/decode. Public client with PKCE (no client_secret). |
| 6 | Login redirects to Keycloak | Playwright click "Login with Twitch" | FAIL (expected) | 500 Internal Error at /auth/login. Root cause: KEYCLOAK_URL env var not set. auth.ts throws "Missing environment variable: KEYCLOAK_URL" at startup. This is correct fail-fast behavior — not a code bug. |
| 7 | Test file exists | Filesystem check | PASS | src/lib/__tests__/auth.test.ts present |
Regression Check
Landing page continues to load correctly after auth route errors — the 500 is contained to /auth/* routes. No regression on the main page.
Discovered Issues
No code bugs. The 500 on /auth/login is expected — Keycloak realm and Twitch IdP are not yet configured in this environment. Full end-to-end auth validation requires: (1) Keycloak realm created with Twitch IdP, (2) KEYCLOAK_URL/REALM/CLIENT_ID env vars set in dev overlay. Tracked by existing issue #21 (end-to-end flow validation).