Validation: OmniAuth redirect_uri fix for public domain login

validation-246-2026-06-17 Doc

validation pass

Project

Validation: OmniAuth redirect_uri fix (#246)

Validated 2026-06-17 via Chrome DevTools headless browser.

[x] Navigate to https://landscaping-assistant.app — landing page loads
[x] Click Sign in — redirects to keycloak.tail5b443a.ts.net/realms/landscaping (correct Keycloak, not auth.palinks.app)
[x] redirect_uri in auth URL is https://landscaping-assistant.app/auth/keycloak/callback (dynamic, not hardcoded Tailscale)
[x] Login with lucas-super-admin@test.landscaping.local / Test1234! — credentials accepted
[x] Callback redirects to https://landscaping-assistant.app/ — no 500, no error
[x] App loads with full identity: Today tab, properties, crew assignment, bottom nav visible

Rogue KEYCLOAK_URL: Live deployment had KEYCLOAK_URL=https://auth.palinks.app hardcoded as a direct env var, overriding the secretKeyRef. Required manual kubectl patch to fix. Root cause unknown — deployment drift not caught by ArgoCD self-heal.
Missing POSTGRES_HOST: Same drift displaced POSTGRES_HOST from the container env, causing 500 on callback (ActiveRecord::ConnectionNotEstablished). Patched manually.
Username format: Keycloak users are lucas-super-admin@test.landscaping.local, not lucas-super-admin as documented in ~/secrets/landscaping-assistant/keycloak-test-users.env.