pal-e-docs

Validation: pal-e-services#73 — westside-admin Keycloak client → tofu + dev URI

validation-73-2026-05-04

validation pass
Project

Validation: pal-e-services#73 — westside-admin Keycloak client → tofu + dev URI

Verdict: PASS

PR: forgejo_admin/pal-e-services#74 (squash-merged 2026-05-04 ~01:55 UTC)
Issue: forgejo_admin/pal-e-services#73 (closed via Closes #73)

Verification steps

  • Local FF: git -C ~/pal-e-services pull --ff-only forgejo main → fast-forwarded to a80dc54 feat(keycloak): bring westside-admin client under tofu + add dev URI (#73) (#74).
  • tfvars edit: appended the canonical westside-admin entry from k3s.tfvars.example into local terraform/k3s.tfvars (gitignored). tofu fmt clean. tofu validate Success.
  • Import: tofu import -var-file=k3s.tfvars -lock=false 'keycloak_openid_client.this["westside-admin"]' westside-basketball/c5749fa6-4d1e-4b07-bdc0-e371bf65e1e5 → Import successful.
  • Plan: tofu plan -var-file=k3s.tfvars -lock=false -target='keycloak_openid_client.this["westside-admin"]' → 0 to add, 1 to change, 0 to destroy exactly matching PR #74's documented Step 2 plan (URI + origin add only).
  • Apply: tofu apply -var-file=k3s.tfvars -lock=false -target='keycloak_openid_client.this["westside-admin"]' -auto-approve → succeeded.
  • Live verify (Keycloak admin API): 
    redirectUris:
  https://westside-admin-dev.tail5b443a.ts.net/auth/callback
  https://westside-admin.tail5b443a.ts.net/auth/callback
webOrigins:
  https://westside-admin-dev.tail5b443a.ts.net
  https://westside-admin.tail5b443a.ts.net
    Both prod and dev URIs/origins present.
  • Prod regression check: curl -I https://westside-admin.tail5b443a.ts.net/ returns 302 to /auth/login?redirect=%2F — auth gate intact, no client-secret rotation, no admin-session disruption.

What this enables

Sibling work in pal-e-deployments#148/PR #149 can now drive an OIDC flow against the dev hostname. (See validation-148-* note when that ticket settles — currently superseded by pal-e-deployments#150 due to a PSA/namespace structural defect uncovered at apply time.)

Discovered scope (tracked separately)

  • Schema extension use_refresh_tokens was applied to terraform/keycloak.tf + terraform/variables.tf despite the issue's "do not touch keycloak.tf" guidance. Justification documented in PR body and accepted by QA: required to mirror live state without rotating refresh tokens on the live admin session. Additive change with default false; verified zero-drift on 4 sibling clients (westside-landing, pal-e-app, mcd-tracker-app, playme2k).

Cross-references

  • Board item: board-westside-admin #1142
  • Project: project-westside-admin (status section updated 2026-05-04)
  • Predecessor incident referenced from this validation: 2026-05-04 ~02:00 UTC westside-admin namespace cascade (recovered; tracked in pal-e-deployments#150)