tenant-registry

20 Commits 9 Branches 0 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	67264d57ed	fix(keycloak): org create must send a domain (KC 26 rejects domainless) ci / shared (pull_request) Successful in 11s Details ci / test (pull_request) Successful in 21m24s Details ci / image (pull_request) Skipped Details Onboarding provisioning failed at CreateOrgAndInvite with create org: 400 "You must provide at least one domain" — Keycloak 26 requires every organization to carry at least one domain, and the payload sent none. Membership is registry-authoritative (model B2), so we do not use Keycloak email-domain auto-join; a synthetic per-tenant domain <slug>.tenant.breakpilot.com satisfies the constraint, is unique (slug is unique in the registry), and never clashes with a real deliverable mail domain. Discovered live: with the service account now holding manage-realm the 403 is gone and this is the next real blocker to onboarding every customer's org on KC 26. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD	2026-09-01 11:16:19 +02:00
sharang	9138731eea	feat(keycloak): M4.3 — Admin API adapter + claim resolver ci / shared (push) Successful in 5s Details ci / test (push) Successful in 1m32s Details ci / image (push) Has been skipped Details internal/keycloak Adapter (HTTPAdapter + Mock). POST /v1/tenants now provisions a KC organization + IT_ADMIN invite when admin_email is set; KC failures emit keycloak.provision_failed but don't roll back. POST /v1/internal/keycloak/claims resolves the current claim bundle for any (tenant_id\|tenant_slug\|user_attrs.*) lookup. Mock used in tests + when KEYCLOAK_ADMIN_URL is empty. HTTPAdapter tested against an in-process stub KC (httptest.Server). Refs: M4.3	2026-05-19 11:51:09 +00:00

Author

SHA1

Message

Date

Sharang ParnerkarandClaude Fable 5

67264d57ed

fix(keycloak): org create must send a domain (KC 26 rejects domainless)

ci / shared (pull_request) Successful in 11s

Details

ci / test (pull_request) Successful in 21m24s

Details

ci / image (pull_request) Skipped

Details

Onboarding provisioning failed at CreateOrgAndInvite with
create org: 400 "You must provide at least one domain" — Keycloak 26
requires every organization to carry at least one domain, and the
payload sent none. Membership is registry-authoritative (model B2), so
we do not use Keycloak email-domain auto-join; a synthetic per-tenant
domain <slug>.tenant.breakpilot.com satisfies the constraint, is unique
(slug is unique in the registry), and never clashes with a real
deliverable mail domain. Discovered live: with the service account now
holding manage-realm the 403 is gone and this is the next real blocker
to onboarding every customer's org on KC 26.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD

2026-09-01 11:16:19 +02:00

sharang

9138731eea

feat(keycloak): M4.3 — Admin API adapter + claim resolver

ci / shared (push) Successful in 5s

Details

ci / test (push) Successful in 1m32s

Details

ci / image (push) Has been skipped

Details

internal/keycloak Adapter (HTTPAdapter + Mock). POST /v1/tenants now provisions a KC organization + IT_ADMIN invite when admin_email is set; KC failures emit keycloak.provision_failed but don't roll back. POST /v1/internal/keycloak/claims resolves the current claim bundle for any (tenant_id|tenant_slug|user_attrs.*) lookup. Mock used in tests + when KEYCLOAK_ADMIN_URL is empty. HTTPAdapter tested against an in-process stub KC (httptest.Server).

Refs: M4.3

2026-05-19 11:51:09 +00:00