Commit a4b16075 authored by George Papathanail's avatar George Papathanail
Browse files

feat: issue CAMARA operation scopes on portal tokens

parent d43ffe48

oop-platform-chart/charts/keycloak/templates/realms-configmap.yaml

+52 −0
Changes for oop-platform-chart/charts/keycloak/templates/realms-configmap.yaml: 52 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -77,6 +77,51 @@ data: 
          }

        ]

      },

      {{- /*

      One CAMARA scope per operation across QoD, Edge Application Management and Location

      Retrieval (matches each API's OpenAPI `security` block exactly -- see the *-api.yaml

      files under src/open_exposure_gateway/api/camara/). Attached below as default scopes

      on the `portal` client alongside Keycloak's own built-ins, so every token already

      carries them the same way `organization` and the realm role already do -- no separate

      consent step, since it's the same developer logging into their own account, not a

      third party requesting delegated access.

      */ -}}

      {{- $camaraScopeNames := list

        "edge-application-management:apps:read"

        "edge-application-management:apps:write"

        "edge-application-management:apps:delete"

        "edge-application-management:instances:read"

        "edge-application-management:instances:write"

        "edge-application-management:instances:delete"

        "edge-application-management:deployments:read"

        "edge-application-management:deployments:write"

        "edge-application-management:deployments:update"

        "edge-application-management:deployments:delete"

        "edge-application-management:clusters:read"

        "edge-application-management:edge-cloud-zones:read"

        "qod-sessions-read"

        "qod-sessions-write"

        "qod-sessions-delete"

        "location-retrieval:read"

      }}

      "clientScopes": [

        { "name": "edge-application-management:apps:read", "protocol": "openid-connect", "description": "List/view applications" },

        { "name": "edge-application-management:apps:write", "protocol": "openid-connect", "description": "Register applications" },

        { "name": "edge-application-management:apps:delete", "protocol": "openid-connect", "description": "Delete applications" },

        { "name": "edge-application-management:instances:read", "protocol": "openid-connect", "description": "List/view app instances" },

        { "name": "edge-application-management:instances:write", "protocol": "openid-connect", "description": "Create app instances" },

        { "name": "edge-application-management:instances:delete", "protocol": "openid-connect", "description": "Delete app instances" },

        { "name": "edge-application-management:deployments:read", "protocol": "openid-connect", "description": "List/view app deployments" },

        { "name": "edge-application-management:deployments:write", "protocol": "openid-connect", "description": "Create app deployments" },

        { "name": "edge-application-management:deployments:update", "protocol": "openid-connect", "description": "Update app deployments" },

        { "name": "edge-application-management:deployments:delete", "protocol": "openid-connect", "description": "Delete app deployments" },

        { "name": "edge-application-management:clusters:read", "protocol": "openid-connect", "description": "List clusters" },

        { "name": "edge-application-management:edge-cloud-zones:read", "protocol": "openid-connect", "description": "List edge cloud zones" },

        { "name": "qod-sessions-read", "protocol": "openid-connect", "description": "Retrieval of QoS sessions" },

        { "name": "qod-sessions-write", "protocol": "openid-connect", "description": "Creation and update of QoS sessions" },

        { "name": "qod-sessions-delete", "protocol": "openid-connect", "description": "Deletion of QoS sessions" },

        { "name": "location-retrieval:read", "protocol": "openid-connect", "description": "Retrieve a device's location" }

      ],

      "clients": [

        {

          "clientId": {{ .portal.clientId | toJson }},
@@ -97,6 +142,13 @@ data: 
            "pkce.code.challenge.method": "S256",

            "post.logout.redirect.uris": {{ printf "%s/*" $portalUrl | toJson }}

          },

          {{- /*

          Explicit, not omitted: Keycloak's own built-ins (web-origins/acr/profile/roles/

          basic/email) are listed here alongside the CAMARA scopes above so this list is

          additive, not a silent replacement -- dropping "roles" here would break every

          role check in the platform (realm_access.roles would stop being issued).

          */ -}}

          "defaultClientScopes": {{ concat (list "web-origins" "acr" "profile" "roles" "basic" "email") $camaraScopeNames | toJson }},

          "protocolMappers": [

            {{- include "keycloak.audienceMapper" (dict "name" "audience-oeg" "custom" "oeg") | nindent 12 }},

            {{- include "keycloak.audienceMapper" (dict "name" "audience-self" "client" .portal.clientId) | nindent 12 }},