feat: WebSocket temps réel + Finance Workflow + corrections
- Task #6: WebSocket /ws/dashboard + Kafka events (5 topics) * Backend: KafkaEventProducer, KafkaEventConsumer * Mobile: WebSocketService (reconnection, heartbeat, typed events) * DashboardBloc: Auto-refresh depuis WebSocket events - Finance Workflow: approbations + budgets (backend + mobile) * Backend: entities, services, resources, migrations Flyway V6 * Mobile: features finance_workflow complète avec BLoC - Corrections DI: interfaces IRepository partout * IProfileRepository, IOrganizationRepository, IMembreRepository * GetIt configuré avec @injectable - Spec-Kit: constitution + templates mis à jour * .specify/memory/constitution.md enrichie * Templates agent, plan, spec, tasks, checklist - Nettoyage: fichiers temporaires supprimés Signed-off-by: lions dev Team
This commit is contained in:
dahoud
196
unionflow/scripts/verify-keycloak-roles.sh
Normal file
196
unionflow/scripts/verify-keycloak-roles.sh
Normal file
@@ -0,0 +1,196 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Script de vérification de la configuration Keycloak pour UnionFlow
|
||||
# Vérifie que les rôles sont bien configurés et mappés dans les tokens
|
||||
|
||||
set -e
|
||||
|
||||
KEYCLOAK_URL="${KEYCLOAK_URL:-http://localhost:8180}"
|
||||
REALM="unionflow"
|
||||
ADMIN_USER="${KEYCLOAK_ADMIN:-admin}"
|
||||
ADMIN_PASSWORD="${KEYCLOAK_ADMIN_PASSWORD:-admin}"
|
||||
CLIENT_ID_NAME="unionflow-client"
|
||||
|
||||
echo "======================================"
|
||||
echo " Vérification Keycloak - UnionFlow"
|
||||
echo "======================================"
|
||||
echo ""
|
||||
echo "Keycloak URL: $KEYCLOAK_URL"
|
||||
echo "Realm: $REALM"
|
||||
echo ""
|
||||
|
||||
# 1. Obtenir token admin
|
||||
echo "[1/6] Obtention du token admin..."
|
||||
ADMIN_TOKEN=$(curl -s -X POST "$KEYCLOAK_URL/realms/master/protocol/openid-connect/token" \
|
||||
-d "client_id=admin-cli" \
|
||||
-d "username=$ADMIN_USER" \
|
||||
-d "password=$ADMIN_PASSWORD" \
|
||||
-d "grant_type=password" 2>/dev/null | jq -r '.access_token')
|
||||
|
||||
if [ "$ADMIN_TOKEN" == "null" ] || [ -z "$ADMIN_TOKEN" ]; then
|
||||
echo "❌ ERREUR: Impossible d'obtenir le token admin"
|
||||
echo " Vérifiez vos credentials et que Keycloak est accessible sur $KEYCLOAK_URL"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "✅ Token admin obtenu"
|
||||
echo ""
|
||||
|
||||
# 2. Lister les realm roles
|
||||
echo "[2/6] Vérification des realm roles..."
|
||||
REALM_ROLES=$(curl -s -X GET "$KEYCLOAK_URL/admin/realms/$REALM/roles" \
|
||||
-H "Authorization: Bearer $ADMIN_TOKEN" 2>/dev/null | jq -r '.[].name')
|
||||
|
||||
EXPECTED_ROLES=(
|
||||
"SUPER_ADMIN"
|
||||
"ADMIN_ORGANISATION"
|
||||
"TRESORIER"
|
||||
"SECRETAIRE"
|
||||
"RESPONSABLE_SOCIAL"
|
||||
"RESPONSABLE_EVENEMENTS"
|
||||
"RESPONSABLE_CREDIT"
|
||||
"MEMBRE_BUREAU"
|
||||
"MEMBRE_ACTIF"
|
||||
"MEMBRE_SIMPLE"
|
||||
)
|
||||
|
||||
echo "Rôles personnalisés trouvés:"
|
||||
MISSING_ROLES=()
|
||||
for role in "${EXPECTED_ROLES[@]}"; do
|
||||
if echo "$REALM_ROLES" | grep -q "^$role$"; then
|
||||
echo " ✅ $role"
|
||||
else
|
||||
echo " ❌ $role (MANQUANT)"
|
||||
MISSING_ROLES+=("$role")
|
||||
fi
|
||||
done
|
||||
echo ""
|
||||
|
||||
if [ ${#MISSING_ROLES[@]} -gt 0 ]; then
|
||||
echo "⚠️ WARNING: ${#MISSING_ROLES[@]} rôle(s) manquant(s)"
|
||||
echo " Exécutez d'abord: unionflow/scripts/keycloak-setup.sh"
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# 3. Vérifier le client unionflow-client
|
||||
echo "[3/6] Vérification du client '$CLIENT_ID_NAME'..."
|
||||
CLIENT_UUID=$(curl -s -X GET "$KEYCLOAK_URL/admin/realms/$REALM/clients?clientId=$CLIENT_ID_NAME" \
|
||||
-H "Authorization: Bearer $ADMIN_TOKEN" 2>/dev/null | jq -r '.[0].id')
|
||||
|
||||
if [ "$CLIENT_UUID" == "null" ] || [ -z "$CLIENT_UUID" ]; then
|
||||
echo "❌ ERREUR: Client '$CLIENT_ID_NAME' non trouvé dans le realm $REALM"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "✅ Client trouvé: $CLIENT_ID_NAME (UUID: $CLIENT_UUID)"
|
||||
echo ""
|
||||
|
||||
# 4. Vérifier les rôles de admin.mukefi@unionflow.test
|
||||
echo "[4/6] Vérification des rôles de 'admin.mukefi@unionflow.test'..."
|
||||
USER_ID=$(curl -s -X GET "$KEYCLOAK_URL/admin/realms/$REALM/users?username=admin.mukefi@unionflow.test" \
|
||||
-H "Authorization: Bearer $ADMIN_TOKEN" 2>/dev/null | jq -r '.[0].id')
|
||||
|
||||
if [ "$USER_ID" == "null" ] || [ -z "$USER_ID" ]; then
|
||||
echo "❌ ERREUR: Utilisateur 'admin.mukefi@unionflow.test' non trouvé"
|
||||
echo " Exécutez d'abord: unionflow/scripts/keycloak-setup.sh"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
USER_ROLES=$(curl -s -X GET "$KEYCLOAK_URL/admin/realms/$REALM/users/$USER_ID/role-mappings/realm" \
|
||||
-H "Authorization: Bearer $ADMIN_TOKEN" 2>/dev/null | jq -r '.[].name')
|
||||
|
||||
echo "Rôles assignés à admin.mukefi@unionflow.test:"
|
||||
if echo "$USER_ROLES" | grep -q "ADMIN_ORGANISATION"; then
|
||||
echo "$USER_ROLES" | while read role; do
|
||||
echo " ✅ $role"
|
||||
done
|
||||
else
|
||||
echo " ❌ ADMIN_ORGANISATION (MANQUANT)"
|
||||
echo " $USER_ROLES"
|
||||
echo ""
|
||||
echo "⚠️ WARNING: Le rôle ADMIN_ORGANISATION n'est pas assigné à cet utilisateur"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 5. Vérifier le client scope 'roles'
|
||||
echo "[5/6] Vérification du client scope 'roles'..."
|
||||
ROLES_SCOPE=$(curl -s -X GET "$KEYCLOAK_URL/admin/realms/$REALM/client-scopes" \
|
||||
-H "Authorization: Bearer $ADMIN_TOKEN" 2>/dev/null | jq -r '.[] | select(.name=="roles") | .name')
|
||||
|
||||
if [ "$ROLES_SCOPE" == "roles" ]; then
|
||||
echo "✅ Client scope 'roles' trouvé"
|
||||
else
|
||||
echo "❌ ERREUR: Client scope 'roles' non trouvé"
|
||||
echo " Ce scope est nécessaire pour inclure les rôles dans le token"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 6. Vérifier les mappers du client
|
||||
echo "[6/6] Vérification des protocol mappers du client..."
|
||||
MAPPERS=$(curl -s -X GET "$KEYCLOAK_URL/admin/realms/$REALM/clients/$CLIENT_UUID/protocol-mappers/models" \
|
||||
-H "Authorization: Bearer $ADMIN_TOKEN" 2>/dev/null)
|
||||
|
||||
REALM_ROLE_MAPPER=$(echo "$MAPPERS" | jq -r '.[] | select(.protocolMapper=="oidc-usermodel-realm-role-mapper") | .name')
|
||||
|
||||
if [ -n "$REALM_ROLE_MAPPER" ]; then
|
||||
echo "✅ Realm role mapper trouvé: '$REALM_ROLE_MAPPER'"
|
||||
|
||||
# Vérifier la configuration du mapper
|
||||
MAPPER_CONFIG=$(echo "$MAPPERS" | jq -r '.[] | select(.protocolMapper=="oidc-usermodel-realm-role-mapper")')
|
||||
TOKEN_CLAIM=$(echo "$MAPPER_CONFIG" | jq -r '.config["claim.name"]')
|
||||
ADD_TO_ID_TOKEN=$(echo "$MAPPER_CONFIG" | jq -r '.config["id.token.claim"]')
|
||||
ADD_TO_ACCESS_TOKEN=$(echo "$MAPPER_CONFIG" | jq -r '.config["access.token.claim"]')
|
||||
|
||||
echo " - Token claim name: $TOKEN_CLAIM"
|
||||
echo " - Add to ID token: $ADD_TO_ID_TOKEN"
|
||||
echo " - Add to access token: $ADD_TO_ACCESS_TOKEN"
|
||||
|
||||
if [ "$ADD_TO_ID_TOKEN" != "true" ]; then
|
||||
echo " ⚠️ WARNING: 'Add to ID token' devrait être 'true'"
|
||||
fi
|
||||
if [ "$ADD_TO_ACCESS_TOKEN" != "true" ]; then
|
||||
echo " ⚠️ WARNING: 'Add to access token' devrait être 'true'"
|
||||
fi
|
||||
else
|
||||
echo "❌ ERREUR: Aucun mapper de type 'oidc-usermodel-realm-role-mapper' trouvé"
|
||||
echo " Les rôles ne seront PAS inclus dans les tokens !"
|
||||
echo ""
|
||||
echo " Pour corriger, dans Keycloak Admin:"
|
||||
echo " 1. Allez dans Clients > $CLIENT_ID_NAME > Client scopes"
|
||||
echo " 2. Cliquez sur le scope dédié (unionflow-client-dedicated)"
|
||||
echo " 3. Add mapper > By configuration > User Realm Role"
|
||||
echo " 4. Name: realm roles"
|
||||
echo " 5. Token Claim Name: roles"
|
||||
echo " 6. Add to ID token: ON"
|
||||
echo " 7. Add to access token: ON"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Résumé
|
||||
echo "======================================"
|
||||
echo " RÉSUMÉ"
|
||||
echo "======================================"
|
||||
|
||||
if [ ${#MISSING_ROLES[@]} -eq 0 ] && [ -n "$REALM_ROLE_MAPPER" ] && echo "$USER_ROLES" | grep -q "ADMIN_ORGANISATION"; then
|
||||
echo "✅ Configuration Keycloak OK"
|
||||
echo ""
|
||||
echo "Si les rôles n'apparaissent toujours pas dans le token:"
|
||||
echo "1. Vérifiez que 'roles' est dans quarkus.oidc.authentication.scopes"
|
||||
echo "2. Redémarrez le frontend Quarkus"
|
||||
echo "3. Déconnectez-vous et reconnectez-vous dans l'application"
|
||||
else
|
||||
echo "❌ Configuration Keycloak INCOMPLÈTE"
|
||||
echo ""
|
||||
if [ ${#MISSING_ROLES[@]} -gt 0 ]; then
|
||||
echo "- Rôles manquants: ${MISSING_ROLES[@]}"
|
||||
fi
|
||||
if [ -z "$REALM_ROLE_MAPPER" ]; then
|
||||
echo "- Mapper de rôles manquant"
|
||||
fi
|
||||
if ! echo "$USER_ROLES" | grep -q "ADMIN_ORGANISATION"; then
|
||||
echo "- Rôle ADMIN_ORGANISATION non assigné à admin.mukefi@unionflow.test"
|
||||
fi
|
||||
echo ""
|
||||
echo "Exécutez: unionflow/scripts/keycloak-setup.sh"
|
||||
fi
|
||||
echo ""
|
||||
Reference in New Issue
Block a user