 WorkClub Automation
|
b9edbb8a65
|
feat(auth): add Keycloak JWT authentication and role-based authorization
- Configure JWT Bearer authentication with Keycloak realm integration
- Create ClubRoleClaimsTransformation to parse 'clubs' claim and add ASP.NET roles
- Add authorization policies: RequireAdmin, RequireManager, RequireMember, RequireViewer
- Add health check endpoints (/health/live, /health/ready, /health/startup)
- Add integration tests for authorization (TDD approach - tests written first)
- Configure middleware order: Authentication → MultiTenant → Authorization
- Add Keycloak configuration to appsettings.Development.json
- Add AspNetCore.HealthChecks.NpgSql v9.0.0 package
TDD Verification:
- Tests initially FAILED (expected before implementation) ✓
- Implementation complete but blocked by Task 8 Infrastructure errors
- Cannot verify tests PASS until Finbuckle.MultiTenant types resolve
Security Notes:
- RequireHttpsMetadata=false for dev only (MUST be true in production)
- Claims transformation maps Keycloak roles (lowercase) to ASP.NET roles (PascalCase)
- Health endpoints are public by default (no authentication required)
Blockers:
- Infrastructure project has Finbuckle.MultiTenant type resolution errors from Task 8
- Tests cannot execute until TenantProvider compilation errors are fixed
|
2026-03-03 14:27:30 +01:00 |
|
|
WorkClub Automation
|
a1032484bd
|
docs(k8s): add Task 6 Kustomize base manifests learnings
- Kustomize vs Helm trade-offs and base+overlay pattern
- K8s resource naming conventions with workclub- prefix
- .NET health probe semantics (startup/liveness/readiness)
- StatefulSet + headless service pattern for Postgres
- PostgreSQL 16-alpine with pg_isready health check
- Keycloak 26.x production mode configuration
- Ingress path-based routing (/ → frontend, /api → backend)
- ConfigMap strategy for non-sensitive configuration
- Resource requests/limits placeholders for overlays
- Image tag strategy with :latest placeholder
- Gotchas: serviceName, headless service publishNotReadyAddresses, probe timeouts
|
2026-03-03 14:10:04 +01:00 |
|
|
WorkClub Automation
|
ba024c45be
|
feat(domain): add core entities — Club, Member, WorkItem, Shift with state machine
- Create domain entities in WorkClub.Domain/Entities: Club, Member, WorkItem, Shift, ShiftSignup
- Implement enums: SportType, ClubRole, WorkItemStatus
- Add ITenantEntity interface for multi-tenancy support
- Implement state machine validation on WorkItem with C# 14 switch expressions
- Valid transitions: Open→Assigned→InProgress→Review→Done, Review→InProgress (rework)
- All invalid transitions throw InvalidOperationException
- TDD approach: Write tests first, 12/12 passing
- Use required properties with explicit Guid/Guid? for foreign keys
- DateTimeOffset for timestamps (timezone-aware, multi-tenant friendly)
- RowVersion byte[] for optimistic concurrency control
- No navigation properties yet (deferred to EF Core task)
- No domain events or validation attributes (YAGNI for MVP)
|
2026-03-03 14:09:25 +01:00 |
|