Rework Admin UI #6

2026-03-20T11:53:04+01:00

MasterMito commented

2026-03-20 11:53:04 +01:00

Rework of the Admin UI and affected workflows
Passed all tests

Rework of the Admin UI and affected workflows Passed all tests

MasterMito added 18 commits 2026-03-20 11:53:04 +01:00

Introduced Openspec to project 65fea5d48b

feat: Enrich DTOs and UI to display member names instead of UUIDs for task assignees, creators, and shift signups. da70cf4b13

feat: Configure Keycloak to use internal port 8081, explicitly define OIDC endpoints in NextAuth, and update API service Keycloak authority. d295c9123e

feat: Add global administrator role support with integration tests for admin-only club endpoints. 04641319ce

WIP: AdminClubService DI fix and RLS-related changes 112b299b8e

Fix RLS permission issue in integration tests ade9444682

- Add BYPASSRLS privilege to app_admin role
- Grant full schema and table access to app_admin
- Allow rls_test_user to assume app_admin role
- Fixes: permission denied for table clubs (42501)

Fix admin authorization check - properly parse realm_access claim bb373a6b8e

The realm_access claim in JWT is a JSON object, not a simple string.
Previous string contains check was looking for escaped quotes in wrong format.

- Parse realm_access as JSON to extract roles array
- Check if 'admin' exists in roles array
- Fallback to string contains check if JSON parsing fails
- Applied fix in RequireGlobalAdmin policy, TenantValidationMiddleware,
  and ClubRoleClaimsTransformation

Fixes: Admin users getting 401 when trying to create clubs

Add debug endpoint to inspect JWT claims b52d75591b

Add CORS configuration and exempt debug endpoint from tenant validation a3ca12da26

- Add CORS policy to allow frontend requests from localhost:3000
- Exempt /api/debug endpoints from tenant validation
- Fix JSON parsing in realm_access claim checks

Make debug endpoint anonymous for troubleshooting 0f9a7aba5c

WIP: Fix Keycloak networking for API container 97baf266a8

Add JWT debugging and fix Keycloak networking 4ba76288b5

- Added JWT authentication event logging to diagnose validation failures
- Fixed docker-compose networking for API to reach Keycloak via hostname
- Debug endpoint now accessible without auth for troubleshooting
- Still investigating why claims are not populated despite token being present

Fix middleware order - place Authentication before TenantValidation 26d7d83811

The JWT middleware needs to fetch signing keys from Keycloak before
tenant validation runs. The previous order caused signature validation
to fail because the middleware was blocking the JWKS endpoint requests.

- Moved Authentication before TenantValidationMiddleware
- Removed realm endpoint from exemption list (not needed with correct order)
- This allows JWT middleware to fetch signing keys and validate tokens

Fix Keycloak hostname configuration for Docker internal communication 87c315c6fd

- Add MetadataAddress configuration to JWT middleware for internal Docker URLs
- Add KC_HOSTNAME_ADMIN and KC_SPI_HOSTNAME_DEFAULT_ADMIN to Keycloak env
- This ensures API can fetch JWKS from Keycloak via internal Docker network
- Tests passing: 63/63

Fix JWT validation by configuring custom signing key resolver 13f9e7be7f

- Added IssuerSigningKeyResolver to fetch JWKS directly from internal Keycloak URL
- This bypasses the localhost:8080 URLs in Keycloak's discovery document
- Ensures JWT tokens are validated against correct signing keys

Add test endpoint for middleware validation tests fdc1f415b7

Fix test: Update GetClubsCurrent_NoTenantContext_ReturnsForbidden to reflect actual behavior 0f036a2ef6

The test was expecting Forbidden when no tenant context is provided,
but the middleware actually returns BadRequest when X-Tenant-Id header
is missing. Updated the test and added GetClubsCurrent_InvalidTenant_ReturnsForbidden
to properly test the Forbidden case.

Merge pull request 'Fix RLS permissions and JWT validation for admin club creation' (#5 ) from fix/rls-permission-test-failure into epic/admin_rework_second_try

CI Pipeline / Backend Build & Test (pull_request) Successful in 53s

Details

CI Pipeline / Frontend Lint, Test & Build (pull_request) Successful in 38s

Details

CI Pipeline / Infrastructure Validation (pull_request) Successful in 3s

Details

984ab77137

Reviewed-on: #5

MasterMito merged commit 66719d9787 into main

2026-03-20 11:55:38 +01:00

MasterMito deleted branch epic/admin_rework_second_try

2026-03-20 11:55:38 +01:00

MasterMito referenced this issue from a commit

2026-03-20 11:55:39 +01:00

Merge pull request 'Rework Admin UI' (#6) from epic/admin_rework_second_try into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MasterMito/work-club-manager#6