Uh oh!
There was an error while loading. Please reload this page.
✨ Smartlink for second gen - #2824
Closed
Findeton wants to merge 4 commits into
Closed
Conversation
Port of feat/meta-12275/release/9.5 onto main. WASM tgz packages and yarn.lock are regenerated in a follow-up commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Contributor
There was a problem hiding this comment.
Pull request overview
Adds second-generation Smart Link support by introducing a neutral Keycloak “login bridge” action-token module, exposing Keycloak realm-attribute management (with secret redaction) through Harvest/Hasura, and wiring admin-portal UI + permissions to configure Smart Link per election-event realm. Also updates Keycloak image build and CI/devcontainer workflows to optionally include the private beyond Keycloak extensions.
Changes:
- Add Keycloak realm-attributes read/write API (Harvest route + Hasura action) with validation and server-side redaction semantics for sensitive keys.
- Introduce
action-token-login-bridgeKeycloak extension and refactor existing Smart Link email/magic-link flows to use it. - Update admin-portal election-event settings UI, permissions, and translations to support viewing/editing realm attributes (including Smart Link config), plus update Keycloak container build to include optional
beyondextensions.
Reviewed changes
Copilot reviewed 51 out of 56 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/yarn.lock | Updates sequent-core tarball hashes referenced by the monorepo lockfile. |
| packages/sequent-core/src/wasm/wasm_permissions.rs | Adds realm-attributes permissions to the WASM/TS permission enum. |
| packages/sequent-core/src/types/permissions.rs | Adds new keycloak-realm-attributes-* permission variants for Rust services. |
| packages/sequent-core/src/types/keycloak.rs | Defines Smart Link realm-attribute keys and max-length constants. |
| packages/sequent-core/src/services/keycloak/realm_attributes.rs | Adds get/update realm-attributes support, validation, and redaction helpers (plus tests). |
| packages/sequent-core/src/services/jwt.rs | Adds optional x-hasura-election-event-id claim field to Hasura JWT claims. |
| packages/keycloak-extensions/pom.xml | Adds new module and optional beyond profile + spotless include updates. |
| packages/keycloak-extensions/message-otp-authenticator/src/main/java/sequent/keycloak/authenticator/smart_link/SmartLinkResource.java | Switches Smart Link resource to use the new LoginBridge helpers. |
| packages/keycloak-extensions/message-otp-authenticator/src/main/java/sequent/keycloak/authenticator/smart_link/SmartLinkAuthenticator.java | Switches Smart Link authenticator to use the new LoginBridge helpers. |
| packages/keycloak-extensions/message-otp-authenticator/src/main/java/sequent/keycloak/authenticator/smart_link/SmartLink.java | Removes action-token creation/link-building logic now owned by the login-bridge module. |
| packages/keycloak-extensions/message-otp-authenticator/src/main/java/sequent/keycloak/authenticator/smart_link/AbstractAdminResource.java | Uses shared CORS helper from the login-bridge module. |
| packages/keycloak-extensions/message-otp-authenticator/pom.xml | Adds dependency on action-token-login-bridge. |
| packages/keycloak-extensions/conditional-authenticators/src/test/java/sequent/keycloak/protocol/oidc/mappers/AuthorizedElectionsUserAttributeMapperTest.java | Adds tests for the new Hasura election-event-id claim injection. |
| packages/keycloak-extensions/conditional-authenticators/src/main/java/sequent/keycloak/protocol/oidc/mappers/AuthorizedElectionsUserAttributeMapper.java | Uses RealmNames helper and injects x-hasura-election-event-id into Hasura claims. |
| packages/keycloak-extensions/conditional-authenticators/pom.xml | Adds dependency on action-token-login-bridge. |
| packages/keycloak-extensions/action-token-login-bridge/src/test/java/sequent/keycloak/realm/RealmNamesTest.java | Adds tests for realm-name parsing helper. |
| packages/keycloak-extensions/action-token-login-bridge/src/main/java/sequent/keycloak/realm/RealmNames.java | Adds reusable parser for tenant-...-event-... realm names. |
| packages/keycloak-extensions/action-token-login-bridge/src/main/java/sequent/keycloak/login_bridge/LoginBridgeActionTokenHandlerFactory.java | Renames/moves handler factory into login-bridge module/package. |
| packages/keycloak-extensions/action-token-login-bridge/src/main/java/sequent/keycloak/login_bridge/LoginBridgeActionTokenHandler.java | Renames/moves handler and improves boolean checks + logging level. |
| packages/keycloak-extensions/action-token-login-bridge/src/main/java/sequent/keycloak/login_bridge/LoginBridgeActionToken.java | Introduces neutral token class while keeping token type compatibility. |
| packages/keycloak-extensions/action-token-login-bridge/src/main/java/sequent/keycloak/login_bridge/LoginBridge.java | Adds shared action-token creation, URL building, and redirect-uri validation helpers. |
| packages/keycloak-extensions/action-token-login-bridge/src/main/java/sequent/keycloak/login_bridge/CorsResource.java | Moves CORS preflight handling into shared module. |
| packages/keycloak-extensions/action-token-login-bridge/src/main/java/sequent/keycloak/login_bridge/BaseRealmResourceProvider.java | Improves OPTIONS handling with null-safe request method access. |
| packages/keycloak-extensions/action-token-login-bridge/pom.xml | Adds Maven module for the shared login-bridge extension. |
| packages/harvest/src/routes/realm_attributes.rs | Adds get-realm-attributes route and updates update route auth/validation/errors. |
| packages/harvest/src/main.rs | Registers the new get_realm_attributes_route. |
| packages/Dockerfile.keycloak.dockerignore | Adds Dockerfile-specific ignore rules for Keycloak build context. |
| packages/Dockerfile.keycloak | Builds provider JARs generically and supports optional beyond build context. |
| packages/admin-portal/src/types/keycloak.ts | Adds new realm-attributes permissions to admin-portal permissions enum. |
| packages/admin-portal/src/translations/tl.ts | Adds realm-attributes UI strings and permission labels. |
| packages/admin-portal/src/translations/nl.ts | Adds realm-attributes UI strings and permission labels. |
| packages/admin-portal/src/translations/gl.ts | Adds realm-attributes UI strings and permission labels. |
| packages/admin-portal/src/translations/fr.ts | Adds realm-attributes UI strings and permission labels. |
| packages/admin-portal/src/translations/eu.ts | Adds realm-attributes UI strings and permission labels. |
| packages/admin-portal/src/translations/es.ts | Adds realm-attributes UI strings and permission labels. |
| packages/admin-portal/src/translations/en.ts | Adds realm-attributes UI strings and permission labels. |
| packages/admin-portal/src/translations/cat.ts | Adds realm-attributes UI strings and permission labels. |
| packages/admin-portal/src/resources/ElectionEvent/EditElectionEventDataForm.tsx | Adds realm-attributes accordion/editor + read/write gating and uses new query/mutation roles. |
| packages/admin-portal/src/queries/GetRealmAttributes.ts | Adds GraphQL query for fetching redacted realm attributes. |
| hasura/metadata/actions.yaml | Adds get_realm_attributes action and updates permissions for realm-attribute updates. |
| hasura/metadata/actions.graphql | Adds GraphQL types for get_realm_attributes output. |
| docs/permissions.md | Documents new keycloak-realm-attributes-* permissions. |
| docs/docusaurus/docs/integrations/smart_link_integration_guide.md | Adds integrator-facing Smart Link SSO guide for second generation. |
| docs/docusaurus/docs/developers/06-Keycloak/smart_link_hmac_design_implementation.md | Adds developer design/implementation notes for Smart Link HMAC + login bridge. |
| .gitmodules | Points beyond submodule branch to feat/meta-12275/main. |
| .github/workflows/reusable_build_push.yml | Adds submodule checkout + build contexts for Keycloak image builds. |
| .github/workflows/reusable_build_push_root.yml | Adds submodule checkout + build contexts for Keycloak image builds (root workflow). |
| .devcontainer/scripts/format-code.sh | Makes formatting script path-robust and optionally formats beyond extensions. |
| .devcontainer/keycloak/import/tenant-90505c8a-23a9-4cdf-a26b-4e19f6a097d5.json | Adds the new permissions into the devcontainer Keycloak realm import. |
| .devcontainer/docker-compose.yml | Adds beyond as an additional build context for Keycloak service. |
| .devcontainer/docker-compose-remote.yml | Adds beyond as an additional build context for Keycloak service (remote). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+183
to
+190
| .map(|(key, value)| { | ||
| let value = if is_sensitive_attribute_key(key) { | ||
| REDACTED_ATTRIBUTE_VALUE.to_string() | ||
| } else { | ||
| value.clone() | ||
| }; | ||
| (key.clone(), value) | ||
| }) |
Comment on lines
1406
to
1420
| <SelectInput | ||
| source={"presentation.voter_certificate_policy"} | ||
| choices={VoterCertificatePolicyChoices()} | ||
| label={String( | ||
| t("electionEventScreen.field.VoterCertificatePolicy.policyLabel") | ||
| )} | ||
| defaultValue={EVoterCertificatePolicy.DISABLED} | ||
| emptyText={undefined} | ||
| validate={required()} | ||
| onChange={(e) => | ||
| setVoterCertificatePolicy(e.target.value as EVoterCertificatePolicy) | ||
| setRealmAttributeDraftValue( | ||
| REALM_ATTR_VOTER_CERTIFICATE_POLICY, | ||
| e.target.value as EVoterCertificatePolicy | ||
| ) | ||
| } |
Comment on lines
+152
to
+155
| `update_realm_attributes` in | ||
| `packages/sequent-core/src/services/keycloak/realm_attributes.rs` validates each | ||
| value (boolean enable flag; non-blank bounded secret; positive integer timeouts; | ||
| comma-separated required attribute names) and drops anything malformed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Parent issue: https://github.com/sequentech/meta/issues/12275