Repository navigation
Conversation
Keycloak sign-in only proved identity; resolveSsoUser always set is_admin=false, so SSO users mapped to platform_admin in the gateway never saw the admin-only Settings tabs. After the token check, call the gateway's /auth/email/me with the user's access token and overlay is_admin, full_name and auth_provider on the session user. A failed lookup keeps today's non-admin fallback because permissions remain enforced gateway-side. Adds regressions for the gateway-mapped admin profile and the failed-lookup fallback. Fixes contextforge-org#245 Signed-off-by: Li Fengmin <2080291162@qq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Keycloak sign-in proves identity, but
resolveSsoUser()always setsis_admin: false. Users whose realm role is mapped toplatform_adminby the gateway (SSO_KEYCLOAK_ROLE_MAPPINGS) therefore never see the admin-only Settings tabs, even though the gateway itself treats them as admins and/api/admin/*calls through the BFF succeed.After the ID token is verified and before the BFF session is created, fetch the gateway's own user record with that user's access token:
GET ${CONTEXTFORGE_URL}/auth/email/mewithupstreamAuthHeader(accessToken), a 3 s timeout, and the client IP headersis_admin,full_nameandauth_provideronto the session user; email still comes from the verified ID tokenThe lookup never fails the login. Network errors, non-2xx responses, non-JSON bodies and malformed bodies log a warning and keep today's
is_admin: falsefallback -- permissions remain enforced gateway-side, so this only changes which UI is shown. This also covers users on gateway versions without/auth/email/me.Tests
is_admin: true,full_name: "Gateway Admin"andauth_provider: "keycloak"produces those values in/auth/session, and the profile request carriesAuthorization: Bearer <access token>./auth/email/mestill establishes the session withis_admin: falseand the ID-token profile.Local: SSO callback 19/19; full BFF server suite 26 files / 301 tests passed;
npm run typecheck, eslint and prettier on changed files.Fixes #245