Keycloak auth server

CHANGELOG.md

@@ -32,6 +32,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 * Update `LocalConfig` to `Consts` for all constants in app (other than permissions and roles)
 * Update `AutoBogus` to `AutobogusLifesupport` to support .NET 6 and UTC
 * `RequireHttpsMetadata`  off in dev for BFF and boundaries
+* `SuperAdmin` text to `Super Admin`
+* `UserPolicyHandler` can accommodate realm roles for keycloak
 
 ### Fixed
 

Craftsman/Builders/AppSettingsBuilder.cs

@@ -23,16 +23,6 @@ public void CreateWebApiAppSettings(string srcDirectory, string dbName, string p
         _utilities.CreateFile(classPath, fileText);
     }
 
-    public void CreateAuthServerAppSettings(string projectDirectory, string authServerProjectName)
-    {
-        var classPath = ClassPathHelper.AuthServerAppSettingsClassPath(projectDirectory, $"appsettings.json", authServerProjectName);
-        var fileText = @$"{{
-  ""AllowedHosts"": ""*""
-}}
-";
-        _utilities.CreateFile(classPath, fileText);
-    }
-
     private static string GetAppSettingsText(string dbName)
     {
         // won't build properly if it has an empty string

Craftsman/Builders/Auth/RolesBuilder.cs

@@ -29,7 +29,7 @@ private static string GetRolesText(string classNamespace)
 
     public static class Roles
     {{
-        public const string SuperAdmin = ""SuperAdmin"";
+        public const string SuperAdmin = ""Super Admin"";
         public const string User = ""User"";
 
         public static List<string> List()

Craftsman/Builders/Auth/UserPolicyHandlerBuilder.cs

@@ -28,6 +28,7 @@ private static string GetPolicyBuilderText(string classNamespace, string solutio
         return @$"namespace {classNamespace};
 
 using System.Security.Claims;
+using System.Text.Json;
 using {entityServices.ClassNamespace};
 using {rolesClassPath.ClassNamespace};
 using {domainPolicyClassPath.ClassNamespace};
@@ -50,11 +51,19 @@ public async Task<IEnumerable<string>> GetUserPermissions()
         var user = _currentUserService.User;
         if (user == null) throw new ArgumentNullException(nameof(user));
 
+        // traditional roles
         var roles = user.Claims
             .Where(c => c.Type is ClaimTypes.Role or ""client_role"")
             .Select(r => r.Value)
             .Distinct()
             .ToArray();
+
+        var realmRoles = user.Claims
+            .Where(c => c.Type is ""realm_access"")
+            .Select(r => JsonSerializer.Deserialize<RealmAccess>(r.Value))
+            .SelectMany(x => x?.Roles);
+
+        roles = roles.Concat(realmRoles).ToArray();
 
         if(roles.Length == 0)
             return Array.Empty<string>();
@@ -71,6 +80,11 @@ public async Task<IEnumerable<string>> GetUserPermissions()
 
         return await Task.FromResult(permissions);
     }}
+
+    private class RealmAccess
+    {{
+        public string[] Roles {{ get; set; }}
+    }}
 }}";
     }
 }