rails_keycloak_authorization 0.0.1

data/app/views/rails_keycloak_authorization/management/index.html.erb

@@ -0,0 +1,79 @@
+<h1 class="text-lg font-medium text-center text-gray-500">Rails Keycloak Authorization Gem</h1>
+
+<div class="text-sm font-medium text-center text-gray-500 border-b border-gray-200 dark:text-gray-400 dark:border-gray-700" role="tablist">
+  <ul class="flex flex-wrap -mb-px">
+    <li>
+      <button
+        id="routes-tab"
+        hx-get="<%= routes_path %>"
+        class="inline-block p-4 rounded-t-lg border-b-2 text-blue-600 border-blue-600 dark:text-blue-500 dark:border-blue-500"
+        hx-on::after-request="
+          document.querySelector('#routes-tab').className = 'inline-block p-4 rounded-t-lg border-b-2 text-blue-600 border-blue-600 dark:text-blue-500 dark:border-blue-500';
+          document.querySelector('#policies-tab').className = 'inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500';
+          document.querySelector('#permissions-tab').className = 'inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500';
+          document.querySelector('#resources-tab').className ='inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500';
+        "
+        hx-target="#tab-content"
+        hx-swap="innerHTML"
+        role="tab"
+        aria-selected="true"
+        aria-controls="tab-content">Rails Routes</button>
+    </li>
+
+    <li>
+      <button
+        id="policies-tab"
+        hx-get="<%= policies_path %>"
+        class="inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500"
+        hx-on::after-request="
+          document.querySelector('#permissions-tab').className ='inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500';
+          document.querySelector('#routes-tab').className ='inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500';
+          document.querySelector('#policies-tab').className = 'inline-block p-4 rounded-t-lg border-b-2 text-blue-600 border-blue-600 dark:text-blue-500 dark:border-blue-500';
+          document.querySelector('#resources-tab').className ='inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500';
+        "
+        hx-target="#tab-content"
+        hx-swap="innerHTML"
+        role="tab"
+        aria-selected="true"
+        aria-controls="tab-content">Keycloak Policies</button>
+    </li>
+
+    <li>
+      <button
+        id="permissions-tab"
+        hx-get="<%= permissions_path %>"
+        class="inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500"
+        hx-on::after-request="
+          document.querySelector('#routes-tab').className ='inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500';
+          document.querySelector('#policies-tab').className ='inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500';
+          document.querySelector('#permissions-tab').className = 'inline-block p-4 rounded-t-lg border-b-2 text-blue-600 border-blue-600 dark:text-blue-500 dark:border-blue-500';
+          document.querySelector('#resources-tab').className ='inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500';
+        "
+        hx-target="#tab-content"
+        hx-swap="innerHTML"
+        role="tab"
+        aria-selected="true"
+        aria-controls="tab-content">Keycloak Permissions</button>
+    </li>
+
+    <li>
+      <button
+        id="resources-tab"
+        hx-get="<%= resources_path %>"
+        class="inline-block p-4 rounded-t-lg  border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500"
+        hx-on::after-request="
+          document.querySelector('#routes-tab').className ='inline-block p-4 rounded-t-lg border-b-2 text-gray-600 border-gray-600 dark:text-gray-500 dark:border-gray-500';
+          document.querySelector('#policies-tab').className = 'inline-block p-4 rounded-t-lg border-b-2 text-gray-600  border-gray-600  dark:text-gray-500 dark:border-gray-500';
+          document.querySelector('#permissions-tab').className = 'inline-block p-4 rounded-t-lg border-b-2 text-gray-600  border-gray-600  dark:text-gray-500 dark:border-gray-500';
+          document.querySelector('#resources-tab').className = 'inline-block p-4 rounded-t-lg border-b-2 text-blue-600 border-blue-600 dark:text-blue-500 dark:border-blue-500';
+        "
+        hx-target="#tab-content"
+        hx-swap="innerHTML"
+        role="tab"
+        aria-selected="false"
+        aria-controls="tab-content">Keycloak Resource</button>
+    </li>
+  </ul>
+</div>
+
+<div id="tab-content" role="tabpanel" class="tab-content" hx-get="<%= routes_path %>" hx-trigger="load delay:100ms" hx-swap="innerHTML"></div>

data/app/views/rails_keycloak_authorization/permissions/index.html.erb

@@ -0,0 +1,41 @@
+<% if @permissions.empty? %>
+  <div>No permissions created yet!</div>
+<% end %>
+
+<% @permissions.each do |permission| %>
+  <div>name:</div>
+  <div><%= permission.name %></div>
+  <div>type:</div>
+  <div><%= permission.type %></div>
+<% end %>
+
+
+<form hx-post="<%= permissions_path %>">
+  <div>
+    <label for="keycloak_policy_id">Policy</label>
+    <select name="keycloak_policy_id" hx-indicator=".htmx-indicator">
+      <option value="" selected disabled>Select Policy</option>
+      <% @policies.map do |policy| %>
+        <option value="<%= policy.id %>"><%= policy.name %></option>
+      <% end %>
+    </select>
+  </div>
+
+  <div>
+    <label for="keycloak_resource_id">Resource</label>
+    <select name="keycloak_resource_id"
+            hx-get="<%= resource_scopes_select_permissions_path %>"
+            hx-target="#scopes"
+            hx-indicator=".htmx-indicator">
+      <option value="" selected disabled>Select Resource</option>
+      <% @resources.map do |resource| %>
+        <option value="<%= resource.id %>"><%= resource.name %></option>
+      <% end %>
+    </select>
+  </div>
+
+  <div id="scopes"></div>
+  <button
+    class="bg-blue-500 hover:bg-blue-700 text-white font-bold py-1 px-3 rounded"
+    type="submit">Create</button>
+</form>

data/app/views/rails_keycloak_authorization/permissions/resource_scopes_select.html.erb

@@ -0,0 +1,7 @@
+<label for="keycloak_scope_id">Scope</label>
+<select name="keycloak_scope_id" hx-indicator=".htmx-indicator">
+  <option value="" selected disabled>Select Scope</option>
+  <% @resource_scopes.map do |scope| %>
+    <option value="<%= scope.id %>"><%= scope.name %></option>
+  <% end %>
+</select>

data/app/views/rails_keycloak_authorization/policies/index.html.erb

@@ -0,0 +1,23 @@
+<h1 class="text-center text-gray-500">Policies</h1>
+<% if @policies.empty? %>
+  <p class="inline">Default Policy for </p>
+  <form class="inline" hx-post="<%= policies_path %>">
+    <input id="keycloak_policy_name" name="keycloak_policy_name" value="<%= @default_policy_name %>" type="text">
+    <label for="keycloak_realm_role">Role</label>
+    <select name="keycloak_realm_role_id" hx-indicator=".htmx-indicator">
+      <% @realm_roles.map do |role| %>
+        <option value="<%= role.id %>" <%= role.name.include?("default") ? "selected=selected" : "" %>>
+          <%= role.name %>
+        </option>
+      <% end %>
+    </select>
+    <button
+      class="bg-blue-500 hover:bg-blue-700 text-white font-bold py-1 px-3 rounded"
+      type="submit">Create</button>
+  </form>
+<% else %>
+    <div class="text-gray-500">Current Policy</div>
+    <% @policies.map do |policy| %>
+     <p><%= policy.name %></p>
+    <% end %>
+<% end %>

data/app/views/rails_keycloak_authorization/resources/index.html.erb

@@ -0,0 +1,5 @@
+<h1>Resources</h1>
+<% @controller_names.each do |controller_name| %>
+  Rails controller: <%= controller_name %>
+  keycloak resource: <%= controller_name %>
+<% end %>

data/app/views/rails_keycloak_authorization/resources/new.html.erb

@@ -0,0 +1,4 @@
+<form hx-post="<%= resources_path %>">
+  <input type="text" name="route_id" hidden="hidden" value="<%= @route.defaults[:controller] %>">
+  <button class="bg-blue-500 hover:bg-blue-700 text-white font-bold py-1 px-3 rounded" type="Submit">Create Resource?</button>
+</form>

data/app/views/rails_keycloak_authorization/resources/show.html.erb

@@ -0,0 +1,28 @@
+<% if @keycloak_resource %>
+  <table class="table-auto">
+    <thead>
+    <tr><th>Controller</th></tr>
+    </thead>
+    <tbody>
+    <tr><td><%= @keycloak_resource.name %></td></tr>
+    </tbody>
+  </table>
+
+  <table class="table-auto">
+    <thead>
+    <tr>
+      <th>Scope</th>
+    </tr>
+    </thead>
+    <tbody>
+    <tr>
+      <td>
+        <div hx-get="<%= scope_path("scope:#{@route.defaults[:action]}", keycloak_resource_id: @keycloak_resource.id, keycloak_scope_name: @route.defaults[:action]) %>" hx-trigger="load" ></div>
+      </td>
+    </tr>
+    </tbody>
+  </table>
+
+<% else %>
+  <div hx-get="<%= new_resource_path(route_id: @route.name) %>" hx-trigger="load" ></div>
+<% end %>

data/app/views/rails_keycloak_authorization/routes/index.html.erb

@@ -0,0 +1,58 @@
+<table>
+  <caption>Available Routes</caption>
+  <thead>
+  <tr>
+    <th scope="col" class="text-left">Verb</th>
+    <th scope="col" class="text-left">Name</th>
+    <th scope="col" class="text-left">Path</th>
+    <th scope="col" class="text-left">Controller</th>
+    <th scope="col" class="text-left">Action</th>
+    <th scope="col" class="text-left">Inspect</th>
+  </tr>
+  </thead>
+  <% @routes.each do |route| %>
+    <tbody>
+    <tr class="p-2 bg-gray-100 border border-gray-200">
+      <td class="text-left">
+        <%= route.verb %>
+      </td>
+      <td class="text-left">
+        <%= route.name %>
+      </td>
+      <td class="text-left">
+        <%= route.path.spec.to_s %>
+      </td>
+      <td class="text-left">
+        <%= route.defaults[:controller] %>
+      </td>
+      <td class="text-left">
+        <%= route.defaults[:action] %>
+      </td>
+      <td class="text-left">
+        <button class="bg-blue-500 hover:bg-blue-700 text-white font-bold py-1 px-3 rounded"
+                popovertarget="modal"
+                hx-get="<%= route_path(route.name) %>"
+                hx-trigger="click"
+                hx-target="#modal-content"
+                hx-swap="innserHtml">Inspect</button>
+      </td>
+    </tr>
+    <tbody>
+  <% end %>
+</table>
+
+<div popover id="modal" class="border border-gray-200">
+  <style>
+      :popover-open {
+          width: 600px;
+          height: 400px;
+      }
+  </style>
+  <div class="bg-gray-200 h-5/6 w-full p-4" id="modal-content" >
+    <h1>Modal Dialog</h1>
+    This is the modal content. You can put anything here, like text, or a form, or an image.
+  </div>
+  <div class="text-center pt-2">
+    <button class="bg-blue-500 hover:bg-blue-700 text-white font-bold py-1 px-3 rounded" hx-on:click="document.getElementById('modal').hidePopover()">Close</button>
+  </div>
+</div>

data/app/views/rails_keycloak_authorization/routes/show.html.erb

@@ -0,0 +1,6 @@
+<h1 class="text-xl">Keycloak Authorization Status</h1>
+
+<div>Route: <%= @route.name %></div>
+
+<div hx-get="<%= resource_path(@route.name) %>" hx-trigger="load" ></div>
+

data/app/views/rails_keycloak_authorization/scopes/index.html.erb

@@ -0,0 +1,9 @@
+<% @scopes.each do |scope| %>
+  <table>
+    <tbody>
+    <tr>
+      <td><%= scope.name %></td>
+    </tr>
+    </tbody>
+  </table>
+<% end %>

data/app/views/rails_keycloak_authorization/scopes/show.html.erb

@@ -0,0 +1,33 @@
+<div id="scope">
+  <% if @resource_scope %>
+    <div>Resource Attached Scope: <b><%= @resource_scope.name %></b></div>
+    <div>Check <b>Keycloak Policies</b> tab</div>
+
+  <% elsif @available_scope %>
+    Available Scope to attach: <%= @available_scope.name %>
+
+    <button
+      class="block bg-blue-500 hover:bg-blue-700 text-white font-bold py-1 px-3 rounded"
+      hx-post="<%= attach_scope_path(@keycloak_scope_name) %>"
+      hx-target="#scope"
+      hx-vals='{
+              "keycloak_scope_name": "<%= @keycloak_scope_name %>",
+              "keycloak_resource_id": "<%= @keycloak_resource_id %>"
+            }'
+    >
+      Attach scope <%= @keycloak_scope_name %> to resource ?
+    </button>
+
+  <% else %>
+    Scope <b><%= @keycloak_scope_name %></b> not created yet.
+    <button
+      class="block bg-blue-500 hover:bg-blue-700 text-white font-bold py-1 px-3 rounded"
+      hx-post="<%= scopes_path %>"
+      hx-target="#scope"
+      hx-vals='{
+              "keycloak_scope_name": "<%= @keycloak_scope_name %>",
+              "keycloak_resource_id": "<%= @keycloak_resource_id %>"
+            }'
+    >Create Scope?</button>
+  <% end %>
+</div>

data/config/routes.rb

@@ -0,0 +1,13 @@
+RailsKeycloakAuthorization::Engine.routes.draw do
+  root "management#index"
+  resources :management, only: [:index]
+  resources :routes, only: [:index, :show]
+  resources :policies, only: [:index, :create]
+  resources :permissions, only: [:index, :create] do
+    get :resource_scopes_select, on: :collection
+  end
+  resources :resources, only: [:create, :show, :new, :index]
+  resources :scopes, only: [:index, :show, :new, :create] do
+    post :attach, on: :member
+  end
+end

data/lib/rails_keycloak_authorization/engine.rb

@@ -0,0 +1,8 @@
+module RailsKeycloakAuthorization
+  class Engine < ::Rails::Engine
+    isolate_namespace RailsKeycloakAuthorization
+    initializer "rails_keycloak_authorization.middleware" do |app|
+      app.middleware.use RailsKeycloakAuthorization::Middleware
+    end
+  end
+end

data/lib/rails_keycloak_authorization/version.rb

@@ -0,0 +1,3 @@
+module RailsKeycloakAuthorization
+  VERSION = "0.0.1"
+end

data/lib/rails_keycloak_authorization.rb

@@ -0,0 +1,77 @@
+require "rails_keycloak_authorization/version"
+require "rails_keycloak_authorization/engine"
+
+module RailsKeycloakAuthorization
+  mattr_accessor :keycloak_realm
+  mattr_accessor :keycloak_server_url
+  mattr_accessor :keycloak_admin_username
+  mattr_accessor :keycloak_admin_password
+  mattr_accessor :match_patterns
+  mattr_accessor :client_id
+
+  class Middleware
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      if should_process?(env["REQUEST_URI"],)
+        if !env["HTTP_AUTHORIZATION"]
+          [403, {}, ["Authentication Failed"]]
+        elsif authorize!(env['REQUEST_URI'], env['HTTP_AUTHORIZATION'])
+          @app.call(env)
+        else
+          [403, {}, ["Authorization Failed"]]
+        end
+      else
+        @app.call(env)
+      end
+    end
+
+    def should_process?(request_uri)
+      RailsKeycloakAuthorization.match_patterns.detect do |r|
+        r.match(request_uri)
+      end
+    end
+
+    def authorize!(request_uri, http_authorization)
+      route = Rails.application.routes.recognize_path(request_uri)
+      uri = uri(RailsKeycloakAuthorization.keycloak_server_url, RailsKeycloakAuthorization.keycloak_realm)
+      request = http_request(uri, http_authorization, route)
+      response = http_client(uri).request(request)
+      response.is_a?(Net::HTTPSuccess)
+    end
+
+    def http_request(uri, http_authorization, route)
+      request = Net::HTTP::Post.new(uri, {
+        'Content-Type' => 'application/x-www-form-urlencoded',
+        'Authorization' => http_authorization,
+      })
+      permission = "#{route[:controller]}_controller##{route[:action]}"
+      request.body = URI.encode_www_form({
+                                           audience: "#{RailsKeycloakAuthorization.client_id}",
+                                           grant_type: grant_type,
+                                           permission: permission,
+                                           response_mode: "permissions",
+                                           permission_resource_format: "id",
+                                           permission_resource_matching_uri: false
+                                         })
+      request
+    end
+
+    def grant_type
+      "urn:ietf:params:oauth:grant-type:uma-ticket"
+    end
+
+    def uri(keycloak_server_url, keycloak_realm)
+      URI("#{keycloak_server_url}/realms/#{keycloak_realm}/protocol/openid-connect/token")
+    end
+
+    def http_client(uri)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = Rails.env.production?
+      http.read_timeout = ENV.fetch("KEYCLOAK_AUTHORIZATION_TIMEOUT", 1).to_i
+      http
+    end
+  end
+end

data/lib/tasks/rails_keycloak_authorization_tasks.rake

@@ -0,0 +1,170 @@
+require 'keycloak-admin'
+
+namespace :'rails-keycloak-authorization' do
+  desc "Explaining what the task does"
+  task :create_default_scopes do
+    keycloak_admin_configure
+    realm_name = ENV["KEYCLOAK_AUTH_CLIENT_REALM_NAME"]
+    client = KeycloakAdmin.realm(realm_name).clients.find_by_client_id(ENV["KEYCLOAK_AUTH_CLIENT_ID"])
+    KeycloakAdmin.realm(realm_name).authz_scopes(client.id).create!("POST", "POST Scope", "")
+    KeycloakAdmin.realm(realm_name).authz_scopes(client.id).create!("GET", "GET Scope", "")
+    KeycloakAdmin.realm(realm_name).authz_scopes(client.id).create!("PUT", "PUT Scope", "")
+    KeycloakAdmin.realm(realm_name).authz_scopes(client.id).create!("PATCH", "PATCH Scope", "")
+    KeycloakAdmin.realm(realm_name).authz_scopes(client.id).create!("DELETE", "DESTROY Scope", "")
+  end
+
+  desc "Explaining what the task does"
+  task :create_resources do
+    create_resource "Organization"
+  end
+
+  desc "Explaining what the task does"
+  task :create_policy do
+    create_policy
+  end
+
+  desc "Explaining what the task does"
+  task :create_permission do
+    create_permission
+  end
+
+
+  desc "Explaining what the task does"
+  task :validate_keycloak_admin_ruby_permissions do
+    puts "Validating, Rails::Keycloak::Authorization ...."
+    keycloak_admin_configure
+    realm_name = ENV["KEYCLOAK_AUTH_CLIENT_REALM_NAME"]
+
+    client = KeycloakAdmin.realm(realm_name).clients.find_by_client_id(ENV["KEYCLOAK_AUTH_CLIENT_ID"])
+    client.authorization_services_enabled = true
+    KeycloakAdmin.realm(realm_name).clients.update(client)
+    KeycloakAdmin.realm(realm_name).authz_scopes(client.id).list.each{|scope| puts scope.name }
+    KeycloakAdmin.realm(realm_name).authz_resources(client.id).list.each{|scope| puts scope.uris }
+    KeycloakAdmin.realm(realm_name).authz_policies(client.id, 'role').list.each{|scope| puts "Policy #{scope.name}" }
+
+    realm_role =  KeycloakAdmin.realm(realm_name).roles.get("default-roles-dummy")
+
+    scope_1 = KeycloakAdmin.realm(realm_name).authz_scopes(client.id).create!("POST_1", "POST 1 scope", "http://asdas")
+    scope_2 = KeycloakAdmin.realm(realm_name).authz_scopes(client.id).create!("POST_2", "POST 2 scope", "http://asdas")
+    puts KeycloakAdmin.realm(realm_name).authz_scopes(client.id).search("POST")
+    puts KeycloakAdmin.realm(realm_name).authz_scopes(client.id).get(scope_1.id)
+
+    # resource = KeycloakAdmin.realm(realm_name).authz_resources(client.id).create!(
+    #   "Dummy Resource",
+    #   "type",
+    #   ["/asdf/*", "/tmp/"],
+    #   true,
+    #   "display_name",
+    #   [{id: scope_1.id, name: scope_1.name},{id: scope_2.id, name: scope_2.name}],
+    #   {"a": ["b", "c"]}
+    # )
+    resource = KeycloakAdmin.realm(realm_name).authz_resources(client.id).create!("Dummy Resource", "type", ["/asdf/*", "/tmp/"], true, "display_name", [], {"a": ["b", "c"]})
+
+    puts KeycloakAdmin.realm(realm_name).authz_resources(client.id).find_by("Dummy Resource", "", "", "", "").first.name
+    puts KeycloakAdmin.realm(realm_name).authz_resources(client.id).find_by("", "type", "", "", "").first.name
+
+    puts KeycloakAdmin.realm(realm_name).authz_resources(client.id).get(resource.id).scopes.count
+    puts KeycloakAdmin.realm(realm_name).authz_resources(client.id).get(resource.id).uris.count
+    puts KeycloakAdmin.realm(realm_name).authz_resources(client.id).update(resource.id,
+                                                                           {
+                                                                             "name": "Dummy Resource",
+                                                                             "type": "type",
+                                                                             "owner_managed_access": true,
+                                                                             "display_name": "display_name",
+                                                                             "attributes": {"a":["b","c"]},
+                                                                             "uris": [ "/asdf/*" , "/tmp/45" ],
+                                                                             "scopes":[
+                                                                               {name: scope_1.name},{name: scope_2.name}
+                                                                             ],
+                                                                             "icon_uri": "https://icon.ico"
+                                                                           }
+                                                                           )
+
+    puts KeycloakAdmin.realm(realm_name).authz_resources(client.id).update(resource.id,
+                                                                           {
+                                                                             "name": "Dummy Resource",
+                                                                             "scopes":[
+                                                                               {name: scope_1.name}
+                                                                             ]
+                                                                           }
+    )
+
+    policy = KeycloakAdmin.realm(realm_name).authz_policies(client.id, 'role').create!("Policy 1", "description", "role", "POSITIVE", "UNANIMOUS", true, [{id: realm_role.id, required: true}])
+    puts KeycloakAdmin.realm(realm_name).authz_policies(client.id, 'role').find_by("Policy 1", "role").first.name
+    puts KeycloakAdmin.realm(realm_name).authz_policies(client.id, 'role').get(policy.id).name
+    scope_permission = KeycloakAdmin.realm(realm_name).authz_permissions(client.id, :scope).create!("Dummy Scope Permission", "scope description", "UNANIMOUS", "POSITIVE", [resource.id], [policy.id], [scope_1.id, scope_2.id], "")
+    resource_permission = KeycloakAdmin.realm(realm_name).authz_permissions(client.id, :resource).create!("Dummy Resource Permission", "resource description", "UNANIMOUS", "POSITIVE", [resource.id], [policy.id], nil, "")
+    resource_permissions = KeycloakAdmin.realm(realm_name).authz_permissions(client.id, "", resource.id).list
+    puts resource_permissions.length
+    puts KeycloakAdmin.realm(realm_name).authz_permissions(client.id, "resource").get(resource_permission.id)
+    debugger
+    resource_scopes = KeycloakAdmin.realm(realm_name).authz_scopes(client.id, resource.id).list
+    puts resource_scopes.length
+    KeycloakAdmin.realm(realm_name).authz_permissions(client.id, 'scope').list.map{|r| puts r.name}
+    KeycloakAdmin.realm(realm_name).authz_permissions(client.id, 'resource').list.map{|r| puts r.name}
+    puts KeycloakAdmin.realm(realm_name).authz_permissions(client.id, "resource").find_by(resource_permission.name, nil).first.name
+    puts KeycloakAdmin.realm(realm_name).authz_permissions(client.id, "resource").find_by(resource_permission.name, resource.id).first.name
+    puts KeycloakAdmin.realm(realm_name).authz_permissions(client.id, "scope").find_by(scope_permission.name, resource.id).first.name
+    puts KeycloakAdmin.realm(realm_name).authz_permissions(client.id, "scope").find_by(scope_permission.name, resource.id, "POST_1").first.name
+    puts KeycloakAdmin.realm(realm_name).authz_permissions(client.id, "resource").find_by(nil, resource.id).first.name
+    puts KeycloakAdmin.realm(realm_name).authz_permissions(client.id, "scope").find_by(nil, resource.id).first.name
+    puts KeycloakAdmin.realm(realm_name).authz_permissions(client.id, "scope").find_by(nil, resource.id, "POST_1").first.name
+    puts KeycloakAdmin.realm(realm_name).authz_permissions(client.id, "scope").find_by(scope_permission.name, nil).first.name
+    # KeycloakAdmin.realm(realm_name).authz_permissions(client.id).find_by(resource_permission.name, resource.id, "scope", nil )
+
+    KeycloakAdmin.realm(realm_name).authz_permissions(client.id, 'scope').delete(scope_permission.id)
+    KeycloakAdmin.realm(realm_name).authz_permissions(client.id, 'resource').delete(resource_permission.id)
+    KeycloakAdmin.realm(realm_name).authz_policies(client.id, 'role').delete(policy.id)
+    KeycloakAdmin.realm(realm_name).authz_resources(client.id).delete(resource.id)
+    KeycloakAdmin.realm(realm_name).authz_scopes(client.id).delete(scope_1.id)
+    KeycloakAdmin.realm(realm_name).authz_scopes(client.id).delete(scope_2.id)
+    puts "Validation, Rails::Keycloak::Authorization done."
+  end
+
+
+
+
+
+  def create_resource(model_name)
+    keycloak_admin_configure
+    resource_name = model_name.downcase.pluralize
+    client = KeycloakAdmin.realm(realm_name).clients.find_by_client_id(ENV.fetch("KEYCLOAK_AUTH_CLIENT_ID"))
+    scopes = KeycloakAdmin.realm(realm_name).authz_scopes(client.id).list.reverse
+    KeycloakAdmin.realm(realm_name)
+                 .authz_resources(client.id)
+                 .create!(model_name,
+                          "type",
+                          ["/#{resource_name}/*", "/#{resource_name}"],
+                          true,
+                          "#{resource_name.capitalize} Resource",
+                          scopes.map{|scope| {id: scope.id, name: scope.name} },
+                          { "model": resource_name }
+                 )
+  end
+
+  def create_policy
+    keycloak_admin_configure
+    realm_role =  KeycloakAdmin.realm(realm_name).roles.get("default-roles-dummy")
+    client = KeycloakAdmin.realm(realm_name).clients.find_by_client_id(ENV["KEYCLOAK_AUTH_CLIENT_ID"])
+    KeycloakAdmin
+      .realm(realm_name)
+      .authz_policies(client.id, 'role')
+      .create!("Policy 1",
+               "description",
+               "role",
+               "POSITIVE",
+               "UNANIMOUS",
+               true,
+               [{id: realm_role.id, required: true}]
+      )
+  end
+  def create_permission
+    keycloak_admin_configure
+    client = KeycloakAdmin.realm(realm_name).clients.find_by_client_id(ENV["KEYCLOAK_AUTH_CLIENT_ID"])
+    resource = KeycloakAdmin.realm(realm_name).authz_resources(client.id).find_by(client.id, "Organization", "", "", "").first
+    policy = KeycloakAdmin.realm(realm_name).authz_policies( client.id, 'role').find_by("Policy 1", "role").first
+    scope_permission = KeycloakAdmin.realm(realm_name).authz_permissions(client.id, :scope).create!("Organizations Scope Permission", "scope description", "UNANIMOUS", "POSITIVE", [resource.id], [policy.id], ["POST", "GET", "PATCH", "PUT", "DELETE"], "")
+  end
+
+
+end