keycloakify 11.5.0 → 11.5.1

package/bin/682.index.js

@@ -311,7 +311,15 @@ const zParsedRealmJson = (() => {
             })
                 .optional(),
             protocol: lib.z.string().optional(),
-            protocolMappers: lib.z.array(lib.z.unknown()).optional()
+            protocolMappers: lib.z.array(lib.z.object({
+                id: lib.z.string(),
+                name: lib.z.string(),
+                protocol: lib.z.string(),
+                protocolMapper: lib.z.string(),
+                consentRequired: lib.z.boolean(),
+                config: lib.z.record(lib.z.string()).optional()
+            }))
+                .optional()
         }))
     });
     assert/* assert */.h;
@@ -705,7 +713,7 @@ function addOrEditClient(params) {
     return { clientId: testClient.clientId };
 }
 function editAccountConsoleAndSecurityAdminConsole(params) {
-    var _a, _b, _c;
+    var _a, _b, _c, _d, _e;
     const { parsedRealmJson } = params;
     for (const clientId of ["account-console", "security-admin-console"]) {
         const client = parsedRealmJson.clients.find(client => client.clientId === clientId);
@@ -721,6 +729,56 @@ function editAccountConsoleAndSecurityAdminConsole(params) {
         }
         ((_c = client.attributes) !== null && _c !== void 0 ? _c : (client.attributes = {}))["post.logout.redirect.uris"] = "+";
         client.webOrigins = ["*"];
+        admin_specific: {
+            if (clientId !== "security-admin-console") {
+                break admin_specific;
+            }
+            const protocolMapper_preexisting = (_d = client.protocolMappers) === null || _d === void 0 ? void 0 : _d.find(protocolMapper => {
+                if (protocolMapper.protocolMapper !== "oidc-hardcoded-claim-mapper") {
+                    return false;
+                }
+                if (protocolMapper.protocol !== "openid-connect") {
+                    return false;
+                }
+                if (protocolMapper.config === undefined) {
+                    return false;
+                }
+                if (protocolMapper.config["claim.name"] !== "allowed-origins") {
+                    return false;
+                }
+                return true;
+            });
+            let protocolMapper;
+            const config = {
+                "introspection.token.claim": "true",
+                "claim.value": '["*"]',
+                "userinfo.token.claim": "true",
+                "id.token.claim": "false",
+                "lightweight.claim": "false",
+                "access.token.claim": "true",
+                "claim.name": "allowed-origins",
+                "jsonType.label": "JSON",
+                "access.tokenResponse.claim": "false"
+            };
+            if (protocolMapper_preexisting !== undefined) {
+                protocolMapper = protocolMapper_preexisting;
+            }
+            else {
+                protocolMapper = {
+                    id: "8fd0d584-7052-4d04-a615-d18a71050873",
+                    name: "allowed-origins",
+                    protocol: "openid-connect",
+                    protocolMapper: "oidc-hardcoded-claim-mapper",
+                    consentRequired: false,
+                    config
+                };
+                ((_e = client.protocolMappers) !== null && _e !== void 0 ? _e : (client.protocolMappers = [])).push(protocolMapper);
+            }
+            (0,assert/* assert */.h)(protocolMapper.config !== undefined);
+            if (config !== protocolMapper.config) {
+                Object.assign(protocolMapper.config, config);
+            }
+        }
     }
 }
 //# sourceMappingURL=prepareRealmConfig.js.map
@@ -735,12 +793,29 @@ function editAccountConsoleAndSecurityAdminConsole(params) {
 (0,assert/* assert */.h)();
 async function dumpContainerConfig(params) {
     const { realmName, keycloakMajorVersionNumber, buildContext } = params;
-    {
-        // https://github.com/keycloak/keycloak/issues/33800
-        const doesUseLockedH2Database = keycloakMajorVersionNumber >= 25;
-        if (doesUseLockedH2Database) {
-            external_child_process_default().execSync(`docker exec ${constants/* CONTAINER_NAME */.sv} sh -c "cp -rp /opt/keycloak/data/h2 /tmp"`);
+    // https://github.com/keycloak/keycloak/issues/33800
+    const doesUseLockedH2Database = keycloakMajorVersionNumber >= 25;
+    if (doesUseLockedH2Database) {
+        const dCompleted = new Deferred.Deferred();
+        const cmd = `docker exec ${constants/* CONTAINER_NAME */.sv} sh -c "cp -rp /opt/keycloak/data/h2 /tmp"`;
+        external_child_process_default().exec(cmd, error => {
+            if (error !== null) {
+                dCompleted.reject(error);
+                return;
+            }
+            dCompleted.resolve();
+        });
+        try {
+            await dCompleted.pr;
         }
+        catch (error) {
+            (0,assert/* assert */.h)((0,assert.is)(error));
+            console.log(source_default().red(`Docker command failed: ${cmd}`));
+            console.log(source_default().red(error.message));
+            throw error;
+        }
+    }
+    {
         const dCompleted = new Deferred.Deferred();
         const child = external_child_process_default().spawn("docker", [
             ...["exec", constants/* CONTAINER_NAME */.sv],
@@ -760,7 +835,7 @@ async function dumpContainerConfig(params) {
         ], { shell: true });
         let output = "";
         const onExit = (code) => {
-            dCompleted.reject(new Error(`Exited with code ${code}`));
+            dCompleted.reject(new Error(`docker exec kc.sh export command failed with code ${code}`));
         };
         child.once("exit", onExit);
         child.stdout.on("data", data => {
@@ -789,31 +864,51 @@ async function dumpContainerConfig(params) {
             (0,assert/* assert */.h)((0,assert.is)(error));
             console.log(source_default().red(error.message));
             console.log(output);
-            process.exit(1);
+            throw error;
         }
-        if (doesUseLockedH2Database) {
-            const dCompleted = new Deferred.Deferred();
-            external_child_process_default().exec(`docker exec ${constants/* CONTAINER_NAME */.sv} sh -c "rm -rf /tmp/h2"`, error => {
-                if (error !== null) {
-                    dCompleted.reject(error);
-                    return;
-                }
-                dCompleted.resolve();
-            });
+    }
+    if (doesUseLockedH2Database) {
+        const dCompleted = new Deferred.Deferred();
+        const cmd = `docker exec ${constants/* CONTAINER_NAME */.sv} sh -c "rm -rf /tmp/h2"`;
+        external_child_process_default().exec(cmd, error => {
+            if (error !== null) {
+                dCompleted.reject(error);
+                return;
+            }
+            dCompleted.resolve();
+        });
+        try {
             await dCompleted.pr;
         }
+        catch (error) {
+            (0,assert/* assert */.h)((0,assert.is)(error));
+            console.log(source_default().red(`Docker command failed: ${cmd}`));
+            console.log(source_default().red(error.message));
+            throw error;
+        }
     }
     const targetRealmConfigJsonFilePath_tmp = (0,external_path_.join)(buildContext.cacheDirPath, "realm.json");
     {
         const dCompleted = new Deferred.Deferred();
-        external_child_process_default().exec(`docker cp ${constants/* CONTAINER_NAME */.sv}:/tmp/${realmName}-realm.json ${targetRealmConfigJsonFilePath_tmp}`, error => {
+        const cmd = `docker cp ${constants/* CONTAINER_NAME */.sv}:/tmp/${realmName}-realm.json ${(0,external_path_.basename)(targetRealmConfigJsonFilePath_tmp)}`;
+        external_child_process_default().exec(cmd, {
+            cwd: (0,external_path_.dirname)(targetRealmConfigJsonFilePath_tmp)
+        }, error => {
             if (error !== null) {
                 dCompleted.reject(error);
                 return;
             }
             dCompleted.resolve();
         });
-        await dCompleted.pr;
+        try {
+            await dCompleted.pr;
+        }
+        catch (error) {
+            (0,assert/* assert */.h)((0,assert.is)(error));
+            console.log(source_default().red(`Docker command failed: ${cmd}`));
+            console.log(source_default().red(error.message));
+            throw error;
+        }
     }
     return readRealmJsonFile({
         realmJsonFilePath: targetRealmConfigJsonFilePath_tmp
@@ -877,11 +972,18 @@ async function getRealmConfig(params) {
         const run = runExclusive.build(async () => {
             const start = Date.now();
             console.log(source_default().grey(`Changes detected to the '${realmName}' config, backing up...`));
-            const parsedRealmJson = await dumpContainerConfig({
-                buildContext,
-                realmName,
-                keycloakMajorVersionNumber
-            });
+            let parsedRealmJson;
+            try {
+                parsedRealmJson = await dumpContainerConfig({
+                    buildContext,
+                    realmName,
+                    keycloakMajorVersionNumber
+                });
+            }
+            catch (error) {
+                console.log(source_default().red(`Failed to backup '${realmName}' config:`));
+                return;
+            }
             await writeRealmJsonFile({ parsedRealmJson });
             console.log([
                 source_default().grey(`Save changed to \`.${external_path_.sep}${(0,external_path_.relative)(buildContext.projectDirPath, realmJsonFilePath)}\``),

package/bin/start-keycloak/realmConfig/ParsedRealmJson.d.ts

@@ -30,7 +30,14 @@ export type ParsedRealmJson = {
             "post.logout.redirect.uris"?: string;
         };
         protocol?: string;
-        protocolMappers?: unknown[];
+        protocolMappers?: {
+            id: string;
+            name: string;
+            protocol: string;
+            protocolMapper: string;
+            consentRequired: boolean;
+            config?: Record<string, string>;
+        }[];
     }[];
 };
 export declare function readRealmJsonFile(params: {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "keycloakify",
-    "version": "11.5.0",
+    "version": "11.5.1",
     "description": "Framework to create custom Keycloak UIs",
     "repository": {
         "type": "git",

package/src/bin/start-keycloak/realmConfig/ParsedRealmJson.ts

@@ -39,7 +39,14 @@ export type ParsedRealmJson = {
             "post.logout.redirect.uris"?: string;
         };
         protocol?: string;
-        protocolMappers?: unknown[];
+        protocolMappers?: {
+            id: string;
+            name: string;
+            protocol: string; // "openid-connect" or something else
+            protocolMapper: string; // "oidc-hardcoded-claim-mapper" or something else
+            consentRequired: boolean;
+            config?: Record<string, string>;
+        }[];
     }[];
 };
 
@@ -89,7 +96,18 @@ const zParsedRealmJson = (() => {
                     })
                     .optional(),
                 protocol: z.string().optional(),
-                protocolMappers: z.array(z.unknown()).optional()
+                protocolMappers: z
+                    .array(
+                        z.object({
+                            id: z.string(),
+                            name: z.string(),
+                            protocol: z.string(),
+                            protocolMapper: z.string(),
+                            consentRequired: z.boolean(),
+                            config: z.record(z.string()).optional()
+                        })
+                    )
+                    .optional()
             })
         )
     });

package/src/bin/start-keycloak/realmConfig/defaultConfig/realm-kc-26.json

@@ -985,6 +985,24 @@
                         "claim.name": "locale",
                         "jsonType.label": "String"
                     }
+                },
+                {
+                    "id": "8fd0d584-7052-4d04-a615-d18a71050873",
+                    "name": "allowed-origins",
+                    "protocol": "openid-connect",
+                    "protocolMapper": "oidc-hardcoded-claim-mapper",
+                    "consentRequired": false,
+                    "config": {
+                        "introspection.token.claim": "true",
+                        "claim.value": "[\"*\"]",
+                        "userinfo.token.claim": "true",
+                        "id.token.claim": "false",
+                        "lightweight.claim": "false",
+                        "access.token.claim": "true",
+                        "claim.name": "allowed-origins",
+                        "jsonType.label": "JSON",
+                        "access.tokenResponse.claim": "false"
+                    }
                 }
             ],
             "defaultClientScopes": [
@@ -1640,13 +1658,13 @@
                 "config": {
                     "allowed-protocol-mapper-types": [
                         "oidc-usermodel-property-mapper",
-                        "saml-user-attribute-mapper",
                         "saml-user-property-mapper",
-                        "oidc-full-name-mapper",
-                        "oidc-sha256-pairwise-sub-mapper",
                         "oidc-address-mapper",
+                        "saml-user-attribute-mapper",
+                        "saml-role-list-mapper",
+                        "oidc-sha256-pairwise-sub-mapper",
                         "oidc-usermodel-attribute-mapper",
-                        "saml-role-list-mapper"
+                        "oidc-full-name-mapper"
                     ]
                 }
             },
@@ -1676,14 +1694,14 @@
                 "subComponents": {},
                 "config": {
                     "allowed-protocol-mapper-types": [
-                        "oidc-sha256-pairwise-sub-mapper",
                         "saml-user-attribute-mapper",
-                        "oidc-usermodel-property-mapper",
                         "oidc-full-name-mapper",
-                        "saml-role-list-mapper",
+                        "oidc-sha256-pairwise-sub-mapper",
                         "saml-user-property-mapper",
-                        "oidc-usermodel-attribute-mapper",
-                        "oidc-address-mapper"
+                        "oidc-usermodel-property-mapper",
+                        "saml-role-list-mapper",
+                        "oidc-address-mapper",
+                        "oidc-usermodel-attribute-mapper"
                     ]
                 }
             },

package/src/bin/start-keycloak/realmConfig/dumpContainerConfig.ts

@@ -1,6 +1,6 @@
 import { CONTAINER_NAME } from "../../shared/constants";
 import child_process from "child_process";
-import { join as pathJoin } from "path";
+import { join as pathJoin, dirname as pathDirname, basename as pathBasename } from "path";
 import chalk from "chalk";
 import { Deferred } from "evt/tools/Deferred";
 import { assert, is } from "tsafe/assert";
@@ -20,16 +20,37 @@ export async function dumpContainerConfig(params: {
 }): Promise<ParsedRealmJson> {
     const { realmName, keycloakMajorVersionNumber, buildContext } = params;
 
-    {
-        // https://github.com/keycloak/keycloak/issues/33800
-        const doesUseLockedH2Database = keycloakMajorVersionNumber >= 25;
+    // https://github.com/keycloak/keycloak/issues/33800
+    const doesUseLockedH2Database = keycloakMajorVersionNumber >= 25;
 
-        if (doesUseLockedH2Database) {
-            child_process.execSync(
-                `docker exec ${CONTAINER_NAME} sh -c "cp -rp /opt/keycloak/data/h2 /tmp"`
-            );
+    if (doesUseLockedH2Database) {
+        const dCompleted = new Deferred<void>();
+
+        const cmd = `docker exec ${CONTAINER_NAME} sh -c "cp -rp /opt/keycloak/data/h2 /tmp"`;
+
+        child_process.exec(cmd, error => {
+            if (error !== null) {
+                dCompleted.reject(error);
+                return;
+            }
+
+            dCompleted.resolve();
+        });
+
+        try {
+            await dCompleted.pr;
+        } catch (error) {
+            assert(is<Error>(error));
+
+            console.log(chalk.red(`Docker command failed: ${cmd}`));
+
+            console.log(chalk.red(error.message));
+
+            throw error;
         }
+    }
 
+    {
         const dCompleted = new Deferred<void>();
 
         const child = child_process.spawn(
@@ -56,7 +77,9 @@ export async function dumpContainerConfig(params: {
         let output = "";
 
         const onExit = (code: number | null) => {
-            dCompleted.reject(new Error(`Exited with code ${code}`));
+            dCompleted.reject(
+                new Error(`docker exec kc.sh export command failed with code ${code}`)
+            );
         };
 
         child.once("exit", onExit);
@@ -96,25 +119,34 @@ export async function dumpContainerConfig(params: {
 
             console.log(output);
 
-            process.exit(1);
+            throw error;
         }
+    }
 
-        if (doesUseLockedH2Database) {
-            const dCompleted = new Deferred<void>();
+    if (doesUseLockedH2Database) {
+        const dCompleted = new Deferred<void>();
 
-            child_process.exec(
-                `docker exec ${CONTAINER_NAME} sh -c "rm -rf /tmp/h2"`,
-                error => {
-                    if (error !== null) {
-                        dCompleted.reject(error);
-                        return;
-                    }
+        const cmd = `docker exec ${CONTAINER_NAME} sh -c "rm -rf /tmp/h2"`;
 
-                    dCompleted.resolve();
-                }
-            );
+        child_process.exec(cmd, error => {
+            if (error !== null) {
+                dCompleted.reject(error);
+                return;
+            }
 
+            dCompleted.resolve();
+        });
+
+        try {
             await dCompleted.pr;
+        } catch (error) {
+            assert(is<Error>(error));
+
+            console.log(chalk.red(`Docker command failed: ${cmd}`));
+
+            console.log(chalk.red(error.message));
+
+            throw error;
         }
     }
 
@@ -126,8 +158,13 @@ export async function dumpContainerConfig(params: {
     {
         const dCompleted = new Deferred<void>();
 
+        const cmd = `docker cp ${CONTAINER_NAME}:/tmp/${realmName}-realm.json ${pathBasename(targetRealmConfigJsonFilePath_tmp)}`;
+
         child_process.exec(
-            `docker cp ${CONTAINER_NAME}:/tmp/${realmName}-realm.json ${targetRealmConfigJsonFilePath_tmp}`,
+            cmd,
+            {
+                cwd: pathDirname(targetRealmConfigJsonFilePath_tmp)
+            },
             error => {
                 if (error !== null) {
                     dCompleted.reject(error);
@@ -138,7 +175,17 @@ export async function dumpContainerConfig(params: {
             }
         );
 
-        await dCompleted.pr;
+        try {
+            await dCompleted.pr;
+        } catch (error) {
+            assert(is<Error>(error));
+
+            console.log(chalk.red(`Docker command failed: ${cmd}`));
+
+            console.log(chalk.red(error.message));
+
+            throw error;
+        }
     }
 
     return readRealmJsonFile({

package/src/bin/start-keycloak/realmConfig/prepareRealmConfig.ts

@@ -276,7 +276,7 @@ function editAccountConsoleAndSecurityAdminConsole(params: {
 }) {
     const { parsedRealmJson } = params;
 
-    for (const clientId of ["account-console", "security-admin-console"]) {
+    for (const clientId of ["account-console", "security-admin-console"] as const) {
         const client = parsedRealmJson.clients.find(
             client => client.clientId === clientId
         );
@@ -298,5 +298,68 @@ function editAccountConsoleAndSecurityAdminConsole(params: {
         (client.attributes ??= {})["post.logout.redirect.uris"] = "+";
 
         client.webOrigins = ["*"];
+
+        admin_specific: {
+            if (clientId !== "security-admin-console") {
+                break admin_specific;
+            }
+
+            const protocolMapper_preexisting = client.protocolMappers?.find(
+                protocolMapper => {
+                    if (protocolMapper.protocolMapper !== "oidc-hardcoded-claim-mapper") {
+                        return false;
+                    }
+
+                    if (protocolMapper.protocol !== "openid-connect") {
+                        return false;
+                    }
+
+                    if (protocolMapper.config === undefined) {
+                        return false;
+                    }
+
+                    if (protocolMapper.config["claim.name"] !== "allowed-origins") {
+                        return false;
+                    }
+
+                    return true;
+                }
+            );
+
+            let protocolMapper: NonNullable<typeof protocolMapper_preexisting>;
+
+            const config = {
+                "introspection.token.claim": "true",
+                "claim.value": '["*"]',
+                "userinfo.token.claim": "true",
+                "id.token.claim": "false",
+                "lightweight.claim": "false",
+                "access.token.claim": "true",
+                "claim.name": "allowed-origins",
+                "jsonType.label": "JSON",
+                "access.tokenResponse.claim": "false"
+            };
+
+            if (protocolMapper_preexisting !== undefined) {
+                protocolMapper = protocolMapper_preexisting;
+            } else {
+                protocolMapper = {
+                    id: "8fd0d584-7052-4d04-a615-d18a71050873",
+                    name: "allowed-origins",
+                    protocol: "openid-connect",
+                    protocolMapper: "oidc-hardcoded-claim-mapper",
+                    consentRequired: false,
+                    config
+                };
+
+                (client.protocolMappers ??= []).push(protocolMapper);
+            }
+
+            assert(protocolMapper.config !== undefined);
+
+            if (config !== protocolMapper.config) {
+                Object.assign(protocolMapper.config, config);
+            }
+        }
     }
 }

package/src/bin/start-keycloak/realmConfig/realmConfig.ts

@@ -105,11 +105,19 @@ export async function getRealmConfig(params: {
                 chalk.grey(`Changes detected to the '${realmName}' config, backing up...`)
             );
 
-            const parsedRealmJson = await dumpContainerConfig({
-                buildContext,
-                realmName,
-                keycloakMajorVersionNumber
-            });
+            let parsedRealmJson: ParsedRealmJson;
+
+            try {
+                parsedRealmJson = await dumpContainerConfig({
+                    buildContext,
+                    realmName,
+                    keycloakMajorVersionNumber
+                });
+            } catch (error) {
+                console.log(chalk.red(`Failed to backup '${realmName}' config:`));
+
+                return;
+            }
 
             await writeRealmJsonFile({ parsedRealmJson });