keycloakify 11.5.3 → 11.6.0

package/src/bin/start-keycloak/realmConfig/defaultConfig/realm-kc-23.json

@@ -789,6 +789,24 @@
             "fullScopeAllowed": false,
             "nodeReRegistrationTimeout": 0,
             "protocolMappers": [
+                {
+                    "id": "8fd0d584-7052-4d04-a615-d18a71050873",
+                    "name": "allowed-origins",
+                    "protocol": "openid-connect",
+                    "protocolMapper": "oidc-hardcoded-claim-mapper",
+                    "consentRequired": false,
+                    "config": {
+                        "introspection.token.claim": "true",
+                        "userinfo.token.claim": "true",
+                        "id.token.claim": "false",
+                        "access.token.claim": "true",
+                        "claim.name": "allowed-origins",
+                        "jsonType.label": "JSON",
+                        "access.tokenResponse.claim": "false",
+                        "claim.value": "[\"*\"]",
+                        "lightweight.claim": "true"
+                    }
+                },
                 {
                     "id": "59cde7ae-2218-4a8e-83af-cad992c3a700",
                     "name": "locale",
@@ -1401,14 +1419,14 @@
                 "subComponents": {},
                 "config": {
                     "allowed-protocol-mapper-types": [
-                        "saml-role-list-mapper",
                         "oidc-sha256-pairwise-sub-mapper",
-                        "oidc-usermodel-attribute-mapper",
                         "saml-user-attribute-mapper",
                         "oidc-full-name-mapper",
+                        "oidc-usermodel-property-mapper",
+                        "oidc-usermodel-attribute-mapper",
                         "oidc-address-mapper",
                         "saml-user-property-mapper",
-                        "oidc-usermodel-property-mapper"
+                        "saml-role-list-mapper"
                     ]
                 }
             },
@@ -1477,14 +1495,14 @@
                 "subComponents": {},
                 "config": {
                     "allowed-protocol-mapper-types": [
-                        "saml-user-attribute-mapper",
+                        "oidc-usermodel-property-mapper",
                         "saml-role-list-mapper",
+                        "saml-user-property-mapper",
                         "oidc-usermodel-attribute-mapper",
+                        "saml-user-attribute-mapper",
                         "oidc-address-mapper",
-                        "saml-user-property-mapper",
                         "oidc-full-name-mapper",
-                        "oidc-sha256-pairwise-sub-mapper",
-                        "oidc-usermodel-property-mapper"
+                        "oidc-sha256-pairwise-sub-mapper"
                     ]
                 }
             }

package/src/bin/start-keycloak/realmConfig/defaultConfig/realm-kc-24.json

@@ -919,6 +919,24 @@
                         "claim.name": "locale",
                         "jsonType.label": "String"
                     }
+                },
+                {
+                    "id": "8fd0d584-7052-4d04-a615-d18a71050873",
+                    "name": "allowed-origins",
+                    "protocol": "openid-connect",
+                    "protocolMapper": "oidc-hardcoded-claim-mapper",
+                    "consentRequired": false,
+                    "config": {
+                        "introspection.token.claim": "true",
+                        "userinfo.token.claim": "true",
+                        "id.token.claim": "false",
+                        "access.token.claim": "true",
+                        "claim.name": "allowed-origins",
+                        "jsonType.label": "JSON",
+                        "access.tokenResponse.claim": "false",
+                        "claim.value": "[\"*\"]",
+                        "lightweight.claim": "true"
+                    }
                 }
             ],
             "defaultClientScopes": ["web-origins", "acr", "profile", "roles", "email"],
@@ -1545,14 +1563,14 @@
                 "subComponents": {},
                 "config": {
                     "allowed-protocol-mapper-types": [
+                        "oidc-full-name-mapper",
                         "saml-role-list-mapper",
+                        "saml-user-attribute-mapper",
+                        "oidc-usermodel-attribute-mapper",
                         "oidc-address-mapper",
                         "oidc-usermodel-property-mapper",
-                        "saml-user-attribute-mapper",
                         "saml-user-property-mapper",
-                        "oidc-sha256-pairwise-sub-mapper",
-                        "oidc-usermodel-attribute-mapper",
-                        "oidc-full-name-mapper"
+                        "oidc-sha256-pairwise-sub-mapper"
                     ]
                 }
             },
@@ -1584,14 +1602,14 @@
                 "subComponents": {},
                 "config": {
                     "allowed-protocol-mapper-types": [
+                        "oidc-sha256-pairwise-sub-mapper",
+                        "oidc-address-mapper",
                         "oidc-full-name-mapper",
                         "oidc-usermodel-property-mapper",
                         "saml-user-attribute-mapper",
-                        "oidc-sha256-pairwise-sub-mapper",
                         "saml-role-list-mapper",
-                        "oidc-address-mapper",
-                        "oidc-usermodel-attribute-mapper",
-                        "saml-user-property-mapper"
+                        "saml-user-property-mapper",
+                        "oidc-usermodel-attribute-mapper"
                     ]
                 }
             },

package/src/bin/start-keycloak/realmConfig/defaultConfig/realm-kc-25.json

@@ -964,6 +964,24 @@
                         "claim.name": "locale",
                         "jsonType.label": "String"
                     }
+                },
+                {
+                    "id": "8fd0d584-7052-4d04-a615-d18a71050873",
+                    "name": "allowed-origins",
+                    "protocol": "openid-connect",
+                    "protocolMapper": "oidc-hardcoded-claim-mapper",
+                    "consentRequired": false,
+                    "config": {
+                        "introspection.token.claim": "true",
+                        "userinfo.token.claim": "true",
+                        "id.token.claim": "false",
+                        "access.token.claim": "true",
+                        "claim.name": "allowed-origins",
+                        "jsonType.label": "JSON",
+                        "access.tokenResponse.claim": "false",
+                        "claim.value": "[\"*\"]",
+                        "lightweight.claim": "true"
+                    }
                 }
             ],
             "defaultClientScopes": [
@@ -1618,14 +1636,14 @@
                 "subComponents": {},
                 "config": {
                     "allowed-protocol-mapper-types": [
-                        "saml-role-list-mapper",
-                        "oidc-full-name-mapper",
-                        "saml-user-property-mapper",
-                        "saml-user-attribute-mapper",
                         "oidc-usermodel-attribute-mapper",
                         "oidc-address-mapper",
+                        "saml-role-list-mapper",
+                        "saml-user-property-mapper",
                         "oidc-sha256-pairwise-sub-mapper",
-                        "oidc-usermodel-property-mapper"
+                        "saml-user-attribute-mapper",
+                        "oidc-usermodel-property-mapper",
+                        "oidc-full-name-mapper"
                     ]
                 }
             },
@@ -1657,12 +1675,12 @@
                     "allowed-protocol-mapper-types": [
                         "oidc-address-mapper",
                         "saml-user-attribute-mapper",
-                        "oidc-full-name-mapper",
                         "saml-role-list-mapper",
+                        "oidc-usermodel-property-mapper",
                         "oidc-sha256-pairwise-sub-mapper",
-                        "oidc-usermodel-attribute-mapper",
                         "saml-user-property-mapper",
-                        "oidc-usermodel-property-mapper"
+                        "oidc-usermodel-attribute-mapper",
+                        "oidc-full-name-mapper"
                     ]
                 }
             },

package/src/bin/start-keycloak/realmConfig/defaultConfig/realm-kc-26.json

@@ -997,7 +997,7 @@
                         "claim.value": "[\"*\"]",
                         "userinfo.token.claim": "true",
                         "id.token.claim": "false",
-                        "lightweight.claim": "false",
+                        "lightweight.claim": "true",
                         "access.token.claim": "true",
                         "claim.name": "allowed-origins",
                         "jsonType.label": "JSON",
@@ -1628,7 +1628,7 @@
     "smtpServer": {},
     "loginTheme": "keycloakify-starter",
     "accountTheme": "",
-    "adminTheme": "",
+    "adminTheme": "keycloakify-starter",
     "emailTheme": "",
     "eventsEnabled": false,
     "eventsListeners": ["keycloakify-logging", "jboss-logging"],
@@ -1657,13 +1657,13 @@
                 "subComponents": {},
                 "config": {
                     "allowed-protocol-mapper-types": [
-                        "oidc-usermodel-property-mapper",
-                        "saml-user-property-mapper",
                         "oidc-address-mapper",
                         "saml-user-attribute-mapper",
-                        "saml-role-list-mapper",
-                        "oidc-sha256-pairwise-sub-mapper",
+                        "oidc-usermodel-property-mapper",
                         "oidc-usermodel-attribute-mapper",
+                        "saml-user-property-mapper",
+                        "oidc-sha256-pairwise-sub-mapper",
+                        "saml-role-list-mapper",
                         "oidc-full-name-mapper"
                     ]
                 }
@@ -1694,14 +1694,14 @@
                 "subComponents": {},
                 "config": {
                     "allowed-protocol-mapper-types": [
-                        "saml-user-attribute-mapper",
-                        "oidc-full-name-mapper",
+                        "oidc-usermodel-attribute-mapper",
                         "oidc-sha256-pairwise-sub-mapper",
-                        "saml-user-property-mapper",
-                        "oidc-usermodel-property-mapper",
                         "saml-role-list-mapper",
                         "oidc-address-mapper",
-                        "oidc-usermodel-attribute-mapper"
+                        "oidc-full-name-mapper",
+                        "saml-user-property-mapper",
+                        "oidc-usermodel-property-mapper",
+                        "saml-user-attribute-mapper"
                     ]
                 }
             },

package/src/bin/start-keycloak/realmConfig/prepareRealmConfig.ts

@@ -333,7 +333,7 @@ function editAccountConsoleAndSecurityAdminConsole(params: {
                 "claim.value": '["*"]',
                 "userinfo.token.claim": "true",
                 "id.token.claim": "false",
-                "lightweight.claim": "false",
+                "lightweight.claim": "true",
                 "access.token.claim": "true",
                 "claim.name": "allowed-origins",
                 "jsonType.label": "JSON",

package/src/bin/start-keycloak/realmConfig/realmConfig.ts

@@ -1,6 +1,5 @@
 import type { BuildContext } from "../../shared/buildContext";
 import { assert } from "tsafe/assert";
-import { runPrettier, getIsPrettierAvailable } from "../../tools/runPrettier";
 import { getDefaultConfig } from "./defaultConfig";
 import {
     prepareRealmConfig,
@@ -14,7 +13,11 @@ import {
     sep as pathSep
 } from "path";
 import { existsAsync } from "../../tools/fs.existsAsync";
-import { readRealmJsonFile, type ParsedRealmJson } from "./ParsedRealmJson";
+import {
+    readRealmJsonFile,
+    writeRealmJsonFile,
+    type ParsedRealmJson
+} from "./ParsedRealmJson";
 import {
     dumpContainerConfig,
     type BuildContextLike as BuildContextLike_dumpContainerConfig
@@ -80,22 +83,11 @@ export async function getRealmConfig(params: {
         }
     }
 
-    const writeRealmJsonFile = async (params: { parsedRealmJson: ParsedRealmJson }) => {
-        const { parsedRealmJson } = params;
-
-        let sourceCode = JSON.stringify(parsedRealmJson, null, 2);
-
-        if (await getIsPrettierAvailable()) {
-            sourceCode = await runPrettier({
-                sourceCode,
-                filePath: realmJsonFilePath
-            });
-        }
-
-        fs.writeFileSync(realmJsonFilePath, sourceCode);
-    };
-
-    await writeRealmJsonFile({ parsedRealmJson });
+    await writeRealmJsonFile({
+        realmJsonFilePath,
+        parsedRealmJson,
+        keycloakMajorVersionNumber
+    });
 
     const { onRealmConfigChange } = (() => {
         const run = runExclusive.build(async () => {
@@ -119,7 +111,11 @@ export async function getRealmConfig(params: {
                 return;
             }
 
-            await writeRealmJsonFile({ parsedRealmJson });
+            await writeRealmJsonFile({
+                realmJsonFilePath,
+                parsedRealmJson,
+                keycloakMajorVersionNumber
+            });
 
             console.log(
                 [

package/src/bin/start-keycloak/start-keycloak.ts

@@ -142,15 +142,96 @@ export async function command(params: {
             ].join("\n")
         );
 
-        const { value: tag } = await cliSelect<string>({
-            values: latestMajorTags
-        }).catch(() => {
-            process.exit(-1);
-        });
+        const tag_userSelected = await (async () => {
+            let tag: string;
+
+            let latestMajorTags_copy = [...latestMajorTags];
+
+            while (true) {
+                const { value } = await cliSelect<string>({
+                    values: latestMajorTags_copy
+                }).catch(() => {
+                    process.exit(-1);
+                });
+
+                tag = value;
+
+                {
+                    const doImplementAccountMpa =
+                        buildContext.implementedThemeTypes.account.isImplemented &&
+                        buildContext.implementedThemeTypes.account.type === "Multi-Page";
+
+                    if (doImplementAccountMpa && tag.startsWith("22.")) {
+                        console.log(
+                            chalk.yellow(
+                                `You are implementing a Multi-Page Account theme. Keycloak 22 is not supported, select another version`
+                            )
+                        );
+                        latestMajorTags_copy = latestMajorTags_copy.filter(
+                            tag => !tag.startsWith("22.")
+                        );
+                        continue;
+                    }
+                }
 
-        console.log(`→ ${tag}`);
+                const readMajor = (tag: string) => {
+                    const major = parseInt(tag.split(".")[0]);
+                    assert(!isNaN(major));
+                    return major;
+                };
 
-        return { dockerImageTag: tag };
+                {
+                    const major = readMajor(tag);
+
+                    const doImplementAdminTheme =
+                        buildContext.implementedThemeTypes.admin.isImplemented;
+
+                    const getIsSupported = (major: number) => major >= 23;
+
+                    if (doImplementAdminTheme && !getIsSupported(major)) {
+                        console.log(
+                            chalk.yellow(
+                                `You are implementing an Admin theme. Only Keycloak 23 and later are supported, select another version`
+                            )
+                        );
+                        latestMajorTags_copy = latestMajorTags_copy.filter(tag =>
+                            getIsSupported(readMajor(tag))
+                        );
+                        continue;
+                    }
+                }
+
+                {
+                    const doImplementAccountSpa =
+                        buildContext.implementedThemeTypes.account.isImplemented &&
+                        buildContext.implementedThemeTypes.account.type === "Single-Page";
+
+                    const major = readMajor(tag);
+
+                    const getIsSupported = (major: number) => major >= 19;
+
+                    if (doImplementAccountSpa && !getIsSupported(major)) {
+                        console.log(
+                            chalk.yellow(
+                                `You are implementing a Single-Page Account theme. Only Keycloak 19 and later are supported, select another version`
+                            )
+                        );
+                        latestMajorTags_copy = latestMajorTags_copy.filter(tag =>
+                            getIsSupported(readMajor(tag))
+                        );
+                        continue;
+                    }
+                }
+
+                break;
+            }
+
+            return tag;
+        })();
+
+        console.log(`→ ${tag_userSelected}`);
+
+        return { dockerImageTag: tag_userSelected };
     })();
 
     const keycloakMajorVersionNumber = (() => {
@@ -623,42 +704,56 @@ export async function command(params: {
                 }
             )
             .on("all", async (...[, filePath]) => {
-                ignore_account_spa: {
-                    const doImplementAccountSpa =
-                        buildContext.implementedThemeTypes.account.isImplemented &&
-                        buildContext.implementedThemeTypes.account.type === "Single-Page";
-
-                    if (!doImplementAccountSpa) {
-                        break ignore_account_spa;
+                ignore_path_covered_by_hmr: {
+                    if (filePath.endsWith(".properties")) {
+                        break ignore_path_covered_by_hmr;
                     }
 
-                    if (
-                        !isInside({
-                            dirPath: pathJoin(buildContext.themeSrcDirPath, "account"),
-                            filePath
-                        })
-                    ) {
-                        break ignore_account_spa;
+                    if (!doStartDevServer) {
+                        break ignore_path_covered_by_hmr;
                     }
 
-                    return;
-                }
-
-                ignore_admin: {
-                    if (!buildContext.implementedThemeTypes.admin.isImplemented) {
-                        break ignore_admin;
+                    ignore_account_spa: {
+                        const doImplementAccountSpa =
+                            buildContext.implementedThemeTypes.account.isImplemented &&
+                            buildContext.implementedThemeTypes.account.type ===
+                                "Single-Page";
+
+                        if (!doImplementAccountSpa) {
+                            break ignore_account_spa;
+                        }
+
+                        if (
+                            !isInside({
+                                dirPath: pathJoin(
+                                    buildContext.themeSrcDirPath,
+                                    "account"
+                                ),
+                                filePath
+                            })
+                        ) {
+                            break ignore_account_spa;
+                        }
+
+                        return;
                     }
 
-                    if (
-                        !isInside({
-                            dirPath: pathJoin(buildContext.themeSrcDirPath, "admin"),
-                            filePath
-                        })
-                    ) {
-                        break ignore_admin;
+                    ignore_admin: {
+                        if (!buildContext.implementedThemeTypes.admin.isImplemented) {
+                            break ignore_admin;
+                        }
+
+                        if (
+                            !isInside({
+                                dirPath: pathJoin(buildContext.themeSrcDirPath, "admin"),
+                                filePath
+                            })
+                        ) {
+                            break ignore_admin;
+                        }
+
+                        return;
                     }
-
-                    return;
                 }
 
                 console.log(`Detected changes in ${filePath}`);

package/src/bin/tools/Stringifyable.ts

@@ -0,0 +1,99 @@
+import { z } from "zod";
+import { same } from "evt/tools/inDepth/same";
+import { assert, type Equals } from "tsafe/assert";
+import { id } from "tsafe/id";
+
+export type Stringifyable =
+    | StringifyableAtomic
+    | StringifyableObject
+    | StringifyableArray;
+
+export type StringifyableAtomic = string | number | boolean | null;
+
+// NOTE: Use Record<string, Stringifyable>
+interface StringifyableObject {
+    [key: string]: Stringifyable;
+}
+
+// NOTE: Use Stringifyable[]
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+interface StringifyableArray extends Array<Stringifyable> {}
+
+export const zStringifyableAtomic = (() => {
+    type TargetType = StringifyableAtomic;
+
+    const zTargetType = z.union([z.string(), z.number(), z.boolean(), z.null()]);
+
+    assert<Equals<z.infer<typeof zTargetType>, TargetType>>();
+
+    return id<z.ZodType<TargetType>>(zTargetType);
+})();
+
+export const zStringifyable: z.ZodType<Stringifyable> = z
+    .any()
+    .superRefine((val, ctx) => {
+        const isStringifyable = same(JSON.parse(JSON.stringify(val)), val);
+        if (!isStringifyable) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "Not stringifyable"
+            });
+        }
+    });
+
+export function getIsAtomic(
+    stringifyable: Stringifyable
+): stringifyable is StringifyableAtomic {
+    return (
+        ["string", "number", "boolean"].includes(typeof stringifyable) ||
+        stringifyable === null
+    );
+}
+
+export const { getValueAtPath } = (() => {
+    function getValueAtPath_rec(
+        stringifyable: Stringifyable,
+        path: (string | number)[]
+    ): Stringifyable | undefined {
+        if (path.length === 0) {
+            return stringifyable;
+        }
+
+        if (getIsAtomic(stringifyable)) {
+            return undefined;
+        }
+
+        const [first, ...rest] = path;
+
+        let dereferenced: Stringifyable | undefined;
+
+        if (stringifyable instanceof Array) {
+            if (typeof first !== "number") {
+                return undefined;
+            }
+
+            dereferenced = stringifyable[first];
+        } else {
+            if (typeof first !== "string") {
+                return undefined;
+            }
+
+            dereferenced = stringifyable[first];
+        }
+
+        if (dereferenced === undefined) {
+            return undefined;
+        }
+
+        return getValueAtPath_rec(dereferenced, rest);
+    }
+
+    function getValueAtPath(
+        stringifyableObjectOrArray: Record<string, Stringifyable> | Stringifyable[],
+        path: (string | number)[]
+    ): Stringifyable | undefined {
+        return getValueAtPath_rec(stringifyableObjectOrArray, path);
+    }
+
+    return { getValueAtPath };
+})();