Add PE test support (GHA and docker)

[b-long]

Merges into #70

• Add support for local docker testing
• Enable directAccessGrantsEnabled for clients
• Configurer IdP / 'issuer'

[gemini-code-assist]

Summary of Changes

Hello @b-long, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a streamlined process for setting up a local development and testing environment for the OpenTDF platform using Docker. It provides a new script to automate the cloning of the platform repository, configure Keycloak and OpenTDF services, and launch them via Docker Compose, significantly simplifying the local setup for developers.

Highlights

• Automated Local Docker Setup: A new shell script (.github/start_opentdf_docker.sh) is introduced to automate the entire process of setting up and running the OpenTDF platform locally using Docker.
• Keycloak Configuration for Local Testing: The setup script dynamically modifies Keycloak client configurations to enable directAccessGrantsEnabled and serviceAccountsEnabled, essential for local authentication flows.
• OpenTDF Service Configuration: The script configures the opentdf.yaml file by removing database settings, updating service URLs, and defining standard crypto providers with specific keys for local development.
• Environment Variable Updates: The .env-docker file is updated to reflect the new Keycloak service URL and port (http://localhost:8888), aligning with the Dockerized environment.
• Git Ignore for Cloned Repository: The platform/ directory is added to .gitignore to prevent the locally cloned OpenTDF platform repository from being committed.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request adds support for local testing using Docker by introducing a new shell script to set up the environment. The changes also include updating environment variables for Keycloak and modifying the .gitignore file. My review focuses on the new setup script, where I've identified several critical issues, including a severe security vulnerability with file permissions and a configuration bug due to a copy-paste error. I've also provided suggestions to improve the script's robustness and maintainability.

[gemini-code-assist]

Using chmod -R 777 on the ./keys directory is a significant security risk as it gives universal read, write, and execute permissions. Even for local testing, this is overly permissive and a bad practice. The permissions should be as restrictive as possible to prevent accidental or malicious access to private keys.

Suggested change

	chmod -R 777 ./keys
	chmod -R 700 ./keys

[gemini-code-assist]

Checking out a specific feature branch (DSPX-1539-keytoolnomore) makes this script brittle. Feature branches are often temporary and may be deleted after merging, which would break this script. It is highly recommended to use a more stable reference, such as a release tag or a specific commit hash from a long-lived branch like main or develop.

[gemini-code-assist]

The comment on line 6 says 'Sparse clone opentdf/platform', but the command on line 7 performs a full clone of the repository's history. This is misleading and can be inefficient. If only the latest version of the files is needed, consider using a shallow clone (--depth 1) to reduce clone time and disk space usage.

Suggested change

	# Sparse clone opentdf/platform
	git clone https://github.com/opentdf/platform.git
	# Shallow clone opentdf/platform
	git clone --depth 1 https://github.com/opentdf/platform.git