fix keycloak implementation and install.sh script and add manager fixes - #508
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughAdds Keycloak OIDC runtime wiring, patches the Keycloak client post-startup, exposes a backend JS auth-config endpoint, replaces the frontend with a SPA that loads the auth config, updates CSP and static-asset allowlists, and refreshes frontend build artifacts. ChangesKeycloak OIDC Integration & Frontend SPA
Sequence DiagramsequenceDiagram
participant Browser
participant EDDI
participant Keycloak
Browser->>EDDI: GET /manage/__auth_config__.js
EDDI->>Keycloak: (server) use internal QUARKUS_OIDC_AUTH_SERVER_URL for discovery
EDDI-->>Browser: serve JS setting window.__EDDI_AUTH__ (method none or keycloak + realm + clientId + url)
Browser->>Keycloak: browser auth flows -> KC_HOSTNAME (public)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docker-compose.auth.yml`:
- Around line 21-31: The docker compose uses ${KEYCLOAK_PORT} in
EDDI_KEYCLOAK_PUBLIC_URL, QUARKUS_OIDC_TOKEN_ISSUER and KC_HOSTNAME but the
keycloak service still publishes a fixed 8180:8080, so overrides of
KEYCLOAK_PORT will break discovery; fix by making the keycloak service's
published port use the same variable (e.g., change the service port mapping to
"${KEYCLOAK_PORT:-8180}:8080") or alternatively define KEYCLOAK_PORT with a
default in the compose environment and reference that consistently so
EDDI_KEYCLOAK_PUBLIC_URL, QUARKUS_OIDC_TOKEN_ISSUER and KC_HOSTNAME remain
aligned with the actual published port.
In `@install.sh`:
- Around line 823-831: The https_origin is incorrectly constructed from
EDDI_PORT causing Keycloak to be updated with the HTTP port; change the
https_origin construction to use EDDI_HTTPS_PORT instead of EDDI_PORT so the PUT
request that updates the client (see variables https_origin, http_origin and the
curl that sets update_status for client_uuid at kc_base using admin_token)
includes the actual HTTPS origin (e.g., "https://localhost:${EDDI_HTTPS_PORT}")
and then leave the rest of the payload unchanged so redirectUris/webOrigins
include the correct secure origin.
In `@keycloak/eddi-realm.json`:
- Line 140: The seeded user credentials in eddi-realm.json are marked
"temporary": false making demo passwords permanent; change the "temporary"
property to true for the seeded accounts (the entries for usernames eddi,
viewer, and user) so their initial passwords require rotation on first login;
locate the credential objects in eddi-realm.json (the credential blocks
associated with the eddi/eddi, viewer/viewer, and user/user user records) and
update "temporary": false → "temporary": true for each.
- Around line 84-91: eddi-frontend.webOrigins is missing the installer's default
HTTPS origin; add "https://localhost:7443" to the eddi-frontend client
"webOrigins" array so the Keycloak client allows the Manager served on the
documented HTTPS port (update the eddi-frontend.webOrigins list to include that
origin alongside the existing localhost entries).
In `@src/main/java/ai/labs/eddi/ui/RestManagerResource.java`:
- Around line 120-128: extractRealm currently returns the realm with any
trailing path delimiter (e.g., "eddi/") when authServerUrl ends with a slash;
update extractRealm to trim trailing slashes (and other path delimiters if
applicable) from the extracted realm before returning it: after computing the
realm substring and removing the query portion (in extractRealm), strip any
trailing '/' characters (and whitespace) so the method returns "eddi" instead of
"eddi/"; ensure this is applied in both the branch where "/realms/" is found
(variable realm) and the fallback return for non-null authServerUrl.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8085051b-3dea-4282-a664-d28b0546b37f
⛔ Files ignored due to path filters (2)
src/main/resources/META-INF/resources/eddi-icon.icois excluded by!**/*.icosrc/main/resources/META-INF/resources/eddi-icon.svgis excluded by!**/*.svg
📒 Files selected for processing (27)
docker-compose.auth.ymlinstall.shkeycloak/eddi-realm.jsonsrc/main/java/ai/labs/eddi/ui/IRestManagerResource.javasrc/main/java/ai/labs/eddi/ui/RestManagerResource.javasrc/main/resources/META-INF/resources/assets/cssMode-C5TT1L4e.jssrc/main/resources/META-INF/resources/assets/freemarker2-DCGWkmiA.jssrc/main/resources/META-INF/resources/assets/handlebars-u2Ap1EnQ.jssrc/main/resources/META-INF/resources/assets/html-CRclPP81.jssrc/main/resources/META-INF/resources/assets/htmlMode-Bg0c_U0Q.jssrc/main/resources/META-INF/resources/assets/index-9Ly7lA6T.csssrc/main/resources/META-INF/resources/assets/index-BZNayFGO.csssrc/main/resources/META-INF/resources/assets/index-Bn-sgAam.jssrc/main/resources/META-INF/resources/assets/javascript-BD21fPfT.jssrc/main/resources/META-INF/resources/assets/jsonMode-DnyOtT0_.jssrc/main/resources/META-INF/resources/assets/liquid-V64DwArz.jssrc/main/resources/META-INF/resources/assets/lspLanguageFeatures-DCTAZVps.jssrc/main/resources/META-INF/resources/assets/mdx-BtMCnFzF.jssrc/main/resources/META-INF/resources/assets/python-DEWDJFn1.jssrc/main/resources/META-INF/resources/assets/razor-DfQnovyn.jssrc/main/resources/META-INF/resources/assets/tsMode-Dc3VVqFA.jssrc/main/resources/META-INF/resources/assets/typescript-LWRzWAn4.jssrc/main/resources/META-INF/resources/assets/xml-GW7RS4i4.jssrc/main/resources/META-INF/resources/assets/yaml-V0todZvQ.jssrc/main/resources/META-INF/resources/index.htmlsrc/main/resources/META-INF/resources/manage.htmlsrc/main/resources/application.properties
There was a problem hiding this comment.
Pull request overview
This PR updates EDDI’s local install/authentication story by wiring the Manager SPA to a runtime-provided Keycloak/OIDC configuration, adjusting HTTP security headers, updating the Keycloak realm export, and adding post-start Keycloak client configuration to the installer.
Changes:
- Add a
/manage/__auth_config__.jsendpoint and update the Manager HTML shell to consume runtime Keycloak/OIDC settings. - Update CSP and unauthenticated static-asset allowlist to support Keycloak connectivity and new root-level icons/assets.
- Enhance
install.shand the auth compose overlay to configure Keycloak more reliably for local development.
Reviewed changes
Copilot reviewed 24 out of 29 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| src/main/resources/META-INF/resources/manage.html | Loads runtime auth config script and updates asset references/favicon. |
| src/main/resources/META-INF/resources/index.html | Converts root entry to SPA shell and updates asset references/favicon. |
| src/main/resources/META-INF/resources/eddi-icon.svg | Adds new SVG app icon. |
| src/main/resources/META-INF/resources/assets/yaml-V0todZvQ.js | Repoints YAML mode bundle imports to new hashed main bundle. |
| src/main/resources/META-INF/resources/assets/xml-GW7RS4i4.js | Repoints XML mode bundle imports to new hashed main bundle. |
| src/main/resources/META-INF/resources/assets/typescript-LWRzWAn4.js | Repoints TS mode bundle imports to new hashed main bundle. |
| src/main/resources/META-INF/resources/assets/tsMode-Dc3VVqFA.js | Repoints TS worker mode bundle imports to new hashed main bundle. |
| src/main/resources/META-INF/resources/assets/razor-DfQnovyn.js | Repoints Razor mode bundle imports to new hashed main bundle. |
| src/main/resources/META-INF/resources/assets/python-DEWDJFn1.js | Repoints Python mode bundle imports to new hashed main bundle. |
| src/main/resources/META-INF/resources/assets/mdx-BtMCnFzF.js | Repoints MDX mode bundle imports to new hashed main bundle. |
| src/main/resources/META-INF/resources/assets/lspLanguageFeatures-DCTAZVps.js | Updates LSP language features bundle reference used by other modes. |
| src/main/resources/META-INF/resources/assets/liquid-V64DwArz.js | Repoints Liquid mode bundle imports to new hashed main bundle. |
| src/main/resources/META-INF/resources/assets/jsonMode-DnyOtT0_.js | Updates JSON mode to import the updated LSP bundle and main bundle. |
| src/main/resources/META-INF/resources/assets/javascript-BD21fPfT.js | Repoints JS mode to updated TS mode and main bundle. |
| src/main/resources/META-INF/resources/assets/htmlMode-Bg0c_U0Q.js | Updates HTML mode to import updated LSP bundle and main bundle. |
| src/main/resources/META-INF/resources/assets/html-CRclPP81.js | Repoints HTML language definition bundle imports to new hashed main bundle. |
| src/main/resources/META-INF/resources/assets/handlebars-u2Ap1EnQ.js | Repoints Handlebars mode bundle imports to new hashed main bundle. |
| src/main/resources/META-INF/resources/assets/freemarker2-DCGWkmiA.js | Repoints FreeMarker mode bundle imports to new hashed main bundle. |
| src/main/resources/META-INF/resources/assets/cssMode-C5TT1L4e.js | Updates CSS mode to import updated LSP bundle and main bundle. |
| src/main/resources/application.properties | Updates CSP connect-src to include Keycloak public URL and expands static asset permit paths. |
| src/main/java/ai/labs/eddi/ui/RestManagerResource.java | Implements runtime auth config JS endpoint and Keycloak config derivation. |
| src/main/java/ai/labs/eddi/ui/IRestManagerResource.java | Adds JAX-RS endpoint contract for /manage/__auth_config__.js. |
| keycloak/eddi-realm.json | Updates realm export with default roles/scopes, CORS origins, audience mapper, and user fields. |
| install.sh | Adds post-start Keycloak client configuration and tweaks wizard boolean setting. |
| docker-compose.auth.yml | Adds public Keycloak URL env var and Keycloak hostname/backchannel settings for issuer correctness. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ginccc
approved these changes
Jun 2, 2026
- docker-compose.auth.yml: use ${KEYCLOAK_PORT:-8180}:8080 for keycloak
port mapping so overriding KEYCLOAK_PORT stays consistent end-to-end
- keycloak/eddi-realm.json: add https://localhost:7443 to webOrigins;
set temporary:true for all seeded users (eddi, viewer, user) so demo
passwords require rotation on first login
- RestManagerResource.java: fix extractRealm() to strip trailing /, ?,
and # delimiters; fix escapeJs() to also escape \n, \r, \t to prevent
JS injection via newlines in config values
- index.html: load /manage/__auth_config__.js so window.__EDDI_AUTH__ is
populated at root /; update asset refs to index-NTxUCPZ1.js /
index-CJdl8JdC.css (old files no longer exist)
- install.sh: remove unused eddi_origin variable; prefer jq for JSON
parsing with python3 as fallback (warn and skip if neither available);
fix https_origin to use EDDI_HTTPS_PORT instead of EDDI_PORT; add
https_origin/* to redirectUris; GET-then-PUT full ClientRepresentation
to avoid wiping Keycloak client settings on partial update
Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/main/resources/META-INF/resources/index.html`:
- Around line 10-11: index.html currently references hashed bundles (script src
"/assets/index-NTxUCPZ1.js" and stylesheet href "/assets/index-CJdl8JdC.css")
that differ from the ones used by manage.html, causing potential 404s; update
the asset references in index.html to match the exact hashed filenames used in
manage.html (or switch both entrypoints to the same template/manifest-driven
asset names used by your build system) by editing the <script> and <link>
entries so both index.html and manage.html point to the identical generated
bundle names.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: dc42e00b-0495-4736-80a2-7447dd075f1c
📒 Files selected for processing (5)
docker-compose.auth.ymlinstall.shkeycloak/eddi-realm.jsonsrc/main/java/ai/labs/eddi/ui/RestManagerResource.javasrc/main/resources/META-INF/resources/index.html
🚧 Files skipped from review as they are similar to previous changes (3)
- docker-compose.auth.yml
- install.sh
- src/main/java/ai/labs/eddi/ui/RestManagerResource.java
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/main/resources/META-INF/resources/index.html`:
- Around line 13-14: Add the same pre-mount loader from manage.html to
index.html so users see the branded spinner/logo before React mounts: copy the
loader CSS into the <head> (styles that target the loader classes) and replace
or populate the existing <div id="root"> element with the loader HTML markup
used in manage.html (the logo and spinner wrapper), ensuring class names and IDs
match those styles so the loader displays immediately and is removed/overridden
when React mounts.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 24b0b2e9-27f5-4844-926e-7de5d0a88ec5
📒 Files selected for processing (1)
src/main/resources/META-INF/resources/index.html
This was referenced Jun 3, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
I have fixed the install.sh script, so that it no longer breaks
Also fixed is the keycloak configuration on install. Now when installing, keycloak fully works.
There were changes in the EDDI-Manager necessary, those changes also have been added.
Type of Change
Related Issue
Closes #
Changes Made
How to Test
Checklist
./mvnw clean verify -DskipITs)Summary by CodeRabbit
New Features
Authentication
Security