kevinveenbirkenbachandClaude Opus 5 b4af1d4b89 fix(keycloak): register redirect URIs only for the apps a play deploys ...

lookup('redirect_uris') walked every app in the domains map whose services.sso.enabled resolves truthy, which every role spells as "'web-app-keycloak' in group_names". A round deploying 21 apps therefore registered 69 redirect URIs and web origins on the shared client, 65 of them onion, and an app that is not running has no reason to be a redirect target. group_names is now required and scopes the result, matching KEYCLOAK_SAML_APPS which already selects on it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-03 09:18:07 +02:00

..

action

perf(applications): render the applications SPOT once per play instead of once per task

2026-09-02 23:55:32 +02:00

filter

refactor(domains): give local testing a .test domain, leave .example to docs

2026-09-02 13:10:34 +02:00

lookup

fix(keycloak): register redirect URIs only for the apps a play deploys

2026-09-03 09:18:07 +02:00

__init__.py

…