keycloak: full nox module — client, tools and events (ADR 0044/0046)

Identity provider. 22 admin tools (realms, users, clients + secrets, groups, roles) over the admin API, moved out of the shared sdk. Emits user created/ deleted, password reset, client/group/role created — from the write tools themselves, since Keycloak's value is the changes it makes, not pollable state. Consumes nothing: it is upstream of everything that authenticates against it. Typechecks; manifest parses.
2026-09-04 02:30:40 +02:00
parent 1498a22c94
commit 4d98da18a0
6 changed files with 677 additions and 1 deletions
@@ -0,0 +1,44 @@
+// keycloak's events. Keycloak's worth to the mesh is in what it changes — an identity created, a
+// client registered, a password reset — so its events are emitted from the admin actions themselves
+// (novox/hq ADR 0046/0047), not scraped back by polling. This module is the single vocabulary for
+// them: every keycloak event goes through one of the helpers here, and the tools call them at the
+// point the change succeeds.
+//
+// Emits:
+//   module.keycloak.user.created / .deleted    — an identity appeared or was removed
+//   module.keycloak.password.reset             — a user's credential was reset (no secret in the body)
+//   module.keycloak.client.created             — an OIDC client was registered
+//   module.keycloak.group.created              — a group was created
+//   module.keycloak.role.created               — a realm role was created
+// Consumes:
+//   nothing — Keycloak is upstream of the things that authenticate against it; it reacts to none of
+//   their events. There is no honest `on(...)` to write, so there is none.
+
+import { emit } from "@novox/mesh-sdk/events";
+
+// A completed admin action must not be undone by a flaky broker: the change already happened in
+// Keycloak, so a failed emit is logged and swallowed rather than thrown back through the tool.
+async function announce(type: string, body: Record<string, unknown>): Promise<void> {
+  try {
+    await emit(type, body);
+  } catch (err) {
+    console.error(`[keycloak] emit ${type} failed: ${err}`);
+  }
+}
+
+export const events = {
+  userCreated: (realm: string, username: string, email?: string) =>
+    announce("module.keycloak.user.created", { realm, username, ...(email ? { email } : {}) }),
+  userDeleted: (realm: string, userId: string) =>
+    announce("module.keycloak.user.deleted", { realm, userId }),
+  passwordReset: (realm: string, userId: string) =>
+    announce("module.keycloak.password.reset", { realm, userId }),
+  clientCreated: (realm: string, clientId: string, name?: string) =>
+    announce("module.keycloak.client.created", { realm, clientId, ...(name ? { name } : {}) }),
+  groupCreated: (realm: string, name: string) =>
+    announce("module.keycloak.group.created", { realm, name }),
+  roleCreated: (realm: string, name: string) =>
+    announce("module.keycloak.role.created", { realm, name }),
+};
+
+console.log("[keycloak] event surface ready — identity, client, group and role changes are announced");