feat: add Google broker configuration profiles

scripts/verify-google-broker-config.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ ! -f .env ]; then
+  echo "missing .env" >&2
+  exit 1
+fi
+
+set -a
+. ./.env
+set +a
+
+keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"
+
+admin_token="$(
+  curl -fsS \
+    -d client_id=admin-cli \
+    -d grant_type=password \
+    -d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
+    -d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
+    "$keycloak_url/realms/master/protocol/openid-connect/token" |
+    jq -er .access_token
+)"
+
+idp="$(
+  curl -fsS \
+    -H "Authorization: Bearer $admin_token" \
+    "$keycloak_url/admin/realms/keycloak-patterns/identity-provider/instances/mock-google"
+)"
+
+printf '%s' "$idp" | jq -e '
+  .providerId == "oidc" and
+  .enabled == true and
+  .trustEmail == false and
+  .config.clientId == "mock-google-broker" and
+  .config.defaultScope == "openid profile email" and
+  .config.syncMode == "IMPORT" and
+  .config.validateSignature == "true"
+' >/dev/null
+
+client="$(
+  curl -fsS \
+    -H "Authorization: Bearer $admin_token" \
+    "$keycloak_url/admin/realms/mock-google/clients?clientId=mock-google-broker"
+)"
+
+printf '%s' "$client" | jq -e '
+  length == 1 and
+  .[0].publicClient == false and
+  (.[0].redirectUris | index(
+    "http://localhost:8080/realms/keycloak-patterns/broker/mock-google/endpoint"
+  )) != null
+' >/dev/null
+
+location="$(
+  curl -sS -D - -o /dev/null \
+    "$keycloak_url/realms/keycloak-patterns/protocol/openid-connect/auth?client_id=spa-public&redirect_uri=http%3A%2F%2Flocalhost%3A8088%2F&response_type=code&scope=openid&code_challenge=K2qUEfBl-nQvF2gB4dNxC2zYVwZc1CVnZb5CsX2L7fI&code_challenge_method=S256&kc_idp_hint=mock-google" |
+    awk 'BEGIN { IGNORECASE=1 } /^Location:/ { print $2 }' |
+    tr -d '\r'
+)"
+
+case "$location" in
+  "$keycloak_url/realms/keycloak-patterns/broker/mock-google/login"*) ;;
+  *)
+    echo "broker did not redirect to the controllable OIDC provider: $location" >&2
+    exit 1
+    ;;
+esac
+
+echo "Google broker contract verified with the local mock OIDC realm"