merge: shared broker and deployment contracts

scripts/configure-google-idp.sh

@@ -144,6 +144,10 @@ upsert_mapper \
   "google-hosted-domain" \
   "oidc-user-attribute-idp-mapper" \
   '{"syncMode":"INHERIT","claim":"hd","user.attribute":"hd"}'
+upsert_mapper \
+  "google-example-domain-role" \
+  "oidc-role-idp-mapper" \
+  '{"syncMode":"INHERIT","claim":"hd","claim.value":"example.test","role":"employee-role"}'
 
 echo "Google Identity Provider $action for realm '$realm'"
 echo "Register this exact Google redirect URI:"

scripts/verify-account-linking-sub-vs-email.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+set -eu
+
+set -a
+. ./.env
+set +a
+
+./scripts/set-first-broker-login-mode.sh secure
+cd google-e2e
+npm install --ignore-scripts
+npm run test:sub-vs-email

scripts/verify-google-claim-to-role.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env sh
+set -eu
+
+set -a
+. ./.env
+set +a
+
+./scripts/configure-broker-user-profile.sh >/dev/null
+./scripts/set-first-broker-login-mode.sh secure
+
+docker compose exec -T keycloak \
+  /opt/keycloak/bin/kcadm.sh create roles -r keycloak-patterns \
+  -s name=employee-role \
+  -s 'description=Assigned from the upstream hd claim' >/dev/null 2>&1 || true
+
+cd google-e2e
+npm install --ignore-scripts
+npm run test:claim-to-role

scripts/verify-google-redirect-uri-policy.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+set -eu
+
+realm="${KEYCLOAK_REALM:-keycloak-patterns}"
+public_keycloak_url="${PUBLIC_KEYCLOAK_URL:-https://auth.example.test}"
+expected="$public_keycloak_url/realms/$realm/broker/google/endpoint"
+
+case "$public_keycloak_url" in
+  https://*) ;;
+  *)
+    echo "PUBLIC_KEYCLOAK_URL must use https outside the local mock environment" >&2
+    exit 1
+    ;;
+esac
+
+case "$public_keycloak_url" in
+  *\** | */)
+    echo "PUBLIC_KEYCLOAK_URL must be an exact origin without wildcard/trailing slash" >&2
+    exit 1
+    ;;
+esac
+
+test "$expected" = "https://auth.example.test/realms/keycloak-patterns/broker/google/endpoint"
+echo "Google redirect URI policy verified: $expected"

scripts/verify-https-termination-config.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env sh
+set -eu
+
+test_dir="$(mktemp -d)"
+cleanup() {
+  rm -rf "$test_dir"
+}
+trap cleanup EXIT
+
+openssl req -x509 -newkey rsa:2048 -nodes -days 1 \
+  -subj "/CN=auth.example.test" \
+  -keyout "$test_dir/tls.key" \
+  -out "$test_dir/tls.crt" >/dev/null 2>&1
+
+docker run --rm \
+  --add-host keycloak:127.0.0.1 \
+  -v "$PWD/deploy/tls/nginx.conf:/etc/nginx/nginx.conf:ro" \
+  -v "$test_dir:/etc/tls:ro" \
+  nginx:1.29-alpine nginx -t
+
+docker run --rm \
+  --add-host keycloak:127.0.0.1 \
+  -v "$PWD/deploy/tls/Caddyfile:/etc/caddy/Caddyfile:ro" \
+  -v "$test_dir:/etc/tls:ro" \
+  caddy:2.10.2-alpine caddy validate --config /etc/caddy/Caddyfile
+
+echo "nginx and Caddy HTTPS termination configurations verified"

scripts/verify-public-tunnel-config.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env sh
+set -eu
+
+config=deploy/tunnel/cloudflared-config.yml
+grep -q '^tunnel: [0-9a-f-]*$' "$config"
+grep -q '^  - hostname: auth.example.test$' "$config"
+grep -q '^    service: http://reverse-proxy:8080$' "$config"
+grep -q '^  - service: http_status:404$' "$config"
+
+docker run --rm \
+  -v "$PWD/$config:/etc/cloudflared/config.yml:ro" \
+  cloudflare/cloudflared:2025.6.1 \
+  tunnel --config /etc/cloudflared/config.yml ingress validate
+
+echo "Cloudflare named-tunnel ingress configuration verified"

scripts/verify-reverse-proxy-headers.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env sh
+set -eu
+
+config=deploy/reverse-proxy/nginx-keycloak.conf
+env_file=deploy/reverse-proxy/keycloak.env.example
+
+grep -q 'proxy_set_header X-Forwarded-Host' "$config"
+grep -q 'proxy_set_header X-Forwarded-Port 443' "$config"
+grep -q 'proxy_set_header X-Forwarded-Proto https' "$config"
+grep -q '^KC_PROXY_HEADERS=xforwarded$' "$env_file"
+grep -q '^KC_HOSTNAME=https://' "$env_file"
+
+docker run --rm \
+  --add-host keycloak:127.0.0.1 \
+  -v "$PWD/$config:/etc/nginx/conf.d/default.conf:ro" \
+  nginx:1.29-alpine nginx -t
+
+echo "Reverse-proxy header and Keycloak hostname contracts verified"