docs: define exact Google redirect URI policy

2026-07-25 16:28:53 +09:00
parent e4eb7e54f7
commit f077e5038e
2 changed files with 48 additions and 0 deletions
@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+set -eu
+
+realm="${KEYCLOAK_REALM:-keycloak-patterns}"
+public_keycloak_url="${PUBLIC_KEYCLOAK_URL:-https://auth.example.test}"
+expected="$public_keycloak_url/realms/$realm/broker/google/endpoint"
+
+case "$public_keycloak_url" in
+  https://*) ;;
+  *)
+    echo "PUBLIC_KEYCLOAK_URL must use https outside the local mock environment" >&2
+    exit 1
+    ;;
+esac
+
+case "$public_keycloak_url" in
+  *\** | */)
+    echo "PUBLIC_KEYCLOAK_URL must be an exact origin without wildcard/trailing slash" >&2
+    exit 1
+    ;;
+esac
+
+test "$expected" = "https://auth.example.test/realms/keycloak-patterns/broker/google/endpoint"
+echo "Google redirect URI policy verified: $expected"