# Keycloak realm

`tech-log-realm.json` is imported by the `keycloak` service at start
(`--import-realm`). It exists because the realm was previously created by hand,
which meant §27 of the release checklist — "Keycloak Realm 설정을 복원할 수
있다" — had no answer: nothing in either repository described the realm.

What it declares, and why each part is load-bearing:

- **`studio-author` realm role.** `StudioAuthzEnvironmentPostProcessor` maps this
  name to `studio:read` and `studio:write`. The name is configurable through
  `APP_STUDIO_AUTHOR_ROLE`; if you change it here, change it there too.
- **`tech-log-bff` confidential client.** The Authorization Code flow belongs to
  the backend, not the browser — the SPA never holds a token. `redirectUris` is
  relative so the same realm works on any origin the deployment is served from.
- **`realm-roles` protocol mapper.** Without it the roles never reach the token,
  the registry resolves zero permissions, and every Studio call answers 403.

## Values that must be replaced

`CHANGE_ME_BFF_SECRET` and `CHANGE_ME_STUDIO_PASSWORD` are placeholders, and the
deploy script substitutes them from the environment before import. They are left
visible rather than pre-filled so a realm file committed with a real secret is an
obvious mistake rather than a quiet one.