fix: lower case role provisioning

.gitignore

@@ -44,4 +44,6 @@ private/keys/*
 
 /.env
 
-certificates
+seeds/pocket-id/*.db
+
+certificates

Makefile

@@ -1,4 +1,28 @@
 CLUSTER_SCRIPT=docker/entrypoints/app-dev-entrypoint.sh
 
 up:
-	@bash $(CLUSTER_SCRIPT)
+	@bash $(CLUSTER_SCRIPT)
+
+seed-keycloak:
+	@[ $$(ls -1 seeds/keycloak/*.json 2>/dev/null | wc -l) -gt 0 ] || (echo "No realm export found in seeds/keycloak. Add an export from Keycloak first."; exit 1)
+	@docker compose -f docker-compose.func.yml stop keycloak >/dev/null 2>&1 || true
+	@docker compose -f docker-compose.func.yml rm -f -s keycloak >/dev/null 2>&1 || true
+	@docker volume rm portabase-dev-func_keycloak-data >/dev/null 2>&1 || true
+	@docker compose -f docker-compose.func.yml up -d keycloak
+	@echo "Keycloak seed import triggered from seeds/keycloak/*.json"
+
+seed-pocket:
+	@[ -f seeds/pocket-id/portabase.zip ] || (echo "No export found in seeds/pocket-id. Add an export from Pocket ID first."; exit 1)
+	@docker compose -f docker-compose.func.yml stop pocket-id >/dev/null 2>&1 || true
+	@docker compose -f docker-compose.func.yml rm -f -s pocket-id >/dev/null 2>&1 || true
+	@docker volume rm portabase-dev-func_pocket-id-data >/dev/null 2>&1 || true
+	@docker compose -f docker-compose.func.yml run --rm -v ./seeds/pocket-id/portabase.zip:/tmp/portabase.zip pocket-id ./pocket-id import --yes --path /tmp/portabase.zip >/dev/null
+	@docker compose -f docker-compose.func.yml up -d pocket-id
+	@sleep 2
+	@docker compose -f docker-compose.func.yml exec pocket-id ./pocket-id one-time-access-token admin
+	@echo "Pocket ID data restored from seeds/pocket-id/portabase.zip"
+
+seed-auth: seed-keycloak seed-pocket-id
+
+pocket-id-token:
+	@docker compose -f docker-compose.func.yml exec pocket-id /app/pocket-id one-time-access-token admin

README.md

@@ -87,4 +87,3 @@ Distributed under the Apache License. See `LICENSE.txt` for more details.
 [ShadcnUI-url]: https://ui.shadcn.com/
 
 [Docker-url]: https://www.docker.com/
-

docker-compose.func.yml

@@ -3,7 +3,7 @@ name: portabase-dev-func
 services:
   keycloak:
     image: quay.io/keycloak/keycloak:latest
-    command: start-dev
+    command: start-dev --import-realm
     environment:
       KC_BOOTSTRAP_ADMIN_USERNAME: admin
       KC_BOOTSTRAP_ADMIN_PASSWORD: admin
@@ -11,6 +11,8 @@ services:
       - "8080:8080"
     volumes:
       - keycloak-data:/opt/keycloak/data
+      - ./seeds/keycloak:/opt/keycloak/data/import:ro
+      - ./export:/tmp/export
   pocket-id:
     image: ghcr.io/pocket-id/pocket-id
     restart: unless-stopped
@@ -21,6 +23,7 @@ services:
       - 3055:1411
     volumes:
       - pocket-id-data:/app/data
+      - ./seeds/pocket-id:/seed:ro
     healthcheck:
       test: "curl -f http://localhost:1411/healthz"
       interval: 1m30s

seeds/keycloak/.gitkeep

@@ -0,0 +1 @@
+

seeds/pocket-id/.gitkeep

@@ -0,0 +1 @@
+

src/env.mjs

@@ -130,6 +130,8 @@ export const env = createEnv({
 
     AUTH_SYNC_OIDC_ROLES_ON_LOGIN: process.env.AUTH_SYNC_OIDC_ROLES_ON_LOGIN,
 
+    AUTH_ROLE_MAP: process.env.AUTH_ROLE_MAP,
+
     AUTH_ALLOW_LINKING: process.env.AUTH_ALLOW_LINKING,
     AUTH_ALLOW_UNLINKING: process.env.AUTH_ALLOW_UNLINKING,
 

src/lib/auth/auth.ts

@@ -187,16 +187,33 @@ export const auth = betterAuth({
         const roleMapStr = oidcProvider?.roleMap;
 
         const rawGroups = userInfo?.groups || userInfo?.roles || [];
+
         const userGroups: string[] = Array.isArray(rawGroups)
-          ? rawGroups
+          ? rawGroups.reduce((carry: string[], group) => {
-          : [rawGroups];
+              carry.push(String(group).toLowerCase());
+              return carry;
+            }, [])
+          : [String(rawGroups).toLowerCase()];
 
         let roleToAssign: string | undefined;
 
         if (roleMapStr) {
           const mappings = roleMapStr.split(",").map((m) => m.split(":"));
           for (const [group, role] of mappings) {
+            console.log(
+              "Checking role mapping:",
+              group.trim(),
+              "against user groups:",
+              userGroups,
+            );
+
             if (userGroups.includes(group.trim())) {
+              console.log(
+                "Role mapping matched for group:",
+                group.trim(),
+                "->",
+                role.trim(),
+              );
               roleToAssign = role.trim();
               break;
             }