Sign-in by customer: realm petrolyst, row rules, guest role (PD-21)

Keycloak import for realm petrolyst: two clients, petrolyst with MFA for
Superset and Traefik, petrolyst-app password only. It lists only
app.petrolyst.com and traefik.petrolyst.com, and no customer names, as this
repository is public. public.v_operator shows each customer's group. Dashboards
overview and site, role Petrolyst Guest, filtered by row. Superset refuses a
user with no mapped role. The realm travels with the release: each release's
compose files name their realm and secret file, and a rollback needs only its
target's secret. Not deployed.

Checks earlier on this content: tests/run.sh 109 of 109 and read-only, dashboards
import twice, column drift 0, compose config on old and new trees, the secret
check on a scratch folder, a rehearsal on a throwaway Keycloak 26.4. Never a real
deploy or rollback; shellcheck not installed today, clean when last run. Codex
inspected once; its fixes are not re-inspected, on the owner's word.

Bands: persistence, Superset. Rules: 1, 2, 3, 6, 14.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

petrolyst-insights/petrolyst_security.py

@@ -1,7 +1,7 @@
 """Keycloak sign-in for Superset at atoma.petrolyst.com.
 
 Set as CUSTOM_SECURITY_MANAGER in superset_config.py. Checked against
-Flask-AppBuilder 5.0.2 as bundled in apache/superset:6.1.0. Three changes to
+Flask-AppBuilder 5.0.2 as bundled in apache/superset:6.1.0. Four changes to
 the stock behaviour:
 
 - User info and roles come from the ID token that Keycloak issues for client
@@ -11,6 +11,8 @@ the stock behaviour:
   login page on /login/, which only shows a "Sign in with keycloak" button.
 - /logout/ also ends the Keycloak session, so the next visit asks for the
   password and OTP again.
+- A Keycloak user with no mapped Superset role is refused, and no account is
+  made. Customers' users belong in the Petrolyst app, never here (PD-21).
 """
 
 import logging
@@ -70,6 +72,14 @@ class PetrolystSecurityManager(SupersetSecurityManager):
     # FAB's OAuth view, and that page wins the route.
     register_superset_auth_view = False
 
+    def auth_user_oauth(self, userinfo: dict[str, Any]) -> Any:
+        # Only the mapped roles count: FAB's own calculation always adds the
+        # registration role, so it is never empty.
+        if not self.get_roles_from_keys(userinfo.get("role_keys", [])):
+            logger.warning("Keycloak sign-in refused: no mapped Superset role")
+            return None
+        return super().auth_user_oauth(userinfo)
+
     def oauth_user_info(
         self, provider: str, response: Optional[dict[str, Any]] = None
     ) -> dict[str, Any]: