Nasim SadatandClaude Opus 5.5
da3f803947
ATOMA's users use the Petrolyst app; Superset keeps admins, editors and the app's embedded dashboards. Removed: the "ATOMA Reader" role and its rules (petrolyst_reader.py, ReaderAccessMixin, reader.css, the head template, the SQL-hiding patch), the atoma-reader mapping (it now maps to nothing in Superset), the iframe allowance for the Map tab, and the "atoma" dashboard with its Fleet/Map tab, D0 and dashboard.css. The bundle holds atoma-overview and atoma-site only (byte-identical to before); the guest role keeps the reader's 12 permissions in roles/atoma_guest.py. Brand files now name petrolyst-web. SPEC marks the retired parts as history. Checks (local): bundle checks pass; image rebuilt and healthy; import with column drift 0 and unchanged embedding ids; the production config loads with OAuth, embedding off, no reader hook; admin sees atoma-site with its tabs and filter column; the app's browser tests pass 10/10. shellcheck not run (not installed). Not deployed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
58 lines
2.2 KiB
JSON
58 lines
2.2 KiB
JSON
{
|
|
"clients": [
|
|
{
|
|
"clientId": "petrolyst",
|
|
"name": "Petrolyst",
|
|
"description": "Petrolyst apps on the petrolyst server: Superset at atoma.petrolyst.com and the Traefik dashboard at traefik.petrolyst.com (oauth2-proxy). Managed from petrolyst-infra/keycloak/.",
|
|
"enabled": true,
|
|
"protocol": "openid-connect",
|
|
"publicClient": false,
|
|
"clientAuthenticatorType": "client-secret",
|
|
"standardFlowEnabled": true,
|
|
"implicitFlowEnabled": false,
|
|
"directAccessGrantsEnabled": false,
|
|
"serviceAccountsEnabled": false,
|
|
"frontchannelLogout": true,
|
|
"baseUrl": "https://atoma.petrolyst.com/",
|
|
"redirectUris": [
|
|
"https://atoma.petrolyst.com/oauth-authorized/keycloak",
|
|
"https://traefik.petrolyst.com/oauth2/callback"
|
|
],
|
|
"webOrigins": ["+"],
|
|
"attributes": {
|
|
"pkce.code.challenge.method": "S256",
|
|
"post.logout.redirect.uris": "https://atoma.petrolyst.com/*##https://traefik.petrolyst.com/*"
|
|
},
|
|
"protocolMappers": [
|
|
{
|
|
"name": "petrolyst client roles",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-usermodel-client-role-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"usermodel.clientRoleMapping.clientId": "petrolyst",
|
|
"multivalued": "true",
|
|
"claim.name": "petrolyst_roles",
|
|
"jsonType.label": "String",
|
|
"id.token.claim": "true",
|
|
"access.token.claim": "true",
|
|
"userinfo.token.claim": "true",
|
|
"introspection.token.claim": "true"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"roles": {
|
|
"client": {
|
|
"petrolyst": [
|
|
{ "name": "superset-admin", "description": "Superset Admin at atoma.petrolyst.com" },
|
|
{ "name": "superset-editor", "description": "Superset Alpha: build charts and dashboards" },
|
|
{ "name": "superset-viewer", "description": "Superset Gamma: view dashboards shared with the role" },
|
|
{ "name": "atoma-reader", "description": "ATOMA's users: the Petrolyst app (no role in Superset)" },
|
|
{ "name": "traefik-admin", "description": "Traefik dashboard at traefik.petrolyst.com" }
|
|
]
|
|
}
|
|
}
|
|
}
|