Keyc 132

[remdub]

Summary by CodeRabbit

• New Features

  • Install-time user migration is now app-aware via application_id, fetching users from the app’s configured Keycloak realms and applying the matching migration settings.
  • Keycloak realm import fixtures were expanded with additional municipality realms for richer test coverage.

• Bug Fixes

  • Migration no longer relies on app-specific identity assumptions for plain Plone users; legacy authentic cleanup runs only when enabled by the selected profile.

• Tests

  • Added unit tests validating migration config selection and that only the appropriate “extra realms” are queried.

• Documentation

  • Updated migration and Keycloak setup documentation to reflect the app-agnostic behavior and new test fixtures.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f12b697e-a6cd-4a6e-a123-f6b13abb64cb

📥 Commits

Reviewing files that changed from the base of the PR and between e64c3a2 and c84cc03.

📒 Files selected for processing (2)

• CLAUDE.md
• docs/kimug.md

✅ Files skipped from review due to trivial changes (1)

• CLAUDE.md

---

📝 Walkthrough

Walkthrough

Updates install-time user migration to use application_id-based configuration, adds shared Keycloak migration helpers and a new orchestrator, wires setup handlers to it, updates tests and docs, and adds or updates Keycloak realm import fixtures.

Changes

App-agnostic migration implementation

Layer / File(s)	Summary
Migration config and orchestration news/app-agnostic-migration.feature.md, src/pas/plugins/kimug/utils.py, docs/kimug.md, CLAUDE.md	Adds application_id-driven migration config, generic Keycloak user fetching, shared admin-token handling, realm existence checks, environment validation, and run_user_migration(context).
Setup wiring and migration tests src/pas/plugins/kimug/setuphandlers/__init__.py, tests/utils/test_utils.py, CLAUDE.md	post_install now calls run_user_migration(context), and unit tests cover config selection plus extra-realm user fetching.
Estimated code review effort: 4 (Complex)	~45 minutes

Keycloak realm test fixtures

Layer / File(s)	Summary
Rename imio-idp alias in existing fixture tests/keycloak/import/realm-plone.json, CLAUDE.md, docs/kimug.md	Updates federated identity and identity provider references from imio-idp to imio.
New municipality realm fixtures tests/keycloak/import/realm-municipality1.json, tests/keycloak/import/realm-municipality2.json, tests/keycloak/import/realm-municipality3.json, tests/keycloak/import/realm-municipality4.json, tests/keycloak/import/realm-municipality5.json	Adds five complete Keycloak realm import fixtures with roles, users, clients, scopes, identity providers, flows, and realm attributes.
Estimated code review effort: 2 (Simple)	~10 minutes

Possibly related PRs

• IMIO/pas.plugins.kimug#18: Shares the same setup and Keycloak/OIDC migration area, including post-install wiring and app-specific migration behavior.

Suggested reviewers: bsuttor

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is too vague and only references an issue number, so it doesn't describe the pull request's main change.	Use a short descriptive title like 'Make Keycloak user migration app-agnostic'.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch KEYC-132

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/pas/plugins/kimug/utils.py`:
- Line 246: The Keycloak admin fetch in the kimug utility is missing a timeout
and can hang the migration indefinitely. Update the `requests.get` call in
`utils.py` to include the same bounded timeout pattern used by the other
Keycloak requests in this module, keeping the fix localized to the admin-API
lookup flow.
- Around line 211-214: The `APP_MIGRATION_CONFIG` entry for `iA.Smartweb` is
missing the required `imio` realm, which breaks the expected migration behavior.
Update the `iA.Smartweb` config in `APP_MIGRATION_CONFIG` so `extra_realms`
includes `imio` while keeping `clean_authentic` unchanged, and ensure any logic
that reads this config (such as `get_app_migration_config` and
`get_keycloak_users`) will now fetch that realm for `iA.Smartweb`.
- Around line 247-254: The Keycloak user fetch logic in the relevant users
helper is treating a valid 200 response with an empty list as an error because
it also checks response.json() before returning. Update the branch in the users
retrieval function so it returns successfully on HTTP 200 regardless of whether
the payload is empty, and only use the raise_on_error path for non-200
responses; keep the existing logger.error and exception behavior for true
failures.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d948ff9f-ec6f-4bf9-9f22-9821ae33accf

📥 Commits

Reviewing files that changed from the base of the PR and between decd671 and bfc568c.

📒 Files selected for processing (10)

• news/app-agnostic-migration.feature.md
• src/pas/plugins/kimug/setuphandlers/__init__.py
• src/pas/plugins/kimug/utils.py
• tests/keycloak/import/realm-municipality1.json
• tests/keycloak/import/realm-municipality2.json
• tests/keycloak/import/realm-municipality3.json
• tests/keycloak/import/realm-municipality4.json
• tests/keycloak/import/realm-municipality5.json
• tests/keycloak/import/realm-plone.json
• tests/utils/test_utils.py