Migrate multitenant example to Nx 23, React 19 and oidc-spa 10

[Wictorgirardi]

Depends on #28 for the shared workflows and the local Keycloak with its orgs profile. The branch includes that commit; the later commits are one step each.

Summary

• Nx 22.4 → 23.2:
  • First applied the 28 migrations that were never run, then ran nx migrate 23.2.1 and applied its migrations.
  • migrations.json is removed, analytics are off, and Nx's deprecated Vite plugins are replaced with Vite 8's own resolve.tsconfigPaths.
• Tooling:
  • pnpm only: the stale root and nested package-lock.json files are gone. Node 24.
  • React 18 → 19.3, Vite 7 → 8, TypeScript 6.0 (no baseUrl, no ignoreDeprecations), Tailwind CSS 4 configured in CSS. The old Tailwind themes were empty, so the p2blue classes never rendered.
  • ESLint 9.39 with Nx's flat configs (eslint-plugin-react, used by Nx's React config, doesn't support ESLint 10), and Prettier 3.
• Tests: Jest is removed, and every project uses Vitest 4 through @nx/vitest. Nx 23's Vitest plugin doesn't support Vitest 5 yet. The old specs couldn't pass; the new ones cover:
  • the apps under oidc-spa mock mode;
  • the API client's Authorization header;
  • the Organizations component.
• Auth:
  • oidc-spa 5 → 10: src/oidc.ts in each app, which also ends the circular imports into main.tsx.
  • The Vite plugin and OidcInitializationGate.
  • Config comes from .env (VITE_OIDC_ISSUER_URI, VITE_OIDC_CLIENT_ID) instead of the <CLIENT> / <REALM> placeholders in code.
• API client:
  • libs/api-manager is now createOrgsApi({ issuerUri, getAccessToken }). It derives the base URL and realm from the issuer and asks oidc-spa for a fresh token on every request.
  • Before, the token was captured once into static headers and expired. The old await oidc.getTokens().accessToken would also have sent Bearer undefined with oidc-spa 10.
• Generated client:
  • Regenerated with OpenAPI Generator 7.25 from the current spec. The old script pointed at the phasetwo-docs master branch, which now returns 404.
  • Generator options live in openapitools.json, and generated code isn't hand-edited.
• UI:
  • The shared layout from the other examples.
  • One card per organization with the user's roles and whether they grant access to the current app.
  • Separate ports: zoo 4200, aquarium 4201 (both used 4200 before).
  • The GitHub link now points to multitenant.
• CI: new CI-only workflow, multitenant.yml.

Test plan

• From a clean install on Node 24: pnpm install --frozen-lockfile && pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run build all pass: 5 projects, 5 tests, 2 app builds.

• End to end against the local Keycloak with docker compose -f keycloak/docker-compose.yml --profile orgs up -d --wait, in dev and in production builds. /orgs/me returns 200:

  App	User	California	New York
  zoo	jane	zoo: access	zoo, aquarium: access
  aquarium	jacques	aquarium: access	aquarium: access
  zoo	jacques	aquarium: no access	aquarium: no access
  aquarium	jane	zoo: no access	zoo, aquarium: access

• actionlint passes on the workflow.

Docs drift

blog/2024-11-11-multi-tenancy-with-organizations.md:

• L94–101: hosted-only setup with * redirect URIs. The example defaults to the local Keycloak, where clients, users (jane / jacques) and organizations are preconfigured. Clients need PKCE and http://localhost:4200/* or http://localhost:4201/*.
• L102 vs L104: the org is called "new york" in one place and "newyork" in the other; the example uses newyork with display name "New York".
• L110–112: "change the realm/client in code" → per-app .env / .env.local.
• L116: the orgs.png screenshot shows the old UI.
• L74–82: the "User 1 / User 2" example contradicts the setup steps. That was already the case before this PR.

[Wictorgirardi]

Combined into #44 with the other SPA examples. The changes are the same; only the commit SHAs differ.