Skip to content

πŸš€ Auto-PR: Merge test β†’ main#584

Open
proxy-smart-releaser[bot] wants to merge 82 commits intomainfrom
test
Open

πŸš€ Auto-PR: Merge test β†’ main#584
proxy-smart-releaser[bot] wants to merge 82 commits intomainfrom
test

Conversation

@proxy-smart-releaser
Copy link
Copy Markdown
Contributor

@proxy-smart-releaser proxy-smart-releaser Bot commented Apr 25, 2026

Automated Pull Request πŸ€–

This PR was automatically created to merge changes from test into main.

Changes:

  • Commits ahead of main: 80
  • Commits behind main: 0
  • TODOs remaining in codebase: 5

Review: Please review the changes before merging.

Last updated: 2026-04-27 20:06:52 UTC

proxy-smart-releaser Bot and others added 30 commits April 25, 2026 16:56
…pharmacogenomics clickable

[skip northflank]
πŸ§ͺ Auto-PR: Merge `develop` β†’ `test`
…per types

- Flip @typescript-eslint/no-explicit-any from warn to error in shared ESLint config
- Backend (42 violations fixed across 14 files):
  - auth.ts: Add KeycloakJwtPayload interface for realm_access/resource_access claims
  - init.ts: Remove as any β€” RealmRepresentation has organizationsEnabled
  - runtime-config.ts: Remove as any β€” RealmRepresentation has loginTheme
  - org-branding.ts: Remove as any β€” OrganizationRepresentation has attributes
  - smart-scope-mappers.ts: Import ProtocolMapperRepresentation, type all mapper callbacks
  - smart-apps.ts: Use ClientRepresentation.protocolMappers directly, type getAttr properly
  - organizations.ts: Import OrganizationRepresentation for create/update calls
  - brand-bundle.ts: Import UserAccessBrandsBundle, use unknown-based assertions
  - access-control.ts: Add ErrorResponse to response schemas, remove as any
  - keycloak-config.ts: Add ErrorResponse to response schema
  - backend-services.ts: Make getKeysInterceptor async, use JSONWebKey[] type
  - oauth.ts: Type token response body fields instead of as any
  - dicomweb.ts: Type set parameter with proper Elysia status/headers types
  - app-factory.ts: Define DiscoveredApp interface for filesystem app objects
  - index.ts: Use Record<string, unknown> for listen options
- UI (3 violations fixed in 1 file):
  - DicomServersManager.tsx: Import AddDicomServerRequest/UpdateDicomServerRequest types

[skip northflank]
πŸ§ͺ Auto-PR: Merge `develop` β†’ `test`
…h generated types

- Export DiscoveredApp from app-factory.ts so tsc can name it in app's inferred type
- Use AddDicomServerRequest and AddDicomServerRequestAuthTypeEnum in AddDicomServerDialog
  instead of inline type with plain string authType

[skip northflank]
πŸ§ͺ Auto-PR: Merge `develop` β†’ `test`
proxy-smart-releaser Bot and others added 30 commits April 26, 2026 02:17
…ploy race

Root cause: smart-compliance-tests.yml triggered directly on push to 'test'
and 'main' branches, racing against the release workflows that deploy first.
Tests hit the beta server before new code was deployed β†’ 503 from Caddy.

Fix: Remove 'test' and 'main' from push triggers. These branches are already
handled by release-beta.yml and release-production.yml which call
testing-strategy.yml β†’ smart-compliance-tests.yml AFTER deployment completes.

Direct push triggers remain for dev/*, develop/*, and develop (alpha).

[skip northflank]
πŸ§ͺ Auto-PR: Merge `develop` β†’ `test`
- Create custom keycloak.v2 child theme (proxy-smart)
- Override social-providers.ftl with inline M logo SVG for maxhealth alias
- Add branded button styles targeting #social-maxhealth
- Copy theme into Keycloak image via Dockerfile

[skip northflank]
πŸ§ͺ Auto-PR: Merge `develop` β†’ `test`
The Keycloak Docker build failed because keycloak/ was fully excluded
except realm-export*.json. Add !keycloak/themes/ to allow the custom
proxy-smart login theme to be copied into the image.

Also adds proxy-smart to the login theme dropdown in BrandSettings.

[skip northflank]
MCP clients (e.g. VS Code) obtain Keycloak tokens via OAuth DCR but
may not refresh them when they expire. This causes 401s on all admin
operations routed through the Keycloak admin client.

When the user token passes JWT signature/claims validation but Keycloak
rejects it (session expired, token revoked), the admin client now falls
back to the admin-service client_credentials grant automatically.

The caller's authorization is still fully enforced β€” their roles are
checked during JWT validation. The service account is only used as a
transport credential for the Keycloak admin API.

- Add getServiceAccountAdmin() with token caching (4.5 min TTL)
- Wrap KcAdminClient in a Proxy that catches 401s on namespace methods
- On 401, retry the same operation with a fresh service-account token

[skip northflank]
πŸ§ͺ Auto-PR: Merge `develop` β†’ `test`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant