القائمة
Use when the user works on authentication, Keycloak configuration, OIDC, roles, or JWT claims.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when the user adds or modifies a Next.js API route under ui/src/app/api/.
Use when the user works on EHDS articles, DSP protocol, DCP credentials, ODRL policies, or the audit trail.
Use when the user works on the force-directed graph explorer, layer colours, persona views, or node filtering.
Use when the user adds nodes, relationships, constraints, or indexes to the Neo4j knowledge graph, or edits any *.cypher file.
Use when the user adds E2E tests, Playwright specs, or journey coverage.
Use when the user works on demo personas, localStorage persistence, or GitHub Pages static-export behaviour.
| name | keycloak-auth |
| description | Use when the user works on authentication, Keycloak configuration, OIDC, roles, or JWT claims. |
Sources: ui/src/lib/auth.ts, jad/keycloak-realm.json, CLAUDE.md gotcha #5,
ui/__tests__/unit/config/keycloak-realm.test.ts,
docs/knowledge/runbooks/keycloak-realm-drift.md.
wellKnown in the NextAuth provider — set token, userinfo,
jwks_endpoint to the Docker-internal host (keycloak:8080) and
authorization/issuer to the public URL (incident-tested invariant).health-dataspace-ui is confidential + PKCE S256; NextAuth checks
must include ["pkce", "state"] or Keycloak returns invalid_request.token.realm_access?.roles in the JWT callback; route
protection lives in ui/src/middleware.ts — read it before adding routes.DEMO_PERSONAS array in auth.ts.jad/keycloak-realm.json is the source of truth, but a
realm re-import returns 409 and imports nothing on an existing realm — new
users/roles/redirect-URIs must be reconciled via the Admin REST API on
deployed instances (see the realm-drift runbook for the exact procedure).keycloak-realm.test.ts green — it pins the production URIs.Realm file, live instance, and the regression test stay in agreement.