Menu
Get Keycloak auth working for local PROMPT 2.0 development — the .env vs .env.dev split, realm import, and common auth failures (401/403/CORS). Use when setting up local dev, fixing login/token issues, or onboarding a new contributor.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Scaffold a new PROMPT 2.0 course phase end-to-end — a micro-frontend (clients/) plus a Go microservice (servers/) wired into Module Federation, the workspaces, and docker-compose. Use when asked to add a new course phase, component, or phase module/service.
Add or reuse a shared UI component in PROMPT 2.0 — install shadcn/ui primitives into the shared_library and surface them via @tumaet/prompt-ui-components instead of writing custom UI. Use when adding a button/dialog/table/form or any reusable UI element.
Address unresolved review comments on the current branch's GitHub PR — fetch the open threads, fix the code, and push. Use when asked to handle, resolve, or respond to PR review comments/feedback.
Docker Compose patterns for PROMPT's local multi-service stack — networking, volumes, container security, and debugging. Use when editing docker-compose*.yml, adding a service, or troubleshooting containers.
Create a GitHub release for the PROMPT 2.0 repository. Use this when asked to create, draft, or publish a GitHub release.
Deeper idiomatic Go patterns for PROMPT's services — concurrency (errgroup, context, goroutine leaks), error wrapping, and performance idioms. The go/ rules point here for these; they own the Gin/pgx/sqlc conventions.
Based on SOC occupation classification
| name | keycloak-local-setup |
| description | Get Keycloak auth working for local PROMPT 2.0 development — the .env vs .env.dev split, realm import, and common auth failures (401/403/CORS). Use when setting up local dev, fixing login/token issues, or onboarding a new contributor. |
PROMPT 2.0 uses Keycloak (RBAC) for auth. Local dev runs Keycloak + Postgres via docker-compose;
the Go services validate tokens through prompt-sdk.
.env.template → .env, .env.dev.template → .env.dev..env holds Docker-hostname values (service-to-service inside compose); .env.dev holds the
localhost overrides for running a server on the host. Both are loaded by the Makefile (.env
first, then .env.dev overrides). Never commit .env* (gitignored); they are copied into
worktrees via .worktreeinclude.KEYCLOAK_HOST, KEYCLOAK_REALM_NAME, CORE_HOST (frontend URL for CORS),
SERVER_CORE_HOST (inter-service base URL).make db starts Postgres + Keycloak (detached); make db-down stops them.keycloakConfig.json at the repo root on first start. If roles/clients
look wrong, stop, remove the keycloak_postgres_data/ volume, and re-import.KEYCLOAK_HOST/KEYCLOAK_REALM_NAME mismatch between the running Keycloak
and the service env, or a stale realm — re-import./api/course_phase/:coursePhaseID, or the user lacks the
required role (PromptAdmin, PromptLecturer, CourseLecturer, CourseEditor, CourseStudent).
See the go/auth-routing rule.CORE_HOST doesn't match the frontend origin; prompt-sdk CORSMiddleware uses it..env vs
.env.dev value for KEYCLOAK_HOST/SERVER_CORE_HOST.make db, then start the core server; log in via the frontend and confirm a protected
/api/course_phase/... route returns 200 with a valid token.