菜单
Use when the user works on authentication, Keycloak configuration, OIDC, roles, or JWT claims.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when the user adds or modifies a Next.js API route under ui/src/app/api/.
Use when the user works on EHDS articles, DSP protocol, DCP credentials, ODRL policies, or the audit trail.
Use when the user works on the force-directed graph explorer, layer colours, persona views, or node filtering.
Use when the user adds nodes, relationships, constraints, or indexes to the Neo4j knowledge graph, or edits any *.cypher file.
Use when the user adds E2E tests, Playwright specs, or journey coverage.
Use when the user works on demo personas, localStorage persistence, or GitHub Pages static-export behaviour.
| name | keycloak-auth |
| description | Use when the user works on authentication, Keycloak configuration, OIDC, roles, or JWT claims. |
Sources: ui/src/lib/auth.ts, jad/keycloak-realm.json, CLAUDE.md gotcha #5,
ui/__tests__/unit/config/keycloak-realm.test.ts,
docs/knowledge/runbooks/keycloak-realm-drift.md.
wellKnown in the NextAuth provider — set token, userinfo,
jwks_endpoint to the Docker-internal host (keycloak:8080) and
authorization/issuer to the public URL (incident-tested invariant).health-dataspace-ui is confidential + PKCE S256; NextAuth checks
must include ["pkce", "state"] or Keycloak returns invalid_request.token.realm_access?.roles in the JWT callback; route
protection lives in ui/src/middleware.ts — read it before adding routes.DEMO_PERSONAS array in auth.ts.jad/keycloak-realm.json is the source of truth, but a
realm re-import returns 409 and imports nothing on an existing realm — new
users/roles/redirect-URIs must be reconciled via the Admin REST API on
deployed instances (see the realm-drift runbook for the exact procedure).keycloak-realm.test.ts green — it pins the production URIs.Realm file, live instance, and the regression test stay in agreement.