Repository navigation
Connect to LibreDB Studio through Keycloak - #1
Merged
Merged
Conversation
The Android application id and namespace, the iOS bundle identifiers and the OIDC redirect scheme still named the template, so a Keycloak client registered for LibreDB would have had to carry the template's scheme. They are now org.libredb.mobile, the redirect URI is org.libredb.mobile:/oauth2redirect, and the app shows as LibreDB on both platforms. The Kotlin sources move to the matching package, and the demo realm, the OIDC guide and the tests follow the new scheme.
A build against a Studio instance needs its API address without editing the source, as the repository and docs links already allow. TemplateConfig.prodApiUrl now reads --dart-define=PROD_API_URL and keeps the placeholder as its default. The demo values guard skips PROD_API_URL for the compiled defaults too, as its documentation already said, since the mock-only demo never selects the production config.
The app had no screen that called Studio, so a signed-in session never proved that Studio accepted the Keycloak access token. A new connections feature reads GET /api/connections/managed through ConnectionListBloc and shows the seed or granted connections, without credentials, on a Connections page in the menu. An unreadable answer fails with a ServerError instead of an empty list, and a failed load offers a retry. The mock answers the request, and the repository method is in the mock asset coverage table.
tool/studio-dev starts Keycloak with a libredb-mobile public client and Studio with its bearer channel on, both behind Caddy over TLS, since Studio refuses an issuer that is not https. studio-dev.env builds the app against it, and trust-android-emulator.sh puts the stack's CA into an emulator's system store and forwards the ports. docs/studio.md describes the Keycloak and Studio settings the app needs and the walkthrough, verified on an API 30 emulator against Studio built from libredb/libredb-studio#1914.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The app now signs in to Keycloak as the public client
libredb-mobileand calls LibreDB Studio with the access token as bearer. Needs libredb/libredb-studio#1914; the Platform installer side is libredb/libredb-platform#22.org.libredb.mobileon Android and iOS, redirect URIorg.libredb.mobile:/oauth2redirect.PROD_API_URLdefine for Studio's/api.GET /api/connections/managed.tool/studio-dev: Keycloak and Studio behind Caddy TLS, an env file, and a script that trusts the CA on an emulator. Guide indocs/studio.md.Verified locally: format, analyze, 3129 tests (coverage 93%), Android JVM tests, release APK, web build and placeholder check. End to end on an API 30 emulator against Studio built from #1914 at
d8d1b4970: SSO sign-in, the connection list, refresh after the 60 s token expired, and logout ending the Keycloak session.Not verified: iOS (no macOS here).
Follow-ups: the app title and drawer still say "BLoC Advance", and Studio's 401
AUTH_ERROR/LLM_AUTHmust not trigger a refresh once query screens arrive.