From 81aa0e64186c6c826aceafc104fb62e058bfc575 Mon Sep 17 00:00:00 2001
From: Nathan Vasse <nathan.vasse@gmail.com>
Date: Wed, 29 Jul 2026 12:03:26 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=A7=91=E2=80=8D=F0=9F=92=BB(dev)=20config?=
 =?UTF-8?q?ure=20the=20local=20Docs=20integration?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Running the POC locally needs the two apps to trust each other: a dev
placeholder token shared by both directions of the server-to-server
API, the Docs URLs resolvable from the compose network, and an impress
client in the Keycloak realm so Docs signs in on Drive's identity
provider (single session across both apps).
---
 docker/auth/realm.json   | 54 ++++++++++++++++++++++++++++++++++++++++
 env.d/development/common |  6 +++++
 2 files changed, 60 insertions(+)

diff --git a/docker/auth/realm.json b/docker/auth/realm.json
index 776c1582..8048c304 100644
--- a/docker/auth/realm.json
+++ b/docker/auth/realm.json
@@ -752,6 +752,60 @@
           "microprofile-jwt"
         ]
       },
+      {
+        "id": "97a9c274-3f21-4c3e-8f6a-bcadd0e51a02",
+        "clientId": "impress",
+        "name": "",
+        "description": "",
+        "rootUrl": "",
+        "adminUrl": "",
+        "baseUrl": "",
+        "surrogateAuthRequired": false,
+        "enabled": true,
+        "alwaysDisplayInConsole": false,
+        "clientAuthenticatorType": "client-secret",
+        "secret": "ThisIsAnExampleKeyForDevPurposeOnly",
+        "redirectUris": [
+          "http://localhost:8072/*",
+          "http://localhost:3001/*"
+        ],
+        "webOrigins": [
+          "http://localhost:3001"
+        ],
+        "notBefore": 0,
+        "bearerOnly": false,
+        "consentRequired": false,
+        "standardFlowEnabled": true,
+        "implicitFlowEnabled": false,
+        "directAccessGrantsEnabled": false,
+        "serviceAccountsEnabled": false,
+        "publicClient": false,
+        "frontchannelLogout": true,
+        "protocol": "openid-connect",
+        "attributes": {
+          "access.token.lifespan": "-1",
+          "user.info.response.signature.alg": "RS256",
+          "post.logout.redirect.uris": "http://localhost:3001/*",
+          "use.refresh.tokens": "true",
+          "acr.loa.map": "{}"
+        },
+        "authenticationFlowBindingOverrides": {},
+        "fullScopeAllowed": true,
+        "nodeReRegistrationTimeout": -1,
+        "defaultClientScopes": [
+          "web-origins",
+          "acr",
+          "roles",
+          "profile",
+          "email"
+        ],
+        "optionalClientScopes": [
+          "address",
+          "phone",
+          "offline_access",
+          "microprofile-jwt"
+        ]
+      },
       {
         "id": "869481d0-5774-4e64-bc30-fedc7c58958g",
         "clientId": "deploycenter",
diff --git a/env.d/development/common b/env.d/development/common
index 04a9ec2e..9375196a 100644
--- a/env.d/development/common
+++ b/env.d/development/common
@@ -111,3 +111,9 @@ MALWARE_DETECTION_DUMMY_SLEEP=10
 # Must be a valid Fernet key (32 url-safe base64-encoded bytes)
 # To create one, use the bin/fernetkey command.
 # OIDC_STORE_REFRESH_TOKEN_KEY="your-32-byte-encryption-key=="
+
+# Docs <-> Drive POC integration
+SERVER_TO_SERVER_API_TOKENS=docs-drive-poc-secret
+FRONTEND_DOCS_URL=http://localhost:3001
+DOCS_API_BASE_URL=http://docs-app-dev-1:8000/api/v1.0
+DOCS_SERVER_TO_SERVER_TOKEN=docs-drive-poc-secret