Removed the direct access grant on the rest-api client in the dev
realm.json
Repair make test-keycloak, which could not run against a freshly
imported realm. The fixtures need more rights than the rest-api service
account holds, so they now use the bootstrap admin service account. The
bootstrap admin user cannot serve here, because it has an empty profile
and Keycloak refuses the password grant.
Grant view-realm to the service account. set_realm_role reads a realm
role by id, which fails with 403 without that role.
Add a setup guide for the authentication provider and one for the
identity provider. Document the required client shape in env.md.
A staging and a production build must be installable side by side on one
device, and two apps claiming the same OIDC deep-link scheme would make
Android ask the user which one receives the login callback, mid-flow. The
app id, the displayed name and the callback scheme therefore become
per-environment (MOBILE_APP_ID / MOBILE_APP_NAME / MOBILE_AUTH_SCHEME).
Use the new preview_text method of jmap_email to generate
clean snippet for thread (denormalized at update_stats)
and message (at serialization). Now when a mesage is folded, we
display this snippet. In the thread list we also display this snippet above
the subject.
In some case, a user can be authenticated on the identity provider
but do not have account on Messages. In this precise case, we know
display a toast to explicit what's wrong.
When a user tries to access to a message route when it is not
authenticated, it is redirect on the homepage and have to authenticate.
Now in this case, we redirect on homepage and persist the previous route
within a next query param, in this way, we are able to automatically
redirect the user on the right view once it is authenticated.
Notably, we try to reduce disk usage by standardizind on common
base Docker images. We also improve node_modules by reducing
duplicate dependencies and install speed.
Bastien Ogier