bugfix(KLEF-124): Redirect mode

[JeremyNRoos]

Pull Request

Summary

• Fixes OIDC redirect mode (Authorization Code flow) being silently blocked by the Keycloak client configuration
• Ensures the kleff-panel client always has standardFlowEnabled, wildcard redirect URIs, and web origins set — both on first install and on updates to existing clients

Related Issues

Closes #

---

Changes

What's Included

• internal/adapters/keycloak/client.go — EnsureRealm now creates/updates the kleff-panel client with standardFlowEnabled: true, redirectUris: ["*"], and webOrigins: ["*"]; added PUT update path for when the client already exists (previously only CREATE was handled, leaving stale config on reinstall)

What's Not Included

• Restricting redirect URIs to specific origins (intentionally left as * for self-hosted dev; production hardening is out of scope)
• Headless mode is unaffected — directAccessGrantsEnabled remains true

---

Testing

How Was This Tested?

• Tested locally: installed plugin with AUTH_MODE=redirect, verified Keycloak login page loads and redirect back to localhost:3000/auth/callback succeeds
• Verified idempotency: reinstalling the plugin re-runs EnsureRealm and correctly updates the existing client

Test Coverage

• Unit tests added or updated
• Integration tests added or updated
• Manually tested end-to-end

---

Breaking Changes

Does this PR introduce breaking changes?

• Yes
• No

Headless mode (directAccessGrantsEnabled) is preserved. The only change is enabling the standard flow that was previously blocked.

---

Security Considerations

• This PR affects authentication or authorization logic
• This PR touches secrets, tokens, or environment variables
• This PR affects infrastructure, deployment pipelines, or network configuration

redirectUris: ["*"] is a wildcard. This is acceptable for a self-hosted development tool but should be tightened in a production-hardened deployment. No change to token validation logic.

---

Documentation

Does this PR require documentation updates?

• Yes
• No

---

UI/UX (If Applicable)

N/A — backend only.

---

Pre-Merge Checklist

• PR title follows semantic format (feat:, fix:, chore:, docs:, refactor:, test:)
• All CI checks passing
• Code follows project style guidelines
• No debug logs or commented-out code left in
• Dependencies reviewed (no unnecessary additions)
• No sensitive information included

---

Reviewer Notes