b6b9c27cb0
Backend (main.py + auth.py): - Validate Bearer JWT against the intense-sale realm JWKS (RS256, issuer checked, aud skipped). Missing/invalid token = anonymous, never an error, so the public map keeps working when Keycloak is down. - Anonymous truncation: /api/meta hides brand/manager/status facets; /api/bookings blanks brand/company_name/manager/task_id/task_status (bars stay, one neutral colour); /api/map keeps occupied_now but empties booking details. Hidden facet filters are ignored for anonymous callers. - boards stay visible to all (physical inventory: address/city/dimension). Frontend (keycloak-js): - Silent SSO (check-sso) — anonymous by default, Войти/Выйти button. - Bearer token attached + refreshed on every API call. - Anonymous UI hides Brand/Manager/Status filters, Brand/Company toggles, appearance menu, collisions and labels; board detail panel (Planfix deep-links) gated to managers. Test manager: user / 1234567890 (realm role `manager`).
11 lines
300 B
HTML
11 lines
300 B
HTML
<!doctype html>
|
|
<html>
|
|
<body>
|
|
<script>
|
|
// Keycloak silent SSO check: hand the redirect URL back to the app in the
|
|
// parent window so keycloak-js can complete the check without a full reload.
|
|
parent.postMessage(location.href, location.origin);
|
|
</script>
|
|
</body>
|
|
</html>
|