From adc9dac006ed83822629a357c5505b50c05fba01 Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Sun, 10 Aug 2025 08:05:46 +0200
Subject: [PATCH] change: Add role mapper for view-profile to timetable
 frontend

change: Import account and view-profile
---
 terraform/imports.tf  | 14 ++++++++++++++
 terraform/keycloak.tf | 32 +++++++++++++++++++++++++++++++-
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/terraform/imports.tf b/terraform/imports.tf
index e69de29..1728300 100644
--- a/terraform/imports.tf
+++ b/terraform/imports.tf
@@ -0,0 +1,14 @@
+import {
+  id = "twomartens/70b117f6-1212-4c30-95ec-21b4b4ed47ea"
+  to = keycloak_openid_client.account
+}
+
+import {
+  id = "twomartens/7598dba2-de04-4493-83a0-8b85e4496895"
+  to = keycloak_role.account_view_profile
+}
+
+import {
+  id = "twomartens/client/44ceab76-cb8f-4883-8093-0bcb8b6d5064/scope-mappings/70b117f6-1212-4c30-95ec-21b4b4ed47ea/7598dba2-de04-4493-83a0-8b85e4496895"
+  to = keycloak_generic_role_mapper.timetable_frontend_view_profile
+}
\ No newline at end of file
diff --git a/terraform/keycloak.tf b/terraform/keycloak.tf
index c4ebf31..4a557dd 100644
--- a/terraform/keycloak.tf
+++ b/terraform/keycloak.tf
@@ -48,6 +48,29 @@ resource "keycloak_realm" "twomartens_realm" {
   }
 }
 
+resource "keycloak_openid_client" "account" {
+  realm_id    = keycloak_realm.twomartens_realm.id
+  client_id   = "account"
+  access_type = "PUBLIC"
+  name        = "$${client_account}"
+  root_url    = "$${authBaseUrl}"
+  base_url    = "/realms/twomartens/account/"
+  valid_redirect_uris = [
+    "/realms/twomartens/account/*"
+  ]
+  valid_post_logout_redirect_uris = [
+    "+"
+  ]
+  standard_flow_enabled               = true
+  backchannel_logout_session_required = true
+}
+
+resource "keycloak_role" "account_view_profile" {
+  realm_id  = keycloak_realm.twomartens_realm.id
+  client_id = keycloak_openid_client.account.id
+  name      = "view-profile"
+}
+
 resource "keycloak_oidc_identity_provider" "twomartens_github_identity_provider" {
   realm        = keycloak_realm.twomartens_realm.id
   alias        = "github"
@@ -145,13 +168,20 @@ resource "keycloak_openid_client" "twomartens_timetable_frontend" {
   full_scope_allowed    = false
 
   valid_redirect_uris = [
-    "http://localhost:8100/*"
+    "http://localhost:8100/*",
+    "https://timetable.2martens.de/*"
   ]
   web_origins = [
     "+"
   ]
 }
 
+resource "keycloak_generic_role_mapper" "timetable_frontend_view_profile" {
+  realm_id  = keycloak_realm.twomartens_realm.id
+  client_id = keycloak_openid_client.twomartens_timetable_frontend.id
+  role_id   = keycloak_role.account_view_profile.id
+}
+
 resource "keycloak_openid_client" "twomartens_wahlrecht_frontend" {
   realm_id              = keycloak_realm.twomartens_realm.id
   name                  = "Wahlrecht Frontend"