3 Commits

Include renames

Author	SHA1	Message	Date
notandClaude Opus 5	984d2e9d54	fix(e2e): spend a fresh TOTP counter per medewerker login (refs #132) ... Keycloak refuses a TOTP code it has already accepted (otpPolicyCodeReusable defaults to false), so the beheer specs — two serial logins as bram-beheerder, well inside one 30-second window — sent the same code twice and the second was rejected: the portal stayed on the OTP prompt and the Catalogus heading never appeared. The Playwright retry ran inside the same window too, so it failed identically. loginMedewerker now spends the first counter the medewerker has left, persisting it in tmpdir because Playwright restarts the worker process between retries, and waits out the window when that counter is still ahead. Verified against keycloak:26.1 with the real realm export: three back-to-back logins as bram-beheerder now all succeed, where reusing one code is refused with 401 invalid_grant. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-04 09:55:58 +02:00
notandClaude Opus 5	a87a32e269	docs(infra): document MFA on the medewerker realm + ADR-0031 (refs #132) ... Runbook gains an MFA section and how to get a code; synthetic-data lists the fixture TOTP secret and the extra grant parameter; demo-script gains the S-15c note and its staff logins now mention the second factor. check_realms.py grows an 'otp' argument that prints a current code for a manual demo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-03 09:11:03 +02:00
eho	c904c64597	feat(infra): Keycloak with four mock realms (closes #3) (#43)	2026-06-03 14:16:49 +00:00