Niek Otten a88584514c feat(auth): medewerker-realm AuthService + provider, roles surface, realm-roles mapper (refs #13) ...

The behandel-portal authenticates staff against the Keycloak `medewerker` realm. Add

MedewerkerAuthService (reads nested realm_access.roles), provideMedewerkerAuth, a roles/hasRole

surface on the shared AuthService, and a realm-roles protocol mapper so the frontend can read

the behandelaar/teamlead roles from the token. Per ADR-0013 the BFF remains the security boundary.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-16 09:05:45 +02:00

1.6 KiB

Raw Blame History

View Raw