fix(admin-ui-ext): include representation in role mapping delete events - #51462
fix(admin-ui-ext): include representation in role mapping delete events#51462alehhu wants to merge 3 commits into
Conversation
Closes keycloak#51459 Signed-off-by: alehhu <159355663+alehhu@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Populates admin-event representations when role mappings are deleted through the Admin UI extension.
Changes:
- Collects brief representations of deleted roles.
- Adds representations to user, group, client, client-scope, and composite-role deletion events.
| adminEvent.operation(OperationType.DELETE) | ||
| .resourcePath(session.getContext().getUri()) | ||
| .resource(ResourceType.REALM_ROLE_MAPPING) | ||
| .representation(reps) |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (1)
rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/RoleMappingDeleteResource.java:142
- The event type here is selected from each removed composite, but the modified resource is the parent role. A realm parent containing a client-role composite will now emit
CLIENT_ROLE(and mixed composites emit multiple events), whereasRoleResource.deleteCompositesandRealmRolesCRUDTest.java:129-148emit oneREALM_ROLEevent based on the parent; determine the type fromparentRoleand keep this deletion in one event.
deleteRoleMappings(roles, compositeRole -> parentRole.removeCompositeRole(compositeRole), ResourceType.REALM_ROLE, ResourceType.CLIENT_ROLE);
|
I pushed a new commit to improve how the admin events are generated: To fix this, I refactored the deleteRoleMappings helper. It now groups the roles being deleted by their actual type (realm vs client) and emits separate, semantically correct events. This way we fix the missing representations while keeping the UI audit logs 100% consistent with the ones generated by the standard REST API. |
Signed-off-by: alehhu <159355663+alehhu@users.noreply.github.com>
Signed-off-by: alehhu <159355663+alehhu@users.noreply.github.com>
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.forms.BruteForceTest#testExceedMaxTemporaryLockouts |
Currently, when unassigning a realm role via the Admin Console, the generated REALM_ROLE_MAPPING admin event has a null representation. This happens because the Admin UI extension
RoleMappingDeleteResourcewas simply reporting success without capturing and providing the deleted role representations to the event builder.This PR fixes it by collecting the
RoleRepresentationlist insidedeleteRoleMappingsand passing it toadminEvent.representation(...), which restores parity with the classic REST API endpoints.Closes #51459