feat(ops/keycloak): configure Forgejo Roles

There's two Roles for the Forgejo application, "Admin" and
"Contributors".
Everyone gets the "Contributor" role assigned automatically (it doesn't
really give you a ton of privileges).

Regarding mapping Gerrit groups, it seems there's no support for this in
the `gerrit-oauth-provider` plugin (yet) -
see https://github.com/davido/gerrit-oauth-provider/issues/170.

Fixes #73.

Change-Id: I3cbb968e664125b1f08235db3008d1dbf778922a
Reviewed-on: https://cl.snix.dev/c/snix/+/30477
Tested-by: besadii
Reviewed-by: Jonas Chevalier <zimbatm@zimbatm.com>
Autosubmit: Florian Klink <flokli@flokli.de>

ops/keycloak/forgejo.tf

@@ -8,8 +8,9 @@ resource "keycloak_openid_client" "forgejo" {
   base_url                                 = "https://git.snix.dev"
 
   description                              = "snix project's code browsing, search and issue tracker"
-  direct_access_grants_enabled             = true
-  exclude_session_state_from_auth_response = false
+
+  // disable full scope, roles are assigned via keycloak_generic_client_role_mapper
+  full_scope_allowed    = false
 
   valid_redirect_uris = [
     "https://git.snix.dev/*",
@@ -20,8 +21,41 @@ resource "keycloak_openid_client" "forgejo" {
   ]
 }
 
-# resource "keycloak_role" "forgejo_admin" {
-# }
-#
-# resource "keycloak_role" "forgejo_trusted_contributor" {
-# }
+resource "keycloak_role" "forgejo_admin" {
+  realm_id    = keycloak_realm.snix.id
+  client_id   = keycloak_openid_client.forgejo.id
+  name        = "Admin"
+  description = "Forgejo site admin and Snix Org Owner"
+}
+
+resource "keycloak_role" "forgejo_snix_contributors" {
+  realm_id    = keycloak_realm.snix.id
+  client_id   = keycloak_openid_client.forgejo.id
+  name        = "Contributors"
+  description = "Snix contributors"
+}
+
+
+# Add the "Contributors" role to all users
+resource "keycloak_openid_hardcoded_role_protocol_mapper" "forgejo_hardcoded_role_mapper" {
+  realm_id = keycloak_realm.snix.id
+  client_id = keycloak_openid_client.forgejo.id
+  name = "add forgejo contributors"
+  role_id = keycloak_role.forgejo_snix_contributors.id
+}
+
+# Expose the above two roles at `forgejo_roles`
+resource "keycloak_openid_user_client_role_protocol_mapper" "forgejo_role_mapper" {
+  realm_id = keycloak_realm.snix.id
+  client_id = keycloak_openid_client.forgejo.id
+  name = "forgejo_roles mapper"
+
+  claim_name = "forgejo_roles"
+  claim_value_type = "String"
+  add_to_id_token = true
+  add_to_access_token = true
+  multivalued = true
+
+  # https://github.com/keycloak/terraform-provider-keycloak/issues/1016
+  client_id_for_role_mappings = keycloak_openid_client.forgejo.client_id
+}

ops/keycloak/permissions.tf

@@ -28,7 +28,7 @@ resource "keycloak_group_roles" "snix_core_team_roles" {
     # keycloak_role.is_local_admin,
     # keycloak_role.can_manage_snix,
     keycloak_role.grafana_admin.id,
-    # keycloak_role.forgejo_admin.id,
+    keycloak_role.forgejo_admin.id,
     # keycloak_role.gerrit_admin.id
   ]
 }