438040acce
Vier-Crate-Workspace mit:
- Domain: Account, Car, Tour, Delivery, DeliveryItem, DeliveryNote, Customer,
Article, Warehouse, ScanState, AuditAction — alle mit serde + feature-gated
utoipa::ToSchema.
- Application: Ports (TourRepository, DeliveryRepository, ScanRepository,
DeliveryNoteRepository, CarRepository, AuthService) und Use Cases.
- Infrastructure: Postgres-Adapter via sqlx (PgTourRepository etc.) +
Keycloak-AuthService mit JWKS-Cache + OIDC-Discovery.
- API: Axum 0.8, utoipa-OpenAPI + Swagger-UI, JWT-Bearer-Middleware,
AuthenticatedUser-Extractor.
Endpoints:
- GET /me/tours/today, /tours/{id}, /accounts/{pn}, /me/cars, /health
- POST /sync/tour, /scans (bulk + idempotent via clientScanId),
/deliveries/{id}/{hold,resume,cancel,complete,notes}, /me/cars
- PUT /tours/{id}/delivery-order, /deliveries/{id}/assigned-car, /me/cars/{id}
- PATCH /me/cars/{id}
Datenmodell:
- 6 Migrationen (accounts, tours/deliveries/items + Stammdaten,
scan_audit mit clientScanId-UNIQUE, state_reason refactor,
delivery_notes, cars + FKs nachziehen).
- Business-stabile Beleg-Keys (belegart_id, belegnummer) für ERP-Sync.
- Append-only scan_audit + embedded scan_state als doppelte Wahrheit.
Dev-Setup:
- docker-compose mit Postgres 17 + Keycloak 26
- Keycloak-Realm 'holzleitner' mit Public-Client (PKCE), Testfahrer
(PN 1001) + Audience-/Personalnummer-Mapper
93 lines
2.5 KiB
JSON
93 lines
2.5 KiB
JSON
{
|
|
"realm": "holzleitner",
|
|
"enabled": true,
|
|
"sslRequired": "none",
|
|
"registrationAllowed": false,
|
|
"loginWithEmailAllowed": true,
|
|
"duplicateEmailsAllowed": false,
|
|
"resetPasswordAllowed": false,
|
|
"editUsernameAllowed": false,
|
|
"bruteForceProtected": true,
|
|
"accessTokenLifespan": 1800,
|
|
"ssoSessionIdleTimeout": 1800,
|
|
"ssoSessionMaxLifespan": 36000,
|
|
"roles": {
|
|
"realm": [
|
|
{
|
|
"name": "driver",
|
|
"description": "Lieferfahrer — darf Touren laden, scannen und abschließen."
|
|
}
|
|
]
|
|
},
|
|
"users": [
|
|
{
|
|
"username": "testfahrer",
|
|
"enabled": true,
|
|
"emailVerified": true,
|
|
"firstName": "Test",
|
|
"lastName": "Fahrer",
|
|
"email": "test@example.com",
|
|
"credentials": [
|
|
{
|
|
"type": "password",
|
|
"value": "test",
|
|
"temporary": false
|
|
}
|
|
],
|
|
"realmRoles": ["driver"],
|
|
"attributes": {
|
|
"personalnummer": ["1001"]
|
|
}
|
|
}
|
|
],
|
|
"clients": [
|
|
{
|
|
"clientId": "holzleitner-app",
|
|
"name": "Holzleitner Mobile App",
|
|
"description": "Public Client für die Flutter-App (Authorization Code + PKCE und Direct Access Grants im Dev).",
|
|
"enabled": true,
|
|
"publicClient": true,
|
|
"standardFlowEnabled": true,
|
|
"directAccessGrantsEnabled": true,
|
|
"serviceAccountsEnabled": false,
|
|
"implicitFlowEnabled": false,
|
|
"redirectUris": [
|
|
"http://localhost:*",
|
|
"holzleitner://*"
|
|
],
|
|
"webOrigins": ["+"],
|
|
"attributes": {
|
|
"post.logout.redirect.uris": "+",
|
|
"pkce.code.challenge.method": "S256"
|
|
},
|
|
"protocolMappers": [
|
|
{
|
|
"name": "audience-holzleitner-api",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-audience-mapper",
|
|
"config": {
|
|
"included.client.audience": "holzleitner-api",
|
|
"id.token.claim": "false",
|
|
"access.token.claim": "true",
|
|
"introspection.token.claim": "true"
|
|
}
|
|
},
|
|
{
|
|
"name": "personalnummer",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
|
"config": {
|
|
"user.attribute": "personalnummer",
|
|
"claim.name": "personalnummer",
|
|
"jsonType.label": "long",
|
|
"id.token.claim": "true",
|
|
"access.token.claim": "true",
|
|
"userinfo.token.claim": "true",
|
|
"introspection.token.claim": "true"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|