[BRAVO68WEB]

Summary

Draft cutover of the API identity layer and the local dev/e2e stack from Keycloak to Atrium ghcr.io/bravo68web/atrium:0.2.0-rc.6.

• packages/envsync-api/src/helpers/identity.ts replaces helpers/keycloak.ts. Management calls use the Atrium client-credentials client (management / scope management): user lookup, create, patch, delete, set-password, and reset-email.
• JWKS is {issuer}/oidc/jwks. Authorize is {issuer}/oauth/authorize. Tokens are POST {internal}/oauth/token with client_secret_post.
• Required env is ATRIUM_* (ATRIUM_INTERNAL_URL, ATRIUM_PUBLIC_URL, ATRIUM_ISSUER, management and web/api/cli client ids and secrets). KEYCLOAK_* is no longer accepted by the API schema.
• Dev compose replaces keycloak / keycloak_db with atrium (Postgres 17, no Atrium Redis), docker/atrium/config.yaml, and a one-shot atrium-seed restore of docker/atrium/clients.json. A second boot does not rewrite client secrets when envsync-web already exists.
• Seeded clients use skip_consent, registration/DCR/CIMD off, JWT access tokens, refresh 168h, and Mailpit SMTP. Issuer for host-run API is http://auth.lvh.me:8080.
• E2E harness talks to Atrium /health, /oauth/token, and /api/users instead of kcadm and /realms/....

Do not merge until Keycloak is gone from prod compose, deploy, and the dashboard login flow.

Program / phase

• feat/migrate-to-atrium — Keycloak day-one cutoff. Not part of feat/the-big-update.

No-piggyback checklist

• Does not make product A depend on product B via spawn, re-export, or rename-only API
• Shared code is a library (kernel/domain/ui), not a second entrypoint of another product
• If this creates or provisions an organization, it matches the channel matrix (§1.1a) — no new org-create path
• Self-host web session never gains a new org-create path
• New enterprise API/UI modules are registered for the enterprise package path — N/A, no new module
• OSS deploy changes do not call into deploy-cli / enterprise deploy sources — deploy is unchanged in this draft

Still on Keycloak

• docker-compose.prod.yaml and scripts/cli.ts service lists
• packages/deploy, packages/deploy-core, render tests
• packages/envsync-keycloak-theme and docker/keycloak/realm-import
• Dashboard UI e2e (#kc-login) and OpenAPI / SDK wording
• SELFHOSTING.md, DEPLOY.md, README.md
• Hosted user import (idp-migrate) is not in this branch
• MFA enrollment prompt stays out of this release. Cutover leaves Atrium mfa.enabled and mfa.required false
• Existing Keycloak passwords are not imported. That behavior lands with the import tool, not this API swap

Tests

• Mock / unit (if API) — not re-run here. An earlier bun test tests/mock/auth.test.ts died while preparing envsync_test (connection terminated), before assertions.
• E2E or pack smoke (if behavior/deploy)

Local API e2e after bun run scripts/e2e-setup.ts init, against the Atrium stack:

cd packages/envsync-api && TEST_MODE=e2e bun test tests/e2e --preload tests/e2e/helpers/real-setup.ts --timeout 60000

289 pass, 2 fail, 291 tests, 38 files, ~27s. Login, JWT, OpenFGA, miniKMS, and migrations passed. The two failures are Enterprise License Lock E2E (active verification… and hosted heartbeat…). Both throw immediately because ENVSYNC_E2E_LICENSE_KEY / ENVSYNC_LICENSE_KEY is empty locally. CI supplies ENVSYNC_E2E_LICENSE_KEY and calls https://license.envsync.cloud. The invalid-key lock test in that file passed.

• N/A docs-only

Risk / rollout

Breaking for any process that still sets KEYCLOAK_* and expects the API to boot. Dev .env must gain the ATRIUM_* block from .env.example. Dev client secrets in compose (dev-web-secret, dev-api-secret, dev-e2e-secret, replace-me-management) match that example and docker/atrium/clients.json.

Hosted production is unchanged until prod compose and deploy render Atrium and the import window runs. Rollback for that later window is revert-the-release plus restore the pre-window Keycloak dump and the pre-window Atrium database. Sessions and refresh tokens are not migrated. Issuer moves from {public}/realms/envsync to the Atrium site root, so existing access tokens fail verification.