Implement real Keycloak client for drift detection

[LahkLeKey]

Closes: #17

Summary

Implements HttpKeycloakClient to connect to live Keycloak instances for auth stack reconciliation and drift detection. Phase 3 of the implementation roadmap.

Architecture

• HttpKeycloakClient — Implements KeycloakClient interface with bearer token auth
• Token caching — Automatic refresh with expiry tracking
• HTTPS/HTTP support — Works with both production and development Keycloak instances
• Zero dependencies — Uses Node's built-in https/http modules

Changes

• src/keycloak/index.ts (270 lines) — Real Keycloak client with three methods
  • readLiveState(deployment) — Queries /admin/realms/{realm} for clients, roles, groups, users
  • applyDesiredState(deployment, desired) — Creates realms, clients, roles
  • verifyLiveState(deployment, desired) — Validates live state matches desired
• src/keycloak/index.test.ts (175 lines) — 4 comprehensive tests with mock Keycloak server
• src/keycloak/README.md — Setup instructions and API endpoint documentation
• src/keycloak/keycloak.ts — Public exports

Testing

npm test
# Output: 14 passing tests (10 existing + 4 Keycloak)

Tests verify:

• Token authentication and caching
• Reading realm, client, role, group, and user state from Keycloak REST API
• Applying desired state (realm/client/role creation)
• Verifying live state matches desired state
• Error handling when state doesn't match

Configuration

Keycloak Setup (for local testing)

docker run -d \
  -e KEYCLOAK_ADMIN=admin \
  -e KEYCLOAK_ADMIN_PASSWORD=admin \
  -p 8080:8080 \
  quay.io/keycloak/keycloak:latest start-dev

Next Steps

• Phase 4: Real infrastructure provisioning (AWS/GCP)
• Phase 5: Deployment pipeline (Docker, Kubernetes, CI/CD)

[Copilot]

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.