refactor: simplify token endpoint to accept optional redirect_uri

Drop /token/external — the same Keycloak client supports multiple
redirect URIs, so only redirect_uri needs to vary per caller.
get_token now takes only redirect_uri as an override, using the
module-level keycloak_openid instance directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Wenqi He

backend/app/routers/keycloak.py

@@ -124,26 +124,9 @@ async def auth(code: str) -> RedirectResponse:
 
 
 @router.get("/token")
-async def token(code: str):
-    return await get_token(code)
-
-
-@router.get("/token/external")
-async def token_external(
-    code: str,
-    server_url: Optional[str] = None,
-    client_id: Optional[str] = None,
-    realm_name: Optional[str] = None,
-    client_secret_key: Optional[str] = None,
-    redirect_uri: Optional[str] = None,
-):
+async def token(code: str, redirect_uri: Optional[str] = None):
     return await get_token(
-        code,
-        server_url=server_url,
-        client_id=client_id,
-        realm_name=realm_name,
-        client_secret_key=client_secret_key,
-        redirect_uri=redirect_uri,
+        code, redirect_uri=redirect_uri or settings.auth_redirect_uri
     )
 
 

backend/app/routers/utils.py

@@ -1,9 +1,8 @@
 import mimetypes
 from typing import Optional
 
-from keycloak import KeycloakOpenID
-
 from app.config import settings
+from app.keycloak_auth import keycloak_openid
 from app.models.files import ContentType
 from app.models.tokens import TokenDB
 from app.models.users import UserDB
@@ -41,29 +40,12 @@ async def save_refresh_token(refresh_token: str, email: str):
         await token_created.insert()
 
 
-async def get_token(
-    code: str,
-    *,
-    server_url=None,
-    client_id=None,
-    realm_name=None,
-    client_secret_key=None,
-    redirect_uri=None,
-    verify=True,
-):
-    keycloak_openid = KeycloakOpenID(
-        server_url=server_url or settings.auth_server_url,
-        client_id=client_id or settings.auth_client_id,
-        realm_name=realm_name or settings.auth_realm,
-        client_secret_key=client_secret_key or settings.auth_client_secret,
-        verify=verify,
-    )
-
+async def get_token(code: str, *, redirect_uri: str = settings.auth_redirect_uri):
     # get token from Keycloak
     token_body = keycloak_openid.token(
         grant_type="authorization_code",
         code=code,
-        redirect_uri=redirect_uri or settings.auth_redirect_uri,
+        redirect_uri=redirect_uri,
     )
 
     access_token = token_body["access_token"]

frontend/src/openapi/v2/services/AuthService.ts

@@ -91,52 +91,19 @@ export class AuthService {
     /**
      * Token
      * @param code
-     * @returns any Successful Response
-     * @throws ApiError
-     */
-    public static tokenApiV2AuthTokenGet(
-        code: string,
-    ): CancelablePromise<any> {
-        return __request({
-            method: 'GET',
-            path: `/api/v2/auth/token`,
-            query: {
-                'code': code,
-            },
-            errors: {
-                422: `Validation Error`,
-            },
-        });
-    }
-
-    /**
-     * Token External
-     * @param code
-     * @param serverUrl
-     * @param clientId
-     * @param realmName
-     * @param clientSecretKey
      * @param redirectUri
      * @returns any Successful Response
      * @throws ApiError
      */
-    public static tokenExternalApiV2AuthTokenExternalGet(
+    public static tokenApiV2AuthTokenGet(
         code: string,
-        serverUrl?: string,
-        clientId?: string,
-        realmName?: string,
-        clientSecretKey?: string,
         redirectUri?: string,
     ): CancelablePromise<any> {
         return __request({
             method: 'GET',
-            path: `/api/v2/auth/token/external`,
+            path: `/api/v2/auth/token`,
             query: {
                 'code': code,
-                'server_url': serverUrl,
-                'client_id': clientId,
-                'realm_name': realmName,
-                'client_secret_key': clientSecretKey,
                 'redirect_uri': redirectUri,
             },
             errors: {

openapi.json

@@ -12074,82 +12074,6 @@
             },
             "name": "code",
             "in": "query"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Successful Response",
-            "content": {
-              "application/json": {
-                "schema": {}
-              }
-            }
-          },
-          "422": {
-            "description": "Validation Error",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/HTTPValidationError"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/v2/auth/token/external": {
-      "get": {
-        "tags": [
-          "auth"
-        ],
-        "summary": "Token External",
-        "operationId": "token_external_api_v2_auth_token_external_get",
-        "parameters": [
-          {
-            "required": true,
-            "schema": {
-              "title": "Code",
-              "type": "string"
-            },
-            "name": "code",
-            "in": "query"
-          },
-          {
-            "required": false,
-            "schema": {
-              "title": "Server Url",
-              "type": "string"
-            },
-            "name": "server_url",
-            "in": "query"
-          },
-          {
-            "required": false,
-            "schema": {
-              "title": "Client Id",
-              "type": "string"
-            },
-            "name": "client_id",
-            "in": "query"
-          },
-          {
-            "required": false,
-            "schema": {
-              "title": "Realm Name",
-              "type": "string"
-            },
-            "name": "realm_name",
-            "in": "query"
-          },
-          {
-            "required": false,
-            "schema": {
-              "title": "Client Secret Key",
-              "type": "string"
-            },
-            "name": "client_secret_key",
-            "in": "query"
           },
           {
             "required": false,