[samwel141]

Part of Greenstand/treetracker-admin-client#1241

Problem

Binding a legacy wallet to a keycloak account means the admin has to identify that account. Dadiorchen asked on the issue that we define this before coding, and we settled on search rather than pasting a uuid: a pasted id is unverifiable, and the acceptance criteria already ask the wallet detail page to show the keycloak user's name or email, which needs a lookup either way.

The browser cannot hold admin credentials, so the lookup has to be proxied. This API already authenticates to Keycloak with a service account for the organization apply flow, so no new secret is needed.

Change

GET /api/keycloak-users?search=&limit=   accounts matching email or username
GET /api/keycloak-users/{id}             one account, for the detail page

Both behind requireRole(Role.WALLET_ADMIN), the same role that gates the wallet pages in the admin panel. An empty search returns [] without calling Keycloak. Only id, username, email, firstName and lastName are returned.

Verification

5 new tests in src/controllers/keycloakUser.controller.test.ts. Full suite 79 passing, tsc --noEmit clean, eslint and prettier clean.

Related

• feat(admin): bind a keycloak account to an existing wallet treetracker-wallet-api#612 adds the binding endpoint
• The admin panel work is next: wallet detail page plus the bind dialog