org adapter:Keycloak Admin API 拉名册(provisioning 服务账号,分页 100,只读 view-users)

用 master realm 的 provisioning 服务账号(client_credentials)取管理 token(闭包缓存、提前 60 秒过期),分页拉全 realm 用户(默认 max=100,必须分页),逐人查 role-mappings/realm/composite 取实际生效的 realm 角色并滤噪声(复用 isNoiseRole)。非 2xx 一律抛带状态码的错,不吞;secret 不落任何留痕。
2026-08-25 16:32:47 +08:00
parent 43917b559a
commit 4d55ac465d
4 changed files with 176 additions and 0 deletions
@@ -20,3 +20,5 @@ export { buildInFlightWork } from './internal/domain/in-flight.ts';
 export { DEFAULT_ROLE_ACCESS, NONE_POSITION_CODE, TEST_POSITION_CODE } from './internal/domain/seed-data.ts';
 export { createKeycloakTokenVerifier, explainJoseError } from './internal/adapter/keycloak-token-verifier.ts';
 export type { KeycloakVerifierOptions } from './internal/adapter/keycloak-token-verifier.ts';
+export { createKeycloakRoster } from './internal/adapter/keycloak-admin-roster.ts';
+export type { KeycloakRosterOptions } from './internal/adapter/keycloak-admin-roster.ts';