PIMS-1927 Keycloak Roles Update

[dbarkowsky]

🎯 Summary

PIMS-1927

Changes

Altered the syncKeycloakUserRoles service so it does the following:

• If the user has keycloak roles, apply them to the database
• If they don't have keycloak roles, but have database roles, apply them to Keycloak
• Otherwise, don't do anything.

Testing

Try changing your role in both keycloak and the database manually.
Log in again to see if the sync took affect. This only triggers on login, not a refresh.

Concern

Because this only triggers on login, there's a situation where a user with no keycloak role may log in and receive the no-access page, even if they have a database role. If they refresh the page, it should resolve itself, but it would be nice to handle this somehow. Open to ideas.

🔰 Checklist

• I have read and agree with the following checklist and am following the guidelines in our Code of Conduct document.

• I have performed a self-review of my code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation where required.
• I have tested my changes to the best of my ability.
• My changes generate no new warnings.

[github-actions]

🚀 Deployment Information

The Express API Image has been built with the tag: 2580. Please make sure to utilize this specific tag when promoting these changes to the TEST and PROD environments during the API deployment. For more updates please monitor Image Tags Page on Wiki.

[codeclimate]

Code Climate has analyzed commit b98693b and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 92.6%.

View more on Code Climate.

[dbarkowsky]

Pulling back to draft for now. May have received intervention from the SSO team that will make this unnecessary.

[dbarkowsky]

Closing this. SSO team transferred BCeID users. Used the role-mapping script to assign roles in new integration. Spot checking seems to suggest it was successful. Keycloak will remain the sole source of authorization truth.