feat(tb-dev): add the tbpro OIDC clients for Send

Send on EKS tb-dev needs two tbpro clients (platform-infrastructure#712, part of
the Send migration #695). Neither exists today -- verified: no send* client in
the thunderbird/accounts realm import (11 clients, appointment pair present) and
none codified here.

Two clients, mirroring the thunderbird-appointment pair, because Send has two
distinct OIDC roles (verified in tbpro-add-on packages/send):
- thunderbird-send-frontend  PUBLIC: the SPA does auth-code + PKCE via
  oidc-client-ts (reads APP_OIDC_CLIENT_ID)
- thunderbird-send-backend   CONFIDENTIAL: validates bearer tokens by RFC 7662
  introspection (reads OIDC_CLIENT_ID + OIDC_CLIENT_SECRET)
A public client cannot introspect, so one shared client would not work.

Under Pattern C the SPA and API share one origin
(https://send.tb-dev.thunderbird.dev), so both clients use that single
redirect/web-origin host -- there is no separate send-backend host on EKS.

Wiring (the file alone would be inert):
- apply-client-config.sh: CONFIG_FILE -> CONFIG_FILES, now passing both imports
  to config-cli's comma-separated IMPORT_FILES_LOCATIONS. Unchanged otherwise:
  still no-delete (never touches other tbpro clients), cache disabled so it
  reconciles on every start, same retry loop.
- kustomization.yaml: ship tbpro-send-clients.yaml in the keycloak-realm-config
  ConfigMap. Verified the rendered ConfigMap has both keys and /config is mounted
  as a whole directory, so the new path resolves.

Because this reconciles on every Keycloak start, a Neon branch reset self-repairs
these clients with no manual kcadm step.

The backend client's SECRET is deliberately not set here (config-cli would need
it in plaintext). Keycloak generates one on creation; it must be copied into the
mzla/tb-dev/send bundle as OIDC_CLIENT_SECRET (platform-infrastructure#711).

Refs platform-infrastructure#712, #695

Author: Arron Atchison

overlays/tb-dev/keycloak/realm-config/apply-client-config.sh

@@ -16,7 +16,12 @@
 
 set -uo pipefail
 
-CONFIG_FILE='/config/tbpro-accounts-client.yaml'
+# Both tbpro client-config imports. config-cli's IMPORT_FILES_LOCATIONS takes a
+# comma-separated list, so adding a file here is all that is needed -- but note the
+# ConfigMap in kustomization.yaml must ship it too, or the path will not exist.
+#   tbpro-accounts-client.yaml : the thunderbird-accounts client
+#   tbpro-send-clients.yaml    : the Send SPA + backend pair (#712)
+CONFIG_FILES='/config/tbpro-accounts-client.yaml,/config/tbpro-send-clients.yaml'
 CONFIG_CLI_JAR='/opt/keycloak/keycloak-config-cli.jar'
 # Management interface (health/metrics) -- enabled via KC_HEALTH_ENABLED=true.
 HEALTH_PORT="${KC_HTTP_MANAGEMENT_PORT:-9000}"
@@ -55,7 +60,7 @@ export KEYCLOAK_REALM=master
 export KEYCLOAK_GRANTTYPE=client_credentials
 export KEYCLOAK_CLIENTID="${KEYCLOAK_ADMIN_CLIENT_ID:-tb-accounts-admin}"
 export KEYCLOAK_CLIENTSECRET="${KEYCLOAK_ADMIN_CLIENT_SECRET}"
-export IMPORT_FILES_LOCATIONS="${CONFIG_FILE}"
+export IMPORT_FILES_LOCATIONS="${CONFIG_FILES}"
 export IMPORT_VARSUBSTITUTION_ENABLED=false
 # Reconcile on every start (config-cli otherwise checksums the file and skips, so
 # drift from a reset would never be repaired). The import is idempotent.

overlays/tb-dev/keycloak/realm-config/tbpro-send-clients.yaml

@@ -0,0 +1,61 @@
+# keycloak-config-cli import: tb-dev env-specific config for the two tbpro OIDC
+# clients Thunderbird Send needs (platform-infrastructure#712, part of the Send
+# EKS migration #695).
+#
+# Reconciled by apply-client-config.sh on every Keycloak start, in no-delete mode
+# -- config-cli only ADDS/UPDATES these clients and never deletes other tbpro
+# clients/users/flows. Because it re-runs on every start, a Neon branch reset
+# (which reverts the realm to the stage clone and wipes these) self-repairs with
+# no manual kcadm step, exactly like tbpro-accounts-client.yaml.
+#
+# TWO clients, mirroring the thunderbird-appointment pair, because Send has two
+# distinct OIDC roles (verified in tbpro-add-on packages/send):
+#   - the SPA is a PUBLIC client using the auth-code flow via oidc-client-ts
+#     (frontend reads VITE_/APP_OIDC_CLIENT_ID);
+#   - the backend is a CONFIDENTIAL client that validates bearer tokens by
+#     RFC 7662 introspection (reads OIDC_CLIENT_ID + OIDC_CLIENT_SECRET).
+# A public client cannot introspect, so one shared client will not work.
+#
+# Pattern C: the SPA and the API share ONE origin
+# (https://send.tb-dev.thunderbird.dev), so the redirect/web-origin host is the
+# same for both. There is no separate send-backend host on EKS.
+realm: tbpro
+clients:
+  # --- public SPA client (browser auth-code + PKCE) ---
+  - clientId: thunderbird-send-frontend
+    name: Thunderbird Send (SPA, tb-dev)
+    enabled: true
+    publicClient: true
+    standardFlowEnabled: true
+    directAccessGrantsEnabled: false
+    serviceAccountsEnabled: false
+    rootUrl: "https://send.tb-dev.thunderbird.dev"
+    baseUrl: "/"
+    redirectUris:
+      # oidc-client-ts returns the browser to the SPA origin after login/logout.
+      - "https://send.tb-dev.thunderbird.dev/*"
+    webOrigins:
+      - "https://send.tb-dev.thunderbird.dev"
+    attributes:
+      # validate post-logout redirects against the registered redirect URIs
+      "post.logout.redirect.uris": "+"
+      # public client => PKCE is required, not optional
+      "pkce.code.challenge.method": "S256"
+
+  # --- confidential backend client (RFC 7662 token introspection) ---
+  # The secret is NOT set here: config-cli would need it in plaintext, and the
+  # backend reads it from the mzla/tb-dev/send Secrets Manager bundle via ESO as
+  # OIDC_CLIENT_SECRET. Keycloak generates a secret on creation; it must be copied
+  # into that bundle once (platform-infrastructure#711).
+  - clientId: thunderbird-send-backend
+    name: Thunderbird Send (backend introspection, tb-dev)
+    enabled: true
+    publicClient: false
+    standardFlowEnabled: true
+    directAccessGrantsEnabled: false
+    serviceAccountsEnabled: false
+    rootUrl: "https://send.tb-dev.thunderbird.dev"
+    redirectUris:
+      - "https://send.tb-dev.thunderbird.dev/*"
+    webOrigins:
+      - "https://send.tb-dev.thunderbird.dev"

overlays/tb-dev/kustomization.yaml

@@ -19,6 +19,7 @@ configMapGenerator:
 - name: keycloak-realm-config
   files:
   - keycloak/realm-config/tbpro-accounts-client.yaml
+  - keycloak/realm-config/tbpro-send-clients.yaml
 - name: keycloak-realm-config-scripts
   files:
   - keycloak/realm-config/apply-client-config.sh