fix(tb-dev): patch tbpro login.ftl (?no_esc) + restore clustered keycloak (#8)

Two related dev-keycloak fixes:

1. Theme loginAction escaping (the real cookie_not_found / invalid_code cause).
   Keycloak 26.5.7 (this image, pulled via the moving quay :26.5 tag) HTML-escapes
   Freemarker output, so the tbpro theme's `formAction: '${url.loginAction}'` inside
   window._page renders with '&'. The Vue login app POSTs to that URL verbatim,
   so Keycloak receives 'amp;execution' (the 'execution' param is lost) and returns
   400 -> the browser reports cookie_not_found / invalid_code on the cross-app OIDC
   login. The stage ECS keycloak runs an older 26.5.x that did not escape, so it is
   unaffected (until its next rebuild on the moving tag).

   Mount a patched login.ftl (extracted from this exact image, with ?no_esc added to
   the four window._page URL fields that carry query strings: loginAction,
   registrationUrl, loginResetCredentialsUrl, p.loginUrl) over the baked theme via a
   subPath volume. Stable-named configMapGenerator so the volume ref resolves.

   The durable fix lives in thunderbird-accounts (theme ?no_esc + pin the keycloak
   base image tag); this override unblocks dev validation until that image ships.

2. Restore clustered keycloak (drop the replicas: 1 override -> base replicas: 2,
   Infinispan DNS_PING). The single-replica workaround was a misdiagnosis of the
   above; Infinispan shares auth sessions across pods, so clustered login works once
   the theme is fixed.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: aatchison

overlays/tb-dev/keycloak/statefulset.yaml

@@ -13,12 +13,11 @@ metadata:
   name: keycloak-customer
   namespace: keycloak-customer
 spec:
-  # Single replica for the dev validation (matches the working ECS keycloak,
-  # desired_count=1). With 2 replicas and no sticky sessions, the auth session
-  # created on one pod (GET /auth) isn't found when the login POST lands on the
-  # other pod -> cookie_not_found / invalid_code on the cross-app OIDC login.
-  # HA (2 replicas + sticky sessions / cookie affinity) is a follow-up for prod.
-  replicas: 1
+  # Clustered (base replicas: 2, Infinispan DNS_PING). The single-replica
+  # workaround tried earlier was a misdiagnosis: the cookie_not_found / invalid_code
+  # was NOT cross-pod session loss but the tbpro theme escaping the loginAction
+  # ('&' -> dropped 'execution' param -> 400), fixed by the login.ftl override
+  # below. Infinispan shares auth sessions across pods, so clustered login works.
   template:
     spec:
       containers:
@@ -55,3 +54,20 @@ spec:
               value: "5432"
             - name: KC_DB_URL_PROPERTIES
               value: "?sslmode=require"
+          # Override the baked tbpro login.ftl with a copy that adds ?no_esc to
+          # the URL fields embedded in window._page (loginAction et al). Keycloak
+          # 26.5.7 (this image, pulled via the moving quay :26.5 tag) HTML-escapes
+          # Freemarker output, so '${url.loginAction}' renders with '&'; the Vue
+          # login app then POSTs to a URL with literal '&' -> Keycloak drops the
+          # 'execution' param -> 400 / cookie_not_found. The stage ECS image is an
+          # older 26.5.x that did not escape, so it is unaffected (for now).
+          # Real fix is in thunderbird-accounts (theme ?no_esc + pin the keycloak
+          # base tag); this subPath override unblocks dev until that image ships.
+          volumeMounts:
+            - name: tbpro-login-override
+              mountPath: /opt/keycloak/themes/tbpro/login/login.ftl
+              subPath: login.ftl
+      volumes:
+        - name: tbpro-login-override
+          configMap:
+            name: keycloak-tbpro-login-override

overlays/tb-dev/keycloak/tbpro-login.ftl

@@ -0,0 +1,60 @@
+<#import "template.ftl" as layout>
+<#import "passkeys.ftl" as passkeys>
+<@layout.registrationLayout displayMessage=!messagesPerField.existsError('username','password') displayInfo=realm.password && realm.registrationAllowed && !registrationDisabled??; section>
+    <#if section = "js">
+    <script>
+      window._page['currentView'] = {
+        formAction: '${url.loginAction?no_esc}',
+        supportUrl: '${properties.tbproContactUrl}',
+        clientUrl: '${client.baseUrl}',
+        // <#if realm.password && realm.registrationAllowed && !registrationDisabled??>
+        registerUrl: '${url.registrationUrl?no_esc}',
+        // <#else>
+        registerUrl: '${properties.tbproSignupUrl}',
+        // </#if>
+        // <#if realm.resetPasswordAllowed>
+        forgotPasswordUrl: '${url.loginResetCredentialsUrl?no_esc}',
+        // <#else>
+        forgotPasswordUrl: null,
+        // </#if>
+        rememberMe: '${(login.rememberMe)!"off"}' === 'on',
+        loginHint: '${login.username!''}',
+        socialProviders: [
+            //<#if realm.password && social?? && social.providers?has_content>
+            //<#list social.providers as p>
+          {
+            name: '${p.displayName!}',
+            alias: '${p.alias}',
+            loginUrl: '${p.loginUrl?no_esc}',
+            iconName: '${properties.kcCommonLogoIdP!}',
+            className: '${properties.kcFormSocialAccountNameClass!}',
+          },
+            //</#list>
+            //</#if>
+        ],
+        firstError: '${kcSanitize(messagesPerField.getFirstError("username","password"))?no_esc}',
+      };
+      window._l10n = {
+        ...window._l10n,
+        loginAccountTitle: '${msg("loginAccountTitle")}',
+        username: '${msg("username")}',
+        usernameOrEmail: '${msg("usernameOrEmail")}',
+        email: '${msg("email")}',
+        password: '${msg("password")}',
+        showPassword: '${msg("showPassword")}',
+        hidePassword: '${msg("hidePassword")}',
+        rememberMe: '${msg("rememberMe")}',
+        noAccount: '${msg("noAccount")}',
+        doLogIn: '${msg("doLogIn")}',
+        doRegister: '${msg("doRegister")}',
+        doForgotPassword: '${msg("doForgotPassword")}',
+        identityProviderLoginLabel: '${msg("identity-provider-login-label")}',
+        goToRegister: '${msg("goToRegister")}',
+        goToRegisterAction: '${msg("goToRegisterAction")}',
+        needHelp: '${msg("needHelp")}',
+        needHelpAction: '${msg("needHelpAction")}',
+      };
+    </script>
+    </#if>
+
+</@layout.registrationLayout>

overlays/tb-dev/kustomization.yaml

@@ -9,6 +9,17 @@ resources:
   - keycloak/tailscale-ingress.yaml
   - keycloak/securitygrouppolicy.yaml
 
+# Patched tbpro login.ftl (?no_esc on the window._page URL fields) mounted over
+# the baked theme via subPath in the StatefulSet patch. Stable name (no hash
+# suffix) so the volume reference in the patch resolves. Drop once the
+# thunderbird-accounts image carries the fix.
+configMapGenerator:
+  - name: keycloak-tbpro-login-override
+    files:
+      - login.ftl=keycloak/tbpro-login.ftl
+generatorOptions:
+  disableNameSuffixHash: true
+
 images:
   - name: REPLACE_MZLA_ECR/keycloak-customer
     newName: 718959508124.dkr.ecr.eu-central-1.amazonaws.com/keycloak-customer