feat: add Keycloak auth adapter for Google SSO

[ChakshuGautam]

Summary

• Adds a pluggable auth adapter layer that supports both DIGIT's OTP-based auth and Keycloak SSO (Google, GitHub)
• Activated by setting AUTH_PROVIDER=keycloak in globalConfigs.js — when not set, the existing DIGIT auth flow is used unchanged
• Includes a unified login page with email/password + SSO provider buttons

Architecture

┌─────────────────────────────────┐
│  globalConfigs.js               │
│  AUTH_PROVIDER = "keycloak"     │
└──────────┬──────────────────────┘
           │
           ▼
┌──────────────────┐    ┌─────────────────────┐
│  AuthAdapter     │◄───│  DigitAuthAdapter    │  (default: OTP flow)
│  (interface)     │◄───│  KeycloakAuthAdapter │  (SSO: Google, GitHub)
└──────────────────┘    └─────────────────────┘
           │
           ▼
┌──────────────────────────────────────┐
│  Request.js (token proxy)            │
│  UserService (auth delegation)       │
│  PrivateRoute (route guards)         │
│  App.js (conditional login routing)  │
└──────────────────────────────────────┘

Files Changed

File	What
auth/AuthAdapter.js	Interface: login, signup, logout, SSO, isAuthenticated, getUser
auth/DigitAuthAdapter.js	Wraps existing DIGIT auth (no behavior change)
auth/KeycloakAuthAdapter.js	keycloak-js integration (CDN loaded), token exchange, user mapping
auth/index.js	Factory: selects adapter based on AUTH_PROVIDER config
Request.js	Routes API calls through token-exchange-svc when Keycloak token exists
User/index.js	Delegates auth checks to active adapter
PrivateRoute.js	Uses adapter.isAuthenticated() for route guards
core/App.js	Conditional routing: UnifiedLogin (keycloak) vs LoginV2/SignUpV2 (DIGIT)
Login/index.js	Unified login page with email + SSO buttons
public/index.html	Adds keycloak-js CDN script
src/App.js	Sets window.globalPath for route matching
src/index.js	Initializes auth adapter before React render
webpack.config.js	Resolve aliases for local core module + React singleton
docker/Dockerfile	Allows lockfile updates for new deps

Key Design Decisions

1. CDN for keycloak-js — Loaded via <script> tag rather than npm import to avoid bundling issues with the monorepo's complex dependency tree
2. Token-only proxy — Pre-login API calls (MDMS init, localization) go direct to Kong; only authenticated calls route through token-exchange-svc
3. No Fragment inside Switch — React Router v5's <Switch> only matches direct <Route> children; using <>...</> breaks route matching
4. Hardcoded login labels — The login page renders before DIGIT's i18n system loads, so labels are hardcoded in English

Configuration Required

In globalConfigs.js:

var defined_auth_provider = "keycloak";
var defined_keycloak_url = "https://your-domain/auth";
var defined_keycloak_realm = "digit-sandbox";
var defined_keycloak_client_id = "digit-sandbox-ui";
var defined_token_exchange_url = "https://your-domain/token-exchange";

Test plan

• Without AUTH_PROVIDER set: verify existing DIGIT OTP login works unchanged
• With AUTH_PROVIDER=keycloak: verify Google SSO login redirects correctly
• After SSO login: verify citizen pages load (complaints, city selection)
• Verify API calls work (create complaint, search complaints) after SSO auth
• Verify logout clears session and redirects to login

🤖 Generated with Claude Code