Bug: Keycloak self-registration bypasses app registration pipeline #151

New issue

Open

opened 2026-03-28 21:26:02 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-03-28 21:26:02 +00:00

Owner

Type

Bug

Lineage

Discovered during spike #150 — parent login flow validation.

Repo

forgejo_admin/westside-landing (fix is Keycloak realm config, not app code)

What Broke

The westside-basketball Keycloak realm has registrationAllowed: true. The Keycloak login form shows a "New user? Register" link that creates a Keycloak account with NO corresponding Parent or Player records in basketball-api. User logs in successfully but sees empty dashboard.

Repro Steps

Navigate to /signin and click "Sign In"
On Keycloak login form, click "Register"
Fill in email, password, first name, last name and submit
User is created in Keycloak and logged in
Dashboard shows "No players found" — orphaned account

Expected Behavior

Self-registration via Keycloak should be disabled. All registration goes through the app's /register flow which creates Keycloak user + Parent + Player records together.

Environment

Cluster/namespace: prod
Service: Keycloak realm westside-basketball

Acceptance Criteria

Keycloak registrationAllowed set to false on westside-basketball realm
"Register" link no longer appears on Keycloak login form
App's /register flow still works
No orphaned Keycloak accounts created going forward

project-westside-basketball
forgejo_admin/westside-landing #150 — parent spike

### Type Bug ### Lineage Discovered during spike #150 — parent login flow validation. ### Repo `forgejo_admin/westside-landing` (fix is Keycloak realm config, not app code) ### What Broke The `westside-basketball` Keycloak realm has `registrationAllowed: true`. The Keycloak login form shows a "New user? Register" link that creates a Keycloak account with NO corresponding Parent or Player records in basketball-api. User logs in successfully but sees empty dashboard. ### Repro Steps 1. Navigate to `/signin` and click "Sign In" 2. On Keycloak login form, click "Register" 3. Fill in email, password, first name, last name and submit 4. User is created in Keycloak and logged in 5. Dashboard shows "No players found" — orphaned account ### Expected Behavior Self-registration via Keycloak should be disabled. All registration goes through the app's `/register` flow which creates Keycloak user + Parent + Player records together. ### Environment - Cluster/namespace: prod - Service: Keycloak realm `westside-basketball` ### Acceptance Criteria - [ ] Keycloak `registrationAllowed` set to `false` on westside-basketball realm - [ ] "Register" link no longer appears on Keycloak login form - [ ] App's `/register` flow still works - [ ] No orphaned Keycloak accounts created going forward ### Related - `project-westside-basketball` - `forgejo_admin/westside-landing #150` — parent spike