From 9ddc4f05858206465f74388e1a153837b5cdb916 Mon Sep 17 00:00:00 2001
From: Subroto <subroto@ebdesk.com>
Date: Sun, 11 Oct 2026 20:10:01 +0700
Subject: [PATCH] fix aiflow-keycloak problem

---
 deploy/bootstrap.sh               |  4 +++-
 deploy/scripts/test-generate.sh   | 26 +++++++++++++++++++++-----
 deploy/scripts/verify-keycloak.sh |  6 +++++-
 3 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/deploy/bootstrap.sh b/deploy/bootstrap.sh
index 4755c93..2088ddf 100755
--- a/deploy/bootstrap.sh
+++ b/deploy/bootstrap.sh
@@ -237,7 +237,9 @@ bootstrap_keycloak() {
     ["trino"]="https TRINO_HOST TRINO_HTTPS_PORT 12443"
     ["grafana"]="http GRAFANA_HOST GRAFANA_PORT 12300"
     ["openmetadata"]="http OPENMETADATA_HOST OPENMETADATA_PORT 12085"
-    ["airflow"]="http AIRFLOW_HOST AIRFLOW_PORT 12082"
+    # AIRFLOW_WEBSERVER_HOST (BUKAN AIRFLOW_HOST — itu penanda external, tak diisi
+    # generator → _comp_addr jatuh ke SICABE_HOST_ADDRESS/localhost).
+    ["airflow"]="http AIRFLOW_WEBSERVER_HOST AIRFLOW_PORT 12082"
     ["starrocks"]="http STARROCKS_FE_HOST STARROCKS_HTTP_PORT 12030"
   )
   _comp_addr() { # <host_var> → alamat efektif (IP/alamat, atau host ini bila co-located)
diff --git a/deploy/scripts/test-generate.sh b/deploy/scripts/test-generate.sh
index 11c98a9..8ab331e 100755
--- a/deploy/scripts/test-generate.sh
+++ b/deploy/scripts/test-generate.sh
@@ -216,11 +216,11 @@ fi
 
 # ─── 0j. Verifikasi Keycloak lengkap (verify-keycloak.sh) ────────────────────
 vk="${DEPLOY_DIR}/scripts/verify-keycloak.sh"
-if [[ -x "${vk}" ]] && bash -n "${vk}" 2>/dev/null \
-   && grep -q 'client_credentials' "${vk}" && grep -q 'redirectUris' "${vk}" \
-   && grep -q 'publicClient' "${vk}" && grep -q 'origin host' "${vk}" \
-   && grep -q 'kc_auth_probe' "${vk}" && grep -q 'password masih DEFAULT' "${vk}"; then
-  ok "verify-keycloak.sh: realm/roles/client(redirectUri origin-host,secret,publicClient)/user/password-default + fungsional"
+  if [[ -x "${vk}" ]] && bash -n "${vk}" 2>/dev/null \
+     && grep -q 'client_credentials' "${vk}" && grep -q 'redirectUris' "${vk}" \
+     && grep -q 'publicClient' "${vk}" && grep -q 'origin host' "${vk}" \
+     && grep -q 'kc_auth_probe' "${vk}" && grep -q 'password masih DEFAULT' "${vk}"; then
+    ok "verify-keycloak.sh: realm/roles/client(redirectUri origin-host,secret,publicClient)/user/password-default + fungsional"
 else
   bad "verify-keycloak.sh hilang/tidak lengkap"
 fi
@@ -357,6 +357,22 @@ else
   bad "eksternal URL penuh belum didukung (wire=${_uo} parse=${_uo_parse} gen=${_uo_gen})"
 fi
 
+# ─── 0p. Origin client 'airflow' pakai AIRFLOW_WEBSERVER_HOST ─────────────────
+# Regresi: memakai `AIRFLOW_HOST` (penanda komponen external, SENGAJA tak diisi
+# generator) → _comp_addr/comp_addr jatuh ke SICABE_HOST_ADDRESS (alamat host LOKAL),
+# sehingga di host non-pemilik (compute/state) origin jadi alamat host ITU, bukan
+# alamat control pemilik airflow → verify-keycloak FAIL "belum terdaftar di client".
+_ap=1
+grep -q '\[airflow\]="http AIRFLOW_WEBSERVER_HOST' "${DEPLOY_DIR}/scripts/verify-keycloak.sh" || _ap=0
+grep -q '\["airflow"\]="http AIRFLOW_WEBSERVER_HOST' "${DEPLOY_DIR}/bootstrap.sh" || _ap=0
+grep -q '\[airflow\]="http AIRFLOW_HOST ' "${DEPLOY_DIR}/scripts/verify-keycloak.sh" && _ap=0
+grep -q '\["airflow"\]="http AIRFLOW_HOST ' "${DEPLOY_DIR}/bootstrap.sh" && _ap=0
+if [[ "${_ap}" == "1" ]]; then
+  ok "client origin airflow: pakai AIRFLOW_WEBSERVER_HOST (verify-keycloak + bootstrap)"
+else
+  bad "client origin airflow masih pakai AIRFLOW_HOST (origin salah di host non-pemilik)"
+fi
+
 # ─── 1. generate ────────────────────────────────────────────────────────────
 if ! python3 "${DEPLOY_DIR}/lib/cluster/generate.py" render \
       "${INVENTORY}" "${DEPLOY_DIR}/docker-compose.yml" "${DEPLOY_DIR}/.env" \
diff --git a/deploy/scripts/verify-keycloak.sh b/deploy/scripts/verify-keycloak.sh
index 7c535f3..2e894a4 100755
--- a/deploy/scripts/verify-keycloak.sh
+++ b/deploy/scripts/verify-keycloak.sh
@@ -65,11 +65,15 @@ declare -A CLIENT_PUBLIC=(
 # redirectUris. Deteksi kesalahan umum: redirectUris hanya `https://localhost:12443/*`
 # padahal user membuka `https://<ip-host>:12443` → Keycloak menolak "invalid redirect_uri".
 #   <client> = "<scheme> <host_var> <port_var> <default_port>"
+# CATATAN: pakai var TOPOLOGI yang DIISI generator. `AIRFLOW_HOST` SENGAJA TIDAK
+# diisi (penanda komponen external, lihat generate.py) → memakainya membuat
+# comp_addr jatuh ke SICABE_HOST_ADDRESS (alamat host LOKAL), sehingga origin salah
+# di host non-pemilik (mis. compute mengharap airflow di alamat compute, bukan control).
 declare -A CLIENT_ORIGIN=(
   [trino]="https TRINO_HOST TRINO_HTTPS_PORT 12443"
   [grafana]="http GRAFANA_HOST GRAFANA_PORT 12300"
   [openmetadata]="http OPENMETADATA_HOST OPENMETADATA_PORT 12085"
-  [airflow]="http AIRFLOW_HOST AIRFLOW_PORT 12082"
+  [airflow]="http AIRFLOW_WEBSERVER_HOST AIRFLOW_PORT 12082"
   [starrocks]="http STARROCKS_FE_HOST STARROCKS_HTTP_PORT 12030"
 )
 # Alamat efektif: nilai var bila berupa ALAMAT (mengandung titik); kalau kosong/co-located