[Issue 55] user identity and access management system implementation

[zephris]

Change Summary

Adds Keycloak-based IAM integration, introduces self-service auth APIs for normal users, and improves deployment/configuration consistency across dev and prod.

• Keycloak + Django admin OIDC integration is wired and configurable.
• First-admin bootstrap/sync flows are automated via scripts.
• New backend endpoints support user self-service signup/login.
• Model and migration updates tighten chapter/user/membership behavior.
• README and env examples were updated for setup and operational clarity.

Change Form

Fill this up (NA if not available). If a certain criteria is not met, can you please give a reason.

• The pull request title has an issue number
• The change works by "Smoke testing" or quick testing
• The change has tests
• The change has documentation

Other Information

Closes #55

[oMakaron]

lgtm... nah gotta read ts

[Copilot]

Pull request overview

Implements a Keycloak-backed IAM path for Django admin (OIDC) alongside new frontend-facing signup/login endpoints, and updates the data model + deployment tooling to support the new auth flows.

Changes:

• Adds Keycloak OIDC integration wiring (settings, URLs, auth backend, env/config, docker-compose) for admin authentication.
• Introduces self-service auth endpoints (/api/auth/signup/, /api/auth/login/) plus serializers and tests for “normal users”.
• Renames core models (Users→User, Chapters→Chapter), adds membership constraints, and provides migrations/scripts/docs to keep dev/prod consistent.

Reviewed changes

Copilot reviewed 25 out of 26 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
server/pyproject.toml	Adds mozilla-django-oidc dependency for OIDC integration.
server/poetry.lock	Updates lockfile to include OIDC deps and bumps some packages.
server/api/urls.py	Adds admin OIDC login route and conditionally mounts OIDC endpoints.
server/api/settings.py	Adds AUTH_SOURCE-gated OIDC + Keycloak settings and backend selection.
server/agronomy_club/views.py	Adds signup/login APIViews; tightens queryset typing patterns.
server/agronomy_club/urls.py	Exposes /auth/signup/ and /auth/login/ under the API namespace.
server/agronomy_club/tests.py	Updates model references; adds auth endpoint tests and membership validation tests.
server/agronomy_club/serializers.py	Adds serializers for normal-user auth flows and user payload shaping.
server/agronomy_club/models.py	Renames models, adds password hashing field/methods, and adds membership constraints + validation.
server/agronomy_club/migrations/0009_user_password_and_membership_constraints.py	Adds password_hash, updates membership position default, and enforces unique membership constraint.
server/agronomy_club/migrations/0010_rename_chapters_chapter_rename_users_user_and_more.py	Renames models and sets explicit DB table names.
server/agronomy_club/auth_views.py	Adds an admin login redirector into the OIDC auth-init flow.
server/agronomy_club/auth_backends.py	Adds a Keycloak-aware OIDC backend that maps realm roles to Django admin flags.
server/agronomy_club/admin.py	Updates admin registrations to renamed models.
server/.env.example	Adds Keycloak/OIDC configuration variables for local development.
scripts/sync-keycloak-first-admin-password.sh	Automates first-admin password sync/rotation in Keycloak and .env.
scripts/ensure-keycloak-test-admin.sh	Ensures a Keycloak test admin user exists and has platform_admin.
scripts/deploy-with-keycloak.sh	One-command helper to bootstrap env, import realm skeleton, and run compose.
scripts/bootstrap-keycloak-env.sh	Bootstraps Keycloak + Django env vars and unifies first-admin identity variables.
README.md	Documents new auth endpoints and Keycloak deployment workflow.
keycloak/import/agronomy-club-realm-skeleton.json	Adds an importable realm skeleton (including clients/roles/groups).
keycloak/agronomy-club-realm-skeleton.json	Adds a realm skeleton source file (non-import path).
docker-compose.yml	Adds a Keycloak service for dev deployments.
docker-compose.prod.yml	Adds Keycloak service for prod deployments and wires server dependency.
client/.env.example	Adds Keycloak env vars for frontend configuration.
.env.prod.example	Adds Keycloak env vars for production configuration example.

Comments suppressed due to low confidence (1)

server/agronomy_club/admin.py:43

• This introduces storage of user password hashes (password_hash) in the app-level User model; by default Django admin will display and allow editing this field on the User change form. Even though it's hashed, exposing it in the admin UI increases the risk of accidental disclosure/copying and makes it easy to corrupt accounts by editing it directly. Exclude the field from the ModelAdmin (or mark it read-only) and provide a dedicated password reset flow if needed.

@admin.register(User)
class UsersAdmin(admin.ModelAdmin):
    list_display = ('id', 'full_name', 'grad_yr', 'discipline', 'email', 'global_role')
    search_fields = ('id', 'full_name', 'discipline',)
    list_filter = ('grad_yr', 'global_role')

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Games4Doritos]

Just some surface-level critiques I can give, unfortunately getting the rest of the MVP done first is our priority