From 0214f2eb08b3acdeac58bee14c6870c9cfc18f21 Mon Sep 17 00:00:00 2001
From: DanliaQwerty20 <danlia2000789@gmail.com>
Date: Fri, 25 Sep 2026 22:52:07 +0300
Subject: [PATCH] fix: allow Telegram offline access

---
 compose/keycloak/portable-agent-realm.json | 1 +
 scripts/check-compose.ps1                  | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/compose/keycloak/portable-agent-realm.json b/compose/keycloak/portable-agent-realm.json
index 8960089..9554351 100644
--- a/compose/keycloak/portable-agent-realm.json
+++ b/compose/keycloak/portable-agent-realm.json
@@ -315,6 +315,7 @@
       "attributes": {
         "tenant_id": ["${ACTION_SERVICE_TENANT_ID}"]
       },
+      "realmRoles": ["offline_access"],
       "requiredActions": [],
       "credentials": [
         {
diff --git a/scripts/check-compose.ps1 b/scripts/check-compose.ps1
index 963fe0a..894bfec 100644
--- a/scripts/check-compose.ps1
+++ b/scripts/check-compose.ps1
@@ -89,6 +89,9 @@ $localUser = $realm.users | Where-Object username -eq "local-user"
 if (-not $localUser.email -or -not $localUser.emailVerified) {
     throw "Профиль local-user не готов для входа."
 }
+if (@($localUser.realmRoles) -notcontains "offline_access") {
+    throw "Профиль local-user не может получить offline refresh token для Device Flow."
+}
 $composeText = Get-Content -Raw -LiteralPath "compose/compose.yaml"
 if ($composeText -notmatch '(?ms)^  keycloak:.*?^    healthcheck:') {
     throw "У Keycloak нет readiness healthcheck."