feat: additional roles per app

config/services.yaml

@@ -7,14 +7,20 @@ parameters:
     keycloak.redirect_uri: '%env(KEYCLOAK_REDIRECT_URI)%'
     keycloak.post_logout_redirect: '%env(KEYCLOAK_POST_LOGOUT_REDIRECT)%'
 
-    # Allowlist of Appsmith apps this BFF will redirect back to, each with
-    # the Keycloak client role (on the bff client) required to enter it.
+    # Allowlist of Appsmith apps this BFF will redirect back to. An app's
+    # permissions are the Keycloak roles on the bff client sharing its
+    # `role_prefix`; the prefix is stripped when they're reported to the app,
+    # so `app-sandbox-write` becomes "write". Adding a permission means
+    # creating the role in Keycloak — nothing to change here. `access_role`
+    # is the single role required to enter the app at all.
+    # Keep prefixes non-overlapping across apps, or roles bleed between them.
     # Add one entry per app you build. Never accept a return URL from the
     # request itself — always resolve through this map.
     appsmith.apps:
         app-sandbox:
             url: '%env(APP_SANDBOX_LOGIN_URL)%'
-            role: 'app-sandbox-access'
+            role_prefix: 'app-sandbox-'
+            access_role: 'app-sandbox-access'
 
     # Named backends the proxy can forward to. A request picks one via the
     # X-Backend header; omitting it uses "default". Add BACKEND_<KEY>_URL to