Use Keycloak client roles in realm import

Co-authored-by: achinaben <achinaben@users.noreply.github.com>

Author: cursoragent

scm-platform/deploy/keycloak/scm-realm.json

@@ -9,8 +9,7 @@
       "directAccessGrantsEnabled": true,
       "redirectUris": ["http://localhost:8080/*"],
       "webOrigins": ["*"],
-      "defaultClientScopes": ["profile", "email", "roles"],
-      "optionalClientScopes": ["oms.write", "wms.write"]
+      "defaultClientScopes": ["profile", "email", "roles"]
     }
   ],
   "users": [

scm-platform/scm-contract-check/src/test/java/com/scm/contract/EdgeKafkaStackConfigTest.java

@@ -15,6 +15,7 @@ void edgeKafkaStackHasScriptsAndCiEntry() throws Exception {
         Path root = resolvePlatformRoot();
         String edgeKafkaCompose = read(root, "docker-compose.edge-kafka.yml");
         String edgeCompose = read(root, "docker-compose.edge.yml");
+        String keycloakRealm = read(root, "deploy/keycloak/scm-realm.json");
         String startScript = read(root, "scripts/start-edge-kafka.sh");
         String stopScript = read(root, "scripts/stop-edge-kafka.sh");
         String runScript = read(root, "scripts/run-e2e-edge-kafka.sh");
@@ -45,6 +46,7 @@ void edgeKafkaStackHasScriptsAndCiEntry() throws Exception {
         assertKafkaOverlayDoesNotUseEmptyProfiles(kafkaOverlay);
         assertKafkaHasInternalAndExternalListeners(compose);
         assertEdgeStackAcceptsHostIssuedKeycloakTokens(edgeCompose);
+        assertKeycloakRealmUsesClientRoles(keycloakRealm);
         assertServiceImagesUseCiFriendlyJvmDefaults(serviceDockerfile);
         assertServiceModulesBuildExecutableJars(parentPom);
         assertJdbcStorageIsAutoConfigured(commonSpringImports, jdbcStorageConfiguration,
@@ -88,6 +90,12 @@ private static void assertEdgeStackAcceptsHostIssuedKeycloakTokens(String edgeCo
         assertTrue(edgeCompose.contains("SCM_JWT_JWKS_URI: http://keycloak:8080/realms/scm/protocol/openid-connect/certs"));
     }
 
+    private static void assertKeycloakRealmUsesClientRoles(String keycloakRealm) {
+        assertTrue(keycloakRealm.contains("\"defaultClientScopes\": [\"profile\", \"email\", \"roles\"]"));
+        assertTrue(keycloakRealm.contains("\"scm-gateway\": [\"oms.write\", \"wms.write\"]"));
+        assertFalse(keycloakRealm.contains("\"optionalClientScopes\": [\"oms.write\", \"wms.write\"]"));
+    }
+
     private static void assertServiceImagesUseCiFriendlyJvmDefaults(String serviceDockerfile) {
         assertTrue(serviceDockerfile.contains("ENV JAVA_OPTS=\"-Xmx256m -Xms128m -XX:MaxMetaspaceSize=128m\""));
         assertFalse(serviceDockerfile.contains("-Xmx384m"));