addressing coderabbitai PR review comments

Signed-off-by: Omer Boehm <omerboehm@gmail.com>

Author: omerboehm

authbridge/demos/github-issue/aiac/Makefile

@@ -64,7 +64,7 @@ preflight:  ## Verify prerequisites (uv, venv, aiac.env, llm_conf.yaml, Keycloak
 	  echo "       Copy aiac_agent/config/llm_conf.yaml.TEMPLATE and configure your LLM."; \
 	  exit 1; \
 	}
-	@$(PYTHON) -c 'import dotenv, yaml, keycloak, langgraph' 2>/dev/null || { \
+	@$(PYTHON) -c 'import dotenv, yaml, keycloak, langgraph, langchain_core, langchain_openai, pydantic' 2>/dev/null || { \
 	  echo "ERROR: Python dependencies missing."; \
 	  echo "       Run: uv pip install --python $(VENV)/bin/python -r ../../../requirements.txt"; \
 	  exit 1; \

authbridge/demos/github-issue/aiac/scripts/show-result.py

@@ -86,9 +86,9 @@ def main() -> None:
                 print(f"    {GREEN}✓{RESET}  {container}.{name}")
 
     gen_dir = AIAC_DIR / "generated_configs"
-    policy_files = sorted(gen_dir.glob("*_policy.yaml")) if gen_dir.exists() else []
+    policy_files = list(gen_dir.glob("*_policy.yaml")) if gen_dir.exists() else []
     if policy_files:
-        latest = policy_files[-1]
+        latest = max(policy_files, key=lambda p: p.stat().st_mtime_ns)
         section(f"Last generated policy: {latest.name}")
         print(latest.read_text())
     else:

authbridge/demos/github-issue/demo-aiac.md

@@ -19,7 +19,7 @@ AI-driven policy management capabilities.
 
 ## Architecture Overview
 
-```
+```txt
 Natural Language Policy Description
          │
          ▼
@@ -89,7 +89,7 @@ This lets you demonstrate finer-grained authorization: a user with full access c
 **Build and Load Container Images (if not already done)**
 
 The agent and tool container images must be built locally and loaded into the kind cluster (they are not published to a public registry):
-```
+```bash
 cd <path-to>/agent-examples
 
 # Build the GitHub tool image
@@ -216,12 +216,12 @@ kubectl get pod -n team1 -l app.kubernetes.io/name=git-issue-agent \
 ```
 
 Expected (proxy-sidecar mode, the cluster default):
-```
+```txt
 agent authbridge-proxy
 ```
 
 Or, in envoy-sidecar mode:
-```
+```txt
 agent envoy-proxy
 ```
 
@@ -234,7 +234,7 @@ kubectl get pods -n team1
 ```
 
 Expected output:
-```
+```txt
 NAME                               READY   STATUS    RESTARTS   AGE
 git-issue-agent-xxxxxxxxxx-xxxxx   2/2     Running   0          2m
 github-tool-yyyyyyyyyyy-yyyyy       1/1     Running   0          3m
@@ -270,7 +270,7 @@ kubectl logs deployment/git-issue-agent -n team1 -c agent
 ```
 
 Expected:
-```
+```txt
 INFO:     Started server process [17]
 INFO:     Waiting for application startup.
 INFO:     Application startup complete.
@@ -324,7 +324,7 @@ curl -s http://git-issue-agent:8080/.well-known/agent.json | jq .
 ```
 
 Expected :
-```
+```txt
 Agent card information (publicly accessible)
 ```
 
@@ -339,7 +339,7 @@ curl -s -X POST http://git-issue-agent:8080/ \
 ```
 
 Expected:
-```
+```txt
 {
   "error": "auth.unauthorized",
   "message": "missing Authorization header",
@@ -442,9 +442,6 @@ ALICE_TOKEN=$(curl -s -X POST \
    --data-urlencode "client_id=$CLIENT_ID" \
    --data-urlencode "client_secret=$CLIENT_SECRET" | jq -r ".access_token")
 
-echo $ALICE_TOKEN
-echo $ALICE_TOKEN | cut -d. -f2- | base64 -d | jq .
-
 
 curl -s --max-time 300 \
   -H "Authorization: Bearer $ALICE_TOKEN" \
@@ -485,9 +482,6 @@ BOB_TOKEN=$(curl -s -X POST \
 echo "Bob token length: ${#BOB_TOKEN}"
 echo "Bob scopes: $(echo $BOB_TOKEN | cut -d. -f2 | base64 -d 2>/dev/null | jq -r '.scope')"
 
-echo $BOB_TOKEN
-echo $BOB_TOKEN | cut -d. -f2- | base64 -d | jq .
-
 curl -s --max-time 300 \
   -H "Authorization: Bearer $BOB_TOKEN" \
   -H "Content-Type: application/json" \
@@ -660,9 +654,6 @@ ALICE_TOKEN=$(curl -s -X POST \
    --data-urlencode "client_id=$CLIENT_ID" \
    --data-urlencode "client_secret=$CLIENT_SECRET" | jq -r ".access_token")
 
-echo $ALICE_TOKEN
-echo $ALICE_TOKEN | cut -d. -f2- | base64 -d | jq .
-
 
 curl -s --max-time 300 \
   -H "Authorization: Bearer $ALICE_TOKEN" \
@@ -713,8 +704,6 @@ BOB_TOKEN=$(curl -s -X POST \
 echo "Bob token length: ${#BOB_TOKEN}"
 echo "Bob scopes: $(echo $BOB_TOKEN | cut -d. -f2- | base64 -d 2>/dev/null | jq -r '.scope')"
 
-echo $BOB_TOKEN
-echo $BOB_TOKEN | cut -d. -f2- | base64 -d | jq .
 
 curl -s --max-time 300 \
   -H "Authorization: Bearer $BOB_TOKEN" \
@@ -763,10 +752,6 @@ CHARLIE_TOKEN=$(curl -s -X POST \
    --data-urlencode "client_id=$CLIENT_ID" \
    --data-urlencode "client_secret=$CLIENT_SECRET" | jq -r ".access_token")
 
-echo $CHARLIE_TOKEN
-echo $CHARLIE_TOKEN | cut -d. -f2- | base64 -d | jq .
-
-
 
 curl -s --max-time 300 \
   -H "Authorization: Bearer $CHARLIE_TOKEN" \
@@ -828,7 +813,7 @@ echo -e "\n5. Sales is now just like Tech-support (\"Other personnel\"):"
 yq '.policy.sales[] | select(.client == "github-tool" and .role == "github-tool-aud")' generated_configs/permissive_policy_policy.yaml
 ```
 Expected output :
-```bash
+```txt
 1. Developer has github-full-access:
 client: github-tool
 role: github-full-access

authbridge/demos/github-issue/setup_keycloak.py

@@ -601,7 +601,7 @@ def load_keycloak_config() -> Tuple[str, str]:
 
     if not all([keycloak_url, realm, admin_username, admin_password]):
         raise ValueError(
-            "Missing required environment variables. Please ensure .env file contains "
+            "Missing required environment variables. Please ensure aiac.env file contains "
             "KEYCLOAK_URL, KEYCLOAK_ADMIN_USERNAME, KEYCLOAK_ADMIN_PASSWORD, and REALM_NAME"
         )
 
@@ -1352,7 +1352,7 @@ def main_rbac(config_file: str, reset_only: bool = False):
     map_scopes_to_roles(admin, realm, client_ids, scope_ids)
 
     # 11. Create users
-    users_config = main_config["users"]
+    users_config = main_config.get("users", [])
     create_users(admin, users_config)
 
     # 12. Summary