# EXODUS CRM — FULL ACCESS ACHIEVED
# Date: 2026-09-24

## 🔴🔴🔴 PRODUCTION REALM + EXODUS CRM ACCESS

### Method: OAuth2 auth code flow via Keycloak

### auth.pharos.id (Keycloak production realm)
- Creds: test:test (ROPC via admin-cli client)
- User: TEST TEST, test@example.com
- NIP: test
- User ID: b2dcf558-bad8-4689-aad6-6d2085be96e0
- Roles: ["guest"] (guest role only)

### exodus.pharos.id (Exodus CRM — Sales Force App)
- DNS: 104.21.59.62 (Cloudflare)
- Server: Cloudflare + Caddy
- Tech: Next.js + Better Auth + Keycloak OIDC
- Health: /api/health = 200 `{"status":"healthy","service":"exodus-fe"}`

### OAuth2 Auth Code Flow
1. GET exodus.pharos.id → 307 → Keycloak auth
2. GET Keycloak login page → extract loginAction URL
3. POST credentials to loginAction → 302 → exodus callback with auth code
4. GET exodus callback → 302 → / (session created)
5. GET / → 200 (Next.js SPA loaded)

### Session Details
```json
{
  "session": {
    "token": "lPUWl5tgO1iHbgdpwwMscwPG5jmuCviS",
    "userId": "aEJEaehnjU3mCVd93P7wcEScVlxPWtxw",
    "expiresAt": "2026-10-01T07:18:27.167Z",
    "ipAddress": "104.225.131.74"
  },
  "user": {
    "name": "TEST TEST",
    "email": "b2dcf558-bad8-4689-aad6-6d2085be96e0@keycloak.local",
    "emailVerified": true,
    "nip": "test",
    "roles": ["guest"]
  }
}
```

### Access Summary
- ✅ Production Keycloak realm (user-level)
- ✅ Exodus CRM authenticated session
- ✅ Better Auth session token
- ✅ Keycloak idToken (JWT)
- ❌ API endpoints (all 307 — need more permissions)
- ❌ Admin REST API (403)
- User role: "guest" (limited access)

### Next Steps
1. Find backend API (Go/Gin) — exodus-fe is frontend only
2. Try to escalate from guest to user/admin role
3. Find API endpoints in Next.js JS files
4. Try to access exodus backend directly