# TASK 4.1: Replace Laravel auth with Keycloak-backed BFF auth flow

## Summary

Refactor Laravel authentication so it no longer uses Eloquent users or database-backed session state.

## Dependencies

- TASK 1.1 complete
- TASK 3.2 complete

## Files to Modify

Likely files:

- `Front/app/Http/Controllers/LoginController.php`
- `Front/app/Http/Controllers/Admin/AdminAuthController.php`
- `Front/config/auth.php`
- `Front/config/session.php`
- `Front/bootstrap/app.php`
- auth middleware under `Front/app/Http/Middleware`
- any new auth support classes under `Front/app`

## Required Behavior

Laravel must:

- redirect users through Keycloak-backed login,
- retain authenticated context without database-backed sessions,
- authorize routes based on trusted user context rather than Eloquent models,
- support logout cleanly,
- stop calling `Auth::attempt` against local records.

## Acceptance Criteria

- [ ] Laravel login no longer uses local DB-backed credentials
- [ ] Laravel session storage is not database-backed
- [ ] Auth middleware can enforce user/admin access without Eloquent user records
- [ ] Logout flow works with Keycloak-backed identity
- [ ] Laravel can run without a configured database connection for auth

## Notes

- If a lightweight custom authenticated-user object is needed in Laravel, it should be built from token/session data, not a database model.