From 814b62375f224d2f54b0ac30d1da125a54bfae1e Mon Sep 17 00:00:00 2001
From: deploy <deploy@athleticmap>
Date: Wed, 7 Oct 2026 20:37:13 +0000
Subject: [PATCH] captacao: variaveis do login do dono no painel (realm
 athleticmap, atm_admin)

---
 tenants/plataforma/82-servico-captacao.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tenants/plataforma/82-servico-captacao.yaml b/tenants/plataforma/82-servico-captacao.yaml
index 491f2c5..d2b74c6 100644
--- a/tenants/plataforma/82-servico-captacao.yaml
+++ b/tenants/plataforma/82-servico-captacao.yaml
@@ -223,6 +223,10 @@ spec:
             # alcanca o nome publico do Keycloak (medido em 2026-09-25: HTTP 000).
             - { name: SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUERURI, value: "https://auth-plataforma.athleticmap.com/realms/clientes" }
             - { name: SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWKSETURI, value: "http://keycloak.plataforma-prod.svc.cluster.local:8080/realms/clientes/protocol/openid-connect/certs" }
+            # Login do DONO no painel (captacao 4.38): JWT do realm `athleticmap` com atm_admin,
+            # aceito alem do x-atm-admin-token. Decodificador proprio, separado do realm clientes.
+            - { name: ATM_PLATAFORMA_ADMIN_JWT_EMISSOR, value: "https://auth-plataforma.athleticmap.com/realms/athleticmap" }
+            - { name: ATM_PLATAFORMA_ADMIN_JWT_CHAVES, value: "http://keycloak.plataforma-prod.svc.cluster.local:8080/realms/athleticmap/protocol/openid-connect/certs" }
             # DESLIGADO ate a tela minha-conta.html estar no ar: ligado, manda a cada
             # comprador o convite para definir senha do painel.
             - { name: ACESSO_DO_CLIENTE_LIGADO, value: "true" }