I kept issuer resolution in services/.../TotpUtils.java instead of server-spi/.../OTPPolicy.java.

OTPPolicy is a suitable place for building the TOTP URI. However, resolving the realm display name requires:

• LOGIN theme message bundles
• the user’s resolved locale
• theme/templating utilities (e.g., TemplatingUtil)

These dependencies belong to the service layer rather than the SPI layer. As a result, TotpUtils resolves the issuer string first and then delegates to OTPPolicy#getKeyURI(String issuer, String user, String secret).

Additionally, OTPPolicy#getKeyURI(RealmModel, UserModel, String) appears unused within this repository. Only TotpUtils used it. We could consider removing the unused overload, provided there is no external usage, since it is part of the public SPI surface and may have external consumers.

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BruteForceTest#testNoFailureResetForPermanentLockout

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: Expected error event ==> expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test