@baukit/auth-node 0.7.2 → 0.7.4

package/src/keycloak-testing.test.ts

@@ -0,0 +1,366 @@
+import type { Page } from '@playwright/test';
+import { describe, expect, it } from 'vitest';
+
+import {
+  allowKeycloakWebOrigin,
+  createKeycloakTestUser,
+  keycloakStack,
+  revokeKeycloakUserSessions,
+  signInWithKeycloak,
+  type KeycloakLoginPage,
+} from './keycloak-testing.js';
+
+const STACK = keycloakStack(
+  { url: 'http://localhost:8081/', realm: 'notes', webClientId: 'notes-web' },
+  {},
+);
+const TOKEN_URL = 'http://localhost:8081/realms/master/protocol/openid-connect/token';
+const ADMIN_URL = 'http://localhost:8081/admin/realms/notes';
+
+interface RecordedRequest {
+  readonly url: string;
+  readonly method: string;
+  readonly headers: Headers;
+  readonly body: string;
+}
+
+function bodyText(body: BodyInit | null | undefined): string {
+  if (typeof body === 'string') return body;
+  return body instanceof URLSearchParams ? body.toString() : '';
+}
+
+function fakeKeycloak(responses: Record<string, () => Response>): {
+  readonly fetch: typeof fetch;
+  readonly requests: RecordedRequest[];
+} {
+  const requests: RecordedRequest[] = [];
+  const fetcher: typeof fetch = (input, init) => {
+    const method = init?.method ?? 'GET';
+    const url = input instanceof Request ? input.url : input.toString();
+    requests.push({ url, method, headers: new Headers(init?.headers), body: bodyText(init?.body) });
+    const respond = responses[`${method} ${url}`];
+    if (respond === undefined) throw new Error(`unexpected ${method} ${url}`);
+    return Promise.resolve(respond());
+  };
+  return { fetch: fetcher, requests };
+}
+
+const adminToken = (): Response => Response.json({ access_token: 'admin-token' });
+
+describe('keycloakStack', () => {
+  it('uses the defaults and admin/admin without variables', () => {
+    expect(STACK).toEqual({
+      url: 'http://localhost:8081',
+      realm: 'notes',
+      adminUsername: 'admin',
+      adminPassword: 'admin',
+      webClientId: 'notes-web',
+    });
+  });
+
+  it('lets E2E_KEYCLOAK_* variables override every field', () => {
+    const stack = keycloakStack(
+      { url: 'http://localhost:8081', realm: 'notes', webClientId: 'notes-web' },
+      {
+        E2E_KEYCLOAK_URL: 'https://id.example.test//',
+        E2E_KEYCLOAK_REALM: 'staging',
+        E2E_KEYCLOAK_ADMIN_USERNAME: 'root',
+        E2E_KEYCLOAK_ADMIN_PASSWORD: 'secret',
+        E2E_KEYCLOAK_WEB_CLIENT_ID: 'staging-web',
+      },
+    );
+    expect(stack).toEqual({
+      url: 'https://id.example.test',
+      realm: 'staging',
+      adminUsername: 'root',
+      adminPassword: 'secret',
+      webClientId: 'staging-web',
+    });
+  });
+});
+
+describe('createKeycloakTestUser', () => {
+  it('creates a verified random user and returns the subject from the location', async () => {
+    const keycloak = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [`POST ${ADMIN_URL}/users`]: () =>
+        new Response(null, {
+          status: 201,
+          headers: { location: `${ADMIN_URL}/users/0f4c-subject` },
+        }),
+    });
+
+    const user = await createKeycloakTestUser(STACK, {}, { fetch: keycloak.fetch });
+
+    expect(user.subject).toBe('0f4c-subject');
+    expect(user.username).toMatch(/^e2e-[0-9a-f-]{36}$/u);
+    expect(user.email).toBe(`${user.username}@example.test`);
+    const [login, create] = keycloak.requests;
+    expect(Object.fromEntries(new URLSearchParams(login?.body))).toEqual({
+      client_id: 'admin-cli',
+      grant_type: 'password',
+      username: 'admin',
+      password: 'admin',
+    });
+    expect(create?.headers.get('authorization')).toBe('Bearer admin-token');
+    expect(JSON.parse(create?.body ?? '')).toMatchObject({
+      username: user.username,
+      email: user.email,
+      emailVerified: true,
+      enabled: true,
+      credentials: [{ type: 'password', value: user.password, temporary: false }],
+    });
+  });
+
+  it('keeps a caller-chosen identity', async () => {
+    const keycloak = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [`POST ${ADMIN_URL}/users`]: () =>
+        new Response(null, { status: 201, headers: { location: `${ADMIN_URL}/users/abc` } }),
+    });
+
+    const user = await createKeycloakTestUser(
+      STACK,
+      { username: 'ada@example.com', email: 'ada@example.com', password: 'pw' },
+      { fetch: keycloak.fetch },
+    );
+
+    expect(user).toEqual({
+      username: 'ada@example.com',
+      email: 'ada@example.com',
+      password: 'pw',
+      subject: 'abc',
+    });
+  });
+
+  it('names the failing step and status without a response body', async () => {
+    const refused = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: () => new Response('bad credentials', { status: 401 }),
+    });
+    await expect(createKeycloakTestUser(STACK, {}, { fetch: refused.fetch })).rejects.toThrow(
+      'Keycloak admin sign-in failed with HTTP 401.',
+    );
+
+    const conflict = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [`POST ${ADMIN_URL}/users`]: () => new Response(null, { status: 409 }),
+    });
+    await expect(createKeycloakTestUser(STACK, {}, { fetch: conflict.fetch })).rejects.toThrow(
+      'Keycloak user creation failed with HTTP 409.',
+    );
+
+    const noLocation = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [`POST ${ADMIN_URL}/users`]: () => new Response(null, { status: 201 }),
+    });
+    await expect(createKeycloakTestUser(STACK, {}, { fetch: noLocation.fetch })).rejects.toThrow(
+      'Keycloak user creation returned no user location.',
+    );
+  });
+});
+
+describe('revokeKeycloakUserSessions', () => {
+  it('logs the user out through the admin API', async () => {
+    const keycloak = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [`POST ${ADMIN_URL}/users/abc/logout`]: () => new Response(null, { status: 204 }),
+    });
+
+    await revokeKeycloakUserSessions(STACK, 'abc', { fetch: keycloak.fetch });
+
+    expect(keycloak.requests.map((request) => request.method)).toEqual(['POST', 'POST']);
+  });
+
+  it('rejects a failed revocation', async () => {
+    const keycloak = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [`POST ${ADMIN_URL}/users/abc/logout`]: () => new Response(null, { status: 404 }),
+    });
+
+    await expect(
+      revokeKeycloakUserSessions(STACK, 'abc', { fetch: keycloak.fetch }),
+    ).rejects.toThrow('Keycloak session revocation failed with HTTP 404.');
+  });
+});
+
+describe('allowKeycloakWebOrigin', () => {
+  const lookup = `GET ${ADMIN_URL}/clients?clientId=notes-web`;
+
+  it('adds a missing origin and keeps the rest of the client', async () => {
+    const keycloak = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [lookup]: () =>
+        Response.json([
+          {
+            id: 'client-1',
+            clientId: 'notes-web',
+            redirectUris: ['http://localhost:5173/*'],
+            webOrigins: ['http://localhost:5173'],
+          },
+        ]),
+      [`PUT ${ADMIN_URL}/clients/client-1`]: () => new Response(null, { status: 204 }),
+    });
+
+    await allowKeycloakWebOrigin(STACK, 'http://localhost:5183', { fetch: keycloak.fetch });
+
+    const update = keycloak.requests.at(-1);
+    expect(update?.headers.get('content-type')).toBe('application/json');
+    expect(JSON.parse(update?.body ?? '')).toEqual({
+      id: 'client-1',
+      clientId: 'notes-web',
+      redirectUris: ['http://localhost:5173/*', 'http://localhost:5183/*'],
+      webOrigins: ['http://localhost:5173', 'http://localhost:5183'],
+      attributes: { 'post.logout.redirect.uris': 'http://localhost:5183/*' },
+    });
+  });
+
+  it('appends the post-logout redirect and keeps the other attributes', async () => {
+    const keycloak = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [lookup]: () =>
+        Response.json([
+          {
+            id: 'client-1',
+            redirectUris: ['http://localhost:5183/*'],
+            webOrigins: ['http://localhost:5183'],
+            attributes: {
+              'pkce.code.challenge.method': 'S256',
+              'post.logout.redirect.uris': 'http://localhost:5173/*',
+            },
+          },
+        ]),
+      [`PUT ${ADMIN_URL}/clients/client-1`]: () => new Response(null, { status: 204 }),
+    });
+
+    await allowKeycloakWebOrigin(STACK, 'http://localhost:5183', { fetch: keycloak.fetch });
+
+    expect(JSON.parse(keycloak.requests.at(-1)?.body ?? '')).toMatchObject({
+      redirectUris: ['http://localhost:5183/*'],
+      webOrigins: ['http://localhost:5183'],
+      attributes: {
+        'pkce.code.challenge.method': 'S256',
+        'post.logout.redirect.uris': 'http://localhost:5173/*##http://localhost:5183/*',
+      },
+    });
+  });
+
+  it.each([
+    ['lists the origin', 'http://localhost:5173/*'],
+    ['reuses the redirect URIs', 'http://localhost:5183/*##+'],
+  ])('skips the update when the client already allows the origin and %s', async (_, uris) => {
+    const keycloak = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [lookup]: () =>
+        Response.json([
+          {
+            id: 'client-1',
+            redirectUris: ['http://localhost:5173/*'],
+            webOrigins: ['http://localhost:5173'],
+            attributes: { 'post.logout.redirect.uris': uris },
+          },
+        ]),
+    });
+
+    await allowKeycloakWebOrigin(STACK, 'http://localhost:5173', { fetch: keycloak.fetch });
+
+    expect(keycloak.requests).toHaveLength(2);
+  });
+
+  it('updates a client that allows the origin everywhere but after logout', async () => {
+    const keycloak = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [lookup]: () =>
+        Response.json([
+          {
+            id: 'client-1',
+            redirectUris: ['http://localhost:5173/*'],
+            webOrigins: ['http://localhost:5173'],
+          },
+        ]),
+      [`PUT ${ADMIN_URL}/clients/client-1`]: () => new Response(null, { status: 204 }),
+    });
+
+    await allowKeycloakWebOrigin(STACK, 'http://localhost:5173', { fetch: keycloak.fetch });
+
+    expect(JSON.parse(keycloak.requests.at(-1)?.body ?? '')).toEqual({
+      id: 'client-1',
+      redirectUris: ['http://localhost:5173/*'],
+      webOrigins: ['http://localhost:5173'],
+      attributes: { 'post.logout.redirect.uris': 'http://localhost:5173/*' },
+    });
+  });
+
+  it('rejects a failed client update', async () => {
+    const keycloak = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [lookup]: () => Response.json([{ id: 'client-1' }]),
+      [`PUT ${ADMIN_URL}/clients/client-1`]: () => new Response(null, { status: 403 }),
+    });
+
+    await expect(
+      allowKeycloakWebOrigin(STACK, 'http://localhost:5173', { fetch: keycloak.fetch }),
+    ).rejects.toThrow('Keycloak client update failed with HTTP 403.');
+  });
+
+  it('rejects a realm without the web client', async () => {
+    const keycloak = fakeKeycloak({
+      [`POST ${TOKEN_URL}`]: adminToken,
+      [lookup]: () => Response.json([]),
+    });
+
+    await expect(
+      allowKeycloakWebOrigin(STACK, 'http://localhost:5173', { fetch: keycloak.fetch }),
+    ).rejects.toThrow('Keycloak realm notes has no notes-web client.');
+  });
+});
+
+describe('signInWithKeycloak', () => {
+  function fakePage(): { readonly page: KeycloakLoginPage; readonly steps: string[] } {
+    const steps: string[] = [];
+    const onKeycloak = new URL('http://localhost:8081/realms/notes/login');
+    const onApp = new URL('http://localhost:5173/');
+    const page: KeycloakLoginPage = {
+      waitForURL: (matches, options) => {
+        const timeout = options?.timeout === undefined ? 'default' : String(options.timeout);
+        steps.push(`wait ${String(matches(onKeycloak))} ${String(matches(onApp))} ${timeout}`);
+        return Promise.resolve();
+      },
+      locator: (selector) => ({
+        fill: (value) => {
+          steps.push(`fill ${selector} ${value}`);
+          return Promise.resolve();
+        },
+        click: () => {
+          steps.push(`click ${selector}`);
+          return Promise.resolve();
+        },
+      }),
+    };
+    return { page, steps };
+  }
+
+  it('waits for the Keycloak origin and submits the form by its IDs', async () => {
+    const { page, steps } = fakePage();
+
+    await signInWithKeycloak(page, { username: 'ada', password: 'pw' }, STACK, {
+      timeoutMs: 60_000,
+    });
+    await signInWithKeycloak(page, { username: 'ada', password: 'pw' }, STACK);
+
+    expect(steps).toEqual([
+      'wait true false 60000',
+      'fill #username ada',
+      'fill #password pw',
+      'click #kc-login',
+      'wait true false default',
+      'fill #username ada',
+      'fill #password pw',
+      'click #kc-login',
+    ]);
+  });
+
+  it('accepts a Playwright page', () => {
+    const asLoginPage = (page: Page): KeycloakLoginPage => page;
+    expect(asLoginPage).toBeTypeOf('function');
+  });
+});

package/src/keycloak-testing.ts

@@ -0,0 +1,267 @@
+import { randomUUID } from 'node:crypto';
+
+/** Where a disposable development Keycloak runs and how to administer it. */
+export interface KeycloakStack {
+  readonly url: string;
+  readonly realm: string;
+  readonly adminUsername: string;
+  readonly adminPassword: string;
+  readonly webClientId: string;
+}
+
+/** The product's development defaults; `E2E_KEYCLOAK_*` variables override each one. */
+export interface KeycloakStackDefaults {
+  readonly url: string;
+  readonly realm: string;
+  readonly webClientId: string;
+  /** Defaults to `admin`. */
+  readonly adminUsername?: string;
+  /** Defaults to `admin`. */
+  readonly adminPassword?: string;
+}
+
+export interface KeycloakTestUser {
+  readonly username: string;
+  readonly password: string;
+  readonly email: string;
+  /** Keycloak user ID, which becomes the `sub` claim of the user's tokens. */
+  readonly subject: string;
+}
+
+export interface KeycloakTestUserOptions {
+  /** Defaults to `e2e-<uuid>`, so parallel tests never share an identity. */
+  readonly username?: string;
+  /** Defaults to a random password. */
+  readonly password?: string;
+  /** Defaults to `<username>@example.test`. */
+  readonly email?: string;
+}
+
+export interface KeycloakRequestOptions {
+  /** Defaults to the global `fetch`. */
+  readonly fetch?: typeof fetch;
+  /** Per-request timeout. Defaults to {@link DEFAULT_KEYCLOAK_REQUEST_TIMEOUT_MS}. */
+  readonly timeoutMs?: number;
+}
+
+/** The part of a Playwright `Page` that {@link signInWithKeycloak} uses. */
+export interface KeycloakLoginPage {
+  waitForURL(url: (url: URL) => boolean, options?: { timeout?: number }): Promise<unknown>;
+  locator(selector: string): {
+    fill(value: string): Promise<unknown>;
+    click(): Promise<unknown>;
+  };
+}
+
+export interface KeycloakSignInOptions {
+  /** How long to wait for the login page. Defaults to the page's own timeout. */
+  readonly timeoutMs?: number;
+}
+
+export const DEFAULT_KEYCLOAK_REQUEST_TIMEOUT_MS = 30_000;
+
+const HTTP_CREATED = 201;
+const DEFAULT_ADMIN = 'admin';
+
+/** Returns the stack from `E2E_KEYCLOAK_*` variables, falling back to the defaults. */
+export function keycloakStack(
+  defaults: KeycloakStackDefaults,
+  environment: NodeJS.ProcessEnv = process.env,
+): KeycloakStack {
+  const url = environment['E2E_KEYCLOAK_URL'] ?? defaults.url;
+  return {
+    url: url.replace(/\/+$/u, ''),
+    realm: environment['E2E_KEYCLOAK_REALM'] ?? defaults.realm,
+    adminUsername:
+      environment['E2E_KEYCLOAK_ADMIN_USERNAME'] ?? defaults.adminUsername ?? DEFAULT_ADMIN,
+    adminPassword:
+      environment['E2E_KEYCLOAK_ADMIN_PASSWORD'] ?? defaults.adminPassword ?? DEFAULT_ADMIN,
+    webClientId: environment['E2E_KEYCLOAK_WEB_CLIENT_ID'] ?? defaults.webClientId,
+  };
+}
+
+/** Creates a verified user with a password in the stack's realm. */
+export async function createKeycloakTestUser(
+  stack: KeycloakStack,
+  user: KeycloakTestUserOptions = {},
+  options: KeycloakRequestOptions = {},
+): Promise<KeycloakTestUser> {
+  const username = user.username ?? `e2e-${randomUUID()}`;
+  const password = user.password ?? `E2e-${randomUUID()}`;
+  const email = user.email ?? `${username}@example.test`;
+  const admin = await adminRequester(stack, options);
+  const response = await admin('users', {
+    method: 'POST',
+    body: {
+      username,
+      email,
+      emailVerified: true,
+      enabled: true,
+      firstName: 'E2E',
+      lastName: 'User',
+      credentials: [{ type: 'password', value: password, temporary: false }],
+    },
+  });
+  if (response.status !== HTTP_CREATED) {
+    throw new Error(`Keycloak user creation failed with HTTP ${String(response.status)}.`);
+  }
+  const subject = response.headers.get('location')?.match(/\/([^/]+)$/u)?.[1];
+  if (subject === undefined) {
+    throw new Error('Keycloak user creation returned no user location.');
+  }
+  return { username, password, email, subject: decodeURIComponent(subject) };
+}
+
+/** Ends every Keycloak session of the user, so the next token refresh fails. */
+export async function revokeKeycloakUserSessions(
+  stack: KeycloakStack,
+  subject: string,
+  options: KeycloakRequestOptions = {},
+): Promise<void> {
+  const admin = await adminRequester(stack, options);
+  const response = await admin(`users/${encodeURIComponent(subject)}/logout`, { method: 'POST' });
+  if (!response.ok) {
+    throw new Error(`Keycloak session revocation failed with HTTP ${String(response.status)}.`);
+  }
+}
+
+interface KeycloakClient {
+  readonly id: string;
+  readonly redirectUris?: readonly string[];
+  readonly webOrigins?: readonly string[];
+  readonly attributes?: Readonly<Record<string, string>>;
+}
+
+const POST_LOGOUT_REDIRECT_URIS = 'post.logout.redirect.uris';
+const POST_LOGOUT_SEPARATOR = '##';
+const SAME_AS_REDIRECT_URIS = '+';
+
+/**
+ * Adds the origin to the web client's redirect URIs, web origins, and post-logout redirect URIs
+ * when the client lacks it.
+ */
+export async function allowKeycloakWebOrigin(
+  stack: KeycloakStack,
+  origin: string,
+  options: KeycloakRequestOptions = {},
+): Promise<void> {
+  const admin = await adminRequester(stack, options);
+  const lookup = await admin(`clients?clientId=${encodeURIComponent(stack.webClientId)}`);
+  if (!lookup.ok) {
+    throw new Error(`Keycloak client lookup failed with HTTP ${String(lookup.status)}.`);
+  }
+  const [client] = (await lookup.json()) as readonly (KeycloakClient & Record<string, unknown>)[];
+  if (client === undefined) {
+    throw new Error(`Keycloak realm ${stack.realm} has no ${stack.webClientId} client.`);
+  }
+  const redirectUri = `${origin}/*`;
+  const postLogoutRedirectUris = postLogoutEntries(client);
+  const logoutAllowed =
+    postLogoutRedirectUris.includes(SAME_AS_REDIRECT_URIS) ||
+    postLogoutRedirectUris.includes(redirectUri);
+  if (
+    client.redirectUris?.includes(redirectUri) &&
+    client.webOrigins?.includes(origin) &&
+    logoutAllowed
+  ) {
+    return;
+  }
+  const update = await admin(`clients/${encodeURIComponent(client.id)}`, {
+    method: 'PUT',
+    body: {
+      ...client,
+      redirectUris: withEntry(client.redirectUris, redirectUri),
+      webOrigins: withEntry(client.webOrigins, origin),
+      attributes: {
+        ...client.attributes,
+        [POST_LOGOUT_REDIRECT_URIS]: (logoutAllowed
+          ? postLogoutRedirectUris
+          : [...postLogoutRedirectUris, redirectUri]
+        ).join(POST_LOGOUT_SEPARATOR),
+      },
+    },
+  });
+  if (!update.ok) {
+    throw new Error(`Keycloak client update failed with HTTP ${String(update.status)}.`);
+  }
+}
+
+/** Waits for the Keycloak login page, fills it by its stable `keycloak.v2` IDs, and submits. */
+export async function signInWithKeycloak(
+  loginPage: KeycloakLoginPage,
+  user: Pick<KeycloakTestUser, 'username' | 'password'>,
+  stack: KeycloakStack,
+  options: KeycloakSignInOptions = {},
+): Promise<void> {
+  const origin = new URL(stack.url).origin;
+  const isKeycloak = (url: URL): boolean => url.origin === origin;
+  await (options.timeoutMs === undefined
+    ? loginPage.waitForURL(isKeycloak)
+    : loginPage.waitForURL(isKeycloak, { timeout: options.timeoutMs }));
+  await loginPage.locator('#username').fill(user.username);
+  await loginPage.locator('#password').fill(user.password);
+  await loginPage.locator('#kc-login').click();
+}
+
+interface AdminRequest {
+  readonly method?: 'GET' | 'POST' | 'PUT';
+  readonly body?: unknown;
+}
+
+type AdminRequester = (path: string, request?: AdminRequest) => Promise<Response>;
+
+async function adminRequester(
+  stack: KeycloakStack,
+  options: KeycloakRequestOptions,
+): Promise<AdminRequester> {
+  const fetcher = options.fetch ?? fetch;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_KEYCLOAK_REQUEST_TIMEOUT_MS;
+  const token = await adminAccessToken(stack, fetcher, timeoutMs);
+  const realmUrl = `${stack.url}/admin/realms/${encodeURIComponent(stack.realm)}`;
+  return (path, request = {}) =>
+    fetcher(`${realmUrl}/${path}`, {
+      method: request.method ?? 'GET',
+      headers: {
+        authorization: `Bearer ${token}`,
+        ...(request.body === undefined ? {} : { 'content-type': 'application/json' }),
+      },
+      ...(request.body === undefined ? {} : { body: JSON.stringify(request.body) }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+}
+
+async function adminAccessToken(
+  stack: KeycloakStack,
+  fetcher: typeof fetch,
+  timeoutMs: number,
+): Promise<string> {
+  const response = await fetcher(`${stack.url}/realms/master/protocol/openid-connect/token`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      client_id: 'admin-cli',
+      grant_type: 'password',
+      username: stack.adminUsername,
+      password: stack.adminPassword,
+    }),
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+  if (!response.ok) {
+    throw new Error(`Keycloak admin sign-in failed with HTTP ${String(response.status)}.`);
+  }
+  const body = (await response.json()) as { readonly access_token?: unknown };
+  if (typeof body.access_token !== 'string') {
+    throw new Error('Keycloak admin sign-in returned no access token.');
+  }
+  return body.access_token;
+}
+
+function postLogoutEntries(client: KeycloakClient): string[] {
+  const value = client.attributes?.[POST_LOGOUT_REDIRECT_URIS] ?? '';
+  return value.split(POST_LOGOUT_SEPARATOR).filter((entry) => entry !== '');
+}
+
+function withEntry(entries: readonly string[] | undefined, entry: string): string[] {
+  const current = entries ?? [];
+  return current.includes(entry) ? [...current] : [...current, entry];
+}