@multiplatform.one/auth 7.16.0 → 7.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/auth",
-  "version": "7.16.0",
+  "version": "7.18.0",
   "description": "Better Auth helpers for multiplatform.one apps with Keycloak",
   "keywords": [
     "auth",
@@ -48,8 +48,8 @@
   },
   "devDependencies": {
     "@better-auth/expo": "^1.6.9",
-    "@multiplatform.one/config": "7.16.0",
-    "@multiplatform.one/test-utils": "7.16.0",
+    "@multiplatform.one/config": "7.18.0",
+    "@multiplatform.one/test-utils": "7.18.0",
     "@tamagui/build": "2.7.6",
     "@vitest/coverage-v8": "^4.1.5",
     "better-auth": "^1.6.9",
@@ -58,7 +58,7 @@
   },
   "peerDependencies": {
     "@better-auth/expo": "^1.4.0",
-    "@multiplatform.one/wallet": "^7.16.0",
+    "@multiplatform.one/wallet": "^7.18.0",
     "better-auth": "^1.4.0"
   },
   "peerDependenciesMeta": {

package/src/index.ts

@@ -21,6 +21,7 @@ import {
   APIError,
   createAuthEndpoint,
   createAuthMiddleware,
+  getAccessToken,
   getSessionFromCtx,
   isAPIError,
 } from "better-auth/api";
@@ -51,13 +52,14 @@ export type { AccessTokenFailureKind, RetryAttemptResult } from "./accessTokenRe
 const requestOriginStorage = new AsyncLocalStorage<string>();
 
 /**
- * The visitor origin for the request being handled. The app may sit behind
+ * The visitor origin for a request from a private-network dev host, else
+ * undefined so callers use the configured BASE_URL. The app may sit behind
  * the bench's dev proxy (browser → :8000 → one server :3456), where
  * `req.url` shows the proxy target — so prefer `X-Forwarded-Proto/Host`
  * (the bench proxy sets them for exactly this purpose), then the browser's
- * `Origin` header, then the request URL. Forwarded/origin hosts are only
- * honored when they match the private-network dev allowlist, so a spoofed
- * header can never steer OAuth redirects at a public host.
+ * `Origin` header, then the request URL. A public host never picks the
+ * origin: behind a TLS edge the request URL says http, and its Host is
+ * whatever the client sent.
  */
 function deriveRequestOrigin(req: Request): string | undefined {
   const isDevHost = (host: string) =>
@@ -69,21 +71,16 @@ function deriveRequestOrigin(req: Request): string | undefined {
     return `${proto}://${forwardedHost}`;
   }
 
-  const originHeader = req.headers.get("origin");
-  if (originHeader) {
+  for (const candidate of [req.headers.get("origin"), req.url]) {
+    if (!candidate) continue;
     try {
-      const url = new URL(originHeader);
+      const url = new URL(candidate);
       if (isDevHost(url.host)) return url.origin;
     } catch {
-      // fall through to the request URL
+      // not a URL; try the next candidate
     }
   }
-
-  try {
-    return new URL(req.url).origin;
-  } catch {
-    return undefined;
-  }
+  return undefined;
 }
 
 // ─── Types ──────────────────────────────────────────────────────────
@@ -160,12 +157,21 @@ interface KeycloakSsoPluginOptions {
   clientSecret: string;
   /** Backchannel issuer (server-to-server), e.g. http://localhost:8080/auth/realms/myrealm */
   issuer: string;
-  /** Fallback visitor origin when none can be derived from the request. */
+  /** Public app origin, used for every visitor that is not on a dev host. */
   baseUrl: string;
   /** Browser-facing Keycloak base for a visitor origin (proxy-aware). */
   publicKeycloakBaseFor: (requestOrigin?: string) => string | undefined;
 }
 
+const accessTokenBodySchema = getAccessToken.options.body as
+  | { safeParse?: (value: unknown) => { success: boolean } }
+  | undefined;
+
+/** Whether the installed Better Auth validates this `/get-access-token` body. */
+function acceptsAccessTokenBody(body: unknown): boolean {
+  return accessTokenBodySchema?.safeParse?.(body).success !== false;
+}
+
 /** Minimal shape of a stored OAuth account used by the SSO plugin. */
 interface KeycloakAccountLike {
   providerId?: string;
@@ -317,10 +323,17 @@ function createKeycloakSsoPlugin(options: KeycloakSsoPluginOptions) {
           // so it is a 200 with no token, as /get-session answers, instead
           // of a 4xx the browser logs. Runs before body validation, so the
           // client's body-shape negotiation never 400s for a visitor either.
+          // A signed-in >=1.7 body (`useAccountCookie`) on a server whose
+          // schema still demands `providerId` gets the Keycloak provider
+          // added, so the negotiation never 400s once signed in either.
           matcher: (ctx) => ctx.path === "/get-access-token",
           handler: createAuthMiddleware(async (ctx) => {
             const session = await getSessionFromCtx(ctx).catch(() => null);
             if (!session) return ctx.json(null);
+            const body = ctx.body as { useAccountCookie?: unknown } | undefined;
+            if (body?.useAccountCookie !== true || acceptsAccessTokenBody(body)) return;
+            const legacy = { ...body, providerId: "keycloak" };
+            if (acceptsAccessTokenBody(legacy)) return { context: { body: legacy } };
           }),
         },
       ],
@@ -649,8 +662,8 @@ export type AuthInstance = ReturnType<typeof createAuth>;
  * ```
  */
 export function createAuthRouteHandler(auth: AuthLike) {
-  // Every auth request runs inside an AsyncLocalStorage scope carrying its
-  // visitor origin (proxy-aware; see deriveRequestOrigin), so the dev
+  // An auth request from a dev host runs inside an AsyncLocalStorage scope
+  // carrying its visitor origin (proxy-aware; see deriveRequestOrigin), so the dev
   // redirect-URI/authorization-URL getters (createAuth) can follow the host
   // the visitor is actually on (survives the awaits inside better-auth).
   const handler = (req: Request) => {

package/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAc7D,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAmDvF,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qCAAqC;IACrC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtD;;;OAGG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;CACzD;AAED,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;IAC5D,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC9D,CAAC;CACH;AA4RD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB;;;;;;;;;;;;;;;;;;;GAmNzD;AAED,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAIzD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ;wBAK7B,OAAO;yBAAP,OAAO;EAK9B;AAID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ;sBAOlB,OAAO;sBALP,OAAO;EAcvC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAe7D,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AA+CvF,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qCAAqC;IACrC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtD;;;OAGG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;CACzD;AAED,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;IAC5D,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC9D,CAAC;CACH;AA4SD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB;;;;;;;;;;;;;;;;;;;GAmNzD;AAED,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAIzD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ;wBAK7B,OAAO;yBAAP,OAAO;EAK9B;AAID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ;sBAOlB,OAAO;sBALP,OAAO;EAcvC"}