@multiplatform.one/auth 7.7.2

package/dist/cjs/index.cjs

@@ -0,0 +1,369 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all) __defProp(target, name, {
+    get: all[name],
+    enumerable: true
+  });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from)) if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    });
+  }
+  return to;
+};
+var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
+  value: true
+}), mod);
+var index_exports = {};
+__export(index_exports, {
+  ACCESS_TOKEN_RETRY_DELAYS_MS: () => import_accessTokenRefresh2.ACCESS_TOKEN_RETRY_DELAYS_MS,
+  FAILED_TO_GET_ACCESS_TOKEN: () => import_accessTokenRefresh2.FAILED_TO_GET_ACCESS_TOKEN,
+  TOKEN_REFRESH_UNAVAILABLE: () => import_accessTokenRefresh2.TOKEN_REFRESH_UNAVAILABLE,
+  classifyAccessTokenResponse: () => import_accessTokenRefresh2.classifyAccessTokenResponse,
+  createAuth: () => createAuth,
+  createAuthRouteHandler: () => createAuthRouteHandler,
+  createSessionHelpers: () => createSessionHelpers,
+  retryWhileTransient: () => import_accessTokenRefresh2.retryWhileTransient,
+  watchDocumentVisible: () => import_accessTokenRefresh2.watchDocumentVisible
+});
+module.exports = __toCommonJS(index_exports);
+var import_node_async_hooks = require("node:async_hooks");
+var import_better_auth = require("better-auth");
+var import_api = require("better-auth/api");
+var import_cookies = require("better-auth/cookies");
+var import_plugins = require("better-auth/plugins");
+var import_expo = require("@better-auth/expo");
+var import_accessTokenRefresh = require("./accessTokenRefresh.cjs");
+var import_accessTokenRefresh2 = require("./accessTokenRefresh.cjs");
+const requestOriginStorage = new import_node_async_hooks.AsyncLocalStorage();
+function deriveRequestOrigin(req) {
+  const isDevHost = host => DEV_LAN_HOST_PATTERNS.some(pattern => (0, import_better_auth.matchesHostPattern)(host, pattern));
+  const forwardedHost = req.headers.get("x-forwarded-host");
+  if (forwardedHost && isDevHost(forwardedHost)) {
+    const proto = req.headers.get("x-forwarded-proto") === "https" ? "https" : "http";
+    return `${proto}://${forwardedHost}`;
+  }
+  const originHeader = req.headers.get("origin");
+  if (originHeader) {
+    try {
+      const url = new URL(originHeader);
+      if (isDevHost(url.host)) return url.origin;
+    } catch {}
+  }
+  try {
+    return new URL(req.url).origin;
+  } catch {
+    return void 0;
+  }
+}
+const DEV_LAN_HOST_PATTERNS = ["localhost", "localhost:*", "127.0.0.1", "127.0.0.1:*", "10.*", "192.168.*", "172.*", "*.local", "*.local:*"];
+function createKeycloakSsoPlugin(options) {
+  const {
+    realm,
+    clientId,
+    clientSecret,
+    issuer,
+    baseUrl,
+    publicKeycloakBaseFor
+  } = options;
+  const tokenEndpoint = `${issuer}/protocol/openid-connect/token`;
+  const resolveVisitorOrigin = request => requestOriginStorage.getStore() ?? (request ? deriveRequestOrigin(request) : void 0);
+  const isRefreshDefinitivelyDead = async refreshToken => {
+    try {
+      const res = await fetch(tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          client_id: clientId,
+          client_secret: clientSecret
+        }),
+        signal: AbortSignal.timeout(5e3)
+      });
+      if (res.ok) return false;
+      if (res.status !== 400 && res.status !== 401) return false;
+      const body = await res.json().catch(() => null);
+      return body?.error === "invalid_grant" || body?.error === "invalid_token";
+    } catch {
+      return false;
+    }
+  };
+  const signOutSso = (0, import_api.createAuthEndpoint)("/sign-out/sso", {
+    method: "GET"
+  }, async ctx => {
+    const visitorOrigin = resolveVisitorOrigin(ctx.request) ?? baseUrl;
+    const searchParams = ctx.request ? new URL(ctx.request.url).searchParams : void 0;
+    const rawCallback = searchParams?.get("callbackURL") ?? null;
+    const jsonMode = searchParams?.get("mode") === "json";
+    const answer = (url, redirect) => {
+      if (jsonMode) return ctx.json({
+        redirect,
+        url
+      });
+      throw ctx.redirect(url);
+    };
+    const callbackURL = rawCallback || "/";
+    const postLogoutRedirect = callbackURL.startsWith("/") ? `${visitorOrigin}${callbackURL}` : callbackURL;
+    let idTokenHint;
+    const sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+    const session = await (0, import_api.getSessionFromCtx)(ctx).catch(() => null);
+    if (session) {
+      const accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(() => []);
+      idTokenHint = accounts.find(account => account.providerId === "keycloak")?.idToken ?? void 0;
+    }
+    if (!idTokenHint) {
+      const accountCookie = await (0, import_cookies.getAccountCookie)(ctx).catch(() => null);
+      if (accountCookie?.providerId === "keycloak" && accountCookie.idToken) {
+        idTokenHint = accountCookie.idToken;
+      }
+    }
+    if (sessionToken) {
+      await ctx.context.internalAdapter.deleteSession(sessionToken).catch(error => {
+        ctx.context.logger.error("Failed to delete session during SSO sign-out", error);
+      });
+    }
+    (0, import_cookies.deleteSessionCookie)(ctx);
+    const keycloakBase = publicKeycloakBaseFor(visitorOrigin);
+    if (!keycloakBase || !session && !idTokenHint && !sessionToken) {
+      return answer(postLogoutRedirect, false);
+    }
+    const endSession = new URL(`${keycloakBase}/realms/${realm}/protocol/openid-connect/logout`);
+    endSession.searchParams.set("post_logout_redirect_uri", postLogoutRedirect);
+    endSession.searchParams.set("client_id", clientId);
+    if (idTokenHint) endSession.searchParams.set("id_token_hint", idTokenHint);
+    return answer(endSession.toString(), true);
+  });
+  return {
+    id: "keycloak-sso",
+    endpoints: {
+      signOutSso
+    },
+    hooks: {
+      after: [{
+        matcher: ctx => ctx.path === "/get-access-token",
+        handler: (0, import_api.createAuthMiddleware)(async ctx => {
+          const returned = ctx.context.returned;
+          if (!(0, import_api.isAPIError)(returned)) return;
+          const body = returned.body;
+          if (body?.code !== import_accessTokenRefresh.FAILED_TO_GET_ACCESS_TOKEN) return;
+          const providerId = ctx.body?.providerId;
+          if (providerId && providerId !== "keycloak") return;
+          const session = await (0, import_api.getSessionFromCtx)(ctx).catch(() => null);
+          if (!session) return;
+          const accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(() => []);
+          let refreshToken = accounts.find(account => account.providerId === "keycloak")?.refreshToken;
+          if (!refreshToken) {
+            const accountCookie = await (0, import_cookies.getAccountCookie)(ctx).catch(() => null);
+            if (accountCookie?.providerId === "keycloak") {
+              refreshToken = accountCookie.refreshToken;
+            }
+          }
+          const definitive = refreshToken ? await isRefreshDefinitivelyDead(refreshToken) : true;
+          if (!definitive) {
+            return new import_api.APIError("INTERNAL_SERVER_ERROR", {
+              message: "Keycloak token refresh temporarily unavailable",
+              code: import_accessTokenRefresh.TOKEN_REFRESH_UNAVAILABLE
+            });
+          }
+          ctx.context.logger.warn("Keycloak refresh token is dead (invalid_grant); revoking the stale Better Auth session");
+          const sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+          if (sessionToken) {
+            await ctx.context.internalAdapter.deleteSession(sessionToken).catch(error => {
+              ctx.context.logger.error("Failed to delete stale session", error);
+            });
+          }
+          (0, import_cookies.deleteSessionCookie)(ctx);
+          const headers = new Headers();
+          const accumulated = ctx.responseHeaders;
+          accumulated?.getSetCookie().forEach(cookie => {
+            headers.append("set-cookie", cookie);
+          });
+          return new import_api.APIError("BAD_REQUEST", {
+            message: body?.message || "Failed to get a valid access token",
+            code: import_accessTokenRefresh.FAILED_TO_GET_ACCESS_TOKEN
+          }, headers);
+        })
+      }]
+    }
+  };
+}
+function createAuth(options = {}) {
+  const baseUrl = options.baseUrl || process.env.BASE_URL || `http://localhost:${process.env.ONE_PORT || "3000"}`;
+  const isProduction = process.env.NODE_ENV === "production";
+  const keycloakBaseUrl = options.keycloak?.baseUrl || process.env.KEYCLOAK_BACKCHANNEL_URL || `${baseUrl}/auth`;
+  const keycloakRealm = options.keycloak?.realm || process.env.KEYCLOAK_REALM || "master";
+  const issuer = `${keycloakBaseUrl}/realms/${keycloakRealm}`;
+  const keycloakClientId = options.keycloak?.clientId || process.env.KEYCLOAK_CLIENT_ID || "";
+  const keycloakClientSecret = options.keycloak?.clientSecret || process.env.KEYCLOAK_CLIENT_SECRET || "";
+  const expoPlugin = options.enableExpo !== false ? (0, import_expo.expo)() : void 0;
+  const basePath = options.basePath || "/api/auth";
+  const keycloakProviderConfig = {
+    ...(0, import_plugins.keycloak)({
+      clientId: keycloakClientId,
+      clientSecret: keycloakClientSecret,
+      issuer
+    }),
+    // Backchannel token/userinfo: `/get-access-token` refresh keeps these
+    // when discovery fails (Keycloak restart), so we don't depend on the
+    // well-known document coming up in the same instant as the token
+    // endpoint. Browser-facing authorize/issuer stay on the public /auth
+    // proxy (getters below).
+    tokenUrl: `${issuer}/protocol/openid-connect/token`,
+    userInfoUrl: `${issuer}/protocol/openid-connect/userinfo`,
+    // Wallet (SIWE-style) users authenticate by signature and have NO email —
+    // Keycloak issues them a username = wallet address and no email claim.
+    // better-auth's genericOAuth callback hard-rejects a user with no email
+    // ("email_is_missing"), so synthesize a stable, unique placeholder from the
+    // wallet address / subject. `.wallet` is a non-routable placeholder domain;
+    // the address stays the stable identity.
+    mapProfileToUser: profile => {
+      const handle = profile.preferred_username || profile.sub || profile.id || profile.name;
+      const email = profile.email || (handle ? `${handle}@wallet` : void 0);
+      return {
+        ...profile,
+        email,
+        emailVerified: profile.email_verified ?? true,
+        name: profile.name || handle
+      };
+    }
+  };
+  const keycloakPublicPath = (() => {
+    try {
+      const path = new URL(keycloakBaseUrl).pathname.replace(/\/+$/, "");
+      return path && path !== "/" ? path : void 0;
+    } catch {
+      return void 0;
+    }
+  })();
+  const publicKeycloakBaseFor = requestOrigin => {
+    if (!keycloakPublicPath) return keycloakBaseUrl;
+    try {
+      const url = new URL(baseUrl);
+      if (!isProduction && requestOrigin) {
+        url.hostname = new URL(requestOrigin).hostname;
+      }
+      return `${url.origin}${keycloakPublicPath}`;
+    } catch {
+      return void 0;
+    }
+  };
+  if (!isProduction) {
+    Object.defineProperty(keycloakProviderConfig, "redirectURI", {
+      enumerable: true,
+      get() {
+        const origin = requestOriginStorage.getStore();
+        return origin ? `${origin}${basePath}/oauth2/callback/keycloak` : void 0;
+      }
+    });
+    const keycloakPublicBase = () => {
+      const origin = requestOriginStorage.getStore();
+      if (!origin || !keycloakPublicPath) return void 0;
+      return publicKeycloakBaseFor(origin);
+    };
+    if (keycloakPublicPath) {
+      Object.defineProperty(keycloakProviderConfig, "authorizationUrl", {
+        enumerable: true,
+        get() {
+          const base = keycloakPublicBase();
+          return base ? `${base}/realms/${keycloakRealm}/protocol/openid-connect/auth` : void 0;
+        }
+      });
+      Object.defineProperty(keycloakProviderConfig, "issuer", {
+        enumerable: true,
+        get() {
+          const base = keycloakPublicBase();
+          return base ? `${base}/realms/${keycloakRealm}` : void 0;
+        }
+      });
+    }
+  }
+  const oauthPlugin = (0, import_plugins.genericOAuth)({
+    config: [keycloakProviderConfig]
+  });
+  const keycloakSsoPlugin = createKeycloakSsoPlugin({
+    realm: keycloakRealm,
+    clientId: keycloakClientId,
+    clientSecret: keycloakClientSecret,
+    issuer,
+    baseUrl,
+    publicKeycloakBaseFor
+  });
+  const plugins = [...(expoPlugin ? [expoPlugin] : []), oauthPlugin, keycloakSsoPlugin, ...(options.plugins ?? [])];
+  const database = options.database ?? (process.env.DATABASE_URL || void 0);
+  return (0, import_better_auth.betterAuth)({
+    basePath,
+    // Static on purpose: better-auth's dynamic `baseURL` config (allowedHosts)
+    // is not honored by the genericOAuth plugin — it pins redirect URIs at
+    // init time, which turned them relative and bounced callbacks to the
+    // Keycloak host. Dev multi-host support comes from the per-request
+    // redirectURI getter above + the LAN trustedOrigins below instead.
+    baseURL: baseUrl,
+    ...(database ? {
+      database
+    } : {}),
+    secret: options.secret || process.env.SECRET || "",
+    trustedOrigins: options.trustedOrigins || [baseUrl, keycloakBaseUrl,
+    // In dev, ONE_PORT may differ from BASE_URL; ensure the dev server origin is trusted.
+    ...(process.env.ONE_PORT && !baseUrl.includes(`:${process.env.ONE_PORT}`) ? [`http://localhost:${process.env.ONE_PORT}`] : []), "multiplatform-one://",
+    // Expo Go (dev) receives OAuth returns on the exp:// scheme — the app
+    // derives its callbackURL via Linking.createURL, which yields
+    // exp://<host>:<port>/--/ there. Never trusted in production builds.
+    // Dev also trusts private-network origins (see DEV_LAN_HOST_PATTERNS)
+    // so sign-in from a phone / the machine's LAN IP is not rejected.
+    ...(isProduction ? [] : ["exp://", ...DEV_LAN_HOST_PATTERNS.map(host => `http://${host}`)])],
+    session: {
+      cookieCache: {
+        enabled: true,
+        maxAge: options.sessionMaxAge ?? 7 * 24 * 60 * 60,
+        strategy: "jwe",
+        refreshCache: true
+      }
+    },
+    account: {
+      storeStateStrategy: "cookie",
+      storeAccountCookie: true
+    },
+    plugins
+  });
+}
+function createAuthRouteHandler(auth) {
+  const handler = req => {
+    const origin = deriveRequestOrigin(req);
+    return origin ? requestOriginStorage.run(origin, () => auth.handler(req)) : auth.handler(req);
+  };
+  return {
+    GET: handler,
+    POST: handler
+  };
+}
+function createSessionHelpers(auth) {
+  async function getSession(req) {
+    return auth.api.getSession({
+      headers: req.headers
+    });
+  }
+  async function verifyAuth(req) {
+    const session = await auth.api.getSession({
+      headers: req.headers
+    });
+    if (!session) {
+      throw new Response("Unauthorized", {
+        status: 401
+      });
+    }
+    return session;
+  }
+  return {
+    verifyAuth,
+    getSession
+  };
+}