@multiplatform.one/keycloak-js 6.0.0

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@multiplatform.one/keycloak-js",
+  "version": "6.0.0",
+  "description": "Keycloak JS adapter vendored and patched (e.g. timeout overflow fix). Built from upstream keycloak-js at build time.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://gitlab.com/bitspur/frappe/multiplatform.one"
+  },
+  "files": [
+    "dist",
+    "patches",
+    "README.md"
+  ],
+  "type": "module",
+  "main": "./dist/keycloak.js",
+  "types": "./dist/keycloak.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/keycloak.d.ts",
+      "import": "./dist/keycloak.js",
+      "default": "./dist/keycloak.js"
+    },
+    "./authz": {
+      "types": "./dist/keycloak-authz.d.ts",
+      "import": "./dist/keycloak-authz.js",
+      "default": "./dist/keycloak-authz.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "js-sha256": "^0.11.1",
+    "jwt-decode": "^4.0.0"
+  },
+  "devDependencies": {
+    "keycloak-js": "26.2.4"
+  },
+  "scripts": {
+    "build": "node scripts/vendorAndPatch.mjs"
+  }
+}

package/patches/README.md

@@ -0,0 +1,34 @@
+# Patches for keycloak-js
+
+This directory is the **only** keycloak-js source stored in the repo. The npm `build` script vendors upstream keycloak-js from `node_modules` and applies every `*.patch` file here (in alphabetical order), then writes the result to `dist/`.
+
+## Adding a patch
+
+1. **Create the patch file** against the **keycloak-js package root** (same layout as `node_modules/keycloak-js`). Paths in the patch should be relative to that root (e.g. `lib/keycloak.js`).
+
+   **From your existing fork (e.g. GitLab):**
+   - Check out upstream keycloak-js and your patched version.
+   - From the keycloak-js root:  
+     `diff -u dist/keycloak.mjs upstream/dist/keycloak.mjs > timeout-overflow.patch`  
+     (or use `git diff` if both are in git and paths match.)
+
+   **From node_modules:**
+   - Copy `node_modules/keycloak-js` to a temp dir, make your fix, then:  
+     `diff -ru keycloak-js-orig keycloak-js-patched > patches/your-fix.patch`
+   - Edit the patch so paths are relative to the keycloak-js root (e.g. `a/lib/keycloak.js`, `b/lib/keycloak.js` → `lib/keycloak.js` if needed for `patch -p1`).
+
+2. **Name the file** `*.patch` and put it in this directory. Patches are applied in alphabetical order.
+
+3. **Run** `pnpm build` in this package (or from root with a filter). The script will vendor keycloak-js, apply all patches, and output to `dist/`.
+
+## Upgrading upstream
+
+1. Bump the `keycloak-js` version in `package.json` under `devDependencies`.
+2. Run `pnpm install`.
+3. Re-apply or re-create patches (they may need manual adjustment if upstream changed).
+4. Run `pnpm build` and test (e.g. in siwe-keycloak).
+5. Bump this package’s version (e.g. `24.0.6-patch.1`) and publish.
+
+## Current patches
+
+- **timeout-overflow.patch** — Caps the token-expiry `setTimeout` delay to `2147483647` ms (2^31−1). Prevents 32-bit overflow when `expiresIn` is very large (e.g. long-lived tokens), which would cause the timer to fire immediately or behave incorrectly.

package/patches/timeout-overflow.patch

@@ -0,0 +1,11 @@
+--- a/lib/keycloak.js
++++ b/lib/keycloak.js
+@@ -1576,7 +1576,7 @@
+           if (expiresIn <= 0) {
+             this.onTokenExpired()
+           } else {
+-            this.tokenTimeoutHandle = window.setTimeout(this.onTokenExpired, expiresIn)
++            this.tokenTimeoutHandle = window.setTimeout(this.onTokenExpired, Math.min(expiresIn, 2147483647))
+           }
+         }
+       }