@multiplatform.one/keycloak 1.0.1 → 1.0.3

package/src/provider/AuthProvider/AuthProvider.native.tsx

@@ -19,15 +19,168 @@
  * limitations under the License.
  */
 
-import React from 'react';
-import type { AuthProviderProps } from './AuthProvider';
+import React, { useState, useEffect, useMemo, useCallback } from 'react';
+import type { AuthProviderProps, Tokens } from './AuthProvider';
+import type { KeycloakLoginOptions, KeycloakLogoutOptions } from '../../keycloak';
 import { AfterAuth } from '../AfterAuth';
-import { KeycloakProvider as ExpoKeycloakProvider } from 'expo-keycloak-auth';
+import { Keycloak, KeycloakConfigContext } from '../../keycloak';
+import { KeycloakContext } from '../../keycloak/context';
+import { makeRedirectUri, useAuthRequest, useAutoDiscovery, refreshAsync, exchangeCodeAsync } from 'expo-auth-session';
+import { persist, useAuthState } from '../../state';
+import { validOrRefreshableToken, isTokenExpired } from '../../token';
 
 export function AuthProvider({ children, keycloakConfig }: AuthProviderProps) {
+  const [keycloak, setKeycloak] = useState<Keycloak>();
+  const authState = useAuthState();
+  const initialRefreshToken = useMemo(() => validOrRefreshableToken((persist && authState.refreshToken) || false), []);
+  const keycloakUrl = `${keycloakConfig?.url}/realms/${keycloakConfig?.realm}`;
+  const clientId = keycloakConfig.publicClientId || keycloakConfig?.clientId || '';
+  const discovery = useAutoDiscovery(keycloakUrl);
+  const redirectUri = makeRedirectUri();
+  const [tokens, setTokens] = useState<Tokens<false>>({
+    refreshToken: initialRefreshToken,
+    token: validOrRefreshableToken((persist && authState.token) || false, initialRefreshToken),
+    idToken: validOrRefreshableToken((persist && authState.idToken) || false, initialRefreshToken),
+  });
+  const scopes = useMemo(
+    () => [...new Set(['email', 'openid', 'profile', ...(keycloakConfig.scopes || [])])],
+    [keycloakConfig.scopes],
+  );
+  const [request, response, promptAsync] = useAuthRequest(
+    {
+      clientId,
+      redirectUri: redirectUri,
+      scopes,
+    },
+    discovery,
+  );
+
+  useEffect(() => {
+    if (!discovery || !response?.type || !request?.codeVerifier || !clientId) return;
+    (async () => {
+      if (response?.type === 'success' && request.codeVerifier && response.params.code) {
+        const tokenResponse = await exchangeCodeAsync(
+          {
+            clientId,
+            code: response.params.code,
+            redirectUri,
+            scopes,
+            extraParams: {
+              code_verifier: request.codeVerifier,
+            },
+          },
+          discovery,
+        );
+        if (tokenResponse) {
+          setTokens({
+            idToken: tokenResponse.idToken,
+            refreshToken: tokenResponse.refreshToken,
+            token: tokenResponse.accessToken,
+          });
+        }
+      }
+    })();
+  }, [
+    discovery,
+    request?.codeVerifier,
+    response?.type === 'success' ? response?.params?.code : undefined,
+    clientId,
+    scopes,
+    redirectUri,
+  ]);
+
+  const resetTokens = useCallback(() => {
+    authState.setIdToken('');
+    authState.setRefreshToken('');
+    authState.setToken('');
+    setTokens({
+      refreshToken: undefined,
+      token: undefined,
+      idToken: undefined,
+    });
+  }, [authState]);
+
+  const refreshTokens = useCallback(async () => {
+    if (!discovery) return;
+    if (typeof tokens.refreshToken === 'string') {
+      if (!isTokenExpired(tokens.refreshToken)) {
+        const tokenResponse = await refreshAsync(
+          {
+            clientId,
+            refreshToken: tokens.refreshToken,
+            scopes,
+          },
+          discovery,
+        );
+        if (tokenResponse) {
+          setTokens({
+            idToken: tokenResponse.idToken,
+            refreshToken: tokenResponse.refreshToken,
+            token: tokenResponse.accessToken,
+          });
+        } else {
+          resetTokens();
+        }
+      } else {
+        resetTokens();
+      }
+    } else if (
+      authState.refreshToken &&
+      typeof authState.refreshToken === 'string' &&
+      isTokenExpired(authState.refreshToken)
+    ) {
+      resetTokens();
+    }
+  }, [discovery, resetTokens, authState.refreshToken, tokens.refreshToken, clientId, scopes]);
+
+  useEffect(() => {
+    if (!discovery) return;
+    refreshTokens();
+  }, [discovery]);
+
+  useEffect(() => {
+    if (!request) return;
+    let refreshHandle: NodeJS.Timeout;
+    (async () => {
+      if (tokens.token && isTokenExpired(tokens.token)) {
+        await refreshTokens();
+      } else {
+        const _keycloak = new Keycloak(
+          keycloakConfig,
+          tokens.token || undefined,
+          tokens.idToken || undefined,
+          tokens.refreshToken || undefined,
+          async (options: KeycloakLoginOptions) => {
+            await promptAsync(options);
+          },
+          async (_options: KeycloakLogoutOptions) => {
+            resetTokens();
+          },
+        );
+        if (_keycloak.refreshTokenParsed?.exp) {
+          const timeout = (_keycloak.refreshTokenParsed.exp - Math.floor(Date.now() / 1000) - 10) * 1000;
+          if (timeout > 0) {
+            refreshHandle = setTimeout(() => {
+              refreshTokens();
+            }, timeout);
+          } else {
+            setTimeout(() => _keycloak.logout(), Math.max(0, timeout + 10) * 1000);
+            return;
+          }
+        }
+        setKeycloak(_keycloak);
+      }
+    })();
+    return () => {
+      if (refreshHandle) clearTimeout(refreshHandle);
+    };
+  }, [request, tokens.token, tokens.idToken, tokens.refreshToken, refreshTokens, resetTokens]);
+
   return (
-    <ExpoKeycloakProvider {...keycloakConfig}>
-      <AfterAuth>{children}</AfterAuth>
-    </ExpoKeycloakProvider>
+    <KeycloakConfigContext.Provider value={keycloakConfig}>
+      <KeycloakContext.Provider value={keycloak}>
+        <AfterAuth>{children}</AfterAuth>
+      </KeycloakContext.Provider>
+    </KeycloakConfigContext.Provider>
   );
 }

package/src/provider/AuthProvider/AuthProvider.tsx

@@ -19,62 +19,72 @@
  * limitations under the License.
  */
 
+'use client';
+
 import KeycloakClient from 'keycloak-js';
 import React, { useEffect, useMemo, useState } from 'react';
-import type { KeycloakConfig, KeycloakInitOptions } from 'keycloak-js';
+import type { KeycloakInitOptions } from 'keycloak-js';
+import type { KeycloakConfig } from '../../keycloak';
 import type { PropsWithChildren } from 'react';
 import type { SessionProviderProps } from 'next-auth/react';
 import { AfterAuth } from '../AfterAuth';
-import { Keycloak } from '../../keycloak';
+import { Keycloak, KeycloakConfigContext } from '../../keycloak';
 import { KeycloakContext } from '../../keycloak/context';
 import { MultiPlatform } from 'multiplatform.one';
 import { SessionProvider } from 'next-auth/react';
 import { persist, useAuthState } from '../../state';
 import { useAuthConfig } from '../../hooks';
 import { useRouter } from 'next/router';
-import { validToken } from '../../token';
+import { validOrRefreshableToken } from '../../token';
 
 export interface AuthProviderProps extends PropsWithChildren {
-  keycloakConfig?: KeycloakConfig;
+  keycloakConfig: KeycloakConfig;
   keycloakInitOptions?: KeycloakInitOptions;
   sessionProvider?: Omit<SessionProviderProps, 'children'>;
 }
 
 const logger = console;
 
+export interface Tokens<B = boolean> {
+  idToken?: string | B;
+  refreshToken?: string | B;
+  token?: string | B;
+}
+
 export function AuthProvider({ children, sessionProvider, keycloakInitOptions, keycloakConfig }: AuthProviderProps) {
   const { debug, messageHandlerKeys } = useAuthConfig();
   const { query } = MultiPlatform.isNext ? useRouter() : { query: {} };
   const authState = useAuthState();
   const [keycloak, setKeycloak] = useState<Keycloak>();
-  const [refreshToken, setRefreshToken] = useState<string | boolean | undefined>(
-    validToken(
-      MultiPlatform.isIframe
-        ? ('refreshToken' in query && (query.refreshToken?.toString() || true)) ||
-            (persist && authState.refreshToken) ||
-            false
-        : undefined,
-    ),
+  const initialRefreshToken = useMemo(
+    () =>
+      validOrRefreshableToken(
+        MultiPlatform.isIframe
+          ? ('refreshToken' in query && (query.refreshToken?.toString() || true)) ||
+              (persist && authState.refreshToken) ||
+              false
+          : undefined,
+      ),
+    [],
   );
-  const [token, setToken] = useState<string | boolean | undefined>(
-    validToken(
+  const [tokens, setTokens] = useState<Tokens>({
+    refreshToken: initialRefreshToken,
+    token: validOrRefreshableToken(
       MultiPlatform.isIframe
         ? ('token' in query && (query.token?.toString() || true)) || (persist && authState.token) || false
         : undefined,
-      refreshToken,
+      initialRefreshToken,
     ),
-  );
-  const [idToken, setIdToken] = useState<string | boolean | undefined>(
-    validToken(
+    idToken: validOrRefreshableToken(
       MultiPlatform.isIframe
         ? ('idToken' in query && (query.idToken?.toString() || true)) || (persist && authState.idToken) || false
         : undefined,
-      refreshToken,
+      initialRefreshToken,
     ),
-  );
+  });
 
   useEffect(() => {
-    if (token !== true && refreshToken !== true && idToken !== true) return;
+    if (tokens.token !== true && tokens.refreshToken !== true && tokens.idToken !== true) return;
     if (debug) logger.debug('post message', JSON.stringify({ type: 'LOADED' }));
     (messageHandlerKeys || []).forEach((key: string) => {
       window?.webkit?.messageHandlers?.[key]?.postMessage(JSON.stringify({ type: 'LOADED' }));
@@ -84,7 +94,7 @@ export function AuthProvider({ children, sessionProvider, keycloakInitOptions, k
   }, []);
 
   useEffect(() => {
-    if (refreshToken !== true) return;
+    if (tokens.refreshToken !== true) return;
     const messageCallback = (e: MessageEvent<any>) => {
       let data = e?.data || null;
       if (typeof data === 'string') {
@@ -97,7 +107,7 @@ export function AuthProvider({ children, sessionProvider, keycloakInitOptions, k
       if (!message.type) return;
       if (message.type.toUpperCase() === 'REFRESH_TOKEN' && message.payload) {
         if (debug) logger.debug('setting refresh token', message.payload);
-        setRefreshToken(validToken(message.payload));
+        setTokens((tokens) => ({ ...tokens, refreshToken: validOrRefreshableToken(message.payload) }));
         window.removeEventListener('message', messageCallback);
       }
     };
@@ -117,7 +127,7 @@ export function AuthProvider({ children, sessionProvider, keycloakInitOptions, k
   }, []);
 
   useEffect(() => {
-    if (token !== true) return;
+    if (tokens.token !== true) return;
     const messageCallback = (e: MessageEvent<any>) => {
       let data = e?.data || null;
       if (typeof data === 'string') {
@@ -130,7 +140,7 @@ export function AuthProvider({ children, sessionProvider, keycloakInitOptions, k
       if (!message.type) return;
       if (message.type.toUpperCase() === 'TOKEN' && message.payload) {
         if (debug) logger.debug('setting token', message.payload);
-        setToken(validToken(message.payload, refreshToken));
+        setTokens((tokens) => ({ ...tokens, token: validOrRefreshableToken(message.payload, tokens.refreshToken) }));
         window.removeEventListener('message', messageCallback);
       }
     };
@@ -150,7 +160,7 @@ export function AuthProvider({ children, sessionProvider, keycloakInitOptions, k
   }, []);
 
   useEffect(() => {
-    if (idToken !== true) return;
+    if (tokens.idToken !== true) return;
     const messageCallback = (e: MessageEvent<any>) => {
       let data = e?.data || null;
       if (typeof data === 'string') {
@@ -163,7 +173,7 @@ export function AuthProvider({ children, sessionProvider, keycloakInitOptions, k
       if (!message.type) return;
       if (message.type.toUpperCase() === 'ID_TOKEN' && message.payload) {
         if (debug) logger.debug('setting id token', message.payload);
-        setIdToken(validToken(message.payload, refreshToken));
+        setTokens((tokens) => ({ ...tokens, idToken: validOrRefreshableToken(message.payload, tokens.refreshToken) }));
         window.removeEventListener('message', messageCallback);
       }
     };
@@ -188,39 +198,50 @@ export function AuthProvider({ children, sessionProvider, keycloakInitOptions, k
         ? new KeycloakClient({
             url: keycloakConfig.url,
             realm: keycloakConfig.realm,
-            clientId: keycloakConfig.clientId,
+            clientId: keycloakConfig.publicClientId || keycloakConfig.clientId,
           })
         : undefined,
-    [keycloakInitOptions, keycloakConfig, token, refreshToken, idToken],
+    [keycloakInitOptions, keycloakConfig, tokens.token, tokens.refreshToken, tokens.idToken],
   );
 
   const initOptions = useMemo(() => {
     if (!MultiPlatform.isIframe) return;
-    const initOptions = {
+    const initOptions: KeycloakInitOptions = {
       ...defaultKeycloakInitOptions,
       ...keycloakInitOptions,
+      scope: [
+        ...new Set([
+          'email',
+          'openid',
+          'profile',
+          ...(defaultKeycloakInitOptions.scope?.split(' ') || []),
+          ...(keycloakInitOptions?.scope?.split(' ') || []),
+          ...(keycloakConfig.scopes || []),
+        ]),
+      ].join(' '),
     };
     if (debug) initOptions.enableLogging = true;
-    if (token && typeof token === 'string') {
-      initOptions.token = token;
+    if (tokens.token && typeof tokens.token === 'string') {
+      initOptions.token = tokens.token;
       initOptions.timeSkew = 0;
-      if (idToken && typeof idToken === 'string') initOptions.idToken = idToken;
-      if (refreshToken && typeof refreshToken === 'string') initOptions.refreshToken = refreshToken;
+      if (tokens.idToken && typeof tokens.idToken === 'string') initOptions.idToken = tokens.idToken;
+      if (tokens.refreshToken && typeof tokens.refreshToken === 'string')
+        initOptions.refreshToken = tokens.refreshToken;
     }
-    if ((typeof window !== 'undefined' && window.self !== window.top) || (token && !refreshToken)) {
+    if ((typeof window !== 'undefined' && window.self !== window.top) || (tokens.token && !tokens.refreshToken)) {
       initOptions.checkLoginIframe = false;
       initOptions.flow = 'implicit';
       initOptions.onLoad = undefined;
     }
     return initOptions;
-  }, [keycloakInitOptions, token, idToken, refreshToken]);
+  }, [keycloakInitOptions, keycloakConfig.scopes, tokens.token, tokens.idToken, tokens.refreshToken]);
 
   useEffect(() => {
     function onError() {
-      if (keycloakClient && initOptions) setKeycloak(new Keycloak(keycloakClient));
+      if (keycloakClient && initOptions) setKeycloak(new Keycloak(keycloakConfig, keycloakClient));
     }
     function onUpdate() {
-      if (keycloakClient && initOptions) setKeycloak(new Keycloak(keycloakClient));
+      if (keycloakClient && initOptions) setKeycloak(new Keycloak(keycloakConfig, keycloakClient));
     }
     if (keycloakClient && initOptions) {
       (async () => {
@@ -234,20 +255,22 @@ export function AuthProvider({ children, sessionProvider, keycloakInitOptions, k
           try {
             await keycloakClient.updateToken(5);
           } catch (err) {
-            setKeycloak(new Keycloak());
+            setKeycloak(new Keycloak(keycloakConfig));
           }
         };
         const authenticated = await keycloakClient.init(initOptions);
-        setKeycloak(new Keycloak(authenticated ? keycloakClient : undefined));
+        setKeycloak(new Keycloak(keycloakConfig, authenticated ? keycloakClient : undefined));
       })();
     }
   }, []);
 
   return (
     <SessionProvider {...sessionProvider}>
-      <KeycloakContext.Provider value={keycloak}>
-        <AfterAuth>{children}</AfterAuth>
-      </KeycloakContext.Provider>
+      <KeycloakConfigContext.Provider value={keycloakConfig}>
+        <KeycloakContext.Provider value={keycloak}>
+          <AfterAuth>{children}</AfterAuth>
+        </KeycloakContext.Provider>
+      </KeycloakConfigContext.Provider>
     </SessionProvider>
   );
 }

package/src/provider/KeycloakProvider.tsx

@@ -29,11 +29,20 @@ import { AuthProvider } from './AuthProvider';
 export interface KeycloakProviderProps extends PropsWithChildren, AuthConfig {
   baseUrl?: string;
   clientId?: string;
+  publicClientId?: string;
   realm?: string;
   session?: Session;
 }
 
-export function KeycloakProvider({ children, debug, realm, clientId, baseUrl, session }: KeycloakProviderProps) {
+export function KeycloakProvider({
+  children,
+  debug,
+  realm,
+  clientId,
+  baseUrl,
+  publicClientId,
+  session,
+}: KeycloakProviderProps) {
   const authConfig = useMemo(() => ({ debug }), [debug]);
 
   return (
@@ -41,8 +50,9 @@ export function KeycloakProvider({ children, debug, realm, clientId, baseUrl, se
       <AuthProvider
         sessionProvider={{ session }}
         keycloakConfig={{
-          realm: realm || 'main',
           clientId: clientId || 'app',
+          publicClientId,
+          realm: realm || 'main',
           url: baseUrl,
         }}
       >

package/src/routes.ts

@@ -37,21 +37,28 @@ const NextResponse = require('next/server').NextResponse as typeof import('next/
 
 const logger = console;
 
-export function createAuthHandler(options = createNextAuthOptions()) {
-  return NextAuth(options);
+export function createAuthHandler(options: AuthHandlerOptions) {
+  return NextAuth(createNextAuthOptions(options));
 }
 
-export function createLogoutHandler(options = createNextAuthOptions()) {
+const defaults = {
+  keycloak: {
+    baseUrl: 'http://localhost:8080',
+    realm: 'master',
+  },
+};
+
+export function createLogoutHandler(options: AuthHandlerOptions) {
   return {
     async GET() {
-      const idToken = ((await getServerSession(options)) as Session)?.idToken;
+      const idToken = ((await getServerSession(createNextAuthOptions(options))) as Session)?.idToken;
       if (idToken) {
         try {
           await fetch(
-            `${process.env.KEYCLOAK_BASE_URL}/realms/${
-              process.env.KEYCLOAK_REALM || 'master'
+            `${options.keycloak?.baseUrl || defaults.keycloak.baseUrl}/realms/${
+              options.keycloak?.realm || defaults.keycloak.realm
             }/protocol/openid-connect/logout?id_token_hint=${idToken}&post_logout_redirect_uri=${encodeURIComponent(
-              process.env.NEXTAUTH_URL || '',
+              options.baseUrl,
             )}`,
             { method: 'GET' },
           );
@@ -65,16 +72,32 @@ export function createLogoutHandler(options = createNextAuthOptions()) {
   };
 }
 
-export function createNextAuthOptions(options: CreateAuthHandlerOptions = {}) {
+export function createNextAuthOptions(options: AuthHandlerOptions) {
   if (_nextAuth) return _nextAuth;
+  const authorization =
+    options.keycloak.authorization && typeof options.keycloak.authorization === 'object'
+      ? options.keycloak.authorization
+      : {};
   _nextAuth = {
     ...options.nextAuth,
     providers: [
       KeycloakProvider({
-        clientId: process.env.KEYCLOAK_CLIENT_ID || '',
-        clientSecret: process.env.KEYCLOAK_CLIENT_SECRET || '',
-        issuer: `${process.env.KEYCLOAK_BASE_URL}/realms/${process.env.KEYCLOAK_REALM || 'master'}`,
-        ...options.keycloakProvider,
+        issuer: `${options.keycloak?.baseUrl || defaults.keycloak.baseUrl}/realms/${options.keycloak?.realm || defaults.keycloak.realm}`,
+        authorization: {
+          ...authorization,
+          params: {
+            scope: [
+              ...new Set([
+                'email',
+                'openid',
+                'profile',
+                ...(authorization.params?.scope?.split(' ') || []),
+                ...(options.scopes || []),
+              ]),
+            ].join(' '),
+          },
+        },
+        ...options.keycloak,
       }),
       ...(options.nextAuth?.providers || []),
     ],
@@ -98,7 +121,7 @@ export function createNextAuthOptions(options: CreateAuthHandlerOptions = {}) {
           return token;
         } else {
           try {
-            return refreshAccessToken(token as NextToken);
+            return refreshAccessToken(options, token as NextToken);
           } catch (err) {
             return { ...token, err };
           }
@@ -121,9 +144,18 @@ export function createNextAuthOptions(options: CreateAuthHandlerOptions = {}) {
   return _nextAuth;
 }
 
-export interface CreateAuthHandlerOptions {
-  keycloakProvider?: Partial<OAuthUserConfig<any>>;
-  nextAuth?: AuthOptions;
+export interface AuthHandlerOptions {
+  baseUrl: string;
+  keycloak: KeycloakOptions;
+  nextAuth?: Partial<AuthOptions>;
+  scopes?: string[];
+}
+
+export interface KeycloakOptions extends OAuthUserConfig<any> {
+  adminPassword?: string;
+  adminUsername?: string;
+  baseUrl?: string;
+  realm?: string;
 }
 
 export interface NextToken extends JWT {
@@ -136,17 +168,19 @@ export interface NextToken extends JWT {
   roles: string[];
 }
 
-async function refreshAccessToken(nextToken: NextToken) {
+async function refreshAccessToken(options: AuthHandlerOptions, nextToken: NextToken) {
   const res = await fetch(
-    `${process.env.KEYCLOAK_BASE_URL}/realms/${process.env.KEYCLOAK_REALM || 'master'}/protocol/openid-connect/token`,
+    `${options.keycloak?.baseUrl || defaults.keycloak.baseUrl}/realms/${
+      options.keycloak?.realm || defaults.keycloak.realm
+    }/protocol/openid-connect/token`,
     {
       method: 'POST',
       headers: {
         'Content-Type': 'application/x-www-form-urlencoded',
       },
       body: new URLSearchParams({
-        client_id: process.env.KEYCLOAK_CLIENT_ID || '',
-        client_secret: process.env.KEYCLOAK_CLIENT_SECRET || '',
+        client_id: options.keycloak.clientId,
+        client_secret: options.keycloak.clientSecret,
         grant_type: 'refresh_token',
         refresh_token: nextToken.refreshToken,
       }),

package/src/session/session.ts

@@ -20,21 +20,13 @@
  */
 
 import type { AuthOptions, Session as NextSession } from 'next-auth';
+import type { SessionContextValue as NextSessionContextValue, UseSessionOptions } from 'next-auth/react';
 import { MultiPlatform } from 'multiplatform.one';
 import { useSession as useNextSession, getSession as getNextSession } from 'next-auth/react';
-import type {
-  GetSessionParams,
-  SessionContextValue as NextSessionContextValue,
-  UseSessionOptions,
-} from 'next-auth/react';
 
 let _getServerSession: ((options?: AuthOptions, req?: any, res?: any) => Promise<Session | null>) | undefined;
 
-export async function getSession(
-  options?: AuthOptions | GetSessionParams,
-  req?: any,
-  res?: any,
-): Promise<Session | null> {
+export async function getSession(options?: AuthOptions, req?: any, res?: any): Promise<Session | null> {
   if (MultiPlatform.isServer) {
     if (typeof _getServerSession === 'function') return _getServerSession(options as AuthOptions, req, res);
     const getSession = (await import('next-auth')).getServerSession;
@@ -43,17 +35,14 @@ export async function getSession(
     };
     return _getServerSession(options as AuthOptions, req, res);
   }
-  return getNextSession(options as GetSessionParams);
+  return getNextSession();
 }
 
 export type SessionContextValue<R extends boolean> = Partial<
   Omit<NextSessionContextValue<R> & { session: Session }, 'data'>
 >;
 
-let useSession = <R extends boolean>(
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  options?: UseSessionOptions<R>,
-): SessionContextValue<R> => {
+let useSession = <R extends boolean>(_options?: UseSessionOptions<R>): SessionContextValue<R> => {
   return {};
 };
 

package/src/token.ts

@@ -22,21 +22,29 @@
 import type { KeycloakTokenParsed } from 'keycloak-js';
 import { jwtDecode } from 'jwt-decode';
 
-export function validToken(token?: string | boolean, refreshToken?: string | boolean) {
+export function validOrRefreshableToken(
+  token?: string | false,
+  refreshToken?: string | boolean,
+): string | false | undefined;
+export function validOrRefreshableToken(
+  token?: string | boolean,
+  refreshToken?: string | boolean,
+): string | boolean | undefined;
+export function validOrRefreshableToken(token?: string | boolean, refreshToken?: string | boolean) {
   if (typeof token === 'undefined') return;
   if (!token) return false;
   if (typeof token !== 'string') return token;
   if (refreshToken) {
-    if (refreshToken === true || isTokenValid(refreshToken)) return token;
+    if (refreshToken === true || !isTokenExpired(refreshToken)) return token;
     return false;
   }
-  return isTokenValid(token) ? token : false;
+  return isTokenExpired(token) ? false : token;
 }
 
-export function isTokenValid(token: string) {
+export function isTokenExpired(token: string) {
   const { exp } = jwtDecode(token) as TokenParsed;
   if (!exp) return false;
-  return Math.floor(Date.now() / 1000) <= exp;
+  return Math.floor(Date.now() / 1000) >= exp;
 }
 
 export interface TokenParsed extends KeycloakTokenParsed {

package/lib/@types/expoKeycloakAuth.d.d.ts

@@ -1,25 +0,0 @@
-/*
- *  File: /src/@types/expoKeycloakAuth.d.ts
- *  Project: @multiplatform.one/keycloak
- *  File Created: 22-06-2023 10:07:56
- *  Author: Clay Risser
- *  -----
- *  BitSpur (c) Copyright 2021 - 2023
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- */
-
-declare module 'expo-keycloak-auth' {
-  export function useKeycloak(): any;
-  export const KeycloakProvider: any;
-}