@multiplatform.one/keycloak 3.0.0 → 5.0.0

package/src/keycloak/config.ts

@@ -19,10 +19,8 @@
  * limitations under the License.
  */
 
-'use client';
-
-import type { KeycloakConfig as KeycloakJsConfig } from 'keycloak-js';
-import { createContext } from 'react';
+import type { KeycloakConfig as KeycloakJsConfig } from "keycloak-js";
+import { createContext } from "react";
 
 export interface KeycloakConfig extends KeycloakJsConfig {
   publicClientId?: string;
@@ -30,7 +28,7 @@ export interface KeycloakConfig extends KeycloakJsConfig {
 }
 
 export const KeycloakConfigContext = createContext<KeycloakConfig>({
-  clientId: '',
-  realm: '',
-  url: '',
+  clientId: "",
+  realm: "",
+  url: "",
 });

package/src/keycloak/context.ts

@@ -19,9 +19,7 @@
  * limitations under the License.
  */
 
-'use client';
-
-import type { Keycloak } from './keycloak';
-import { createContext } from 'react';
+import { createContext } from "react";
+import type { Keycloak } from ".";
 
 export const KeycloakContext = createContext<Keycloak | undefined>(undefined);

package/{routes/index.d.ts → src/keycloak/index.electron.ts}

@@ -1,7 +1,7 @@
-/*
- * File: /routes/index.d.ts
+/**
+ * File: /src/keycloak/index.electron.ts
  * Project: @multiplatform.one/keycloak
- * File Created: 04-04-2024 15:50:39
+ * File Created: 23-12-2024 00:51:34
  * Author: Clay Risser
  * -----
  * BitSpur (c) Copyright 2021 - 2024
@@ -19,4 +19,9 @@
  * limitations under the License.
  */
 
-export * from '../types/routes';
+import { BaseKeycloak } from "./base";
+
+export class Keycloak extends BaseKeycloak {}
+
+export * from "./base";
+export * from "./config";

package/src/keycloak/index.native.ts

@@ -0,0 +1,46 @@
+/**
+ * File: /src/keycloak/index.native.ts
+ * Project: @multiplatform.one/keycloak
+ * File Created: 19-11-2024 20:26:31
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2021 - 2024
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { isStorybook } from "multiplatform.one";
+import { useContext } from "react";
+import { useAuthConfig } from "../hooks";
+import { BaseKeycloak } from "./base";
+import { KeycloakConfigContext } from "./config";
+import { KeycloakContext } from "./context";
+
+export class Keycloak extends BaseKeycloak {}
+
+export function useKeycloak() {
+  const keycloak = useContext(KeycloakContext);
+  const keycloakConfig = useContext(KeycloakConfigContext);
+  const { disabled } = useAuthConfig();
+  if (disabled) return null;
+  if (keycloak) return keycloak;
+  if (isStorybook) {
+    return new Keycloak(keycloakConfig, {
+      email: "storybook@example.com",
+      username: "storybook",
+    });
+  }
+}
+
+export * from "./base";
+export * from "./config";

package/src/keycloak/index.ts

@@ -1,7 +1,7 @@
 /*
  * File: /src/keycloak/index.ts
  * Project: @multiplatform.one/keycloak
- * File Created: 04-04-2024 15:50:39
+ * File Created: 25-12-2024 04:55:48
  * Author: Clay Risser
  * -----
  * BitSpur (c) Copyright 2021 - 2024
@@ -19,5 +19,152 @@
  * limitations under the License.
  */
 
-export * from './config';
-export * from './keycloak';
+import type KeycloakClient from "keycloak-js";
+import { isBrowser, isServer, isStorybook } from "multiplatform.one";
+import {
+  type SignInAuthorizationParams,
+  type SignInOptions,
+  type SignInResponse,
+  getCsrfToken,
+  getProviders,
+  getSession,
+  signOut,
+} from "next-auth/react";
+import { useContext } from "react";
+import { useAuthConfig } from "../hooks";
+import type { Session } from "../session";
+import { useSession } from "../session";
+import type { KeycloakMock } from "../types";
+import {
+  BaseKeycloak,
+  type KeycloakLoginOptions,
+  type KeycloakLogoutOptions,
+} from "./base";
+import { KeycloakConfigContext } from "./config";
+import { KeycloakContext } from "./context";
+
+export class Keycloak extends BaseKeycloak {
+  protected _handleInputObject(input: KeycloakClient | KeycloakMock | Session) {
+    if (typeof (input as KeycloakClient).init === "function") {
+      this._keycloakClient = input as KeycloakClient;
+    } else if ((input as Session).accessToken) {
+      const session = input as Session;
+      this.token = session.accessToken;
+      this.idToken = session.idToken;
+      this.refreshToken = session.refreshToken;
+      this._parseTokens();
+    } else {
+      this._mock = input as KeycloakMock;
+    }
+  }
+
+  async login(options: KeycloakLoginOptions = {}) {
+    this._clear();
+    if (this._keycloakClient) {
+      await this._keycloakClient.login(options);
+    } else if (isBrowser && !isServer) {
+      await cookieSignIn({
+        callbackUrl: options.redirectUri,
+        ...(typeof options.redirect !== "undefined"
+          ? { redirect: options.redirect }
+          : {}),
+      });
+    } else {
+      await this._login?.(options);
+    }
+    this._sync();
+  }
+
+  async logout(options: KeycloakLogoutOptions = {}) {
+    if (this._keycloakClient) {
+      await this._keycloakClient.logout(options);
+    } else if (isBrowser && !isServer) {
+      await fetch("/api/auth/logout", { method: "GET" });
+      await signOut({
+        callbackUrl: options.redirectUri,
+      });
+    } else {
+      await this._logout?.(options);
+    }
+    this._clear();
+  }
+}
+
+export function useKeycloak() {
+  const keycloak = useContext(KeycloakContext);
+  const keycloakConfig = useContext(KeycloakConfigContext);
+  const { disabled } = useAuthConfig();
+  if (disabled) return null;
+  if (keycloak) return keycloak;
+  const { session, status } = useSession();
+  if (isStorybook) {
+    return new Keycloak(keycloakConfig, {
+      email: "storybook@example.com",
+      username: "storybook",
+    });
+  }
+  if (status === "unauthenticated") {
+    return new Keycloak(keycloakConfig);
+  }
+  if (status === "authenticated" && session?.accessToken) {
+    return new Keycloak(keycloakConfig, session as Session);
+  }
+}
+
+export async function cookieSignIn(
+  options?: SignInOptions,
+  authorizationParams?: SignInAuthorizationParams,
+): Promise<SignInResponse | undefined> {
+  const provider = "keycloak";
+  const baseUrl = `${new URL(window.location.href).origin}/api/auth`;
+  const { callbackUrl = window.location.href, redirect = true } = options ?? {};
+  const providers = await getProviders();
+  if (!providers) {
+    window.location.href = `${baseUrl}/error`;
+    return;
+  }
+  if (!provider || !(provider in providers)) {
+    window.location.href = `${baseUrl}/signin?${new URLSearchParams({
+      callbackUrl,
+    })}`;
+    return;
+  }
+  const isCredentials = providers[provider].type === "credentials";
+  const isEmail = providers[provider].type === "email";
+  const isSupportingReturn = isCredentials || isEmail;
+  const signInUrl = `${baseUrl}/${
+    isCredentials ? "callback" : "signin"
+  }/${provider}`;
+  const _signInUrl = `${signInUrl}${authorizationParams ? `?${new URLSearchParams(authorizationParams)}` : ""}`;
+  const res = await fetch(_signInUrl, {
+    method: "post",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "X-Auth-Return-Redirect": "1",
+    },
+    body: new URLSearchParams({
+      ...(options as any),
+      csrfToken: await getCsrfToken(),
+      callbackUrl,
+      json: true,
+    }),
+  });
+  const data = await res.json();
+  if (redirect || !isSupportingReturn) {
+    const url = data.url ?? callbackUrl;
+    window.location.href = url;
+    if (url.includes("#")) window.location.reload();
+    return;
+  }
+  const error = new URL(data.url).searchParams.get("error");
+  if (res.ok) await getSession({ event: "storage" });
+  return {
+    error,
+    status: res.status,
+    ok: res.ok,
+    url: error ? null : data.url,
+  };
+}
+
+export * from "./base";
+export * from "./config";

package/src/one.ts

@@ -0,0 +1,170 @@
+/**
+ * File: /src/one.ts
+ * Project: @multiplatform.one/keycloak
+ * File Created: 19-11-2024 20:26:31
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2021 - 2024
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type { AuthConfig } from "@auth/core";
+import type { JWT } from "@auth/core/jwt";
+import type { OAuthUserConfig } from "@auth/core/providers";
+import KeycloakProvider from "@auth/core/providers/keycloak";
+import { jwtDecode } from "jwt-decode";
+import type { Session } from "./session/index";
+import type { AccessTokenParsed } from "./token";
+
+let _authConfig: AuthConfig | undefined;
+const defaults = {
+  keycloak: {
+    baseUrl: "http://localhost:8080",
+    realm: "master",
+  },
+};
+
+export function createAuthConfig(config: AuthHandlerConfig) {
+  if (_authConfig) return _authConfig;
+  const authorization =
+    config.keycloak.authorization &&
+    typeof config.keycloak.authorization === "object"
+      ? config.keycloak.authorization
+      : {};
+  _authConfig = {
+    ...config.auth,
+    basePath: "/api/auth",
+    trustHost: true,
+    providers: [
+      KeycloakProvider({
+        issuer: `${config.keycloak?.baseUrl || defaults.keycloak.baseUrl}/realms/${config.keycloak?.realm || defaults.keycloak.realm}`,
+        authorization: {
+          ...authorization,
+          params: {
+            scope: [
+              ...new Set([
+                "email",
+                "openid",
+                "profile",
+                ...(authorization.params?.scope?.split(" ") || []),
+                ...(config.scopes || []),
+              ]),
+            ].join(" "),
+          },
+        },
+        ...config.keycloak,
+      }),
+      ...(config.auth?.providers || []),
+    ],
+    callbacks: {
+      ...config.auth?.callbacks,
+      async jwt(params) {
+        if (typeof config.auth?.callbacks?.jwt === "function") {
+          return config.auth?.callbacks.jwt(params);
+        }
+        const { token, account } = params;
+        if (account) {
+          const decoded = jwtDecode(
+            account.access_token || "",
+          ) as AccessTokenParsed;
+          token.decoded = decoded;
+          token.accessToken = account.access_token;
+          token.idToken = account.id_token;
+          token.expiresAt = account.expires_at;
+          token.refreshToken = account.refresh_token;
+          token.roles = decoded.realm_access?.roles;
+          return token;
+        }
+        if (Math.floor(Date.now() / 1000) < Number(token.expiresAt)) {
+          return token;
+        }
+        try {
+          return refreshAccessToken(config, token as AuthToken);
+        } catch (err) {
+          return { ...token, err };
+        }
+      },
+      async session(params) {
+        if (typeof config.auth?.callbacks?.session === "function") {
+          return config.auth.callbacks.session(params);
+        }
+        const { session: nextSession, token: nextToken } = params;
+        const session = nextSession as Session;
+        const token = nextToken as AuthToken;
+        if (token.accessToken) session.accessToken = token.accessToken;
+        if (token.idToken) session.idToken = token.idToken;
+        session.err = token.err;
+        return session;
+      },
+    } as AuthConfig["callbacks"],
+  } as AuthConfig;
+  return _authConfig;
+}
+
+async function refreshAccessToken(
+  options: AuthHandlerConfig,
+  nextToken: AuthToken,
+) {
+  const res = await fetch(
+    `${options.keycloak?.baseUrl || defaults.keycloak.baseUrl}/realms/${
+      options.keycloak?.realm || defaults.keycloak.realm
+    }/protocol/openid-connect/token`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+      body: new URLSearchParams({
+        client_id: options.keycloak.clientId || "",
+        client_secret: options.keycloak.clientSecret || "",
+        grant_type: "refresh_token",
+        refresh_token: nextToken.refreshToken,
+      }),
+    },
+  );
+  const refreshToken = await res.json();
+  if (!res.ok) throw refreshToken;
+  return {
+    ...nextToken,
+    accessToken: refreshToken.access_token,
+    decoded: jwtDecode(refreshToken.access_token),
+    expiresAt: Math.floor(Date.now() / 1000) + Number(refreshToken.expires_in),
+    idToken: refreshToken.id_token,
+    refreshToken: refreshToken.refresh_token,
+  };
+}
+
+export interface AuthToken extends JWT {
+  accessToken?: string;
+  decoded: AccessTokenParsed;
+  err?: Error;
+  expiresAt: number;
+  idToken?: string;
+  refreshToken: string;
+  roles: string[];
+}
+
+export interface KeycloakOptions extends OAuthUserConfig<any> {
+  adminPassword?: string;
+  adminUsername?: string;
+  baseUrl?: string;
+  realm?: string;
+}
+
+export interface AuthHandlerConfig {
+  baseUrl: string;
+  keycloak: KeycloakOptions;
+  auth?: Partial<AuthConfig>;
+  scopes?: string[];
+}

package/src/provider/AfterAuth.tsx

@@ -19,47 +19,68 @@
  * limitations under the License.
  */
 
-'use client';
+import { logger } from "multiplatform.one";
+import { type ComponentType, type PropsWithChildren, useEffect } from "react";
+import { Loading } from "../Loading";
+import { useAuthConfig } from "../hooks";
+import { useKeycloak } from "../keycloak/index";
+import { persist, useAuthStore } from "../state";
 
-import React, { useEffect } from 'react';
-import type { PropsWithChildren } from 'react';
-import { useAuthConfig } from '../hooks';
-import { useAuthState, persist } from '../state';
-import { useKeycloak } from '../keycloak';
-
-export interface AfterAuthProps extends PropsWithChildren {}
-
-const logger = console;
+export interface AfterAuthProps extends PropsWithChildren {
+  loadingComponent?: ComponentType;
+}
 
-export function AfterAuth({ children }: AfterAuthProps) {
+export function AfterAuth({ children, loadingComponent }: AfterAuthProps) {
   const authConfig = useAuthConfig();
-  const authState = useAuthState();
+  const authStore = useAuthStore();
   const keycloak = useKeycloak();
 
   useEffect(() => {
-    if (!persist || !keycloak?.authenticated) return;
+    if (!authStore || !persist || !keycloak?.authenticated) return;
     if (keycloak.token) {
-      authState.setToken(keycloak.token);
-      if (keycloak.idToken) authState.setIdToken(keycloak.idToken);
-      if (keycloak.refreshToken) authState.setRefreshToken(keycloak.refreshToken);
+      authStore.token = keycloak.token;
+      if (keycloak.idToken) authStore.idToken = keycloak.idToken;
+      if (keycloak.refreshToken) authStore.refreshToken = keycloak.refreshToken;
+    }
+  }, [
+    authStore,
+    persist,
+    keycloak?.authenticated,
+    keycloak?.token,
+    keycloak?.idToken,
+    keycloak?.refreshToken,
+  ]);
+
+  useEffect(() => {
+    if (authConfig.debug && keycloak?.token) {
+      logger.debug("token", keycloak.token);
     }
-  }, [keycloak?.authenticated, keycloak?.token, keycloak?.idToken, keycloak?.refreshToken]);
+  }, [authConfig.debug, keycloak?.token]);
 
   useEffect(() => {
-    if (authConfig.debug && keycloak?.token) logger.debug('token', keycloak.token);
-  }, [keycloak?.token]);
+    if (authConfig.debug && keycloak?.idToken) {
+      logger.debug("idToken", keycloak.idToken);
+    }
+  }, [authConfig.debug, keycloak?.idToken]);
 
   useEffect(() => {
-    if (authConfig.debug && keycloak?.idToken) logger.debug('idToken', keycloak.idToken);
-  }, [keycloak?.idToken]);
+    if (authConfig.debug && keycloak?.refreshToken) {
+      logger.debug("refreshToken", keycloak.refreshToken);
+    }
+  }, [authConfig.debug, keycloak?.refreshToken]);
 
   useEffect(() => {
-    if (authConfig.debug && keycloak?.refreshToken) logger.debug('refreshToken', keycloak.refreshToken);
-  }, [keycloak?.refreshToken]);
+    if (authConfig.debug && keycloak?.authenticated) {
+      logger.debug("authenticated", keycloak.authenticated);
+    }
+  }, [authConfig.debug, keycloak?.authenticated]);
 
   useEffect(() => {
-    if (authConfig.debug && keycloak?.authenticated) logger.debug('authenticated', keycloak.authenticated);
-  }, [keycloak?.authenticated]);
+    if (authConfig.debug && keycloak === null) {
+      logger.debug("keycloak disabled");
+    }
+  }, [authConfig.debug, keycloak]);
 
+  if (!authStore) return <Loading loadingComponent={loadingComponent} />;
   return <>{children}</>;
 }