@multiplatform.one/keycloak 5.0.26 → 6.0.0

package/src/provider/authProvider/index.native.tsx

@@ -0,0 +1,116 @@
+/**
+ * File: /src/provider/auth_provider/index.native.tsx
+ * Project: @multiplatform.one/keycloak
+ *
+ * Native (Expo) AuthProvider using Better Auth Expo client.
+ * Replaces the previous expo-auth-session PKCE flow.
+ * Auth is handled by the Better Auth server; the Expo client manages
+ * the browser redirect flow and stores the session cookie in SecureStore.
+ */
+
+import { useEffect, useMemo, useState } from "react";
+import { Loading } from "../../Loading";
+import { getExpoAuthClient } from "../../betterAuth/expoClient";
+import { KeycloakConfigContext } from "../../keycloak/config";
+import { Keycloak } from "../../keycloak/index";
+import type { KeycloakLoginOptions, KeycloakLogoutOptions } from "../../keycloak/base";
+import { KeycloakContext } from "../../keycloak/context";
+import { AfterAuth } from "../AfterAuth";
+import type { AuthProviderProps } from "./shared";
+
+export function AuthProvider({
+  children,
+  disabled,
+  keycloakConfig,
+  loadingComponent,
+}: AuthProviderProps) {
+  const [keycloak, setKeycloak] = useState<Keycloak>();
+  const [isLoading, setIsLoading] = useState(true);
+
+  // Resolve the Better Auth server base URL from keycloak config.
+  // On native, the keycloakConfig.url is the Keycloak server — the Better Auth
+  // server is the app backend. We derive it from env or fall back to a sensible default.
+  const serverBaseUrl = useMemo(() => {
+    // The Better Auth server URL should come from config or env.
+    // For now, derive from keycloakConfig — the app server is typically on the same origin.
+    // In production, set BETTER_AUTH_BASE_URL in the app config / env.
+    return keycloakConfig.betterAuthBaseUrl || "http://localhost:5000";
+  }, [keycloakConfig]);
+
+  const scheme = useMemo(() => keycloakConfig.expoScheme || "multiplatform-one", [keycloakConfig]);
+
+  const client = useMemo(
+    () => (disabled ? null : getExpoAuthClient(serverBaseUrl, scheme)),
+    [disabled, serverBaseUrl, scheme],
+  );
+
+  // Check session on mount
+  useEffect(() => {
+    if (disabled || !client) {
+      setIsLoading(false);
+      return;
+    }
+    (async () => {
+      try {
+        const session = await client.getSession();
+        if (session.data?.user) {
+          const _keycloak = new Keycloak(
+            keycloakConfig,
+            undefined, // no raw token
+            undefined,
+            undefined,
+            async (options: KeycloakLoginOptions) => {
+              await client.signIn.social({
+                provider: "keycloak" as any,
+                callbackURL: options.redirectUri,
+              });
+            },
+            async (_options: KeycloakLogoutOptions) => {
+              await client.signOut();
+            },
+          );
+          // Set minimal user info from session
+          _keycloak.authenticated = true;
+          _keycloak.email = session.data.user.email || undefined;
+          _keycloak.username = session.data.user.name || undefined;
+          _keycloak.subject = session.data.user.id;
+          setKeycloak(_keycloak);
+        } else {
+          setKeycloak(
+            new Keycloak(
+              keycloakConfig,
+              undefined,
+              undefined,
+              undefined,
+              async (options: KeycloakLoginOptions) => {
+                await client.signIn.social({
+                  provider: "keycloak" as any,
+                  callbackURL: options.redirectUri,
+                });
+              },
+              async (_options: KeycloakLogoutOptions) => {
+                await client.signOut();
+              },
+            ),
+          );
+        }
+      } catch {
+        setKeycloak(new Keycloak(keycloakConfig));
+      } finally {
+        setIsLoading(false);
+      }
+    })();
+  }, [disabled, client, keycloakConfig]);
+
+  if (disabled) return <>{children}</>;
+  if (isLoading || !keycloak) {
+    return <Loading loadingComponent={loadingComponent} />;
+  }
+  return (
+    <KeycloakConfigContext.Provider value={keycloakConfig}>
+      <KeycloakContext.Provider value={keycloak}>
+        <AfterAuth>{children}</AfterAuth>
+      </KeycloakContext.Provider>
+    </KeycloakConfigContext.Provider>
+  );
+}

package/src/provider/{AuthProvider → authProvider}/index.tsx

@@ -1,28 +1,18 @@
 /**
- * File: /src/provider/AuthProvider/index.tsx
+ * File: /src/provider/auth_provider/index.tsx
  * Project: @multiplatform.one/keycloak
- * File Created: 19-11-2024 20:26:31
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * Web AuthProvider using Better Auth.
+ * Replaces the previous next-auth SessionProvider approach.
+ * For cookie-based (session) auth, Better Auth manages the session
+ * server-side; no client-side SessionProvider wrapper is needed.
+ * Patched Keycloak JS client for iframe/direct-token strategies.
  */
 
-import KeycloakClient from "keycloak-js";
-import type { KeycloakInitOptions } from "keycloak-js";
-import { isIframe, isWindowDefined, logger } from "multiplatform.one";
-import { SessionProvider } from "next-auth/react";
+import KeycloakClient from "@multiplatform.one/keycloak-js";
+import type { KeycloakInitOptions } from "@multiplatform.one/keycloak-js";
+import { isIframe, isWindowDefined } from "@multiplatform.one/platform";
+import { logger } from "@multiplatform.one/logger";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { Loading } from "../../Loading";
 import { useAuthConfig } from "../../hooks";
@@ -40,12 +30,9 @@ export function AuthProvider({
   keycloakConfig,
   keycloakInitOptions,
   loadingComponent,
-  sessionProvider,
 }: AuthProviderProps) {
   const { debug, messageHandlerKeys, iframeSso } = useAuthConfig();
-  const query = new URLSearchParams(
-    isWindowDefined ? window?.location?.search || "" : "",
-  );
+  const query = new URLSearchParams(isWindowDefined ? window?.location?.search || "" : "");
   const authStore = useAuthStore();
   const [keycloak, setKeycloak] = useState<Keycloak>();
   const idTokenQuery = query.get("idToken");
@@ -77,11 +64,7 @@ export function AuthProvider({
   const initialTokenQuery = useMemo(
     () =>
       validOrRefreshableToken(
-        isIframe
-          ? typeof tokenQuery === "string"
-            ? tokenQuery || true
-            : undefined
-          : undefined,
+        isIframe ? (typeof tokenQuery === "string" ? tokenQuery || true : undefined) : undefined,
         initialRefreshTokenQuery,
       ),
     [tokenQuery, initialRefreshTokenQuery, iframeSso],
@@ -99,17 +82,16 @@ export function AuthProvider({
     return AuthSource.Session;
   }, [initialTokenQuery, iframeSso]);
   const authStrategy = useMemo(() => {
-    if (authSource === AuthSource.Session) return AuthStrategy.AuthJS;
+    if (authSource === AuthSource.Session) return AuthStrategy.BetterAuth;
     if (authSource === AuthSource.Query) {
       return AuthStrategy.KeycloakClientImplicit;
     }
     if (!persist) return AuthStrategy.KeycloakClientStandard;
-    if (typeof authStore === "undefined") return;
     if (authStore.token && typeof tokens.token === "string" && tokens.token) {
       return AuthStrategy.KeycloakClientImplicit;
     }
     return AuthStrategy.KeycloakClientStandard;
-  }, [authSource, authStore?.token, tokens.token]);
+  }, [authSource, authStore.token, tokens.token]);
   const isLoading = useMemo(() => {
     if (!authStrategy) return true;
     if (authStrategy === AuthStrategy.KeycloakClientImplicit) {
@@ -121,16 +103,13 @@ export function AuthProvider({
       ) {
         return true;
       }
-      if (authSource === AuthSource.Store && typeof authStore === "undefined") {
-        return true;
-      }
     }
     return false;
   }, [
     authSource,
-    authStore?.idToken,
-    authStore?.refreshToken,
-    authStore?.token,
+    authStore.idToken,
+    authStore.refreshToken,
+    authStore.token,
     authStrategy,
     initialIdTokenQuery,
     initialRefreshTokenQuery,
@@ -138,13 +117,7 @@ export function AuthProvider({
   ]);
 
   useEffect(() => {
-    if (
-      !persist ||
-      authStore === undefined ||
-      tokens.idToken ||
-      tokens.refreshToken ||
-      tokens.token
-    ) {
+    if (!persist || tokens.idToken || tokens.refreshToken || tokens.token) {
       return;
     }
     const refreshToken = validOrRefreshableToken(authStore.refreshToken);
@@ -171,9 +144,7 @@ export function AuthProvider({
     }
     if (debug) logger.debug("post message", JSON.stringify({ type: "LOADED" }));
     (messageHandlerKeys || []).forEach((key: string) => {
-      window?.webkit?.messageHandlers?.[key]?.postMessage(
-        JSON.stringify({ type: "LOADED" }),
-      );
+      window?.webkit?.messageHandlers?.[key]?.postMessage(JSON.stringify({ type: "LOADED" }));
     });
     window?.ReactNativeWebView?.postMessage(JSON.stringify({ type: "LOADED" }));
     window?.parent?.postMessage(JSON.stringify({ type: "LOADED" }));
@@ -190,7 +161,7 @@ export function AuthProvider({
       if (typeof data === "string") {
         try {
           data = JSON.parse(data);
-        } catch (err) {}
+        } catch {}
       }
       if (debug) logger.debug("received message", JSON.stringify(data));
       const message: MessageSchema = data;
@@ -228,7 +199,7 @@ export function AuthProvider({
       if (typeof data === "string") {
         try {
           data = JSON.parse(data);
-        } catch (err) {}
+        } catch {}
       }
       if (debug) logger.debug("received message", JSON.stringify(data));
       const message: MessageSchema = data;
@@ -266,7 +237,7 @@ export function AuthProvider({
       if (typeof data === "string") {
         try {
           data = JSON.parse(data);
-        } catch (err) {}
+        } catch {}
       }
       if (debug) logger.debug("received message", JSON.stringify(data));
       const message: MessageSchema = data;
@@ -275,10 +246,7 @@ export function AuthProvider({
         if (debug) logger.debug("setting id token", message.payload);
         setTokens((tokens) => ({
           ...tokens,
-          idToken: validOrRefreshableToken(
-            message.payload,
-            tokens.refreshToken,
-          ),
+          idToken: validOrRefreshableToken(message.payload, tokens.refreshToken),
         }));
         window.removeEventListener("message", messageCallback);
         setListeningIdToken(false);
@@ -418,8 +386,9 @@ export function AuthProvider({
     [children, keycloak, keycloakConfig],
   );
   if (disabled) return <>{children}</>;
-  if (authStrategy === AuthStrategy.AuthJS) {
-    return <SessionProvider {...sessionProvider}>{render()}</SessionProvider>;
+  // Better Auth sessions are cookie-based; no wrapping SessionProvider needed.
+  if (authStrategy === AuthStrategy.BetterAuth) {
+    return render();
   }
   if (isLoading) return <Loading loadingComponent={loadingComponent} />;
   return render();

package/src/provider/{AuthProvider → authProvider}/index.webext.tsx

@@ -1,27 +1,19 @@
 /**
- * File: /src/provider/AuthProvider/index.electron.tsx
+ * File: /src/provider/auth_provider/index.webext.tsx
  * Project: @multiplatform.one/keycloak
- * File Created: 23-01-2025 16:57:16
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2025
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * WebExt AuthProvider using Better Auth client.
+ * Web extensions run in a browser context — Better Auth client
+ * works via same-origin cookies. The extension must have host
+ * permissions for the Better Auth server origin.
  *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * Patched Keycloak JS client for direct-token scenarios (iframe, store).
  */
 
-import KeycloakClient from "keycloak-js";
-import type { KeycloakInitOptions } from "keycloak-js";
-import { isIframe, isWindowDefined, logger } from "multiplatform.one";
+import KeycloakClient from "@multiplatform.one/keycloak-js";
+import type { KeycloakInitOptions } from "@multiplatform.one/keycloak-js";
+import { isIframe, isWindowDefined } from "@multiplatform.one/platform";
+import { logger } from "@multiplatform.one/logger";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { Loading } from "../../Loading";
 import { useAuthConfig } from "../../hooks";
@@ -41,9 +33,7 @@ export function AuthProvider({
   loadingComponent,
 }: AuthProviderProps) {
   const { debug, messageHandlerKeys, iframeSso } = useAuthConfig();
-  const query = new URLSearchParams(
-    isWindowDefined ? window?.location?.search || "" : "",
-  );
+  const query = new URLSearchParams(isWindowDefined ? window?.location?.search || "" : "");
   const authStore = useAuthStore();
   const [keycloak, setKeycloak] = useState<Keycloak>();
   const idTokenQuery = query.get("idToken");
@@ -57,9 +47,9 @@ export function AuthProvider({
     () =>
       validOrRefreshableToken(
         ((!iframeSso && isIframe) ||
-          (typeof refreshTokenQuery === "string"
-            ? refreshTokenQuery || true
-            : undefined)) as string | boolean,
+          (typeof refreshTokenQuery === "string" ? refreshTokenQuery || true : undefined)) as
+          | string
+          | boolean,
       ),
     [refreshTokenQuery, iframeSso],
   );
@@ -67,9 +57,9 @@ export function AuthProvider({
     () =>
       validOrRefreshableToken(
         ((!iframeSso && isIframe) ||
-          (typeof idTokenQuery === "string"
-            ? idTokenQuery || true
-            : undefined)) as string | boolean,
+          (typeof idTokenQuery === "string" ? idTokenQuery || true : undefined)) as
+          | string
+          | boolean,
         initialRefreshTokenQuery,
       ),
     [idTokenQuery, initialRefreshTokenQuery, iframeSso],
@@ -78,9 +68,7 @@ export function AuthProvider({
     () =>
       validOrRefreshableToken(
         ((!iframeSso && isIframe) ||
-          (typeof tokenQuery === "string" ? tokenQuery || true : undefined)) as
-          | string
-          | boolean,
+          (typeof tokenQuery === "string" ? tokenQuery || true : undefined)) as string | boolean,
         initialRefreshTokenQuery,
       ),
     [tokenQuery, initialRefreshTokenQuery, iframeSso],
@@ -92,20 +80,22 @@ export function AuthProvider({
   });
   const authSource = useMemo(() => {
     if (!iframeSso && isIframe && initialTokenQuery) return AuthSource.Query;
-    return AuthSource.Store;
+    if (!iframeSso && isIframe) return AuthSource.Store;
+    return AuthSource.Session;
   }, [initialTokenQuery, iframeSso]);
   const authStrategy = useMemo(() => {
+    // WebExt: prefer Better Auth for session-based auth (cookie flow)
+    if (authSource === AuthSource.Session) return AuthStrategy.BetterAuth;
     if (authSource === AuthSource.Query) {
       return AuthStrategy.KeycloakClientImplicit;
     }
     if (!persist) return AuthStrategy.KeycloakClientStandard;
-    if (typeof authStore === "undefined") return;
     if (authStore.token) {
       if (typeof tokens.token === "undefined") return;
       if (tokens.token) return AuthStrategy.KeycloakClientImplicit;
     }
     return AuthStrategy.KeycloakClientStandard;
-  }, [authSource, authStore?.token, tokens.token]);
+  }, [authSource, authStore.token, tokens.token]);
   const isLoading = useMemo(() => {
     if (!authStrategy) return true;
     if (authStrategy === AuthStrategy.KeycloakClientImplicit) {
@@ -117,16 +107,13 @@ export function AuthProvider({
       ) {
         return true;
       }
-      if (authSource === AuthSource.Store && typeof authStore === "undefined") {
-        return true;
-      }
     }
     return false;
   }, [
     authSource,
-    authStore?.idToken,
-    authStore?.refreshToken,
-    authStore?.token,
+    authStore.idToken,
+    authStore.refreshToken,
+    authStore.token,
     authStrategy,
     initialIdTokenQuery,
     initialRefreshTokenQuery,
@@ -134,13 +121,7 @@ export function AuthProvider({
   ]);
 
   useEffect(() => {
-    if (
-      !persist ||
-      authStore === undefined ||
-      tokens.idToken ||
-      tokens.refreshToken ||
-      tokens.token
-    ) {
+    if (!persist || tokens.idToken || tokens.refreshToken || tokens.token) {
       return;
     }
     const refreshToken = validOrRefreshableToken(authStore.refreshToken);
@@ -148,9 +129,9 @@ export function AuthProvider({
     const token = validOrRefreshableToken(authStore.token, refreshToken);
     if (!idToken && !refreshToken && !token) return;
     setTokens({
-      idToken: idToken,
-      refreshToken: refreshToken,
-      token: token,
+      idToken,
+      refreshToken,
+      token,
     });
   }, [authStore, persist]);
 
@@ -167,9 +148,7 @@ export function AuthProvider({
     }
     if (debug) logger.debug("post message", JSON.stringify({ type: "LOADED" }));
     (messageHandlerKeys || []).forEach((key: string) => {
-      window?.webkit?.messageHandlers?.[key]?.postMessage(
-        JSON.stringify({ type: "LOADED" }),
-      );
+      window?.webkit?.messageHandlers?.[key]?.postMessage(JSON.stringify({ type: "LOADED" }));
     });
     window?.ReactNativeWebView?.postMessage(JSON.stringify({ type: "LOADED" }));
     window?.parent?.postMessage(JSON.stringify({ type: "LOADED" }));
@@ -186,7 +165,7 @@ export function AuthProvider({
       if (typeof data === "string") {
         try {
           data = JSON.parse(data);
-        } catch (err) {}
+        } catch {}
       }
       if (debug) logger.debug("received message", JSON.stringify(data));
       const message: MessageSchema = data;
@@ -201,15 +180,6 @@ export function AuthProvider({
         setListeningRefreshToken(false);
       }
     }
-    if (debug) {
-      logger.debug(
-        "listening for message",
-        JSON.stringify({
-          type: "REFRESH_TOKEN",
-          payload: "<some_refresh_token>",
-        }),
-      );
-    }
     window.addEventListener("message", messageCallback);
     return () => {
       window.removeEventListener("message", messageCallback);
@@ -224,7 +194,7 @@ export function AuthProvider({
       if (typeof data === "string") {
         try {
           data = JSON.parse(data);
-        } catch (err) {}
+        } catch {}
       }
       if (debug) logger.debug("received message", JSON.stringify(data));
       const message: MessageSchema = data;
@@ -239,15 +209,6 @@ export function AuthProvider({
         setListeningToken(false);
       }
     }
-    if (debug) {
-      logger.debug(
-        "listening for message",
-        JSON.stringify({
-          type: "TOKEN",
-          payload: "<some_token>",
-        }),
-      );
-    }
     window.addEventListener("message", messageCallback);
     return () => {
       window.removeEventListener("message", messageCallback);
@@ -262,7 +223,7 @@ export function AuthProvider({
       if (typeof data === "string") {
         try {
           data = JSON.parse(data);
-        } catch (err) {}
+        } catch {}
       }
       if (debug) logger.debug("received message", JSON.stringify(data));
       const message: MessageSchema = data;
@@ -271,24 +232,12 @@ export function AuthProvider({
         if (debug) logger.debug("setting id token", message.payload);
         setTokens((tokens) => ({
           ...tokens,
-          idToken: validOrRefreshableToken(
-            message.payload,
-            tokens.refreshToken,
-          ),
+          idToken: validOrRefreshableToken(message.payload, tokens.refreshToken),
         }));
         window.removeEventListener("message", messageCallback);
         setListeningIdToken(false);
       }
     }
-    if (debug) {
-      logger.debug(
-        "listening for message",
-        JSON.stringify({
-          type: "ID_TOKEN",
-          payload: "<some_id_token>",
-        }),
-      );
-    }
     window.addEventListener("message", messageCallback);
     return () => {
       window.removeEventListener("message", messageCallback);
@@ -414,6 +363,7 @@ export function AuthProvider({
     [children, keycloak, keycloakConfig],
   );
   if (disabled) return <>{children}</>;
+  if (authStrategy === AuthStrategy.BetterAuth) return render();
   if (isLoading) return <Loading loadingComponent={loadingComponent} />;
   return render();
 }

package/src/provider/{AuthProvider → authProvider}/shared.ts

@@ -1,26 +1,12 @@
 /**
- * File: /src/provider/AuthProvider/shared.ts
+ * File: /src/provider/auth_provider/shared.ts
  * Project: @multiplatform.one/keycloak
- * File Created: 23-12-2024 19:30:25
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * Shared types and constants for AuthProvider.
+ * No longer depends on next-auth.
  */
 
-import type { KeycloakInitOptions } from "keycloak-js";
-import type { SessionProviderProps } from "next-auth/react";
+import type { KeycloakInitOptions } from "@multiplatform.one/keycloak-js";
 import type { ComponentType, PropsWithChildren } from "react";
 import type { KeycloakConfig } from "../../keycloak/index";
 
@@ -42,7 +28,6 @@ export interface AuthProviderProps extends PropsWithChildren {
   keycloakConfig: KeycloakConfig;
   keycloakInitOptions?: KeycloakInitOptions;
   loadingComponent?: ComponentType;
-  sessionProvider?: Omit<SessionProviderProps, "children">;
 }
 
 export interface Tokens<B = boolean> {
@@ -52,7 +37,7 @@ export interface Tokens<B = boolean> {
 }
 
 export enum AuthStrategy {
-  AuthJS = "authjs",
+  BetterAuth = "better-auth",
   ExpoAuth = "expo-auth",
   KeycloakClientImplicit = "keycloak-client-implicit",
   KeycloakClientStandard = "keycloak-client-standard",

package/src/provider/index.ts

@@ -1,24 +1,3 @@
-/**
- * File: /src/provider/index.ts
- * Project: @multiplatform.one/keycloak
- * File Created: 19-11-2024 20:26:31
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
 export * from "./AfterAuth";
-export * from "./AuthProvider";
+export * from "./authProvider";
 export * from "./KeycloakProvider";

package/src/session/index.native.ts

@@ -1,33 +1,21 @@
-/*
+/**
  * File: /src/session/index.native.ts
  * Project: @multiplatform.one/keycloak
- * File Created: 04-04-2024 15:50:39
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * Better Auth session hook for React Native / Expo.
+ * Uses the Expo auth client when available, otherwise returns empty session.
  */
 
-import type { UseSessionOptions } from "next-auth/react";
 import type { SessionContextValue } from "./index";
 
 export async function getSession() {
   return null;
 }
 
-export function useSession<R extends boolean>(
-  _options?: UseSessionOptions<R>,
+export function useSession<R extends boolean = false>(
+  _options?: Record<string, unknown>,
 ): SessionContextValue<R> {
-  return {};
+  // On native, session is managed by AuthProvider (Expo auth client).
+  // Components consuming useSession outside AuthProvider get empty state.
+  return { session: null, status: "unauthenticated" };
 }