@multiplatform.one/keycloak 5.0.27 → 6.0.0

package/src/keycloak/index.ts

@@ -1,45 +1,20 @@
-/*
+/**
  * File: /src/keycloak/index.ts
  * Project: @multiplatform.one/keycloak
- * File Created: 25-12-2024 04:55:48
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * Better Auth–powered Keycloak class and useKeycloak hook for web.
+ * Replaces the previous next-auth/react based implementation.
  */
 
-import type KeycloakClient from "keycloak-js";
-import { isBrowser, isServer, isStorybook } from "multiplatform.one";
-import {
-  type SignInAuthorizationParams,
-  type SignInOptions,
-  type SignInResponse,
-  getCsrfToken,
-  getProviders,
-  getSession,
-  signOut,
-} from "next-auth/react";
+import type KeycloakClient from "@multiplatform.one/keycloak-js";
+import { isBrowser, isServer, isStorybook, isWeb } from "@multiplatform.one/platform";
 import { useContext } from "react";
+import { getAuthClient } from "../betterAuth/client";
 import { useAuthConfig } from "../hooks/index";
 import type { Session } from "../session/index";
 import { useSession } from "../session/index";
 import type { KeycloakMock } from "../types";
-import {
-  BaseKeycloak,
-  type KeycloakLoginOptions,
-  type KeycloakLogoutOptions,
-} from "./base";
+import { BaseKeycloak, type KeycloakLoginOptions, type KeycloakLogoutOptions } from "./base";
 import { KeycloakConfigContext } from "./config";
 import { KeycloakContext } from "./context";
 
@@ -63,11 +38,10 @@ export class Keycloak extends BaseKeycloak {
     if (this._keycloakClient) {
       await this._keycloakClient.login(options);
     } else if (isBrowser && !isServer) {
-      await cookieSignIn({
-        callbackUrl: options.redirectUri,
-        ...(typeof options.redirect !== "undefined"
-          ? { redirect: options.redirect }
-          : {}),
+      const client = getAuthClient();
+      await client.signIn.social({
+        provider: "keycloak" as any,
+        callbackURL: options.redirectUri || (isWeb ? window.location.href : ""),
       });
     } else {
       await this._login?.(options);
@@ -79,9 +53,17 @@ export class Keycloak extends BaseKeycloak {
     if (this._keycloakClient) {
       await this._keycloakClient.logout(options);
     } else if (isBrowser && !isServer) {
-      await fetch("/api/auth/logout", { method: "GET" });
-      await signOut({
-        callbackUrl: options.redirectUri,
+      const client = getAuthClient();
+      await client.signOut({
+        fetchOptions: {
+          onSuccess: () => {
+            if (options.redirectUri) {
+              if (isWeb) window.location.href = options.redirectUri;
+            } else {
+              if (isWeb) window.location.reload();
+            }
+          },
+        },
       });
     } else {
       await this._logout?.(options);
@@ -106,64 +88,14 @@ export function useKeycloak() {
   if (status === "unauthenticated") {
     return new Keycloak(keycloakConfig);
   }
-  if (status === "authenticated" && session?.accessToken) {
-    return new Keycloak(keycloakConfig, session as Session);
-  }
-}
-
-export async function cookieSignIn(
-  options?: SignInOptions,
-  authorizationParams?: SignInAuthorizationParams,
-): Promise<SignInResponse | undefined> {
-  const provider = "keycloak";
-  const baseUrl = `${new URL(window.location.href).origin}/api/auth`;
-  const { callbackUrl = window.location.href, redirect = true } = options ?? {};
-  const providers = await getProviders();
-  if (!providers) {
-    window.location.href = `${baseUrl}/error`;
-    return;
-  }
-  if (!provider || !(provider in providers)) {
-    window.location.href = `${baseUrl}/signin?${new URLSearchParams({
-      callbackUrl,
-    })}`;
-    return;
-  }
-  const isCredentials = providers[provider].type === "credentials";
-  const isEmail = providers[provider].type === "email";
-  const isSupportingReturn = isCredentials || isEmail;
-  const signInUrl = `${baseUrl}/${
-    isCredentials ? "callback" : "signin"
-  }/${provider}`;
-  const _signInUrl = `${signInUrl}${authorizationParams ? `?${new URLSearchParams(authorizationParams)}` : ""}`;
-  const res = await fetch(_signInUrl, {
-    method: "post",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      "X-Auth-Return-Redirect": "1",
-    },
-    body: new URLSearchParams({
-      ...(options as any),
-      csrfToken: await getCsrfToken(),
-      callbackUrl,
-      json: true,
-    }),
-  });
-  const data = await res.json();
-  if (redirect || !isSupportingReturn) {
-    const url = data.url ?? callbackUrl;
-    window.location.href = url;
-    if (url.includes("#")) window.location.reload();
-    return;
+  if (status === "authenticated") {
+    if (session?.accessToken) {
+      return new Keycloak(keycloakConfig, session as Session);
+    }
+    // Better Auth cookie-based session without tokens — return a Keycloak
+    // wrapper so login()/logout() delegate to the Better Auth client.
+    return new Keycloak(keycloakConfig);
   }
-  const error = new URL(data.url).searchParams.get("error");
-  if (res.ok) await getSession({ event: "storage" });
-  return {
-    error,
-    status: res.status,
-    ok: res.ok,
-    url: error ? null : data.url,
-  };
 }
 
 export * from "./base";

package/src/keycloak/index.webext.ts

@@ -1,34 +1,18 @@
-/*
- * File: /src/keycloak/index.electron.ts
+/**
+ * File: /src/keycloak/index.webext.ts
  * Project: @multiplatform.one/keycloak
- * File Created: 10-01-2025 21:02:36
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2025
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * WebExt Keycloak class using Better Auth client for login/logout.
+ * Patched Keycloak JS client when available (iframe/token scenarios).
  */
 
-import type KeycloakClient from "keycloak-js";
+import type KeycloakClient from "@multiplatform.one/keycloak-js";
+import { isBrowser, isServer } from "@multiplatform.one/platform";
 import { useContext } from "react";
+import { getAuthClient } from "../betterAuth/client";
 import { useAuthConfig } from "../hooks";
 import type { KeycloakMock } from "../types";
-import {
-  BaseKeycloak,
-  type KeycloakLoginOptions,
-  type KeycloakLogoutOptions,
-} from "./base";
-import { KeycloakConfigContext } from "./config";
+import { BaseKeycloak, type KeycloakLoginOptions, type KeycloakLogoutOptions } from "./base";
 import { KeycloakContext } from "./context";
 
 export class Keycloak extends BaseKeycloak {
@@ -44,6 +28,12 @@ export class Keycloak extends BaseKeycloak {
     this._clear();
     if (this._keycloakClient) {
       await this._keycloakClient.login(options);
+    } else if (isBrowser && !isServer) {
+      const client = getAuthClient();
+      await client.signIn.social({
+        provider: "keycloak" as any,
+        callbackURL: options.redirectUri || window.location.href,
+      });
     } else {
       await this._login?.(options);
     }
@@ -53,6 +43,15 @@ export class Keycloak extends BaseKeycloak {
   async logout(options: KeycloakLogoutOptions = {}) {
     if (this._keycloakClient) {
       await this._keycloakClient.logout(options);
+    } else if (isBrowser && !isServer) {
+      const client = getAuthClient();
+      await client.signOut({
+        fetchOptions: {
+          onSuccess: () => {
+            if (options.redirectUri) window.location.href = options.redirectUri;
+          },
+        },
+      });
     } else {
       await this._logout?.(options);
     }
@@ -62,7 +61,6 @@ export class Keycloak extends BaseKeycloak {
 
 export function useKeycloak() {
   const keycloak = useContext(KeycloakContext);
-  const keycloakConfig = useContext(KeycloakConfigContext);
   const { disabled } = useAuthConfig();
   if (disabled) return null;
   if (keycloak) return keycloak;

package/src/one.ts

@@ -1,170 +1,84 @@
-/*
+/**
  * File: /src/one.ts
  * Project: @multiplatform.one/keycloak
- * File Created: 10-01-2025 21:02:36
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2025
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * Better Auth server configuration factory for apps using One.
+ * Replaces the previous Auth.js (createAuthConfig) approach.
+ * Stateless sessions — no database required.
  */
 
-import type { AuthConfig } from "@auth/core";
-import type { JWT } from "@auth/core/jwt";
-import type { OAuthUserConfig } from "@auth/core/providers";
-import KeycloakProvider from "@auth/core/providers/keycloak";
-import { jwtDecode } from "jwt-decode";
-import type { Session } from "./session/index";
-import type { AccessTokenParsed } from "./token";
+import { betterAuth } from "better-auth";
+import { genericOAuth, keycloak } from "better-auth/plugins";
+import { expo } from "@better-auth/expo";
 
-let _authConfig: AuthConfig | undefined;
-const defaults = {
-  keycloak: {
-    baseUrl: "http://localhost:8080",
-    realm: "master",
-  },
-};
+let _auth: ReturnType<typeof betterAuth<any>> | undefined;
 
-export function createAuthConfig(config: AuthHandlerConfig) {
-  if (_authConfig) return _authConfig;
-  const authorization =
-    config.keycloak.authorization &&
-    typeof config.keycloak.authorization === "object"
-      ? config.keycloak.authorization
-      : {};
-  _authConfig = {
-    ...config.auth,
+export function createAuth(config: AuthHandlerConfig) {
+  if (_auth) return _auth;
+  const baseUrl =
+    config.baseUrl ||
+    (typeof process !== "undefined"
+      ? process.env?.BASE_URL || `http://localhost:${process.env?.ONE_PORT || "3000"}`
+      : "http://localhost:3000");
+  const keycloakBaseUrl = config.keycloak?.baseUrl || `${baseUrl}/auth`;
+  const realm = config.keycloak?.realm || "master";
+  const issuer = `${keycloakBaseUrl}/realms/${realm}`;
+
+  _auth = betterAuth({
     basePath: "/api/auth",
-    trustHost: true,
-    providers: [
-      KeycloakProvider({
-        issuer: `${config.keycloak?.baseUrl || defaults.keycloak.baseUrl}/realms/${config.keycloak?.realm || defaults.keycloak.realm}`,
-        authorization: {
-          ...authorization,
-          params: {
-            scope: [
-              ...new Set([
-                "email",
-                "openid",
-                "profile",
-                ...(authorization.params?.scope?.split(" ") || []),
-                ...(config.scopes || []),
-              ]),
-            ].join(" "),
-          },
-        },
-        ...config.keycloak,
-      }),
-      ...(config.auth?.providers || []),
+    baseURL: baseUrl,
+    secret: config.secret || "",
+    trustedOrigins: [
+      baseUrl,
+      keycloakBaseUrl,
+      ...(config.expoScheme ? [`${config.expoScheme}://`] : []),
     ],
-    callbacks: {
-      ...config.auth?.callbacks,
-      async jwt(params) {
-        if (typeof config.auth?.callbacks?.jwt === "function") {
-          return config.auth?.callbacks.jwt(params);
-        }
-        const { token, account } = params;
-        if (account) {
-          const decoded = jwtDecode(
-            account.access_token || "",
-          ) as AccessTokenParsed;
-          token.decoded = decoded;
-          token.accessToken = account.access_token;
-          token.idToken = account.id_token;
-          token.expiresAt = account.expires_at;
-          token.refreshToken = account.refresh_token;
-          token.roles = decoded.realm_access?.roles;
-          return token;
-        }
-        if (Math.floor(Date.now() / 1000) < Number(token.expiresAt)) {
-          return token;
-        }
-        try {
-          return refreshAccessToken(config, token as AuthToken);
-        } catch (err) {
-          return { ...token, err };
-        }
-      },
-      async session(params) {
-        if (typeof config.auth?.callbacks?.session === "function") {
-          return config.auth.callbacks.session(params);
-        }
-        const { session: nextSession, token: nextToken } = params;
-        const session = nextSession as Session;
-        const token = nextToken as AuthToken;
-        if (token.accessToken) session.accessToken = token.accessToken;
-        if (token.idToken) session.idToken = token.idToken;
-        session.err = token.err;
-        return session;
-      },
-    } as AuthConfig["callbacks"],
-  } as AuthConfig;
-  return _authConfig;
-}
-
-async function refreshAccessToken(
-  options: AuthHandlerConfig,
-  nextToken: AuthToken,
-) {
-  const res = await fetch(
-    `${options.keycloak?.baseUrl || defaults.keycloak.baseUrl}/realms/${
-      options.keycloak?.realm || defaults.keycloak.realm
-    }/protocol/openid-connect/token`,
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
+    session: {
+      cookieCache: {
+        enabled: true,
+        maxAge: 7 * 24 * 60 * 60,
+        strategy: "jwe",
+        refreshCache: true,
       },
-      body: new URLSearchParams({
-        client_id: options.keycloak.clientId || "",
-        client_secret: options.keycloak.clientSecret || "",
-        grant_type: "refresh_token",
-        refresh_token: nextToken.refreshToken,
-      }),
     },
-  );
-  const refreshToken = await res.json();
-  if (!res.ok) throw refreshToken;
-  return {
-    ...nextToken,
-    accessToken: refreshToken.access_token,
-    decoded: jwtDecode(refreshToken.access_token),
-    expiresAt: Math.floor(Date.now() / 1000) + Number(refreshToken.expires_in),
-    idToken: refreshToken.id_token,
-    refreshToken: refreshToken.refresh_token,
-  };
-}
+    account: {
+      storeStateStrategy: "cookie",
+      storeAccountCookie: true,
+    },
+    plugins: [
+      expo(),
+      genericOAuth({
+        config: [
+          keycloak({
+            clientId: config.keycloak.clientId || "",
+            clientSecret: config.keycloak.clientSecret || "",
+            issuer,
+          }),
+        ],
+      }),
+    ],
+  });
 
-export interface AuthToken extends JWT {
-  accessToken?: string;
-  decoded: AccessTokenParsed;
-  err?: Error;
-  expiresAt: number;
-  idToken?: string;
-  refreshToken: string;
-  roles: string[];
+  return _auth;
 }
 
-export interface KeycloakOptions extends OAuthUserConfig<any> {
+export interface KeycloakOptions {
   adminPassword?: string;
   adminUsername?: string;
   baseUrl?: string;
+  clientId: string;
+  clientSecret: string;
   realm?: string;
+  authorization?: Record<string, any>;
 }
 
 export interface AuthHandlerConfig {
-  baseUrl: string;
+  baseUrl?: string;
   keycloak: KeycloakOptions;
-  auth?: Partial<AuthConfig>;
+  secret?: string;
   scopes?: string[];
+  /** Expo deep-link scheme (e.g. "multiplatform-one") — added to trustedOrigins. */
+  expoScheme?: string;
 }
+
+export type Auth = ReturnType<typeof createAuth>;

package/src/provider/AfterAuth.tsx

@@ -1,27 +1,5 @@
-/**
- * File: /src/provider/AfterAuth.tsx
- * Project: @multiplatform.one/keycloak
- * File Created: 10-01-2024 12:41:33
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { logger } from "multiplatform.one";
+import { logger } from "@multiplatform.one/logger";
 import { type ComponentType, type PropsWithChildren, useEffect } from "react";
-import { Loading } from "../Loading";
 import { useAuthConfig } from "../hooks";
 import { useKeycloak } from "../keycloak/index";
 import { persist, useAuthStore } from "../state";
@@ -30,17 +8,21 @@ export interface AfterAuthProps extends PropsWithChildren {
   loadingComponent?: ComponentType;
 }
 
-export function AfterAuth({ children, loadingComponent }: AfterAuthProps) {
+export function AfterAuth({ children, loadingComponent: _loadingComponent }: AfterAuthProps) {
   const authConfig = useAuthConfig();
   const authStore = useAuthStore();
   const keycloak = useKeycloak();
 
   useEffect(() => {
-    if (!authStore || !persist || !keycloak?.authenticated) return;
+    if (!persist || !keycloak?.authenticated) return;
     if (keycloak.token) {
-      authStore.token = keycloak.token;
-      if (keycloak.idToken) authStore.idToken = keycloak.idToken;
-      if (keycloak.refreshToken) authStore.refreshToken = keycloak.refreshToken;
+      authStore.setTokens({
+        token: keycloak.token,
+        ...(keycloak.idToken && { idToken: keycloak.idToken }),
+        ...(keycloak.refreshToken && {
+          refreshToken: keycloak.refreshToken,
+        }),
+      });
     }
   }, [
     authStore,
@@ -81,6 +63,5 @@ export function AfterAuth({ children, loadingComponent }: AfterAuthProps) {
     }
   }, [authConfig.debug, keycloak]);
 
-  if (!authStore) return <Loading loadingComponent={loadingComponent} />;
   return <>{children}</>;
 }

package/src/provider/KeycloakProvider.tsx

@@ -1,29 +1,8 @@
-/**
- * File: /src/provider/KeycloakProvider.tsx
- * Project: @multiplatform.one/keycloak
- * File Created: 10-01-2024 13:56:05
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
 import type { PropsWithChildren } from "react";
 import { useMemo } from "react";
 import type { AuthConfig } from "../authConfig";
 import { AuthConfigContext } from "../authConfig";
-import { AuthProvider } from "./AuthProvider";
+import { AuthProvider } from "./authProvider";
 
 export interface KeycloakProviderProps extends PropsWithChildren, AuthConfig {
   baseUrl?: string;
@@ -55,7 +34,7 @@ export function KeycloakProvider({
           clientId: clientId || "app",
           publicClientId,
           realm: realm || "main",
-          url: baseUrl,
+          url: baseUrl ?? "",
         }}
       >
         {children}