@multiplatform.one/keycloak 5.0.27 → 6.0.1

package/dist/cjs/index.cjs

@@ -1,24 +1,888 @@
+"use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
-    if (from && typeof from == "object" || typeof from == "function") for (let key of __getOwnPropNames(from)) !__hasOwnProp.call(to, key) && key !== except && __defProp(to, key, {
-      get: () => from[key],
-      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-    });
-    return to;
-  },
-  __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
-var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
-  value: !0
-}), mod);
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
 var index_exports = {};
+__export(index_exports, {
+  AfterAuth: () => AfterAuth,
+  AuthConfigContext: () => AuthConfigContext,
+  AuthProvider: () => AuthProvider,
+  Authenticated: () => Authenticated,
+  BaseKeycloak: () => BaseKeycloak,
+  Keycloak: () => Keycloak,
+  KeycloakConfigContext: () => KeycloakConfigContext,
+  KeycloakProvider: () => KeycloakProvider,
+  defaultAuthConfig: () => defaultAuthConfig,
+  getAllWalletAddresses: () => getAllWalletAddresses,
+  getWalletAddresses: () => getWalletAddresses,
+  getWalletsFromToken: () => getWalletsFromToken,
+  hasWallets: () => hasWallets,
+  isTokenExpired: () => isTokenExpired,
+  useAuthConfig: () => useAuthConfig,
+  useKeycloak: () => useKeycloak,
+  useSession: () => useSession,
+  useTokensFromQuery: () => useTokensFromQuery,
+  useTokensFromStore: () => useTokensFromStore,
+  validOrRefreshableToken: () => validOrRefreshableToken,
+  withAuthenticated: () => withAuthenticated
+});
 module.exports = __toCommonJS(index_exports);
-__reExport(index_exports, require("./Authenticated.cjs"), module.exports);
-__reExport(index_exports, require("./authConfig.cjs"), module.exports);
-__reExport(index_exports, require("./hooks/index.cjs"), module.exports);
-__reExport(index_exports, require("./keycloak/index.cjs"), module.exports);
-__reExport(index_exports, require("./provider/index.cjs"), module.exports);
-__reExport(index_exports, require("./session/index.cjs"), module.exports);
-__reExport(index_exports, require("./types.cjs"), module.exports);
+
+// src/Authenticated.tsx
+var import_platform6 = require("@multiplatform.one/platform");
+var import_react8 = require("react");
+var import_tamagui = require("tamagui");
+
+// src/hooks/useAuthConfig.ts
+var import_react2 = require("react");
+
+// src/authConfig.ts
+var import_react = require("react");
+var defaultAuthConfig = {};
+var AuthConfigContext = (0, import_react.createContext)(defaultAuthConfig);
+
+// src/hooks/useAuthConfig.ts
+function useAuthConfig() {
+  return (0, import_react2.useContext)(AuthConfigContext);
+}
+
+// src/hooks/useTokensFromQuery/index.ts
+var import_platform = require("@multiplatform.one/platform");
+function useTokensFromQuery() {
+  const { iframeSso } = useAuthConfig();
+  if (iframeSso || !import_platform.isIframe) return false;
+  const query = new URLSearchParams(
+    typeof window === "undefined" ? "" : window?.location?.search || ""
+  );
+  return typeof query.get("idToken") === "string" || typeof query.get("token") === "string" || typeof query.get("refreshToken") === "string";
+}
+
+// src/state.ts
+var import_store = require("@multiplatform.one/store");
+var import_platform2 = require("@multiplatform.one/platform");
+var persist = import_platform2.isIframe || import_platform2.isTauri || !import_platform2.isBrowser && !import_platform2.isServer;
+var authStore = (0, import_store.createStore)(
+  { idToken: "", refreshToken: "", token: "" },
+  { name: "auth", persist }
+);
+function useAuthStore() {
+  const state = (0, import_store.useStore)(authStore);
+  return {
+    ...state,
+    setIdToken: (idToken) => authStore.setState((prev) => ({ ...prev, idToken })),
+    setRefreshToken: (refreshToken) => authStore.setState((prev) => ({ ...prev, refreshToken })),
+    setToken: (token) => authStore.setState((prev) => ({ ...prev, token })),
+    setTokens: (tokens) => authStore.setState((prev) => ({ ...prev, ...tokens }))
+  };
+}
+
+// src/token.ts
+var import_jwt_decode = require("jwt-decode");
+function getWalletsFromToken(token) {
+  try {
+    const decoded = (0, import_jwt_decode.jwtDecode)(token);
+    return decoded.crypto?.wallets ?? {};
+  } catch {
+    return {};
+  }
+}
+function getWalletAddresses(token, walletType = "ethereum") {
+  const wallets = getWalletsFromToken(token);
+  return wallets[walletType]?.addresses ?? [];
+}
+function hasWallets(token) {
+  const wallets = getWalletsFromToken(token);
+  return Object.values(wallets).some((info) => info.addresses && info.addresses.length > 0);
+}
+function getAllWalletAddresses(token) {
+  const wallets = getWalletsFromToken(token);
+  const result = [];
+  for (const [walletType, info] of Object.entries(wallets)) {
+    if (info.addresses) {
+      for (const address of info.addresses) {
+        result.push({ walletType, address });
+      }
+    }
+  }
+  return result;
+}
+function validOrRefreshableToken(token, refreshToken) {
+  if (typeof token === "undefined") return;
+  if (!token) return false;
+  if (typeof token !== "string") return token;
+  if (refreshToken) {
+    if (refreshToken === true || !isTokenExpired(refreshToken)) return token;
+    return false;
+  }
+  return isTokenExpired(token) ? false : token;
+}
+function isTokenExpired(token) {
+  const { exp } = (0, import_jwt_decode.jwtDecode)(token);
+  if (!exp) return false;
+  return Math.floor(Date.now() / 1e3) >= exp;
+}
+
+// src/hooks/useTokensFromState.ts
+function useTokensFromStore() {
+  const authStore2 = useAuthStore();
+  return !!validOrRefreshableToken(authStore2.token, authStore2.refreshToken);
+}
+
+// src/keycloak/index.ts
+var import_platform5 = require("@multiplatform.one/platform");
+var import_react7 = require("react");
+
+// src/betterAuth/client.ts
+var import_react3 = require("better-auth/react");
+var import_plugins = require("better-auth/client/plugins");
+var import_platform3 = require("@multiplatform.one/platform");
+var _client;
+function getAuthClient(baseURL) {
+  if (_client) return _client;
+  _client = (0, import_react3.createAuthClient)({
+    baseURL: baseURL || (import_platform3.isWeb && typeof window !== "undefined" ? window.location.origin : ""),
+    plugins: [(0, import_plugins.genericOAuthClient)()]
+  });
+  return _client;
+}
+
+// src/session/index.ts
+var import_platform4 = require("@multiplatform.one/platform");
+var useSession = (_options) => {
+  return { session: null, status: "unauthenticated" };
+};
+if (import_platform4.isBrowser && !import_platform4.isTauri) {
+  useSession = (_options) => {
+    const client = getAuthClient();
+    const { data, isPending, error: _error } = client.useSession();
+    if (isPending) {
+      return { session: null, status: "loading" };
+    }
+    if (!data?.user) {
+      return { session: null, status: "unauthenticated" };
+    }
+    return {
+      session: {
+        user: data.user,
+        expires: data.session?.expiresAt?.toString()
+      },
+      status: "authenticated"
+    };
+  };
+}
+
+// src/keycloak/base.ts
+var import_jwt_decode2 = require("jwt-decode");
+var import_react5 = require("react");
+
+// src/keycloak/context.ts
+var import_react4 = require("react");
+var KeycloakContext = (0, import_react4.createContext)(void 0);
+
+// src/keycloak/base.ts
+var BaseKeycloak = class {
+  constructor(config, input, idToken, refreshToken, login, logout) {
+    this.config = config;
+    this.authenticated = false;
+    this.clientId = this.config.clientId;
+    this.realm = this.config.realm;
+    if (typeof input === "string") {
+      this.token = input;
+      this.idToken = idToken;
+      this.refreshToken = refreshToken;
+      this._parseTokens();
+    } else if (typeof input === "object") {
+      this._handleInputObject(input);
+    }
+    this._login = login;
+    this._logout = logout;
+    this._sync();
+  }
+  _handleInputObject(input) {
+    if (typeof input.init === "function") {
+      this._keycloakClient = input;
+    } else {
+      this._mock = input;
+    }
+  }
+  _parseTokens() {
+    if (this.token && !this.tokenParsed) {
+      this.tokenParsed = (0, import_jwt_decode2.jwtDecode)(this.token);
+    }
+    if (this.idToken && !this.idTokenParsed) {
+      this.idTokenParsed = (0, import_jwt_decode2.jwtDecode)(this.idToken);
+    }
+    if (this.refreshToken && !this.refreshTokenParsed) {
+      this.refreshTokenParsed = (0, import_jwt_decode2.jwtDecode)(this.refreshToken);
+    }
+  }
+  _clear() {
+    this.authenticated = false;
+    this.email = void 0;
+    this.idToken = void 0;
+    this.idTokenParsed = void 0;
+    this.realmAccess = void 0;
+    this.refreshToken = void 0;
+    this.refreshTokenParsed = void 0;
+    this.resourceAccess = void 0;
+    this.sessionId = void 0;
+    this.subject = void 0;
+    this.token = void 0;
+    this.tokenParsed = void 0;
+    this.username = void 0;
+  }
+  _sync() {
+    if (this._mock) {
+      this.authenticated = true;
+      this.email = this._mock.email;
+      this.username = this._mock.username;
+    } else if (this._keycloakClient) {
+      this.authenticated = !!this._keycloakClient.authenticated;
+      this.email = this._keycloakClient?.tokenParsed?.email;
+      this.idToken = this._keycloakClient?.idToken;
+      this.idTokenParsed = this._keycloakClient?.idTokenParsed;
+      this.realmAccess = this._keycloakClient?.realmAccess;
+      this.refreshToken = this._keycloakClient?.refreshToken;
+      this.refreshTokenParsed = this._keycloakClient?.refreshTokenParsed;
+      this.resourceAccess = this._keycloakClient?.resourceAccess;
+      this.sessionId = this._keycloakClient?.sessionId;
+      this.subject = this._keycloakClient?.subject;
+      this.token = this._keycloakClient?.token;
+      this.tokenParsed = this._keycloakClient?.tokenParsed;
+      this.username = this.tokenParsed?.preferred_username;
+      if (this._keycloakClient.realm) this.realm = this._keycloakClient.realm;
+      if (this._keycloakClient.clientId) {
+        this.clientId = this._keycloakClient.clientId;
+      }
+    } else if (this.tokenParsed) {
+      this.clientId = this.tokenParsed.azp || this.config.clientId;
+      this.email = this.tokenParsed.email;
+      this.realm = this.tokenParsed.iss?.split("/").pop() || this.config.realm;
+      this.realmAccess = this.tokenParsed.realm_access;
+      this.resourceAccess = this.tokenParsed.resource_access;
+      this.sessionId = this.tokenParsed.session_state;
+      this.subject = this.tokenParsed.sub;
+      this.authenticated = !!(this.tokenParsed?.exp && this.idToken && this.tokenParsed.exp > Date.now() / 1e3);
+      this.username = this.tokenParsed?.preferred_username;
+    } else {
+      return this._clear();
+    }
+  }
+  async getUserInfo() {
+    if (!this.authenticated) return;
+    const response = await fetch(
+      `${this.config.url}/realms/${this.realm}/protocol/openid-connect/userinfo`,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${this.token}`,
+          Accept: "application/json"
+        }
+      }
+    );
+    if (response.ok) return response.json();
+  }
+  async login(options = {}) {
+    this._clear();
+    if (this._keycloakClient) {
+      await this._keycloakClient.login(options);
+    } else {
+      await this._login?.(options);
+    }
+    this._sync();
+  }
+  async logout(options = {}) {
+    if (this._keycloakClient) {
+      await this._keycloakClient.logout(options);
+    } else {
+      await this._logout?.(options);
+    }
+    this._clear();
+  }
+};
+
+// src/keycloak/config.ts
+var import_react6 = require("react");
+var KeycloakConfigContext = (0, import_react6.createContext)({
+  clientId: "",
+  realm: "",
+  url: ""
+});
+
+// src/keycloak/index.ts
+var Keycloak = class extends BaseKeycloak {
+  _handleInputObject(input) {
+    if (typeof input.init === "function") {
+      this._keycloakClient = input;
+    } else if (input.accessToken) {
+      const session = input;
+      this.token = session.accessToken;
+      this.idToken = session.idToken;
+      this.refreshToken = session.refreshToken;
+      this._parseTokens();
+    } else {
+      this._mock = input;
+    }
+  }
+  async login(options = {}) {
+    this._clear();
+    if (this._keycloakClient) {
+      await this._keycloakClient.login(options);
+    } else if (import_platform5.isBrowser && !import_platform5.isServer) {
+      const client = getAuthClient();
+      await client.signIn.social({
+        provider: "keycloak",
+        callbackURL: options.redirectUri || (import_platform5.isWeb ? window.location.href : "")
+      });
+    } else {
+      await this._login?.(options);
+    }
+    this._sync();
+  }
+  async logout(options = {}) {
+    if (this._keycloakClient) {
+      await this._keycloakClient.logout(options);
+    } else if (import_platform5.isBrowser && !import_platform5.isServer) {
+      const client = getAuthClient();
+      await client.signOut({
+        fetchOptions: {
+          onSuccess: () => {
+            if (options.redirectUri) {
+              if (import_platform5.isWeb) window.location.href = options.redirectUri;
+            } else {
+              if (import_platform5.isWeb) window.location.reload();
+            }
+          }
+        }
+      });
+    } else {
+      await this._logout?.(options);
+    }
+    this._clear();
+  }
+};
+function useKeycloak() {
+  const keycloak = (0, import_react7.useContext)(KeycloakContext);
+  const keycloakConfig = (0, import_react7.useContext)(KeycloakConfigContext);
+  const { disabled } = useAuthConfig();
+  if (disabled) return null;
+  if (keycloak) return keycloak;
+  const { session, status } = useSession();
+  if (import_platform5.isStorybook) {
+    return new Keycloak(keycloakConfig, {
+      email: "storybook@example.com",
+      username: "storybook"
+    });
+  }
+  if (status === "unauthenticated") {
+    return new Keycloak(keycloakConfig);
+  }
+  if (status === "authenticated") {
+    if (session?.accessToken) {
+      return new Keycloak(keycloakConfig, session);
+    }
+    return new Keycloak(keycloakConfig);
+  }
+}
+
+// src/Authenticated.tsx
+var import_jsx_runtime = require("react/jsx-runtime");
+function Authenticated({
+  children,
+  disabled,
+  loggedOutComponent,
+  loadingComponent
+}) {
+  const authConfig = useAuthConfig();
+  const keycloak = useKeycloak();
+  const tokensFromQuery = useTokensFromQuery();
+  (0, import_react8.useEffect)(() => {
+    if (!keycloak || !authConfig.iframeSso && import_platform6.isIframe || import_platform6.isServer || keycloak.authenticated || tokensFromQuery) {
+      return;
+    }
+    keycloak?.login({
+      redirectUri: authConfig.loginRedirectUri
+    });
+  }, [keycloak?.authenticated]);
+  if (typeof disabled === "undefined") disabled = authConfig.disabled;
+  if (disabled) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children });
+  if (typeof keycloak === "undefined") {
+    const LoadingComponent = loadingComponent;
+    return LoadingComponent ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoadingComponent, {}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_tamagui.Text, { children: authConfig.debug ? "loading" : null });
+  }
+  if (keycloak === null || keycloak.authenticated) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children });
+  const LoggedOutComponent = loggedOutComponent;
+  return LoggedOutComponent ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoggedOutComponent, {}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_tamagui.Text, { children: authConfig.debug ? "not authenticated" : null });
+}
+function withAuthenticated(Component, options = {}) {
+  return (props) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Authenticated, { ...options, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Component, { ...props }) });
+}
+
+// src/provider/AfterAuth.tsx
+var import_logger = require("@multiplatform.one/logger");
+var import_react9 = require("react");
+var import_jsx_runtime2 = require("react/jsx-runtime");
+function AfterAuth({ children, loadingComponent: _loadingComponent }) {
+  const authConfig = useAuthConfig();
+  const authStore2 = useAuthStore();
+  const keycloak = useKeycloak();
+  (0, import_react9.useEffect)(() => {
+    if (!persist || !keycloak?.authenticated) return;
+    if (keycloak.token) {
+      authStore2.setTokens({
+        token: keycloak.token,
+        ...keycloak.idToken && { idToken: keycloak.idToken },
+        ...keycloak.refreshToken && {
+          refreshToken: keycloak.refreshToken
+        }
+      });
+    }
+  }, [
+    authStore2,
+    persist,
+    keycloak?.authenticated,
+    keycloak?.token,
+    keycloak?.idToken,
+    keycloak?.refreshToken
+  ]);
+  (0, import_react9.useEffect)(() => {
+    if (authConfig.debug && keycloak?.token) {
+      import_logger.logger.debug("token", keycloak.token);
+    }
+  }, [authConfig.debug, keycloak?.token]);
+  (0, import_react9.useEffect)(() => {
+    if (authConfig.debug && keycloak?.idToken) {
+      import_logger.logger.debug("idToken", keycloak.idToken);
+    }
+  }, [authConfig.debug, keycloak?.idToken]);
+  (0, import_react9.useEffect)(() => {
+    if (authConfig.debug && keycloak?.refreshToken) {
+      import_logger.logger.debug("refreshToken", keycloak.refreshToken);
+    }
+  }, [authConfig.debug, keycloak?.refreshToken]);
+  (0, import_react9.useEffect)(() => {
+    if (authConfig.debug && keycloak?.authenticated) {
+      import_logger.logger.debug("authenticated", keycloak.authenticated);
+    }
+  }, [authConfig.debug, keycloak?.authenticated]);
+  (0, import_react9.useEffect)(() => {
+    if (authConfig.debug && keycloak === null) {
+      import_logger.logger.debug("keycloak disabled");
+    }
+  }, [authConfig.debug, keycloak]);
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_jsx_runtime2.Fragment, { children });
+}
+
+// src/provider/authProvider/index.tsx
+var import_keycloak_js = __toESM(require("@multiplatform.one/keycloak-js"));
+var import_platform7 = require("@multiplatform.one/platform");
+var import_logger2 = require("@multiplatform.one/logger");
+var import_react10 = require("react");
+
+// src/Loading.tsx
+var import_tamagui2 = require("tamagui");
+var import_jsx_runtime3 = require("react/jsx-runtime");
+function Loading({ loadingComponent }) {
+  const { debug } = useAuthConfig();
+  const LoadingComponent = loadingComponent;
+  if (typeof LoadingComponent === "undefined") {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_tamagui2.Text, { children: debug ? "loading" : null });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(LoadingComponent, {});
+}
+
+// src/provider/authProvider/shared.ts
+var defaultKeycloakInitOptions = {
+  checkLoginIframe: true,
+  checkLoginIframeInterval: 5,
+  enableLogging: false,
+  onLoad: "check-sso",
+  pkceMethod: "S256"
+};
+
+// src/provider/authProvider/index.tsx
+var import_jsx_runtime4 = require("react/jsx-runtime");
+function AuthProvider({
+  children,
+  disabled,
+  keycloakConfig,
+  keycloakInitOptions,
+  loadingComponent
+}) {
+  const { debug, messageHandlerKeys, iframeSso } = useAuthConfig();
+  const query = new URLSearchParams(import_platform7.isWindowDefined ? window?.location?.search || "" : "");
+  const authStore2 = useAuthStore();
+  const [keycloak, setKeycloak] = (0, import_react10.useState)();
+  const idTokenQuery = query.get("idToken");
+  const refreshTokenQuery = query.get("refreshToken");
+  const tokenQuery = query.get("token");
+  const [listeningRefreshToken, setListeningRefreshToken] = (0, import_react10.useState)(false);
+  const [listeningToken, setListeningToken] = (0, import_react10.useState)(false);
+  const [listeningIdToken, setListeningIdToken] = (0, import_react10.useState)(false);
+  const [loadedMessagePosted, setLoadedMessagePosted] = (0, import_react10.useState)(false);
+  const initialRefreshTokenQuery = (0, import_react10.useMemo)(
+    () => validOrRefreshableToken(
+      !iframeSso && import_platform7.isIframe || typeof refreshTokenQuery === "string" ? refreshTokenQuery || true : void 0
+    ),
+    [refreshTokenQuery, iframeSso]
+  );
+  const initialIdTokenQuery = (0, import_react10.useMemo)(
+    () => validOrRefreshableToken(
+      !iframeSso && import_platform7.isIframe || typeof idTokenQuery === "string" ? idTokenQuery || true : void 0,
+      initialRefreshTokenQuery
+    ),
+    [idTokenQuery, initialRefreshTokenQuery, iframeSso]
+  );
+  const initialTokenQuery = (0, import_react10.useMemo)(
+    () => validOrRefreshableToken(
+      import_platform7.isIframe ? typeof tokenQuery === "string" ? tokenQuery || true : void 0 : void 0,
+      initialRefreshTokenQuery
+    ),
+    [tokenQuery, initialRefreshTokenQuery, iframeSso]
+  );
+  const [tokens, setTokens] = (0, import_react10.useState)({
+    refreshToken: initialRefreshTokenQuery,
+    token: initialTokenQuery,
+    idToken: initialIdTokenQuery
+  });
+  const authSource = (0, import_react10.useMemo)(() => {
+    if (!iframeSso && import_platform7.isIframe) {
+      if (initialTokenQuery) return "query" /* Query */;
+      return "store" /* Store */;
+    }
+    return "session" /* Session */;
+  }, [initialTokenQuery, iframeSso]);
+  const authStrategy = (0, import_react10.useMemo)(() => {
+    if (authSource === "session" /* Session */) return "better-auth" /* BetterAuth */;
+    if (authSource === "query" /* Query */) {
+      return "keycloak-client-implicit" /* KeycloakClientImplicit */;
+    }
+    if (!persist) return "keycloak-client-standard" /* KeycloakClientStandard */;
+    if (authStore2.token && typeof tokens.token === "string" && tokens.token) {
+      return "keycloak-client-implicit" /* KeycloakClientImplicit */;
+    }
+    return "keycloak-client-standard" /* KeycloakClientStandard */;
+  }, [authSource, authStore2.token, tokens.token]);
+  const isLoading = (0, import_react10.useMemo)(() => {
+    if (!authStrategy) return true;
+    if (authStrategy === "keycloak-client-implicit" /* KeycloakClientImplicit */) {
+      if (authSource === "query" /* Query */ && (initialRefreshTokenQuery === true || initialTokenQuery === true || initialIdTokenQuery === true)) {
+        return true;
+      }
+    }
+    return false;
+  }, [
+    authSource,
+    authStore2.idToken,
+    authStore2.refreshToken,
+    authStore2.token,
+    authStrategy,
+    initialIdTokenQuery,
+    initialRefreshTokenQuery,
+    initialTokenQuery
+  ]);
+  (0, import_react10.useEffect)(() => {
+    if (!persist || tokens.idToken || tokens.refreshToken || tokens.token) {
+      return;
+    }
+    const refreshToken = validOrRefreshableToken(authStore2.refreshToken);
+    const idToken = validOrRefreshableToken(authStore2.idToken, refreshToken);
+    const token = validOrRefreshableToken(authStore2.token, refreshToken);
+    if (!idToken && !refreshToken && !token) return;
+    setTokens({
+      idToken,
+      refreshToken,
+      token
+    });
+  }, [authStore2, persist]);
+  (0, import_react10.useEffect)(() => {
+    if (disabled || authSource !== "query" /* Query */ || tokens.token === true || tokens.refreshToken === true || tokens.idToken === true || loadedMessagePosted) {
+      return;
+    }
+    if (debug) import_logger2.logger.debug("post message", JSON.stringify({ type: "LOADED" }));
+    (messageHandlerKeys || []).forEach((key) => {
+      window?.webkit?.messageHandlers?.[key]?.postMessage(JSON.stringify({ type: "LOADED" }));
+    });
+    window?.ReactNativeWebView?.postMessage(JSON.stringify({ type: "LOADED" }));
+    window?.parent?.postMessage(JSON.stringify({ type: "LOADED" }));
+    setLoadedMessagePosted(true);
+  }, [disabled, authSource, tokens.token, tokens.refreshToken, tokens.idToken]);
+  (0, import_react10.useEffect)(() => {
+    if (disabled || tokens.refreshToken !== true || listeningRefreshToken) {
+      return;
+    }
+    setListeningRefreshToken(true);
+    function messageCallback(e) {
+      let data = e?.data || null;
+      if (typeof data === "string") {
+        try {
+          data = JSON.parse(data);
+        } catch {
+        }
+      }
+      if (debug) import_logger2.logger.debug("received message", JSON.stringify(data));
+      const message = data;
+      if (!message.type) return;
+      if (message.type.toUpperCase() === "REFRESH_TOKEN" && message.payload) {
+        if (debug) import_logger2.logger.debug("setting refresh token", message.payload);
+        setTokens((tokens2) => ({
+          ...tokens2,
+          refreshToken: validOrRefreshableToken(message.payload)
+        }));
+        window.removeEventListener("message", messageCallback);
+        setListeningRefreshToken(false);
+      }
+    }
+    if (debug) {
+      import_logger2.logger.debug(
+        "listening for message",
+        JSON.stringify({
+          type: "REFRESH_TOKEN",
+          payload: "<some_refresh_token>"
+        })
+      );
+    }
+    window.addEventListener("message", messageCallback);
+    return () => {
+      window.removeEventListener("message", messageCallback);
+    };
+  }, [disabled, tokens.refreshToken, listeningRefreshToken]);
+  (0, import_react10.useEffect)(() => {
+    if (disabled || tokens.token !== true || listeningToken) return;
+    setListeningToken(true);
+    function messageCallback(e) {
+      let data = e?.data || null;
+      if (typeof data === "string") {
+        try {
+          data = JSON.parse(data);
+        } catch {
+        }
+      }
+      if (debug) import_logger2.logger.debug("received message", JSON.stringify(data));
+      const message = data;
+      if (!message.type) return;
+      if (message.type.toUpperCase() === "TOKEN" && message.payload) {
+        if (debug) import_logger2.logger.debug("setting token", message.payload);
+        setTokens((tokens2) => ({
+          ...tokens2,
+          token: validOrRefreshableToken(message.payload, tokens2.refreshToken)
+        }));
+        window.removeEventListener("message", messageCallback);
+        setListeningToken(false);
+      }
+    }
+    if (debug) {
+      import_logger2.logger.debug(
+        "listening for message",
+        JSON.stringify({
+          type: "TOKEN",
+          payload: "<some_token>"
+        })
+      );
+    }
+    window.addEventListener("message", messageCallback);
+    return () => {
+      window.removeEventListener("message", messageCallback);
+    };
+  }, [disabled, tokens.token, listeningToken]);
+  (0, import_react10.useEffect)(() => {
+    if (disabled || tokens.idToken !== true || listeningIdToken) return;
+    setListeningIdToken(true);
+    function messageCallback(e) {
+      let data = e?.data || null;
+      if (typeof data === "string") {
+        try {
+          data = JSON.parse(data);
+        } catch {
+        }
+      }
+      if (debug) import_logger2.logger.debug("received message", JSON.stringify(data));
+      const message = data;
+      if (!message.type) return;
+      if (message.type.toUpperCase() === "ID_TOKEN" && message.payload) {
+        if (debug) import_logger2.logger.debug("setting id token", message.payload);
+        setTokens((tokens2) => ({
+          ...tokens2,
+          idToken: validOrRefreshableToken(message.payload, tokens2.refreshToken)
+        }));
+        window.removeEventListener("message", messageCallback);
+        setListeningIdToken(false);
+      }
+    }
+    if (debug) {
+      import_logger2.logger.debug(
+        "listening for message",
+        JSON.stringify({
+          type: "ID_TOKEN",
+          payload: "<some_id_token>"
+        })
+      );
+    }
+    window.addEventListener("message", messageCallback);
+    return () => {
+      window.removeEventListener("message", messageCallback);
+    };
+  }, [disabled, tokens.idToken, listeningIdToken]);
+  const keycloakClient = (0, import_react10.useMemo)(
+    () => !disabled && !isLoading && (authStrategy === "keycloak-client-standard" /* KeycloakClientStandard */ || authStrategy === "keycloak-client-implicit" /* KeycloakClientImplicit */) && keycloakConfig ? new import_keycloak_js.default({
+      clientId: keycloakConfig.publicClientId || keycloakConfig.clientId,
+      realm: keycloakConfig.realm,
+      url: keycloakConfig.url
+    }) : void 0,
+    [
+      authStrategy,
+      disabled,
+      isLoading,
+      keycloakConfig,
+      keycloakInitOptions,
+      tokens.idToken,
+      tokens.refreshToken,
+      tokens.token
+    ]
+  );
+  const initOptions = (0, import_react10.useMemo)(() => {
+    if (!keycloakClient) return;
+    const initOptions2 = {
+      ...defaultKeycloakInitOptions,
+      ...keycloakInitOptions,
+      scope: [
+        .../* @__PURE__ */ new Set([
+          "email",
+          "openid",
+          "profile",
+          ...defaultKeycloakInitOptions.scope?.split(" ") || [],
+          ...keycloakInitOptions?.scope?.split(" ") || [],
+          ...keycloakConfig.scopes || []
+        ])
+      ].join(" ")
+    };
+    if (debug) initOptions2.enableLogging = true;
+    if (tokens.token && typeof tokens.token === "string") {
+      initOptions2.token = tokens.token;
+      initOptions2.timeSkew = 0;
+      if (tokens.idToken && typeof tokens.idToken === "string") {
+        initOptions2.idToken = tokens.idToken;
+      }
+      if (tokens.refreshToken && typeof tokens.refreshToken === "string") {
+        initOptions2.refreshToken = tokens.refreshToken;
+      }
+    }
+    if (!iframeSso && import_platform7.isIframe || tokens.token && !tokens.refreshToken) {
+      initOptions2.checkLoginIframe = false;
+      initOptions2.flow = "implicit";
+      initOptions2.onLoad = void 0;
+    }
+    return initOptions2;
+  }, [
+    keycloakClient,
+    keycloakInitOptions,
+    keycloakConfig.scopes,
+    debug,
+    tokens.token,
+    tokens.idToken,
+    tokens.refreshToken,
+    iframeSso
+  ]);
+  (0, import_react10.useEffect)(() => {
+    if (!keycloakClient || !initOptions || authStrategy === "keycloak-client-implicit" /* KeycloakClientImplicit */ && (typeof tokens.token !== "string" || !tokens.token)) {
+      return;
+    }
+    function onError() {
+      if (keycloakClient && initOptions) {
+        setKeycloak(new Keycloak(keycloakConfig, keycloakClient));
+      }
+    }
+    function onUpdate() {
+      if (keycloakClient && initOptions) {
+        setKeycloak(new Keycloak(keycloakConfig, keycloakClient));
+      }
+    }
+    (async () => {
+      keycloakClient.onAuthError = onError;
+      keycloakClient.onAuthLogout = onUpdate;
+      keycloakClient.onAuthRefreshError = onError;
+      keycloakClient.onAuthRefreshSuccess = onUpdate;
+      keycloakClient.onAuthSuccess = onUpdate;
+      keycloakClient.onReady = onUpdate;
+      keycloakClient.onTokenExpired = async () => {
+        try {
+          await keycloakClient.updateToken(5);
+        } catch (err) {
+          import_logger2.logger.warn(err);
+          setKeycloak(new Keycloak(keycloakConfig, keycloakClient));
+        }
+      };
+      await keycloakClient.init(initOptions);
+      setKeycloak(new Keycloak(keycloakConfig, keycloakClient));
+    })();
+  }, [keycloakClient, initOptions, authStrategy, tokens.token]);
+  const render = (0, import_react10.useCallback)(
+    () => /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(KeycloakConfigContext.Provider, { value: keycloakConfig, children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(KeycloakContext.Provider, { value: keycloak, children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(AfterAuth, { loadingComponent, children }) }) }),
+    [children, keycloak, keycloakConfig]
+  );
+  if (disabled) return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_jsx_runtime4.Fragment, { children });
+  if (authStrategy === "better-auth" /* BetterAuth */) {
+    return render();
+  }
+  if (isLoading) return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(Loading, { loadingComponent });
+  return render();
+}
+
+// src/provider/KeycloakProvider.tsx
+var import_react11 = require("react");
+var import_jsx_runtime5 = require("react/jsx-runtime");
+function KeycloakProvider({
+  baseUrl,
+  children,
+  clientId,
+  loginRedirectUri,
+  debug,
+  disabled,
+  iframeSso,
+  publicClientId,
+  realm
+}) {
+  const authConfig = (0, import_react11.useMemo)(
+    () => ({ debug, disabled, iframeSso, loginRedirectUri }),
+    [debug, disabled, iframeSso, loginRedirectUri]
+  );
+  return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(AuthConfigContext.Provider, { value: authConfig, children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+    AuthProvider,
+    {
+      disabled,
+      keycloakConfig: {
+        clientId: clientId || "app",
+        publicClientId,
+        realm: realm || "main",
+        url: baseUrl ?? ""
+      },
+      children
+    }
+  ) });
+}