@multiplatform.one/keycloak 5.0.27 → 6.0.1

package/dist/esm/index.js

@@ -1,8 +1,855 @@
-export * from "./Authenticated";
-export * from "./authConfig";
-export * from "./hooks/index";
-export * from "./keycloak/index";
-export * from "./provider/index";
-export * from "./session/index";
-export * from "./types";
-//# sourceMappingURL=index.js.map
+// src/Authenticated.tsx
+import { isIframe as isIframe3, isServer as isServer3 } from "@multiplatform.one/platform";
+import { useEffect } from "react";
+import { Text } from "tamagui";
+
+// src/hooks/useAuthConfig.ts
+import { useContext } from "react";
+
+// src/authConfig.ts
+import { createContext } from "react";
+var defaultAuthConfig = {};
+var AuthConfigContext = createContext(defaultAuthConfig);
+
+// src/hooks/useAuthConfig.ts
+function useAuthConfig() {
+  return useContext(AuthConfigContext);
+}
+
+// src/hooks/useTokensFromQuery/index.ts
+import { isIframe } from "@multiplatform.one/platform";
+function useTokensFromQuery() {
+  const { iframeSso } = useAuthConfig();
+  if (iframeSso || !isIframe) return false;
+  const query = new URLSearchParams(
+    typeof window === "undefined" ? "" : window?.location?.search || ""
+  );
+  return typeof query.get("idToken") === "string" || typeof query.get("token") === "string" || typeof query.get("refreshToken") === "string";
+}
+
+// src/state.ts
+import { createStore, useStore } from "@multiplatform.one/store";
+import { isBrowser, isIframe as isIframe2, isServer, isTauri } from "@multiplatform.one/platform";
+var persist = isIframe2 || isTauri || !isBrowser && !isServer;
+var authStore = createStore(
+  { idToken: "", refreshToken: "", token: "" },
+  { name: "auth", persist }
+);
+function useAuthStore() {
+  const state = useStore(authStore);
+  return {
+    ...state,
+    setIdToken: (idToken) => authStore.setState((prev) => ({ ...prev, idToken })),
+    setRefreshToken: (refreshToken) => authStore.setState((prev) => ({ ...prev, refreshToken })),
+    setToken: (token) => authStore.setState((prev) => ({ ...prev, token })),
+    setTokens: (tokens) => authStore.setState((prev) => ({ ...prev, ...tokens }))
+  };
+}
+
+// src/token.ts
+import { jwtDecode } from "jwt-decode";
+function getWalletsFromToken(token) {
+  try {
+    const decoded = jwtDecode(token);
+    return decoded.crypto?.wallets ?? {};
+  } catch {
+    return {};
+  }
+}
+function getWalletAddresses(token, walletType = "ethereum") {
+  const wallets = getWalletsFromToken(token);
+  return wallets[walletType]?.addresses ?? [];
+}
+function hasWallets(token) {
+  const wallets = getWalletsFromToken(token);
+  return Object.values(wallets).some((info) => info.addresses && info.addresses.length > 0);
+}
+function getAllWalletAddresses(token) {
+  const wallets = getWalletsFromToken(token);
+  const result = [];
+  for (const [walletType, info] of Object.entries(wallets)) {
+    if (info.addresses) {
+      for (const address of info.addresses) {
+        result.push({ walletType, address });
+      }
+    }
+  }
+  return result;
+}
+function validOrRefreshableToken(token, refreshToken) {
+  if (typeof token === "undefined") return;
+  if (!token) return false;
+  if (typeof token !== "string") return token;
+  if (refreshToken) {
+    if (refreshToken === true || !isTokenExpired(refreshToken)) return token;
+    return false;
+  }
+  return isTokenExpired(token) ? false : token;
+}
+function isTokenExpired(token) {
+  const { exp } = jwtDecode(token);
+  if (!exp) return false;
+  return Math.floor(Date.now() / 1e3) >= exp;
+}
+
+// src/hooks/useTokensFromState.ts
+function useTokensFromStore() {
+  const authStore2 = useAuthStore();
+  return !!validOrRefreshableToken(authStore2.token, authStore2.refreshToken);
+}
+
+// src/keycloak/index.ts
+import { isBrowser as isBrowser3, isServer as isServer2, isStorybook, isWeb as isWeb2 } from "@multiplatform.one/platform";
+import { useContext as useContext3 } from "react";
+
+// src/betterAuth/client.ts
+import { createAuthClient } from "better-auth/react";
+import { genericOAuthClient } from "better-auth/client/plugins";
+import { isWeb } from "@multiplatform.one/platform";
+var _client;
+function getAuthClient(baseURL) {
+  if (_client) return _client;
+  _client = createAuthClient({
+    baseURL: baseURL || (isWeb && typeof window !== "undefined" ? window.location.origin : ""),
+    plugins: [genericOAuthClient()]
+  });
+  return _client;
+}
+
+// src/session/index.ts
+import { isBrowser as isBrowser2, isTauri as isTauri2 } from "@multiplatform.one/platform";
+var useSession = (_options) => {
+  return { session: null, status: "unauthenticated" };
+};
+if (isBrowser2 && !isTauri2) {
+  useSession = (_options) => {
+    const client = getAuthClient();
+    const { data, isPending, error: _error } = client.useSession();
+    if (isPending) {
+      return { session: null, status: "loading" };
+    }
+    if (!data?.user) {
+      return { session: null, status: "unauthenticated" };
+    }
+    return {
+      session: {
+        user: data.user,
+        expires: data.session?.expiresAt?.toString()
+      },
+      status: "authenticated"
+    };
+  };
+}
+
+// src/keycloak/base.ts
+import { jwtDecode as jwtDecode2 } from "jwt-decode";
+import { useContext as useContext2 } from "react";
+
+// src/keycloak/context.ts
+import { createContext as createContext2 } from "react";
+var KeycloakContext = createContext2(void 0);
+
+// src/keycloak/base.ts
+var BaseKeycloak = class {
+  constructor(config, input, idToken, refreshToken, login, logout) {
+    this.config = config;
+    this.authenticated = false;
+    this.clientId = this.config.clientId;
+    this.realm = this.config.realm;
+    if (typeof input === "string") {
+      this.token = input;
+      this.idToken = idToken;
+      this.refreshToken = refreshToken;
+      this._parseTokens();
+    } else if (typeof input === "object") {
+      this._handleInputObject(input);
+    }
+    this._login = login;
+    this._logout = logout;
+    this._sync();
+  }
+  _handleInputObject(input) {
+    if (typeof input.init === "function") {
+      this._keycloakClient = input;
+    } else {
+      this._mock = input;
+    }
+  }
+  _parseTokens() {
+    if (this.token && !this.tokenParsed) {
+      this.tokenParsed = jwtDecode2(this.token);
+    }
+    if (this.idToken && !this.idTokenParsed) {
+      this.idTokenParsed = jwtDecode2(this.idToken);
+    }
+    if (this.refreshToken && !this.refreshTokenParsed) {
+      this.refreshTokenParsed = jwtDecode2(this.refreshToken);
+    }
+  }
+  _clear() {
+    this.authenticated = false;
+    this.email = void 0;
+    this.idToken = void 0;
+    this.idTokenParsed = void 0;
+    this.realmAccess = void 0;
+    this.refreshToken = void 0;
+    this.refreshTokenParsed = void 0;
+    this.resourceAccess = void 0;
+    this.sessionId = void 0;
+    this.subject = void 0;
+    this.token = void 0;
+    this.tokenParsed = void 0;
+    this.username = void 0;
+  }
+  _sync() {
+    if (this._mock) {
+      this.authenticated = true;
+      this.email = this._mock.email;
+      this.username = this._mock.username;
+    } else if (this._keycloakClient) {
+      this.authenticated = !!this._keycloakClient.authenticated;
+      this.email = this._keycloakClient?.tokenParsed?.email;
+      this.idToken = this._keycloakClient?.idToken;
+      this.idTokenParsed = this._keycloakClient?.idTokenParsed;
+      this.realmAccess = this._keycloakClient?.realmAccess;
+      this.refreshToken = this._keycloakClient?.refreshToken;
+      this.refreshTokenParsed = this._keycloakClient?.refreshTokenParsed;
+      this.resourceAccess = this._keycloakClient?.resourceAccess;
+      this.sessionId = this._keycloakClient?.sessionId;
+      this.subject = this._keycloakClient?.subject;
+      this.token = this._keycloakClient?.token;
+      this.tokenParsed = this._keycloakClient?.tokenParsed;
+      this.username = this.tokenParsed?.preferred_username;
+      if (this._keycloakClient.realm) this.realm = this._keycloakClient.realm;
+      if (this._keycloakClient.clientId) {
+        this.clientId = this._keycloakClient.clientId;
+      }
+    } else if (this.tokenParsed) {
+      this.clientId = this.tokenParsed.azp || this.config.clientId;
+      this.email = this.tokenParsed.email;
+      this.realm = this.tokenParsed.iss?.split("/").pop() || this.config.realm;
+      this.realmAccess = this.tokenParsed.realm_access;
+      this.resourceAccess = this.tokenParsed.resource_access;
+      this.sessionId = this.tokenParsed.session_state;
+      this.subject = this.tokenParsed.sub;
+      this.authenticated = !!(this.tokenParsed?.exp && this.idToken && this.tokenParsed.exp > Date.now() / 1e3);
+      this.username = this.tokenParsed?.preferred_username;
+    } else {
+      return this._clear();
+    }
+  }
+  async getUserInfo() {
+    if (!this.authenticated) return;
+    const response = await fetch(
+      `${this.config.url}/realms/${this.realm}/protocol/openid-connect/userinfo`,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${this.token}`,
+          Accept: "application/json"
+        }
+      }
+    );
+    if (response.ok) return response.json();
+  }
+  async login(options = {}) {
+    this._clear();
+    if (this._keycloakClient) {
+      await this._keycloakClient.login(options);
+    } else {
+      await this._login?.(options);
+    }
+    this._sync();
+  }
+  async logout(options = {}) {
+    if (this._keycloakClient) {
+      await this._keycloakClient.logout(options);
+    } else {
+      await this._logout?.(options);
+    }
+    this._clear();
+  }
+};
+
+// src/keycloak/config.ts
+import { createContext as createContext3 } from "react";
+var KeycloakConfigContext = createContext3({
+  clientId: "",
+  realm: "",
+  url: ""
+});
+
+// src/keycloak/index.ts
+var Keycloak = class extends BaseKeycloak {
+  _handleInputObject(input) {
+    if (typeof input.init === "function") {
+      this._keycloakClient = input;
+    } else if (input.accessToken) {
+      const session = input;
+      this.token = session.accessToken;
+      this.idToken = session.idToken;
+      this.refreshToken = session.refreshToken;
+      this._parseTokens();
+    } else {
+      this._mock = input;
+    }
+  }
+  async login(options = {}) {
+    this._clear();
+    if (this._keycloakClient) {
+      await this._keycloakClient.login(options);
+    } else if (isBrowser3 && !isServer2) {
+      const client = getAuthClient();
+      await client.signIn.social({
+        provider: "keycloak",
+        callbackURL: options.redirectUri || (isWeb2 ? window.location.href : "")
+      });
+    } else {
+      await this._login?.(options);
+    }
+    this._sync();
+  }
+  async logout(options = {}) {
+    if (this._keycloakClient) {
+      await this._keycloakClient.logout(options);
+    } else if (isBrowser3 && !isServer2) {
+      const client = getAuthClient();
+      await client.signOut({
+        fetchOptions: {
+          onSuccess: () => {
+            if (options.redirectUri) {
+              if (isWeb2) window.location.href = options.redirectUri;
+            } else {
+              if (isWeb2) window.location.reload();
+            }
+          }
+        }
+      });
+    } else {
+      await this._logout?.(options);
+    }
+    this._clear();
+  }
+};
+function useKeycloak() {
+  const keycloak = useContext3(KeycloakContext);
+  const keycloakConfig = useContext3(KeycloakConfigContext);
+  const { disabled } = useAuthConfig();
+  if (disabled) return null;
+  if (keycloak) return keycloak;
+  const { session, status } = useSession();
+  if (isStorybook) {
+    return new Keycloak(keycloakConfig, {
+      email: "storybook@example.com",
+      username: "storybook"
+    });
+  }
+  if (status === "unauthenticated") {
+    return new Keycloak(keycloakConfig);
+  }
+  if (status === "authenticated") {
+    if (session?.accessToken) {
+      return new Keycloak(keycloakConfig, session);
+    }
+    return new Keycloak(keycloakConfig);
+  }
+}
+
+// src/Authenticated.tsx
+import { Fragment, jsx } from "react/jsx-runtime";
+function Authenticated({
+  children,
+  disabled,
+  loggedOutComponent,
+  loadingComponent
+}) {
+  const authConfig = useAuthConfig();
+  const keycloak = useKeycloak();
+  const tokensFromQuery = useTokensFromQuery();
+  useEffect(() => {
+    if (!keycloak || !authConfig.iframeSso && isIframe3 || isServer3 || keycloak.authenticated || tokensFromQuery) {
+      return;
+    }
+    keycloak?.login({
+      redirectUri: authConfig.loginRedirectUri
+    });
+  }, [keycloak?.authenticated]);
+  if (typeof disabled === "undefined") disabled = authConfig.disabled;
+  if (disabled) return /* @__PURE__ */ jsx(Fragment, { children });
+  if (typeof keycloak === "undefined") {
+    const LoadingComponent = loadingComponent;
+    return LoadingComponent ? /* @__PURE__ */ jsx(LoadingComponent, {}) : /* @__PURE__ */ jsx(Text, { children: authConfig.debug ? "loading" : null });
+  }
+  if (keycloak === null || keycloak.authenticated) return /* @__PURE__ */ jsx(Fragment, { children });
+  const LoggedOutComponent = loggedOutComponent;
+  return LoggedOutComponent ? /* @__PURE__ */ jsx(LoggedOutComponent, {}) : /* @__PURE__ */ jsx(Text, { children: authConfig.debug ? "not authenticated" : null });
+}
+function withAuthenticated(Component, options = {}) {
+  return (props) => /* @__PURE__ */ jsx(Authenticated, { ...options, children: /* @__PURE__ */ jsx(Component, { ...props }) });
+}
+
+// src/provider/AfterAuth.tsx
+import { logger } from "@multiplatform.one/logger";
+import { useEffect as useEffect2 } from "react";
+import { Fragment as Fragment2, jsx as jsx2 } from "react/jsx-runtime";
+function AfterAuth({ children, loadingComponent: _loadingComponent }) {
+  const authConfig = useAuthConfig();
+  const authStore2 = useAuthStore();
+  const keycloak = useKeycloak();
+  useEffect2(() => {
+    if (!persist || !keycloak?.authenticated) return;
+    if (keycloak.token) {
+      authStore2.setTokens({
+        token: keycloak.token,
+        ...keycloak.idToken && { idToken: keycloak.idToken },
+        ...keycloak.refreshToken && {
+          refreshToken: keycloak.refreshToken
+        }
+      });
+    }
+  }, [
+    authStore2,
+    persist,
+    keycloak?.authenticated,
+    keycloak?.token,
+    keycloak?.idToken,
+    keycloak?.refreshToken
+  ]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.token) {
+      logger.debug("token", keycloak.token);
+    }
+  }, [authConfig.debug, keycloak?.token]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.idToken) {
+      logger.debug("idToken", keycloak.idToken);
+    }
+  }, [authConfig.debug, keycloak?.idToken]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.refreshToken) {
+      logger.debug("refreshToken", keycloak.refreshToken);
+    }
+  }, [authConfig.debug, keycloak?.refreshToken]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.authenticated) {
+      logger.debug("authenticated", keycloak.authenticated);
+    }
+  }, [authConfig.debug, keycloak?.authenticated]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak === null) {
+      logger.debug("keycloak disabled");
+    }
+  }, [authConfig.debug, keycloak]);
+  return /* @__PURE__ */ jsx2(Fragment2, { children });
+}
+
+// src/provider/authProvider/index.tsx
+import KeycloakClient from "@multiplatform.one/keycloak-js";
+import { isIframe as isIframe4, isWindowDefined } from "@multiplatform.one/platform";
+import { logger as logger2 } from "@multiplatform.one/logger";
+import { useCallback, useEffect as useEffect3, useMemo, useState } from "react";
+
+// src/Loading.tsx
+import { Text as Text2 } from "tamagui";
+import { jsx as jsx3 } from "react/jsx-runtime";
+function Loading({ loadingComponent }) {
+  const { debug } = useAuthConfig();
+  const LoadingComponent = loadingComponent;
+  if (typeof LoadingComponent === "undefined") {
+    return /* @__PURE__ */ jsx3(Text2, { children: debug ? "loading" : null });
+  }
+  return /* @__PURE__ */ jsx3(LoadingComponent, {});
+}
+
+// src/provider/authProvider/shared.ts
+var defaultKeycloakInitOptions = {
+  checkLoginIframe: true,
+  checkLoginIframeInterval: 5,
+  enableLogging: false,
+  onLoad: "check-sso",
+  pkceMethod: "S256"
+};
+
+// src/provider/authProvider/index.tsx
+import { Fragment as Fragment3, jsx as jsx4 } from "react/jsx-runtime";
+function AuthProvider({
+  children,
+  disabled,
+  keycloakConfig,
+  keycloakInitOptions,
+  loadingComponent
+}) {
+  const { debug, messageHandlerKeys, iframeSso } = useAuthConfig();
+  const query = new URLSearchParams(isWindowDefined ? window?.location?.search || "" : "");
+  const authStore2 = useAuthStore();
+  const [keycloak, setKeycloak] = useState();
+  const idTokenQuery = query.get("idToken");
+  const refreshTokenQuery = query.get("refreshToken");
+  const tokenQuery = query.get("token");
+  const [listeningRefreshToken, setListeningRefreshToken] = useState(false);
+  const [listeningToken, setListeningToken] = useState(false);
+  const [listeningIdToken, setListeningIdToken] = useState(false);
+  const [loadedMessagePosted, setLoadedMessagePosted] = useState(false);
+  const initialRefreshTokenQuery = useMemo(
+    () => validOrRefreshableToken(
+      !iframeSso && isIframe4 || typeof refreshTokenQuery === "string" ? refreshTokenQuery || true : void 0
+    ),
+    [refreshTokenQuery, iframeSso]
+  );
+  const initialIdTokenQuery = useMemo(
+    () => validOrRefreshableToken(
+      !iframeSso && isIframe4 || typeof idTokenQuery === "string" ? idTokenQuery || true : void 0,
+      initialRefreshTokenQuery
+    ),
+    [idTokenQuery, initialRefreshTokenQuery, iframeSso]
+  );
+  const initialTokenQuery = useMemo(
+    () => validOrRefreshableToken(
+      isIframe4 ? typeof tokenQuery === "string" ? tokenQuery || true : void 0 : void 0,
+      initialRefreshTokenQuery
+    ),
+    [tokenQuery, initialRefreshTokenQuery, iframeSso]
+  );
+  const [tokens, setTokens] = useState({
+    refreshToken: initialRefreshTokenQuery,
+    token: initialTokenQuery,
+    idToken: initialIdTokenQuery
+  });
+  const authSource = useMemo(() => {
+    if (!iframeSso && isIframe4) {
+      if (initialTokenQuery) return "query" /* Query */;
+      return "store" /* Store */;
+    }
+    return "session" /* Session */;
+  }, [initialTokenQuery, iframeSso]);
+  const authStrategy = useMemo(() => {
+    if (authSource === "session" /* Session */) return "better-auth" /* BetterAuth */;
+    if (authSource === "query" /* Query */) {
+      return "keycloak-client-implicit" /* KeycloakClientImplicit */;
+    }
+    if (!persist) return "keycloak-client-standard" /* KeycloakClientStandard */;
+    if (authStore2.token && typeof tokens.token === "string" && tokens.token) {
+      return "keycloak-client-implicit" /* KeycloakClientImplicit */;
+    }
+    return "keycloak-client-standard" /* KeycloakClientStandard */;
+  }, [authSource, authStore2.token, tokens.token]);
+  const isLoading = useMemo(() => {
+    if (!authStrategy) return true;
+    if (authStrategy === "keycloak-client-implicit" /* KeycloakClientImplicit */) {
+      if (authSource === "query" /* Query */ && (initialRefreshTokenQuery === true || initialTokenQuery === true || initialIdTokenQuery === true)) {
+        return true;
+      }
+    }
+    return false;
+  }, [
+    authSource,
+    authStore2.idToken,
+    authStore2.refreshToken,
+    authStore2.token,
+    authStrategy,
+    initialIdTokenQuery,
+    initialRefreshTokenQuery,
+    initialTokenQuery
+  ]);
+  useEffect3(() => {
+    if (!persist || tokens.idToken || tokens.refreshToken || tokens.token) {
+      return;
+    }
+    const refreshToken = validOrRefreshableToken(authStore2.refreshToken);
+    const idToken = validOrRefreshableToken(authStore2.idToken, refreshToken);
+    const token = validOrRefreshableToken(authStore2.token, refreshToken);
+    if (!idToken && !refreshToken && !token) return;
+    setTokens({
+      idToken,
+      refreshToken,
+      token
+    });
+  }, [authStore2, persist]);
+  useEffect3(() => {
+    if (disabled || authSource !== "query" /* Query */ || tokens.token === true || tokens.refreshToken === true || tokens.idToken === true || loadedMessagePosted) {
+      return;
+    }
+    if (debug) logger2.debug("post message", JSON.stringify({ type: "LOADED" }));
+    (messageHandlerKeys || []).forEach((key) => {
+      window?.webkit?.messageHandlers?.[key]?.postMessage(JSON.stringify({ type: "LOADED" }));
+    });
+    window?.ReactNativeWebView?.postMessage(JSON.stringify({ type: "LOADED" }));
+    window?.parent?.postMessage(JSON.stringify({ type: "LOADED" }));
+    setLoadedMessagePosted(true);
+  }, [disabled, authSource, tokens.token, tokens.refreshToken, tokens.idToken]);
+  useEffect3(() => {
+    if (disabled || tokens.refreshToken !== true || listeningRefreshToken) {
+      return;
+    }
+    setListeningRefreshToken(true);
+    function messageCallback(e) {
+      let data = e?.data || null;
+      if (typeof data === "string") {
+        try {
+          data = JSON.parse(data);
+        } catch {
+        }
+      }
+      if (debug) logger2.debug("received message", JSON.stringify(data));
+      const message = data;
+      if (!message.type) return;
+      if (message.type.toUpperCase() === "REFRESH_TOKEN" && message.payload) {
+        if (debug) logger2.debug("setting refresh token", message.payload);
+        setTokens((tokens2) => ({
+          ...tokens2,
+          refreshToken: validOrRefreshableToken(message.payload)
+        }));
+        window.removeEventListener("message", messageCallback);
+        setListeningRefreshToken(false);
+      }
+    }
+    if (debug) {
+      logger2.debug(
+        "listening for message",
+        JSON.stringify({
+          type: "REFRESH_TOKEN",
+          payload: "<some_refresh_token>"
+        })
+      );
+    }
+    window.addEventListener("message", messageCallback);
+    return () => {
+      window.removeEventListener("message", messageCallback);
+    };
+  }, [disabled, tokens.refreshToken, listeningRefreshToken]);
+  useEffect3(() => {
+    if (disabled || tokens.token !== true || listeningToken) return;
+    setListeningToken(true);
+    function messageCallback(e) {
+      let data = e?.data || null;
+      if (typeof data === "string") {
+        try {
+          data = JSON.parse(data);
+        } catch {
+        }
+      }
+      if (debug) logger2.debug("received message", JSON.stringify(data));
+      const message = data;
+      if (!message.type) return;
+      if (message.type.toUpperCase() === "TOKEN" && message.payload) {
+        if (debug) logger2.debug("setting token", message.payload);
+        setTokens((tokens2) => ({
+          ...tokens2,
+          token: validOrRefreshableToken(message.payload, tokens2.refreshToken)
+        }));
+        window.removeEventListener("message", messageCallback);
+        setListeningToken(false);
+      }
+    }
+    if (debug) {
+      logger2.debug(
+        "listening for message",
+        JSON.stringify({
+          type: "TOKEN",
+          payload: "<some_token>"
+        })
+      );
+    }
+    window.addEventListener("message", messageCallback);
+    return () => {
+      window.removeEventListener("message", messageCallback);
+    };
+  }, [disabled, tokens.token, listeningToken]);
+  useEffect3(() => {
+    if (disabled || tokens.idToken !== true || listeningIdToken) return;
+    setListeningIdToken(true);
+    function messageCallback(e) {
+      let data = e?.data || null;
+      if (typeof data === "string") {
+        try {
+          data = JSON.parse(data);
+        } catch {
+        }
+      }
+      if (debug) logger2.debug("received message", JSON.stringify(data));
+      const message = data;
+      if (!message.type) return;
+      if (message.type.toUpperCase() === "ID_TOKEN" && message.payload) {
+        if (debug) logger2.debug("setting id token", message.payload);
+        setTokens((tokens2) => ({
+          ...tokens2,
+          idToken: validOrRefreshableToken(message.payload, tokens2.refreshToken)
+        }));
+        window.removeEventListener("message", messageCallback);
+        setListeningIdToken(false);
+      }
+    }
+    if (debug) {
+      logger2.debug(
+        "listening for message",
+        JSON.stringify({
+          type: "ID_TOKEN",
+          payload: "<some_id_token>"
+        })
+      );
+    }
+    window.addEventListener("message", messageCallback);
+    return () => {
+      window.removeEventListener("message", messageCallback);
+    };
+  }, [disabled, tokens.idToken, listeningIdToken]);
+  const keycloakClient = useMemo(
+    () => !disabled && !isLoading && (authStrategy === "keycloak-client-standard" /* KeycloakClientStandard */ || authStrategy === "keycloak-client-implicit" /* KeycloakClientImplicit */) && keycloakConfig ? new KeycloakClient({
+      clientId: keycloakConfig.publicClientId || keycloakConfig.clientId,
+      realm: keycloakConfig.realm,
+      url: keycloakConfig.url
+    }) : void 0,
+    [
+      authStrategy,
+      disabled,
+      isLoading,
+      keycloakConfig,
+      keycloakInitOptions,
+      tokens.idToken,
+      tokens.refreshToken,
+      tokens.token
+    ]
+  );
+  const initOptions = useMemo(() => {
+    if (!keycloakClient) return;
+    const initOptions2 = {
+      ...defaultKeycloakInitOptions,
+      ...keycloakInitOptions,
+      scope: [
+        .../* @__PURE__ */ new Set([
+          "email",
+          "openid",
+          "profile",
+          ...defaultKeycloakInitOptions.scope?.split(" ") || [],
+          ...keycloakInitOptions?.scope?.split(" ") || [],
+          ...keycloakConfig.scopes || []
+        ])
+      ].join(" ")
+    };
+    if (debug) initOptions2.enableLogging = true;
+    if (tokens.token && typeof tokens.token === "string") {
+      initOptions2.token = tokens.token;
+      initOptions2.timeSkew = 0;
+      if (tokens.idToken && typeof tokens.idToken === "string") {
+        initOptions2.idToken = tokens.idToken;
+      }
+      if (tokens.refreshToken && typeof tokens.refreshToken === "string") {
+        initOptions2.refreshToken = tokens.refreshToken;
+      }
+    }
+    if (!iframeSso && isIframe4 || tokens.token && !tokens.refreshToken) {
+      initOptions2.checkLoginIframe = false;
+      initOptions2.flow = "implicit";
+      initOptions2.onLoad = void 0;
+    }
+    return initOptions2;
+  }, [
+    keycloakClient,
+    keycloakInitOptions,
+    keycloakConfig.scopes,
+    debug,
+    tokens.token,
+    tokens.idToken,
+    tokens.refreshToken,
+    iframeSso
+  ]);
+  useEffect3(() => {
+    if (!keycloakClient || !initOptions || authStrategy === "keycloak-client-implicit" /* KeycloakClientImplicit */ && (typeof tokens.token !== "string" || !tokens.token)) {
+      return;
+    }
+    function onError() {
+      if (keycloakClient && initOptions) {
+        setKeycloak(new Keycloak(keycloakConfig, keycloakClient));
+      }
+    }
+    function onUpdate() {
+      if (keycloakClient && initOptions) {
+        setKeycloak(new Keycloak(keycloakConfig, keycloakClient));
+      }
+    }
+    (async () => {
+      keycloakClient.onAuthError = onError;
+      keycloakClient.onAuthLogout = onUpdate;
+      keycloakClient.onAuthRefreshError = onError;
+      keycloakClient.onAuthRefreshSuccess = onUpdate;
+      keycloakClient.onAuthSuccess = onUpdate;
+      keycloakClient.onReady = onUpdate;
+      keycloakClient.onTokenExpired = async () => {
+        try {
+          await keycloakClient.updateToken(5);
+        } catch (err) {
+          logger2.warn(err);
+          setKeycloak(new Keycloak(keycloakConfig, keycloakClient));
+        }
+      };
+      await keycloakClient.init(initOptions);
+      setKeycloak(new Keycloak(keycloakConfig, keycloakClient));
+    })();
+  }, [keycloakClient, initOptions, authStrategy, tokens.token]);
+  const render = useCallback(
+    () => /* @__PURE__ */ jsx4(KeycloakConfigContext.Provider, { value: keycloakConfig, children: /* @__PURE__ */ jsx4(KeycloakContext.Provider, { value: keycloak, children: /* @__PURE__ */ jsx4(AfterAuth, { loadingComponent, children }) }) }),
+    [children, keycloak, keycloakConfig]
+  );
+  if (disabled) return /* @__PURE__ */ jsx4(Fragment3, { children });
+  if (authStrategy === "better-auth" /* BetterAuth */) {
+    return render();
+  }
+  if (isLoading) return /* @__PURE__ */ jsx4(Loading, { loadingComponent });
+  return render();
+}
+
+// src/provider/KeycloakProvider.tsx
+import { useMemo as useMemo2 } from "react";
+import { jsx as jsx5 } from "react/jsx-runtime";
+function KeycloakProvider({
+  baseUrl,
+  children,
+  clientId,
+  loginRedirectUri,
+  debug,
+  disabled,
+  iframeSso,
+  publicClientId,
+  realm
+}) {
+  const authConfig = useMemo2(
+    () => ({ debug, disabled, iframeSso, loginRedirectUri }),
+    [debug, disabled, iframeSso, loginRedirectUri]
+  );
+  return /* @__PURE__ */ jsx5(AuthConfigContext.Provider, { value: authConfig, children: /* @__PURE__ */ jsx5(
+    AuthProvider,
+    {
+      disabled,
+      keycloakConfig: {
+        clientId: clientId || "app",
+        publicClientId,
+        realm: realm || "main",
+        url: baseUrl ?? ""
+      },
+      children
+    }
+  ) });
+}
+export {
+  AfterAuth,
+  AuthConfigContext,
+  AuthProvider,
+  Authenticated,
+  BaseKeycloak,
+  Keycloak,
+  KeycloakConfigContext,
+  KeycloakProvider,
+  defaultAuthConfig,
+  getAllWalletAddresses,
+  getWalletAddresses,
+  getWalletsFromToken,
+  hasWallets,
+  isTokenExpired,
+  useAuthConfig,
+  useKeycloak,
+  useSession,
+  useTokensFromQuery,
+  useTokensFromStore,
+  validOrRefreshableToken,
+  withAuthenticated
+};