@multiplatform.one/keycloak 6.0.3 → 6.1.0

package/dist/cjs/index.native.cjs

@@ -0,0 +1,717 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AfterAuth: () => AfterAuth,
+  AuthConfigContext: () => AuthConfigContext,
+  AuthProvider: () => AuthProvider,
+  Authenticated: () => Authenticated,
+  BaseKeycloak: () => BaseKeycloak,
+  Keycloak: () => Keycloak,
+  KeycloakConfigContext: () => KeycloakConfigContext,
+  KeycloakProvider: () => KeycloakProvider,
+  defaultAuthConfig: () => defaultAuthConfig,
+  getAllWalletAddresses: () => getAllWalletAddresses,
+  getKeycloakBearerToken: () => getKeycloakBearerToken,
+  getSession: () => getSession,
+  getWalletAddresses: () => getWalletAddresses,
+  getWalletsFromToken: () => getWalletsFromToken,
+  hasWallets: () => hasWallets,
+  isTokenExpired: () => isTokenExpired,
+  setNativeSession: () => setNativeSession,
+  useAuthConfig: () => useAuthConfig,
+  useKeycloak: () => useKeycloak,
+  useSession: () => useSession,
+  useTokensFromQuery: () => useTokensFromQuery,
+  useTokensFromStore: () => useTokensFromStore,
+  validOrRefreshableToken: () => validOrRefreshableToken,
+  withAuthenticated: () => withAuthenticated
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/Authenticated.tsx
+var import_platform3 = require("@multiplatform.one/platform");
+var import_react7 = require("react");
+var import_react_native = require("react-native");
+
+// src/hooks/useAuthConfig.ts
+var import_react2 = require("react");
+
+// src/authConfig.ts
+var import_react = require("react");
+var defaultAuthConfig = {};
+var AuthConfigContext = (0, import_react.createContext)(defaultAuthConfig);
+
+// src/hooks/useAuthConfig.ts
+function useAuthConfig() {
+  return (0, import_react2.useContext)(AuthConfigContext);
+}
+
+// src/hooks/useTokensFromQuery/index.native.ts
+var useTokensFromQuery = () => false;
+
+// src/state.ts
+var import_store = require("@multiplatform.one/store");
+var import_platform = require("@multiplatform.one/platform");
+var persist = import_platform.isIframe || import_platform.isTauri || !import_platform.isBrowser && !import_platform.isServer;
+var authStore = (0, import_store.createStore)(
+  { idToken: "", refreshToken: "", token: "" },
+  { name: "auth", persist }
+);
+function useAuthStore() {
+  const state2 = (0, import_store.useStore)(authStore);
+  return {
+    ...state2,
+    setIdToken: (idToken) => authStore.setState((prev) => ({ ...prev, idToken })),
+    setRefreshToken: (refreshToken) => authStore.setState((prev) => ({ ...prev, refreshToken })),
+    setToken: (token) => authStore.setState((prev) => ({ ...prev, token })),
+    setTokens: (tokens) => authStore.setState((prev) => ({ ...prev, ...tokens }))
+  };
+}
+
+// src/token.ts
+var import_jwt_decode = require("jwt-decode");
+function getWalletsFromToken(token) {
+  try {
+    const decoded = (0, import_jwt_decode.jwtDecode)(token);
+    return decoded.crypto?.wallets ?? {};
+  } catch {
+    return {};
+  }
+}
+function getWalletAddresses(token, walletType = "ethereum") {
+  const wallets = getWalletsFromToken(token);
+  return wallets[walletType]?.addresses ?? [];
+}
+function hasWallets(token) {
+  const wallets = getWalletsFromToken(token);
+  return Object.values(wallets).some((info) => info.addresses && info.addresses.length > 0);
+}
+function getAllWalletAddresses(token) {
+  const wallets = getWalletsFromToken(token);
+  const result = [];
+  for (const [walletType, info] of Object.entries(wallets)) {
+    if (info.addresses) {
+      for (const address of info.addresses) {
+        result.push({ walletType, address });
+      }
+    }
+  }
+  return result;
+}
+function validOrRefreshableToken(token, refreshToken) {
+  if (typeof token === "undefined") return;
+  if (!token) return false;
+  if (typeof token !== "string") return token;
+  if (refreshToken) {
+    if (refreshToken === true || !isTokenExpired(refreshToken)) return token;
+    return false;
+  }
+  return isTokenExpired(token) ? false : token;
+}
+function isTokenExpired(token) {
+  const { exp } = (0, import_jwt_decode.jwtDecode)(token);
+  if (!exp) return false;
+  return Math.floor(Date.now() / 1e3) >= exp;
+}
+
+// src/hooks/useTokensFromState.ts
+function useTokensFromStore() {
+  const authStore2 = useAuthStore();
+  return !!validOrRefreshableToken(authStore2.token, authStore2.refreshToken);
+}
+
+// src/keycloak/index.native.ts
+var import_platform2 = require("@multiplatform.one/platform");
+var import_react6 = require("react");
+
+// src/keycloak/base.ts
+var import_jwt_decode2 = require("jwt-decode");
+var import_react4 = require("react");
+
+// src/keycloak/context.ts
+var import_react3 = require("react");
+var KeycloakContext = (0, import_react3.createContext)(void 0);
+
+// src/keycloak/base.ts
+var BaseKeycloak = class {
+  constructor(config, input, idToken, refreshToken, login, logout) {
+    this.config = config;
+    this.authenticated = false;
+    this.clientId = this.config.clientId;
+    this.realm = this.config.realm;
+    if (typeof input === "string") {
+      this.token = input;
+      this.idToken = idToken;
+      this.refreshToken = refreshToken;
+      this._parseTokens();
+    } else if (typeof input === "object") {
+      this._handleInputObject(input);
+    }
+    this._login = login;
+    this._logout = logout;
+    this._sync();
+  }
+  _handleInputObject(input) {
+    if (typeof input.init === "function") {
+      this._keycloakClient = input;
+    } else {
+      this._mock = input;
+    }
+  }
+  _parseTokens() {
+    if (this.token && !this.tokenParsed) {
+      this.tokenParsed = (0, import_jwt_decode2.jwtDecode)(this.token);
+    }
+    if (this.idToken && !this.idTokenParsed) {
+      this.idTokenParsed = (0, import_jwt_decode2.jwtDecode)(this.idToken);
+    }
+    if (this.refreshToken && !this.refreshTokenParsed) {
+      this.refreshTokenParsed = (0, import_jwt_decode2.jwtDecode)(this.refreshToken);
+    }
+  }
+  _clear() {
+    this.authenticated = false;
+    this.email = void 0;
+    this.idToken = void 0;
+    this.idTokenParsed = void 0;
+    this.realmAccess = void 0;
+    this.refreshToken = void 0;
+    this.refreshTokenParsed = void 0;
+    this.resourceAccess = void 0;
+    this.sessionId = void 0;
+    this.subject = void 0;
+    this.token = void 0;
+    this.tokenParsed = void 0;
+    this.username = void 0;
+  }
+  _sync() {
+    if (this._mock) {
+      this.authenticated = true;
+      this.email = this._mock.email;
+      this.username = this._mock.username;
+    } else if (this._keycloakClient) {
+      this.authenticated = !!this._keycloakClient.authenticated;
+      this.email = this._keycloakClient?.tokenParsed?.email;
+      this.idToken = this._keycloakClient?.idToken;
+      this.idTokenParsed = this._keycloakClient?.idTokenParsed;
+      this.realmAccess = this._keycloakClient?.realmAccess;
+      this.refreshToken = this._keycloakClient?.refreshToken;
+      this.refreshTokenParsed = this._keycloakClient?.refreshTokenParsed;
+      this.resourceAccess = this._keycloakClient?.resourceAccess;
+      this.sessionId = this._keycloakClient?.sessionId;
+      this.subject = this._keycloakClient?.subject;
+      this.token = this._keycloakClient?.token;
+      this.tokenParsed = this._keycloakClient?.tokenParsed;
+      this.username = this.tokenParsed?.preferred_username;
+      if (this._keycloakClient.realm) this.realm = this._keycloakClient.realm;
+      if (this._keycloakClient.clientId) {
+        this.clientId = this._keycloakClient.clientId;
+      }
+    } else if (this.tokenParsed) {
+      this.clientId = this.tokenParsed.azp || this.config.clientId;
+      this.email = this.tokenParsed.email;
+      this.realm = this.tokenParsed.iss?.split("/").pop() || this.config.realm;
+      this.realmAccess = this.tokenParsed.realm_access;
+      this.resourceAccess = this.tokenParsed.resource_access;
+      this.sessionId = this.tokenParsed.session_state;
+      this.subject = this.tokenParsed.sub;
+      this.authenticated = !!(this.tokenParsed?.exp && this.idToken && this.tokenParsed.exp > Date.now() / 1e3);
+      this.username = this.tokenParsed?.preferred_username;
+    } else {
+      return this._clear();
+    }
+  }
+  async getUserInfo() {
+    if (!this.authenticated) return;
+    const response = await fetch(
+      `${this.config.url}/realms/${this.realm}/protocol/openid-connect/userinfo`,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${this.token}`,
+          Accept: "application/json"
+        }
+      }
+    );
+    if (response.ok) return response.json();
+  }
+  async login(options = {}) {
+    this._clear();
+    if (this._keycloakClient) {
+      await this._keycloakClient.login(options);
+    } else {
+      await this._login?.(options);
+    }
+    this._sync();
+  }
+  async logout(options = {}) {
+    if (this._keycloakClient) {
+      await this._keycloakClient.logout(options);
+    } else {
+      await this._logout?.(options);
+    }
+    this._clear();
+  }
+};
+
+// src/keycloak/config.ts
+var import_react5 = require("react");
+var KeycloakConfigContext = (0, import_react5.createContext)({
+  clientId: "",
+  realm: "",
+  url: ""
+});
+
+// src/keycloak/index.native.ts
+var Keycloak = class extends BaseKeycloak {
+};
+function useKeycloak() {
+  const keycloak = (0, import_react6.useContext)(KeycloakContext);
+  const keycloakConfig = (0, import_react6.useContext)(KeycloakConfigContext);
+  const { disabled } = useAuthConfig();
+  if (disabled) return null;
+  if (keycloak) return keycloak;
+  if (import_platform2.isStorybook) {
+    return new Keycloak(keycloakConfig, {
+      email: "storybook@example.com",
+      username: "storybook"
+    });
+  }
+}
+
+// src/Authenticated.tsx
+var import_jsx_runtime = require("react/jsx-runtime");
+function Authenticated({
+  children,
+  disabled,
+  loggedOutComponent,
+  loadingComponent
+}) {
+  const authConfig = useAuthConfig();
+  const keycloak = useKeycloak();
+  const tokensFromQuery = useTokensFromQuery();
+  (0, import_react7.useEffect)(() => {
+    if (!keycloak || !authConfig.iframeSso && import_platform3.isIframe || import_platform3.isServer || keycloak.authenticated || tokensFromQuery) {
+      return;
+    }
+    keycloak?.login({
+      redirectUri: authConfig.loginRedirectUri
+    });
+  }, [keycloak?.authenticated]);
+  if (typeof disabled === "undefined") disabled = authConfig.disabled;
+  if (disabled) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children });
+  if (typeof keycloak === "undefined") {
+    const LoadingComponent = loadingComponent;
+    return LoadingComponent ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoadingComponent, {}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react_native.Text, { children: authConfig.debug ? "loading" : null });
+  }
+  if (keycloak === null || keycloak.authenticated) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children });
+  const LoggedOutComponent = loggedOutComponent;
+  return LoggedOutComponent ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoggedOutComponent, {}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react_native.Text, { children: authConfig.debug ? "not authenticated" : null });
+}
+function withAuthenticated(Component, options = {}) {
+  return (props) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Authenticated, { ...options, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Component, { ...props }) });
+}
+
+// src/provider/AfterAuth.tsx
+var import_logger = require("@multiplatform.one/logger");
+var import_react8 = require("react");
+var import_jsx_runtime2 = require("react/jsx-runtime");
+function AfterAuth({ children, loadingComponent: _loadingComponent }) {
+  const authConfig = useAuthConfig();
+  const authStore2 = useAuthStore();
+  const keycloak = useKeycloak();
+  (0, import_react8.useEffect)(() => {
+    if (!persist || !keycloak?.authenticated) return;
+    if (keycloak.token) {
+      authStore2.setTokens({
+        token: keycloak.token,
+        ...keycloak.idToken && { idToken: keycloak.idToken },
+        ...keycloak.refreshToken && {
+          refreshToken: keycloak.refreshToken
+        }
+      });
+    }
+  }, [
+    authStore2,
+    persist,
+    keycloak?.authenticated,
+    keycloak?.token,
+    keycloak?.idToken,
+    keycloak?.refreshToken
+  ]);
+  (0, import_react8.useEffect)(() => {
+    if (authConfig.debug && keycloak?.token) {
+      import_logger.logger.debug("token", keycloak.token);
+    }
+  }, [authConfig.debug, keycloak?.token]);
+  (0, import_react8.useEffect)(() => {
+    if (authConfig.debug && keycloak?.idToken) {
+      import_logger.logger.debug("idToken", keycloak.idToken);
+    }
+  }, [authConfig.debug, keycloak?.idToken]);
+  (0, import_react8.useEffect)(() => {
+    if (authConfig.debug && keycloak?.refreshToken) {
+      import_logger.logger.debug("refreshToken", keycloak.refreshToken);
+    }
+  }, [authConfig.debug, keycloak?.refreshToken]);
+  (0, import_react8.useEffect)(() => {
+    if (authConfig.debug && keycloak?.authenticated) {
+      import_logger.logger.debug("authenticated", keycloak.authenticated);
+    }
+  }, [authConfig.debug, keycloak?.authenticated]);
+  (0, import_react8.useEffect)(() => {
+    if (authConfig.debug && keycloak === null) {
+      import_logger.logger.debug("keycloak disabled");
+    }
+  }, [authConfig.debug, keycloak]);
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_jsx_runtime2.Fragment, { children });
+}
+
+// src/provider/authProvider/index.native.tsx
+var import_react10 = require("react");
+var Linking2 = __toESM(require("expo-linking"));
+
+// src/Loading.tsx
+var import_react_native2 = require("react-native");
+var import_jsx_runtime3 = require("react/jsx-runtime");
+function Loading({ loadingComponent }) {
+  const { debug } = useAuthConfig();
+  const LoadingComponent = loadingComponent;
+  if (typeof LoadingComponent === "undefined") {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_react_native2.View, { style: { flex: 1, alignItems: "center", justifyContent: "center" }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_react_native2.ActivityIndicator, {}),
+      debug ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_react_native2.Text, { children: "loading" }) : null
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(LoadingComponent, {});
+}
+
+// src/betterAuth/expoAuthFlow.native.ts
+var Linking = __toESM(require("expo-linking"));
+var SecureStore = __toESM(require("expo-secure-store"));
+var WebBrowser = __toESM(require("expo-web-browser"));
+var COOKIE_KEY = "better-auth_cookie";
+var SECURE_COOKIE_PREFIX = "__Secure-";
+function readJar() {
+  try {
+    return JSON.parse(SecureStore.getItem(COOKIE_KEY) || "{}");
+  } catch {
+    return {};
+  }
+}
+function writeJar(jar) {
+  SecureStore.setItem(COOKIE_KEY, JSON.stringify(jar));
+}
+function cookieHeader() {
+  return Object.entries(readJar()).reduce((acc, [key, v]) => {
+    if (v.expires && new Date(v.expires) < /* @__PURE__ */ new Date()) return acc;
+    return acc ? `${acc}; ${key}=${v.value}` : `${key}=${v.value}`;
+  }, "");
+}
+function absorbSetCookie(header) {
+  if (!header) return;
+  const jar = readJar();
+  for (const part of header.split(/,(?=[^;,]+?=)/)) {
+    const [pair, ...attrs] = part.split(";");
+    const eq = pair.indexOf("=");
+    if (eq === -1) continue;
+    const name = pair.slice(0, eq).trim();
+    const value = pair.slice(eq + 1).trim();
+    let expires = null;
+    let dead = false;
+    for (const attr of attrs) {
+      const [k, v] = attr.split("=").map((s) => s?.trim());
+      const lk = (k || "").toLowerCase();
+      if (lk === "max-age") {
+        const n = Number(v);
+        if (n <= 0) dead = true;
+        else expires = new Date(Date.now() + n * 1e3).toISOString();
+      } else if (lk === "expires" && !expires && v) {
+        const d = new Date(part.slice(part.toLowerCase().indexOf("expires=") + 8).split(";")[0]);
+        if (!Number.isNaN(d.getTime())) {
+          if (d.getTime() <= Date.now()) dead = true;
+          else expires = d.toISOString();
+        }
+      }
+    }
+    if (dead) delete jar[name];
+    else jar[name] = { value, expires };
+  }
+  writeJar(jar);
+}
+function getOAuthState() {
+  const jar = readJar();
+  for (const name of [
+    `${SECURE_COOKIE_PREFIX}better-auth.oauth_state`,
+    "better-auth.oauth_state"
+  ]) {
+    if (jar[name]?.value) return jar[name].value;
+  }
+  return null;
+}
+var activeFlow = null;
+function getActiveExpoAuthFlow() {
+  return activeFlow;
+}
+function createExpoAuthFlow(baseURL, scheme) {
+  const base = baseURL.replace(/\/$/, "");
+  const origin = () => Linking.createURL("/", scheme ? { scheme } : void 0);
+  async function authFetch(path, init) {
+    const cookie = cookieHeader();
+    const res = await fetch(`${base}/api/auth${path}`, {
+      ...init,
+      credentials: "omit",
+      headers: {
+        "Content-Type": "application/json",
+        ...cookie ? { cookie } : {},
+        "expo-origin": origin(),
+        "x-skip-oauth-proxy": "true",
+        ...init?.headers || {}
+      }
+    });
+    absorbSetCookie(res.headers.get("set-cookie"));
+    return res;
+  }
+  const flow = {
+    async signIn(provider, callbackURL) {
+      const to = callbackURL || Linking.createURL("/");
+      const res = await authFetch("/sign-in/social", {
+        method: "POST",
+        body: JSON.stringify({ provider, callbackURL: to })
+      });
+      if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`sign-in failed (${res.status}): ${body.slice(0, 200)}`);
+      }
+      const data = await res.json();
+      if (!data?.url) throw new Error("sign-in response had no authorization url");
+      const params = new URLSearchParams({ authorizationURL: data.url });
+      const oauthState = getOAuthState();
+      if (oauthState) params.append("oauthState", oauthState);
+      const proxyURL = `${base}/api/auth/expo-authorization-proxy?${params.toString()}`;
+      const result = await WebBrowser.openAuthSessionAsync(proxyURL, to);
+      if (result.type !== "success") {
+        throw new Error(`sign-in ${result.type}`);
+      }
+      const cookie = new URL(result.url).searchParams.get("cookie");
+      if (cookie) absorbSetCookie(cookie);
+    },
+    async signOut() {
+      try {
+        await authFetch("/sign-out", { method: "POST", body: "{}" });
+      } finally {
+        writeJar({});
+      }
+    },
+    async getSession() {
+      const res = await authFetch("/get-session");
+      if (!res.ok) return null;
+      const data = await res.json().catch(() => null);
+      return data && Object.keys(data).length ? data : null;
+    },
+    async getAccessToken(providerId) {
+      const res = await authFetch("/get-access-token", {
+        method: "POST",
+        body: JSON.stringify({ providerId })
+      });
+      if (!res.ok) return null;
+      return await res.json().catch(() => null);
+    }
+  };
+  activeFlow = flow;
+  return flow;
+}
+
+// src/session/index.native.ts
+var import_react9 = require("react");
+var state = { session: null, status: "loading" };
+var listeners = /* @__PURE__ */ new Set();
+function setNativeSession(session, status) {
+  state = {
+    session,
+    status: status ?? (session?.user ? "authenticated" : "unauthenticated")
+  };
+  for (const l of listeners) l();
+}
+function subscribe(listener) {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+async function getSession() {
+  return state.session;
+}
+function useSession(_options) {
+  return (0, import_react9.useSyncExternalStore)(
+    subscribe,
+    () => state,
+    () => state
+  );
+}
+
+// src/provider/authProvider/index.native.tsx
+var import_jsx_runtime4 = require("react/jsx-runtime");
+function AuthProvider({
+  children,
+  disabled,
+  keycloakConfig,
+  loadingComponent
+}) {
+  const [keycloak, setKeycloak] = (0, import_react10.useState)();
+  const [isLoading, setIsLoading] = (0, import_react10.useState)(true);
+  const serverBaseUrl = (0, import_react10.useMemo)(() => {
+    return keycloakConfig.betterAuthBaseUrl || "http://localhost:8000";
+  }, [keycloakConfig]);
+  const scheme = (0, import_react10.useMemo)(() => keycloakConfig.expoScheme, [keycloakConfig]);
+  const flow = (0, import_react10.useMemo)(
+    () => disabled ? null : createExpoAuthFlow(serverBaseUrl, scheme),
+    [disabled, serverBaseUrl, scheme]
+  );
+  (0, import_react10.useEffect)(() => {
+    if (disabled || !flow) {
+      setIsLoading(false);
+      return;
+    }
+    let alive = true;
+    const refresh = async () => {
+      let session = null;
+      try {
+        session = await flow.getSession();
+      } catch (err) {
+        console.error("[keycloak] native session check failed:", err);
+      }
+      const _keycloak = new Keycloak(
+        keycloakConfig,
+        void 0,
+        void 0,
+        void 0,
+        async (options) => {
+          await flow.signIn("keycloak", options.redirectUri || Linking2.createURL("/"));
+          await refresh();
+          return void 0;
+        },
+        async (_options) => {
+          await flow.signOut();
+          await refresh();
+          return void 0;
+        }
+      );
+      if (session?.user) {
+        _keycloak.authenticated = true;
+        _keycloak.email = session.user.email || void 0;
+        _keycloak.username = session.user.name || void 0;
+        _keycloak.subject = session.user.id;
+      }
+      if (!alive) return;
+      setNativeSession(
+        session?.user ? {
+          user: {
+            id: session.user.id,
+            name: session.user.name ?? null,
+            email: session.user.email ?? null
+          }
+        } : null
+      );
+      setKeycloak(_keycloak);
+    };
+    refresh().finally(() => {
+      if (alive) setIsLoading(false);
+    });
+    return () => {
+      alive = false;
+    };
+  }, [disabled, flow, keycloakConfig]);
+  if (disabled) return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_jsx_runtime4.Fragment, { children });
+  if (isLoading || !keycloak) {
+    return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(Loading, { loadingComponent });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(KeycloakConfigContext.Provider, { value: keycloakConfig, children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(KeycloakContext.Provider, { value: keycloak, children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(AfterAuth, { children }) }) });
+}
+
+// src/provider/KeycloakProvider.tsx
+var import_react11 = require("react");
+var import_jsx_runtime5 = require("react/jsx-runtime");
+function KeycloakProvider({
+  baseUrl,
+  betterAuthBaseUrl,
+  children,
+  clientId,
+  expoScheme,
+  loginRedirectUri,
+  debug,
+  disabled,
+  iframeSso,
+  publicClientId,
+  realm
+}) {
+  const authConfig = (0, import_react11.useMemo)(
+    () => ({ debug, disabled, iframeSso, loginRedirectUri }),
+    [debug, disabled, iframeSso, loginRedirectUri]
+  );
+  return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(AuthConfigContext.Provider, { value: authConfig, children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+    AuthProvider,
+    {
+      disabled,
+      keycloakConfig: {
+        clientId: clientId || "app",
+        publicClientId,
+        realm: realm || "main",
+        url: baseUrl ?? "",
+        betterAuthBaseUrl,
+        expoScheme
+      },
+      children
+    }
+  ) });
+}
+
+// src/frappeToken.native.ts
+var cached;
+async function getKeycloakBearerToken() {
+  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
+  const flow = getActiveExpoAuthFlow();
+  if (!flow) return void 0;
+  try {
+    const res = await flow.getAccessToken("keycloak");
+    if (!res?.accessToken) {
+      cached = void 0;
+      return void 0;
+    }
+    cached = {
+      token: res.accessToken,
+      expiresAt: res.accessTokenExpiresAt ? new Date(res.accessTokenExpiresAt).getTime() : Date.now() + 6e4
+    };
+    return cached.token;
+  } catch {
+    cached = void 0;
+    return void 0;
+  }
+}