@multiplatform.one/keycloak 6.0.3 → 6.1.0

package/dist/esm/index.native.js

@@ -0,0 +1,684 @@
+// src/Authenticated.tsx
+import { isIframe as isIframe2, isServer as isServer2 } from "@multiplatform.one/platform";
+import { useEffect } from "react";
+import { Text } from "react-native";
+
+// src/hooks/useAuthConfig.ts
+import { useContext } from "react";
+
+// src/authConfig.ts
+import { createContext } from "react";
+var defaultAuthConfig = {};
+var AuthConfigContext = createContext(defaultAuthConfig);
+
+// src/hooks/useAuthConfig.ts
+function useAuthConfig() {
+  return useContext(AuthConfigContext);
+}
+
+// src/hooks/useTokensFromQuery/index.native.ts
+var useTokensFromQuery = () => false;
+
+// src/state.ts
+import { createStore, useStore } from "@multiplatform.one/store";
+import { isBrowser, isIframe, isServer, isTauri } from "@multiplatform.one/platform";
+var persist = isIframe || isTauri || !isBrowser && !isServer;
+var authStore = createStore(
+  { idToken: "", refreshToken: "", token: "" },
+  { name: "auth", persist }
+);
+function useAuthStore() {
+  const state2 = useStore(authStore);
+  return {
+    ...state2,
+    setIdToken: (idToken) => authStore.setState((prev) => ({ ...prev, idToken })),
+    setRefreshToken: (refreshToken) => authStore.setState((prev) => ({ ...prev, refreshToken })),
+    setToken: (token) => authStore.setState((prev) => ({ ...prev, token })),
+    setTokens: (tokens) => authStore.setState((prev) => ({ ...prev, ...tokens }))
+  };
+}
+
+// src/token.ts
+import { jwtDecode } from "jwt-decode";
+function getWalletsFromToken(token) {
+  try {
+    const decoded = jwtDecode(token);
+    return decoded.crypto?.wallets ?? {};
+  } catch {
+    return {};
+  }
+}
+function getWalletAddresses(token, walletType = "ethereum") {
+  const wallets = getWalletsFromToken(token);
+  return wallets[walletType]?.addresses ?? [];
+}
+function hasWallets(token) {
+  const wallets = getWalletsFromToken(token);
+  return Object.values(wallets).some((info) => info.addresses && info.addresses.length > 0);
+}
+function getAllWalletAddresses(token) {
+  const wallets = getWalletsFromToken(token);
+  const result = [];
+  for (const [walletType, info] of Object.entries(wallets)) {
+    if (info.addresses) {
+      for (const address of info.addresses) {
+        result.push({ walletType, address });
+      }
+    }
+  }
+  return result;
+}
+function validOrRefreshableToken(token, refreshToken) {
+  if (typeof token === "undefined") return;
+  if (!token) return false;
+  if (typeof token !== "string") return token;
+  if (refreshToken) {
+    if (refreshToken === true || !isTokenExpired(refreshToken)) return token;
+    return false;
+  }
+  return isTokenExpired(token) ? false : token;
+}
+function isTokenExpired(token) {
+  const { exp } = jwtDecode(token);
+  if (!exp) return false;
+  return Math.floor(Date.now() / 1e3) >= exp;
+}
+
+// src/hooks/useTokensFromState.ts
+function useTokensFromStore() {
+  const authStore2 = useAuthStore();
+  return !!validOrRefreshableToken(authStore2.token, authStore2.refreshToken);
+}
+
+// src/keycloak/index.native.ts
+import { isStorybook } from "@multiplatform.one/platform";
+import { useContext as useContext3 } from "react";
+
+// src/keycloak/base.ts
+import { jwtDecode as jwtDecode2 } from "jwt-decode";
+import { useContext as useContext2 } from "react";
+
+// src/keycloak/context.ts
+import { createContext as createContext2 } from "react";
+var KeycloakContext = createContext2(void 0);
+
+// src/keycloak/base.ts
+var BaseKeycloak = class {
+  constructor(config, input, idToken, refreshToken, login, logout) {
+    this.config = config;
+    this.authenticated = false;
+    this.clientId = this.config.clientId;
+    this.realm = this.config.realm;
+    if (typeof input === "string") {
+      this.token = input;
+      this.idToken = idToken;
+      this.refreshToken = refreshToken;
+      this._parseTokens();
+    } else if (typeof input === "object") {
+      this._handleInputObject(input);
+    }
+    this._login = login;
+    this._logout = logout;
+    this._sync();
+  }
+  _handleInputObject(input) {
+    if (typeof input.init === "function") {
+      this._keycloakClient = input;
+    } else {
+      this._mock = input;
+    }
+  }
+  _parseTokens() {
+    if (this.token && !this.tokenParsed) {
+      this.tokenParsed = jwtDecode2(this.token);
+    }
+    if (this.idToken && !this.idTokenParsed) {
+      this.idTokenParsed = jwtDecode2(this.idToken);
+    }
+    if (this.refreshToken && !this.refreshTokenParsed) {
+      this.refreshTokenParsed = jwtDecode2(this.refreshToken);
+    }
+  }
+  _clear() {
+    this.authenticated = false;
+    this.email = void 0;
+    this.idToken = void 0;
+    this.idTokenParsed = void 0;
+    this.realmAccess = void 0;
+    this.refreshToken = void 0;
+    this.refreshTokenParsed = void 0;
+    this.resourceAccess = void 0;
+    this.sessionId = void 0;
+    this.subject = void 0;
+    this.token = void 0;
+    this.tokenParsed = void 0;
+    this.username = void 0;
+  }
+  _sync() {
+    if (this._mock) {
+      this.authenticated = true;
+      this.email = this._mock.email;
+      this.username = this._mock.username;
+    } else if (this._keycloakClient) {
+      this.authenticated = !!this._keycloakClient.authenticated;
+      this.email = this._keycloakClient?.tokenParsed?.email;
+      this.idToken = this._keycloakClient?.idToken;
+      this.idTokenParsed = this._keycloakClient?.idTokenParsed;
+      this.realmAccess = this._keycloakClient?.realmAccess;
+      this.refreshToken = this._keycloakClient?.refreshToken;
+      this.refreshTokenParsed = this._keycloakClient?.refreshTokenParsed;
+      this.resourceAccess = this._keycloakClient?.resourceAccess;
+      this.sessionId = this._keycloakClient?.sessionId;
+      this.subject = this._keycloakClient?.subject;
+      this.token = this._keycloakClient?.token;
+      this.tokenParsed = this._keycloakClient?.tokenParsed;
+      this.username = this.tokenParsed?.preferred_username;
+      if (this._keycloakClient.realm) this.realm = this._keycloakClient.realm;
+      if (this._keycloakClient.clientId) {
+        this.clientId = this._keycloakClient.clientId;
+      }
+    } else if (this.tokenParsed) {
+      this.clientId = this.tokenParsed.azp || this.config.clientId;
+      this.email = this.tokenParsed.email;
+      this.realm = this.tokenParsed.iss?.split("/").pop() || this.config.realm;
+      this.realmAccess = this.tokenParsed.realm_access;
+      this.resourceAccess = this.tokenParsed.resource_access;
+      this.sessionId = this.tokenParsed.session_state;
+      this.subject = this.tokenParsed.sub;
+      this.authenticated = !!(this.tokenParsed?.exp && this.idToken && this.tokenParsed.exp > Date.now() / 1e3);
+      this.username = this.tokenParsed?.preferred_username;
+    } else {
+      return this._clear();
+    }
+  }
+  async getUserInfo() {
+    if (!this.authenticated) return;
+    const response = await fetch(
+      `${this.config.url}/realms/${this.realm}/protocol/openid-connect/userinfo`,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${this.token}`,
+          Accept: "application/json"
+        }
+      }
+    );
+    if (response.ok) return response.json();
+  }
+  async login(options = {}) {
+    this._clear();
+    if (this._keycloakClient) {
+      await this._keycloakClient.login(options);
+    } else {
+      await this._login?.(options);
+    }
+    this._sync();
+  }
+  async logout(options = {}) {
+    if (this._keycloakClient) {
+      await this._keycloakClient.logout(options);
+    } else {
+      await this._logout?.(options);
+    }
+    this._clear();
+  }
+};
+
+// src/keycloak/config.ts
+import { createContext as createContext3 } from "react";
+var KeycloakConfigContext = createContext3({
+  clientId: "",
+  realm: "",
+  url: ""
+});
+
+// src/keycloak/index.native.ts
+var Keycloak = class extends BaseKeycloak {
+};
+function useKeycloak() {
+  const keycloak = useContext3(KeycloakContext);
+  const keycloakConfig = useContext3(KeycloakConfigContext);
+  const { disabled } = useAuthConfig();
+  if (disabled) return null;
+  if (keycloak) return keycloak;
+  if (isStorybook) {
+    return new Keycloak(keycloakConfig, {
+      email: "storybook@example.com",
+      username: "storybook"
+    });
+  }
+}
+
+// src/Authenticated.tsx
+import { Fragment, jsx } from "react/jsx-runtime";
+function Authenticated({
+  children,
+  disabled,
+  loggedOutComponent,
+  loadingComponent
+}) {
+  const authConfig = useAuthConfig();
+  const keycloak = useKeycloak();
+  const tokensFromQuery = useTokensFromQuery();
+  useEffect(() => {
+    if (!keycloak || !authConfig.iframeSso && isIframe2 || isServer2 || keycloak.authenticated || tokensFromQuery) {
+      return;
+    }
+    keycloak?.login({
+      redirectUri: authConfig.loginRedirectUri
+    });
+  }, [keycloak?.authenticated]);
+  if (typeof disabled === "undefined") disabled = authConfig.disabled;
+  if (disabled) return /* @__PURE__ */ jsx(Fragment, { children });
+  if (typeof keycloak === "undefined") {
+    const LoadingComponent = loadingComponent;
+    return LoadingComponent ? /* @__PURE__ */ jsx(LoadingComponent, {}) : /* @__PURE__ */ jsx(Text, { children: authConfig.debug ? "loading" : null });
+  }
+  if (keycloak === null || keycloak.authenticated) return /* @__PURE__ */ jsx(Fragment, { children });
+  const LoggedOutComponent = loggedOutComponent;
+  return LoggedOutComponent ? /* @__PURE__ */ jsx(LoggedOutComponent, {}) : /* @__PURE__ */ jsx(Text, { children: authConfig.debug ? "not authenticated" : null });
+}
+function withAuthenticated(Component, options = {}) {
+  return (props) => /* @__PURE__ */ jsx(Authenticated, { ...options, children: /* @__PURE__ */ jsx(Component, { ...props }) });
+}
+
+// src/provider/AfterAuth.tsx
+import { logger } from "@multiplatform.one/logger";
+import { useEffect as useEffect2 } from "react";
+import { Fragment as Fragment2, jsx as jsx2 } from "react/jsx-runtime";
+function AfterAuth({ children, loadingComponent: _loadingComponent }) {
+  const authConfig = useAuthConfig();
+  const authStore2 = useAuthStore();
+  const keycloak = useKeycloak();
+  useEffect2(() => {
+    if (!persist || !keycloak?.authenticated) return;
+    if (keycloak.token) {
+      authStore2.setTokens({
+        token: keycloak.token,
+        ...keycloak.idToken && { idToken: keycloak.idToken },
+        ...keycloak.refreshToken && {
+          refreshToken: keycloak.refreshToken
+        }
+      });
+    }
+  }, [
+    authStore2,
+    persist,
+    keycloak?.authenticated,
+    keycloak?.token,
+    keycloak?.idToken,
+    keycloak?.refreshToken
+  ]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.token) {
+      logger.debug("token", keycloak.token);
+    }
+  }, [authConfig.debug, keycloak?.token]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.idToken) {
+      logger.debug("idToken", keycloak.idToken);
+    }
+  }, [authConfig.debug, keycloak?.idToken]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.refreshToken) {
+      logger.debug("refreshToken", keycloak.refreshToken);
+    }
+  }, [authConfig.debug, keycloak?.refreshToken]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.authenticated) {
+      logger.debug("authenticated", keycloak.authenticated);
+    }
+  }, [authConfig.debug, keycloak?.authenticated]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak === null) {
+      logger.debug("keycloak disabled");
+    }
+  }, [authConfig.debug, keycloak]);
+  return /* @__PURE__ */ jsx2(Fragment2, { children });
+}
+
+// src/provider/authProvider/index.native.tsx
+import { useEffect as useEffect3, useMemo, useState } from "react";
+import * as Linking2 from "expo-linking";
+
+// src/Loading.tsx
+import { ActivityIndicator, Text as Text2, View } from "react-native";
+import { jsx as jsx3, jsxs } from "react/jsx-runtime";
+function Loading({ loadingComponent }) {
+  const { debug } = useAuthConfig();
+  const LoadingComponent = loadingComponent;
+  if (typeof LoadingComponent === "undefined") {
+    return /* @__PURE__ */ jsxs(View, { style: { flex: 1, alignItems: "center", justifyContent: "center" }, children: [
+      /* @__PURE__ */ jsx3(ActivityIndicator, {}),
+      debug ? /* @__PURE__ */ jsx3(Text2, { children: "loading" }) : null
+    ] });
+  }
+  return /* @__PURE__ */ jsx3(LoadingComponent, {});
+}
+
+// src/betterAuth/expoAuthFlow.native.ts
+import * as Linking from "expo-linking";
+import * as SecureStore from "expo-secure-store";
+import * as WebBrowser from "expo-web-browser";
+var COOKIE_KEY = "better-auth_cookie";
+var SECURE_COOKIE_PREFIX = "__Secure-";
+function readJar() {
+  try {
+    return JSON.parse(SecureStore.getItem(COOKIE_KEY) || "{}");
+  } catch {
+    return {};
+  }
+}
+function writeJar(jar) {
+  SecureStore.setItem(COOKIE_KEY, JSON.stringify(jar));
+}
+function cookieHeader() {
+  return Object.entries(readJar()).reduce((acc, [key, v]) => {
+    if (v.expires && new Date(v.expires) < /* @__PURE__ */ new Date()) return acc;
+    return acc ? `${acc}; ${key}=${v.value}` : `${key}=${v.value}`;
+  }, "");
+}
+function absorbSetCookie(header) {
+  if (!header) return;
+  const jar = readJar();
+  for (const part of header.split(/,(?=[^;,]+?=)/)) {
+    const [pair, ...attrs] = part.split(";");
+    const eq = pair.indexOf("=");
+    if (eq === -1) continue;
+    const name = pair.slice(0, eq).trim();
+    const value = pair.slice(eq + 1).trim();
+    let expires = null;
+    let dead = false;
+    for (const attr of attrs) {
+      const [k, v] = attr.split("=").map((s) => s?.trim());
+      const lk = (k || "").toLowerCase();
+      if (lk === "max-age") {
+        const n = Number(v);
+        if (n <= 0) dead = true;
+        else expires = new Date(Date.now() + n * 1e3).toISOString();
+      } else if (lk === "expires" && !expires && v) {
+        const d = new Date(part.slice(part.toLowerCase().indexOf("expires=") + 8).split(";")[0]);
+        if (!Number.isNaN(d.getTime())) {
+          if (d.getTime() <= Date.now()) dead = true;
+          else expires = d.toISOString();
+        }
+      }
+    }
+    if (dead) delete jar[name];
+    else jar[name] = { value, expires };
+  }
+  writeJar(jar);
+}
+function getOAuthState() {
+  const jar = readJar();
+  for (const name of [
+    `${SECURE_COOKIE_PREFIX}better-auth.oauth_state`,
+    "better-auth.oauth_state"
+  ]) {
+    if (jar[name]?.value) return jar[name].value;
+  }
+  return null;
+}
+var activeFlow = null;
+function getActiveExpoAuthFlow() {
+  return activeFlow;
+}
+function createExpoAuthFlow(baseURL, scheme) {
+  const base = baseURL.replace(/\/$/, "");
+  const origin = () => Linking.createURL("/", scheme ? { scheme } : void 0);
+  async function authFetch(path, init) {
+    const cookie = cookieHeader();
+    const res = await fetch(`${base}/api/auth${path}`, {
+      ...init,
+      credentials: "omit",
+      headers: {
+        "Content-Type": "application/json",
+        ...cookie ? { cookie } : {},
+        "expo-origin": origin(),
+        "x-skip-oauth-proxy": "true",
+        ...init?.headers || {}
+      }
+    });
+    absorbSetCookie(res.headers.get("set-cookie"));
+    return res;
+  }
+  const flow = {
+    async signIn(provider, callbackURL) {
+      const to = callbackURL || Linking.createURL("/");
+      const res = await authFetch("/sign-in/social", {
+        method: "POST",
+        body: JSON.stringify({ provider, callbackURL: to })
+      });
+      if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`sign-in failed (${res.status}): ${body.slice(0, 200)}`);
+      }
+      const data = await res.json();
+      if (!data?.url) throw new Error("sign-in response had no authorization url");
+      const params = new URLSearchParams({ authorizationURL: data.url });
+      const oauthState = getOAuthState();
+      if (oauthState) params.append("oauthState", oauthState);
+      const proxyURL = `${base}/api/auth/expo-authorization-proxy?${params.toString()}`;
+      const result = await WebBrowser.openAuthSessionAsync(proxyURL, to);
+      if (result.type !== "success") {
+        throw new Error(`sign-in ${result.type}`);
+      }
+      const cookie = new URL(result.url).searchParams.get("cookie");
+      if (cookie) absorbSetCookie(cookie);
+    },
+    async signOut() {
+      try {
+        await authFetch("/sign-out", { method: "POST", body: "{}" });
+      } finally {
+        writeJar({});
+      }
+    },
+    async getSession() {
+      const res = await authFetch("/get-session");
+      if (!res.ok) return null;
+      const data = await res.json().catch(() => null);
+      return data && Object.keys(data).length ? data : null;
+    },
+    async getAccessToken(providerId) {
+      const res = await authFetch("/get-access-token", {
+        method: "POST",
+        body: JSON.stringify({ providerId })
+      });
+      if (!res.ok) return null;
+      return await res.json().catch(() => null);
+    }
+  };
+  activeFlow = flow;
+  return flow;
+}
+
+// src/session/index.native.ts
+import { useSyncExternalStore } from "react";
+var state = { session: null, status: "loading" };
+var listeners = /* @__PURE__ */ new Set();
+function setNativeSession(session, status) {
+  state = {
+    session,
+    status: status ?? (session?.user ? "authenticated" : "unauthenticated")
+  };
+  for (const l of listeners) l();
+}
+function subscribe(listener) {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+async function getSession() {
+  return state.session;
+}
+function useSession(_options) {
+  return useSyncExternalStore(
+    subscribe,
+    () => state,
+    () => state
+  );
+}
+
+// src/provider/authProvider/index.native.tsx
+import { Fragment as Fragment3, jsx as jsx4 } from "react/jsx-runtime";
+function AuthProvider({
+  children,
+  disabled,
+  keycloakConfig,
+  loadingComponent
+}) {
+  const [keycloak, setKeycloak] = useState();
+  const [isLoading, setIsLoading] = useState(true);
+  const serverBaseUrl = useMemo(() => {
+    return keycloakConfig.betterAuthBaseUrl || "http://localhost:8000";
+  }, [keycloakConfig]);
+  const scheme = useMemo(() => keycloakConfig.expoScheme, [keycloakConfig]);
+  const flow = useMemo(
+    () => disabled ? null : createExpoAuthFlow(serverBaseUrl, scheme),
+    [disabled, serverBaseUrl, scheme]
+  );
+  useEffect3(() => {
+    if (disabled || !flow) {
+      setIsLoading(false);
+      return;
+    }
+    let alive = true;
+    const refresh = async () => {
+      let session = null;
+      try {
+        session = await flow.getSession();
+      } catch (err) {
+        console.error("[keycloak] native session check failed:", err);
+      }
+      const _keycloak = new Keycloak(
+        keycloakConfig,
+        void 0,
+        void 0,
+        void 0,
+        async (options) => {
+          await flow.signIn("keycloak", options.redirectUri || Linking2.createURL("/"));
+          await refresh();
+          return void 0;
+        },
+        async (_options) => {
+          await flow.signOut();
+          await refresh();
+          return void 0;
+        }
+      );
+      if (session?.user) {
+        _keycloak.authenticated = true;
+        _keycloak.email = session.user.email || void 0;
+        _keycloak.username = session.user.name || void 0;
+        _keycloak.subject = session.user.id;
+      }
+      if (!alive) return;
+      setNativeSession(
+        session?.user ? {
+          user: {
+            id: session.user.id,
+            name: session.user.name ?? null,
+            email: session.user.email ?? null
+          }
+        } : null
+      );
+      setKeycloak(_keycloak);
+    };
+    refresh().finally(() => {
+      if (alive) setIsLoading(false);
+    });
+    return () => {
+      alive = false;
+    };
+  }, [disabled, flow, keycloakConfig]);
+  if (disabled) return /* @__PURE__ */ jsx4(Fragment3, { children });
+  if (isLoading || !keycloak) {
+    return /* @__PURE__ */ jsx4(Loading, { loadingComponent });
+  }
+  return /* @__PURE__ */ jsx4(KeycloakConfigContext.Provider, { value: keycloakConfig, children: /* @__PURE__ */ jsx4(KeycloakContext.Provider, { value: keycloak, children: /* @__PURE__ */ jsx4(AfterAuth, { children }) }) });
+}
+
+// src/provider/KeycloakProvider.tsx
+import { useMemo as useMemo2 } from "react";
+import { jsx as jsx5 } from "react/jsx-runtime";
+function KeycloakProvider({
+  baseUrl,
+  betterAuthBaseUrl,
+  children,
+  clientId,
+  expoScheme,
+  loginRedirectUri,
+  debug,
+  disabled,
+  iframeSso,
+  publicClientId,
+  realm
+}) {
+  const authConfig = useMemo2(
+    () => ({ debug, disabled, iframeSso, loginRedirectUri }),
+    [debug, disabled, iframeSso, loginRedirectUri]
+  );
+  return /* @__PURE__ */ jsx5(AuthConfigContext.Provider, { value: authConfig, children: /* @__PURE__ */ jsx5(
+    AuthProvider,
+    {
+      disabled,
+      keycloakConfig: {
+        clientId: clientId || "app",
+        publicClientId,
+        realm: realm || "main",
+        url: baseUrl ?? "",
+        betterAuthBaseUrl,
+        expoScheme
+      },
+      children
+    }
+  ) });
+}
+
+// src/frappeToken.native.ts
+var cached;
+async function getKeycloakBearerToken() {
+  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
+  const flow = getActiveExpoAuthFlow();
+  if (!flow) return void 0;
+  try {
+    const res = await flow.getAccessToken("keycloak");
+    if (!res?.accessToken) {
+      cached = void 0;
+      return void 0;
+    }
+    cached = {
+      token: res.accessToken,
+      expiresAt: res.accessTokenExpiresAt ? new Date(res.accessTokenExpiresAt).getTime() : Date.now() + 6e4
+    };
+    return cached.token;
+  } catch {
+    cached = void 0;
+    return void 0;
+  }
+}
+export {
+  AfterAuth,
+  AuthConfigContext,
+  AuthProvider,
+  Authenticated,
+  BaseKeycloak,
+  Keycloak,
+  KeycloakConfigContext,
+  KeycloakProvider,
+  defaultAuthConfig,
+  getAllWalletAddresses,
+  getKeycloakBearerToken,
+  getSession,
+  getWalletAddresses,
+  getWalletsFromToken,
+  hasWallets,
+  isTokenExpired,
+  setNativeSession,
+  useAuthConfig,
+  useKeycloak,
+  useSession,
+  useTokensFromQuery,
+  useTokensFromStore,
+  validOrRefreshableToken,
+  withAuthenticated
+};