@multiplatform.one/keycloak 6.0.4 → 6.3.0

package/README.md

@@ -0,0 +1,58 @@
+# @multiplatform.one/keycloak
+
+Keycloak authentication for the multiplatform.one ecosystem — a
+[Better Auth](https://better-auth.com)–powered client with a `useKeycloak()`
+hook, session hooks, route guards, and a server config factory for
+[One](https://onestack.dev) apps.
+
+## Install
+
+```bash
+pnpm add @multiplatform.one/keycloak
+```
+
+Peers: `react`, `@multiplatform.one/logger`, `@multiplatform.one/platform`.
+
+## What it owns
+
+- **`KeycloakProvider`** — auth context (`debug`, `disabled`, `iframeSso`,
+  `loginRedirectUri`, …); usually mounted for you by
+  `createApp({ keycloak: true })` from `@multiplatform.one/core`
+- **`useKeycloak()`** — the Keycloak client (login/logout, tokens); returns
+  `null` when auth is disabled
+- **`useSession()`**, `useAuthConfig()`, `useTokensFromQuery`,
+  `useTokensFromState`
+- **`Authenticated`** / `withAuthenticated` — render children only when
+  signed in
+- **Token helpers** — `isTokenExpired`, `validOrRefreshableToken`,
+  `getKeycloakBearerToken`, wallet-claim readers (`getWalletsFromToken`,
+  `getWalletAddresses`, `hasWallets`)
+- **`@multiplatform.one/keycloak/one`** — `createAuth()` Better Auth server
+  factory (stateless JWE sessions, Keycloak OAuth, Expo support)
+
+## What it must not do
+
+- No UI beyond the guard components — login screens belong to apps
+- No Frappe logic besides bearer-token bridging (`getKeycloakBearerToken`)
+
+## Usage
+
+```tsx
+import { Authenticated, useKeycloak } from "@multiplatform.one/keycloak";
+
+export function AccountMenu() {
+  const keycloak = useKeycloak();
+  if (!keycloak) return null; // auth disabled
+  return (
+    <Authenticated>
+      <button onClick={() => keycloak.logout()}>Sign out</button>
+    </Authenticated>
+  );
+}
+```
+
+Uses the patched adapter from `@multiplatform.one/keycloak-js` under the hood.
+
+## License
+
+Apache-2.0

package/dist/cjs/index.cjs

@@ -40,6 +40,7 @@ __export(index_exports, {
   KeycloakProvider: () => KeycloakProvider,
   defaultAuthConfig: () => defaultAuthConfig,
   getAllWalletAddresses: () => getAllWalletAddresses,
+  getKeycloakBearerToken: () => getKeycloakBearerToken,
   getWalletAddresses: () => getWalletAddresses,
   getWalletsFromToken: () => getWalletsFromToken,
   hasWallets: () => hasWallets,
@@ -57,7 +58,7 @@ module.exports = __toCommonJS(index_exports);
 // src/Authenticated.tsx
 var import_platform6 = require("@multiplatform.one/platform");
 var import_react8 = require("react");
-var import_tamagui = require("tamagui");
+var import_react_native = require("react-native");
 
 // src/hooks/useAuthConfig.ts
 var import_react2 = require("react");
@@ -434,11 +435,11 @@ function Authenticated({
   if (disabled) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children });
   if (typeof keycloak === "undefined") {
     const LoadingComponent = loadingComponent;
-    return LoadingComponent ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoadingComponent, {}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_tamagui.Text, { children: authConfig.debug ? "loading" : null });
+    return LoadingComponent ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoadingComponent, {}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react_native.Text, { children: authConfig.debug ? "loading" : null });
   }
   if (keycloak === null || keycloak.authenticated) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children });
   const LoggedOutComponent = loggedOutComponent;
-  return LoggedOutComponent ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoggedOutComponent, {}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_tamagui.Text, { children: authConfig.debug ? "not authenticated" : null });
+  return LoggedOutComponent ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoggedOutComponent, {}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react_native.Text, { children: authConfig.debug ? "not authenticated" : null });
 }
 function withAuthenticated(Component, options = {}) {
   return (props) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Authenticated, { ...options, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Component, { ...props }) });
@@ -506,13 +507,16 @@ var import_logger2 = require("@multiplatform.one/logger");
 var import_react10 = require("react");
 
 // src/Loading.tsx
-var import_tamagui2 = require("tamagui");
+var import_react_native2 = require("react-native");
 var import_jsx_runtime3 = require("react/jsx-runtime");
 function Loading({ loadingComponent }) {
   const { debug } = useAuthConfig();
   const LoadingComponent = loadingComponent;
   if (typeof LoadingComponent === "undefined") {
-    return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_tamagui2.Text, { children: debug ? "loading" : null });
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_react_native2.View, { style: { flex: 1, alignItems: "center", justifyContent: "center" }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_react_native2.ActivityIndicator, {}),
+      debug ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_react_native2.Text, { children: "loading" }) : null
+    ] });
   }
   return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(LoadingComponent, {});
 }
@@ -859,8 +863,10 @@ var import_react11 = require("react");
 var import_jsx_runtime5 = require("react/jsx-runtime");
 function KeycloakProvider({
   baseUrl,
+  betterAuthBaseUrl,
   children,
   clientId,
+  expoScheme,
   loginRedirectUri,
   debug,
   disabled,
@@ -880,9 +886,43 @@ function KeycloakProvider({
         clientId: clientId || "app",
         publicClientId,
         realm: realm || "main",
-        url: baseUrl ?? ""
+        url: baseUrl ?? "",
+        betterAuthBaseUrl,
+        expoScheme
       },
       children
     }
   ) });
 }
+
+// src/frappeToken.ts
+var cached;
+async function getKeycloakBearerToken() {
+  if (typeof window === "undefined") return void 0;
+  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
+  try {
+    const res = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ providerId: "keycloak" })
+    });
+    if (!res.ok) {
+      cached = void 0;
+      return void 0;
+    }
+    const data = await res.json().catch(() => null);
+    if (!data?.accessToken) {
+      cached = void 0;
+      return void 0;
+    }
+    cached = {
+      token: data.accessToken,
+      expiresAt: data.accessTokenExpiresAt ? new Date(data.accessTokenExpiresAt).getTime() : Date.now() + 6e4
+    };
+    return cached.token;
+  } catch {
+    cached = void 0;
+    return void 0;
+  }
+}