@multiplatform.one/keycloak 6.0.4 → 6.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/keycloak",
-  "version": "6.0.4",
+  "version": "6.3.0",
   "description": "keycloak client for multiplatform.one ecosystem",
   "keywords": [
     "auth",
@@ -14,30 +14,35 @@
   "author": "BitSpur",
   "repository": {
     "type": "git",
-    "url": "https://gitlab.com/risserlabs/multiplatform.one/keycloak"
+    "url": "git+https://gitlab.com/bitspur/frappe/multiplatform.one.git",
+    "directory": "public/keycloak"
   },
   "source": "src/index.ts",
   "files": [
     "dist",
-    "routes",
     "src",
-    "types"
+    "types",
+    "!types/.tsbuildinfo"
   ],
   "sideEffects": false,
   "main": "src/index.ts",
   "module": "src/index.ts",
-  "types": "src/index.ts",
+  "types": "types/index.d.ts",
   "exports": {
     "./package.json": "./package.json",
     ".": {
-      "react-native": "./src/index.native.ts",
-      "types": "./src/index.ts",
+      "react-native": {
+        "types": "./types/index.d.ts",
+        "import": "./dist/esm/index.native.js",
+        "require": "./dist/cjs/index.native.cjs"
+      },
+      "types": "./types/index.d.ts",
       "import": "./src/index.ts",
       "require": "./src/index.ts",
       "default": "./src/index.ts"
     },
     "./one": {
-      "types": "./src/one.ts",
+      "types": "./types/one.d.ts",
       "import": "./src/one.ts",
       "require": "./src/one.ts"
     }
@@ -49,8 +54,8 @@
     "@better-auth/expo": "^1.6.9",
     "better-auth": "^1.6.9",
     "jwt-decode": "^4.0.0",
-    "@multiplatform.one/keycloak-js": "6.0.4",
-    "@multiplatform.one/store": "6.0.4"
+    "@multiplatform.one/keycloak-js": "6.3.0",
+    "@multiplatform.one/store": "6.3.0"
   },
   "devDependencies": {
     "@tamagui/build": "2.0.0-rc.41",
@@ -65,17 +70,18 @@
     "react": "19.2.5",
     "typescript": "~5.9.3",
     "vitest": "^4.1.5",
-    "@multiplatform.one/logger": "6.0.4",
-    "@multiplatform.one/config": "6.0.4",
-    "@multiplatform.one/platform": "6.0.4",
-    "@multiplatform.one/test-utils": "6.0.4"
+    "@multiplatform.one/platform": "6.3.0",
+    "@multiplatform.one/test-utils": "6.3.0",
+    "@multiplatform.one/config": "6.3.0",
+    "@multiplatform.one/logger": "6.3.0"
   },
   "peerDependencies": {
     "react": "^19.1.0",
-    "@multiplatform.one/logger": "6.0.4",
-    "@multiplatform.one/platform": "6.0.4"
+    "@multiplatform.one/platform": "^6.3.0",
+    "@multiplatform.one/logger": "^6.3.0"
   },
   "optionalDependencies": {
+    "expo-linking": "^55.0.15",
     "expo-secure-store": "^55.0.13",
     "expo-web-browser": "^55.0.14"
   },
@@ -85,7 +91,7 @@
   "module:jsx": "dist/jsx",
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "build": "rm -rf dist types 2>/dev/null && node scripts/build.mjs",
+    "build": "rm -rf dist types 2>/dev/null && node scripts/build.mjs && tsc -p tsconfig.build.json",
     "test": "vitest run --coverage --coverage.provider=v8 --coverage.reporter=text --coverage.reporter=lcov --coverage.reporter=html"
   }
 }

package/src/Authenticated.tsx

@@ -1,6 +1,8 @@
 import { isIframe, isServer } from "@multiplatform.one/platform";
 import { type ComponentType, type PropsWithChildren, useEffect } from "react";
-import { Text } from "tamagui";
+// react-native Text, not tamagui -- this can render above the app's
+// TamaguiProvider (see Loading.tsx).
+import { Text } from "react-native";
 import { useAuthConfig, useTokensFromQuery } from "./hooks";
 import { useKeycloak } from "./keycloak/index";
 

package/src/Loading.tsx

@@ -1,5 +1,8 @@
 import type { ComponentType } from "react";
-import { Text } from "tamagui";
+// react-native primitives, NOT tamagui: the Keycloak provider mounts ABOVE the
+// app's ThemeProvider/TamaguiProvider in createApp's composition, so tamagui
+// components here throw "Can't find Tamagui configuration" on native.
+import { ActivityIndicator, Text, View } from "react-native";
 import { useAuthConfig } from "./hooks";
 
 export interface LoadingProps {
@@ -10,7 +13,12 @@ export function Loading({ loadingComponent }: LoadingProps) {
   const { debug } = useAuthConfig();
   const LoadingComponent = loadingComponent;
   if (typeof LoadingComponent === "undefined") {
-    return <Text>{debug ? "loading" : null}</Text>;
+    return (
+      <View style={{ flex: 1, alignItems: "center", justifyContent: "center" }}>
+        <ActivityIndicator />
+        {debug ? <Text>loading</Text> : null}
+      </View>
+    );
   }
   return <LoadingComponent />;
 }

package/src/betterAuth/expoAuthFlow.native.ts

@@ -0,0 +1,238 @@
+/**
+ * Hand-rolled Better Auth flow for native (Expo) — fetch + expo-web-browser +
+ * SecureStore, NO better-auth client packages.
+ *
+ * Why not @better-auth/expo/client: its import graph drags better-auth's
+ * cookies module -> @better-auth/core db schema -> zod into the Hermes bundle,
+ * and zod's module init dies under the vxrn/rolldown dev transform
+ * ("fn is not a function"). The wire protocol underneath is tiny (mirrors
+ * @better-auth/expo/dist/client.js): a cookie jar in SecureStore, an
+ * expo-origin header, the server's /expo-authorization-proxy to hand the
+ * session cookie back through the auth-session return URL.
+ */
+
+import { Platform } from "react-native";
+import * as Linking from "expo-linking";
+import * as SecureStore from "expo-secure-store";
+import * as WebBrowser from "expo-web-browser";
+
+const COOKIE_KEY = "better-auth_cookie";
+const SECURE_COOKIE_PREFIX = "__Secure-";
+
+type CookieJar = Record<string, { value: string; expires: string | null }>;
+
+function readJar(): CookieJar {
+  try {
+    return JSON.parse(SecureStore.getItem(COOKIE_KEY) || "{}");
+  } catch {
+    return {};
+  }
+}
+
+function writeJar(jar: CookieJar) {
+  SecureStore.setItem(COOKIE_KEY, JSON.stringify(jar));
+}
+
+/** Serialize the jar to a Cookie header, dropping expired entries. */
+function cookieHeader(): string {
+  return Object.entries(readJar()).reduce((acc, [key, v]) => {
+    if (v.expires && new Date(v.expires) < new Date()) return acc;
+    return acc ? `${acc}; ${key}=${v.value}` : `${key}=${v.value}`;
+  }, "");
+}
+
+/** Merge a Set-Cookie header (possibly comma-joined) into the jar. */
+function absorbSetCookie(header: string | null) {
+  if (!header) return;
+  const jar = readJar();
+  // Split on commas that start a new cookie (name=), not expires dates.
+  for (const part of header.split(/,(?=[^;,]+?=)/)) {
+    const [pair, ...attrs] = part.split(";");
+    const eq = pair.indexOf("=");
+    if (eq === -1) continue;
+    const name = pair.slice(0, eq).trim();
+    const value = pair.slice(eq + 1).trim();
+    let expires: string | null = null;
+    let dead = false;
+    for (const attr of attrs) {
+      const [k, v] = attr.split("=").map((s) => s?.trim());
+      const lk = (k || "").toLowerCase();
+      if (lk === "max-age") {
+        const n = Number(v);
+        if (n <= 0) dead = true;
+        else expires = new Date(Date.now() + n * 1000).toISOString();
+      } else if (lk === "expires" && !expires && v) {
+        const d = new Date(part.slice(part.toLowerCase().indexOf("expires=") + 8).split(";")[0]);
+        if (!Number.isNaN(d.getTime())) {
+          if (d.getTime() <= Date.now()) dead = true;
+          else expires = d.toISOString();
+        }
+      }
+    }
+    if (dead) delete jar[name];
+    else jar[name] = { value, expires };
+  }
+  writeJar(jar);
+}
+
+function getOAuthState(): string | null {
+  const jar = readJar();
+  for (const name of [
+    `${SECURE_COOKIE_PREFIX}better-auth.oauth_state`,
+    "better-auth.oauth_state",
+  ]) {
+    if (jar[name]?.value) return jar[name].value;
+  }
+  return null;
+}
+
+export interface ExpoAuthFlow {
+  signIn(provider: string, callbackURL?: string): Promise<void>;
+  signOut(): Promise<void>;
+  getSession(): Promise<{ user?: { id: string; email?: string; name?: string } } | null>;
+  /** Valid provider access token (server refreshes when expired). */
+  getAccessToken(
+    providerId: string,
+  ): Promise<{ accessToken?: string; accessTokenExpiresAt?: string } | null>;
+}
+
+// The app mounts ONE AuthProvider, which creates one flow. Expose it so
+// non-React consumers (the Frappe Bearer-token getter) can reach the same
+// cookie jar + base URL.
+let activeFlow: ExpoAuthFlow | null = null;
+
+export function getActiveExpoAuthFlow(): ExpoAuthFlow | null {
+  return activeFlow;
+}
+
+export function createExpoAuthFlow(baseURL: string, scheme?: string): ExpoAuthFlow {
+  const base = baseURL.replace(/\/$/, "");
+  const origin = () => Linking.createURL("/", scheme ? { scheme } : undefined);
+
+  async function authFetch(path: string, init?: RequestInit) {
+    const cookie = cookieHeader();
+    const res = await fetch(`${base}/api/auth${path}`, {
+      ...init,
+      credentials: "omit",
+      headers: {
+        "Content-Type": "application/json",
+        ...(cookie ? { cookie } : {}),
+        "expo-origin": origin(),
+        "x-skip-oauth-proxy": "true",
+        ...init?.headers,
+      },
+    });
+    absorbSetCookie(res.headers.get("set-cookie"));
+    return res;
+  }
+
+  const flow: ExpoAuthFlow = {
+    async signIn(provider: string, callbackURL?: string) {
+      const to = callbackURL || Linking.createURL("/");
+      const res = await authFetch("/sign-in/social", {
+        method: "POST",
+        body: JSON.stringify({ provider, callbackURL: to }),
+      });
+      if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`sign-in failed (${res.status}): ${body.slice(0, 200)}`);
+      }
+      const data = (await res.json()) as { url?: string; redirect?: boolean };
+      if (!data?.url) throw new Error("sign-in response had no authorization url");
+
+      // The server's expo plugin proxies the IdP redirect and forwards the
+      // session cookie back via the return URL (?cookie=...), because the
+      // OAuth callback's Set-Cookie lands in the auth-session browser, not us.
+      const params = new URLSearchParams({ authorizationURL: data.url });
+      const oauthState = getOAuthState();
+      if (oauthState) params.append("oauthState", oauthState);
+      const proxyURL = `${base}/api/auth/expo-authorization-proxy?${params.toString()}`;
+
+      // Which browser opens the Keycloak login page differs by platform, because
+      // the wallet deeplink (metamask://connect?channelId=…, a CUSTOM scheme
+      // emitted by the classic @metamask/sdk connector) must be able to app-switch
+      // to MetaMask from inside it:
+      //
+      //  - ANDROID: a Chrome Custom Tab (openAuthSessionAsync). Custom Tabs DO
+      //    launch other apps via custom schemes, and the tab is hosted by + returns
+      //    to THIS app, so it stays warm across the wallet bounce and the KC page
+      //    receives the MetaMask-SDK relay response, then hands the custom-scheme
+      //    return URL (to?cookie=…) back to us.
+      //  - iOS: ASWebAuthenticationSession (what openAuthSessionAsync maps to)
+      //    REFUSES to launch other apps via custom schemes — it's an OAuth-return
+      //    surface only, so "Open MetaMask" does nothing (verified on-device:
+      //    SafariViewService never app-switches to io.metamask). Full system Safari
+      //    via Linking.openURL DOES app-switch to MetaMask (iOS shows an "Open in
+      //    MetaMask?" prompt for custom schemes). The wallet signs over the SDK
+      //    relay, KC verifies + redirects to the custom-scheme return URL, and
+      //    Safari hands that back to the app, caught by a Linking listener.
+      const toBase = to.split("?")[0];
+      let returnUrl: string | undefined;
+      if (Platform.OS === "ios") {
+        returnUrl = await new Promise<string | undefined>((resolve, reject) => {
+          let settled = false;
+          const linkSub = Linking.addEventListener("url", ({ url }) => {
+            if (settled || !url || !url.startsWith(toBase)) return;
+            settled = true;
+            try {
+              linkSub.remove();
+            } catch {
+              /* already removed */
+            }
+            resolve(url);
+          });
+          Linking.openURL(proxyURL).catch((e) => {
+            if (settled) return;
+            settled = true;
+            try {
+              linkSub.remove();
+            } catch {
+              /* already removed */
+            }
+            reject(e instanceof Error ? e : new Error(`sign-in openURL failed: ${e}`));
+          });
+        });
+      } else {
+        const result = await WebBrowser.openAuthSessionAsync(proxyURL, toBase, {
+          preferEphemeralSession: false, // keep the SSO + siww nonce cookie across the wallet bounce
+        });
+        returnUrl = result.type === "success" && "url" in result ? result.url : undefined;
+      }
+      if (!returnUrl) {
+        // dismissed / cancelled — treat as a no-op sign-in (user backed out)
+        return;
+      }
+      const cookie = new URL(returnUrl).searchParams.get("cookie");
+      if (cookie) absorbSetCookie(cookie);
+    },
+
+    async signOut() {
+      try {
+        await authFetch("/sign-out", { method: "POST", body: "{}" });
+      } finally {
+        writeJar({});
+      }
+    },
+
+    async getSession() {
+      const res = await authFetch("/get-session");
+      if (!res.ok) return null;
+      const data = await res.json().catch(() => null);
+      return data && Object.keys(data).length ? data : null;
+    },
+
+    async getAccessToken(providerId: string) {
+      const res = await authFetch("/get-access-token", {
+        method: "POST",
+        body: JSON.stringify({ providerId }),
+      });
+      if (!res.ok) return null;
+      return (await res.json().catch(() => null)) as {
+        accessToken?: string;
+        accessTokenExpiresAt?: string;
+      } | null;
+    },
+  };
+  activeFlow = flow;
+  return flow;
+}

package/src/frappeToken.native.ts

@@ -0,0 +1,45 @@
+/**
+ * Keycloak access token for Frappe API requests — native variant.
+ *
+ * Native Frappe requests can't ride the better-auth cookies (they live in the
+ * SecureStore jar, not the OS cookie store), so the Frappe HttpClient sends
+ * `Authorization: Bearer <keycloak access token>` instead — the bench's
+ * frappe_keycloak auth hook checks the Bearer header first. The token comes
+ * from better-auth's /get-access-token endpoint (which refreshes server-side
+ * when expired), authenticated with the SecureStore cookie jar.
+ */
+
+import { getActiveExpoAuthFlow } from "./betterAuth/expoAuthFlow.native";
+
+let cached: { token: string; expiresAt: number } | undefined;
+
+/** Returns a valid Keycloak access token, or undefined when signed out. */
+export async function getKeycloakBearerToken(): Promise<string | undefined> {
+  // 60s slack so we never hand out a token that expires mid-request.
+  if (cached && cached.expiresAt - 60_000 > Date.now()) return cached.token;
+  const flow = getActiveExpoAuthFlow();
+  if (!flow) return undefined;
+  try {
+    const res = await flow.getAccessToken("keycloak");
+    if (!res?.accessToken) {
+      cached = undefined;
+      return undefined;
+    }
+    cached = {
+      token: res.accessToken,
+      expiresAt: res.accessTokenExpiresAt
+        ? new Date(res.accessTokenExpiresAt).getTime()
+        : Date.now() + 60_000,
+    };
+    return cached.token;
+  } catch {
+    // Signed out / server unreachable -> guest requests.
+    cached = undefined;
+    return undefined;
+  }
+}
+
+/** Drop the cached token (sign-out). */
+export function clearKeycloakBearerToken() {
+  cached = undefined;
+}

package/src/frappeToken.ts

@@ -0,0 +1,59 @@
+/**
+ * Keycloak access token for Frappe API requests — web variant.
+ *
+ * Web HTTP requests to a same-origin bench could ride the better-auth
+ * account cookie, but the Socket.IO realtime handshake cannot: frappe's
+ * socketio auth middleware only accepts a frappe `sid` cookie or an
+ * `Authorization` header (it never forwards arbitrary cookies to the web
+ * server). So the web client fetches the Keycloak access token from
+ * better-auth's same-origin `/get-access-token` endpoint (which refreshes
+ * server-side when expired, authenticated by the better-auth session
+ * cookie) and sends `Authorization: Bearer <token>` on every REST request
+ * and socket handshake — the same transport native uses. The bench's
+ * frappe_keycloak auth hook validates the JWT against the realm public key.
+ */
+
+let cached: { token: string; expiresAt: number } | undefined;
+
+/** Returns a valid Keycloak access token, or undefined when signed out. */
+export async function getKeycloakBearerToken(): Promise<string | undefined> {
+  if (typeof window === "undefined") return undefined;
+  // 60s slack so we never hand out a token that expires mid-request.
+  if (cached && cached.expiresAt - 60_000 > Date.now()) return cached.token;
+  try {
+    const res = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ providerId: "keycloak" }),
+    });
+    if (!res.ok) {
+      cached = undefined;
+      return undefined;
+    }
+    const data = (await res.json().catch(() => null)) as {
+      accessToken?: string;
+      accessTokenExpiresAt?: string;
+    } | null;
+    if (!data?.accessToken) {
+      cached = undefined;
+      return undefined;
+    }
+    cached = {
+      token: data.accessToken,
+      expiresAt: data.accessTokenExpiresAt
+        ? new Date(data.accessTokenExpiresAt).getTime()
+        : Date.now() + 60_000,
+    };
+    return cached.token;
+  } catch {
+    // Signed out / server unreachable -> guest requests.
+    cached = undefined;
+    return undefined;
+  }
+}
+
+/** Drop the cached token (sign-out). */
+export function clearKeycloakBearerToken() {
+  cached = undefined;
+}

package/src/index.ts

@@ -6,3 +6,4 @@ export * from "./provider/index";
 export * from "./session/index";
 export * from "./token";
 export * from "./types";
+export { getKeycloakBearerToken } from "./frappeToken";

package/src/provider/KeycloakProvider.tsx

@@ -9,12 +9,21 @@ export interface KeycloakProviderProps extends PropsWithChildren, AuthConfig {
   clientId?: string;
   publicClientId?: string;
   realm?: string;
+  /** Better Auth server base URL (drives the native sign-in flow). Without it
+   * the native provider falls back to a hardcoded localhost:5000 -- on macOS
+   * that's ControlCenter (AirPlay) answering 403 to everything, which makes
+   * the Login button a perfectly silent no-op. */
+  betterAuthBaseUrl?: string;
+  /** App scheme for the Expo auth-session redirect (native). */
+  expoScheme?: string;
 }
 
 export function KeycloakProvider({
   baseUrl,
+  betterAuthBaseUrl,
   children,
   clientId,
+  expoScheme,
   loginRedirectUri,
   debug,
   disabled,
@@ -35,6 +44,8 @@ export function KeycloakProvider({
           publicClientId,
           realm: realm || "main",
           url: baseUrl ?? "",
+          betterAuthBaseUrl,
+          expoScheme,
         }}
       >
         {children}