@multiplatform.one/keycloak 6.0.4 → 6.3.0

package/src/provider/authProvider/index.native.tsx

@@ -2,19 +2,24 @@
  * File: /src/provider/auth_provider/index.native.tsx
  * Project: @multiplatform.one/keycloak
  *
- * Native (Expo) AuthProvider using Better Auth Expo client.
- * Replaces the previous expo-auth-session PKCE flow.
- * Auth is handled by the Better Auth server; the Expo client manages
- * the browser redirect flow and stores the session cookie in SecureStore.
+ * Native (Expo) AuthProvider using the hand-rolled Better Auth flow
+ * (betterAuth/expoAuthFlow.native.ts): fetch + expo-web-browser + SecureStore.
+ * Deliberately NOT @better-auth/expo/client — its import graph drags
+ * better-auth's cookies module -> @better-auth/core db schema -> zod into the
+ * Hermes bundle, and zod's module init dies under the vxrn/rolldown dev
+ * transform. The server side stays better-auth (the expo() plugin provides
+ * /expo-authorization-proxy and the cookie hand-back).
  */
 
 import { useEffect, useMemo, useState } from "react";
+import * as Linking from "expo-linking";
 import { Loading } from "../../Loading";
-import { getExpoAuthClient } from "../../betterAuth/expoClient";
+import { createExpoAuthFlow } from "../../betterAuth/expoAuthFlow.native";
 import { KeycloakConfigContext } from "../../keycloak/config";
 import { Keycloak } from "../../keycloak/index";
 import type { KeycloakLoginOptions, KeycloakLogoutOptions } from "../../keycloak/base";
 import { KeycloakContext } from "../../keycloak/context";
+import { setNativeSession } from "../../session/index.native";
 import { AfterAuth } from "../AfterAuth";
 import type { AuthProviderProps } from "./shared";
 
@@ -29,78 +34,81 @@ export function AuthProvider({
 
   // Resolve the Better Auth server base URL from keycloak config.
   // On native, the keycloakConfig.url is the Keycloak server — the Better Auth
-  // server is the app backend. We derive it from env or fall back to a sensible default.
+  // server is the app backend (CreateApp wires BETTER_AUTH_BASE_URL/BASE_URL).
   const serverBaseUrl = useMemo(() => {
-    // The Better Auth server URL should come from config or env.
-    // For now, derive from keycloakConfig — the app server is typically on the same origin.
-    // In production, set BETTER_AUTH_BASE_URL in the app config / env.
-    return keycloakConfig.betterAuthBaseUrl || "http://localhost:5000";
+    return keycloakConfig.betterAuthBaseUrl || "http://localhost:8000";
   }, [keycloakConfig]);
 
-  const scheme = useMemo(() => keycloakConfig.expoScheme || "multiplatform-one", [keycloakConfig]);
+  const scheme = useMemo(() => keycloakConfig.expoScheme, [keycloakConfig]);
 
-  const client = useMemo(
-    () => (disabled ? null : getExpoAuthClient(serverBaseUrl, scheme)),
+  const flow = useMemo(
+    () => (disabled ? null : createExpoAuthFlow(serverBaseUrl, scheme)),
     [disabled, serverBaseUrl, scheme],
   );
 
-  // Check session on mount
   useEffect(() => {
-    if (disabled || !client) {
+    if (disabled || !flow) {
       setIsLoading(false);
       return;
     }
-    (async () => {
+    let alive = true;
+
+    // Probe the session, build a Keycloak instance reflecting it, and push the
+    // result into the native session store (useSession's backing).
+    const refresh = async () => {
+      let session: Awaited<ReturnType<typeof flow.getSession>> = null;
       try {
-        const session = await client.getSession();
-        if (session.data?.user) {
-          const _keycloak = new Keycloak(
-            keycloakConfig,
-            undefined, // no raw token
-            undefined,
-            undefined,
-            async (options: KeycloakLoginOptions) => {
-              await client.signIn.social({
-                provider: "keycloak" as any,
-                callbackURL: options.redirectUri,
-              });
-            },
-            async (_options: KeycloakLogoutOptions) => {
-              await client.signOut();
-            },
-          );
-          // Set minimal user info from session
-          _keycloak.authenticated = true;
-          _keycloak.email = session.data.user.email || undefined;
-          _keycloak.username = session.data.user.name || undefined;
-          _keycloak.subject = session.data.user.id;
-          setKeycloak(_keycloak);
-        } else {
-          setKeycloak(
-            new Keycloak(
-              keycloakConfig,
-              undefined,
-              undefined,
-              undefined,
-              async (options: KeycloakLoginOptions) => {
-                await client.signIn.social({
-                  provider: "keycloak" as any,
-                  callbackURL: options.redirectUri,
-                });
-              },
-              async (_options: KeycloakLogoutOptions) => {
-                await client.signOut();
-              },
-            ),
-          );
-        }
-      } catch {
-        setKeycloak(new Keycloak(keycloakConfig));
-      } finally {
-        setIsLoading(false);
+        session = await flow.getSession();
+      } catch (err) {
+        console.error("[keycloak] native session check failed:", err);
       }
-    })();
-  }, [disabled, client, keycloakConfig]);
+      const _keycloak = new Keycloak(
+        keycloakConfig,
+        undefined,
+        undefined,
+        undefined,
+        async (options: KeycloakLoginOptions) => {
+          // Default the OAuth return URL to the app's own runtime URL: Expo Go
+          // can only receive exp:// redirects (Linking.createURL derives
+          // exp://<host>/--/ there; the bare app scheme in dev builds).
+          await flow.signIn("keycloak", options.redirectUri || Linking.createURL("/"));
+          await refresh();
+          return undefined;
+        },
+        async (_options: KeycloakLogoutOptions) => {
+          await flow.signOut();
+          await refresh();
+          return undefined;
+        },
+      );
+      if (session?.user) {
+        _keycloak.authenticated = true;
+        _keycloak.email = session.user.email || undefined;
+        _keycloak.username = session.user.name || undefined;
+        _keycloak.subject = session.user.id;
+      }
+      if (!alive) return;
+      setNativeSession(
+        session?.user
+          ? {
+              user: {
+                id: session.user.id,
+                name: session.user.name ?? null,
+                email: session.user.email ?? null,
+              },
+            }
+          : null,
+      );
+      setKeycloak(_keycloak);
+    };
+
+    refresh().finally(() => {
+      if (alive) setIsLoading(false);
+    });
+    return () => {
+      alive = false;
+    };
+  }, [disabled, flow, keycloakConfig]);
 
   if (disabled) return <>{children}</>;
   if (isLoading || !keycloak) {

package/src/session/index.native.ts

@@ -2,20 +2,45 @@
  * File: /src/session/index.native.ts
  * Project: @multiplatform.one/keycloak
  *
- * Better Auth session hook for React Native / Expo.
- * Uses the Expo auth client when available, otherwise returns empty session.
+ * Native session hook backed by a tiny external store the AuthProvider feeds
+ * (no better-auth client on native -- see betterAuth/expoAuthFlow.native.ts).
  */
 
-import type { SessionContextValue } from "./index";
+import { useSyncExternalStore } from "react";
+import type { Session, SessionContextValue, SessionStatus } from "./index";
+
+interface NativeSessionState {
+  session: Session | null;
+  status: SessionStatus;
+}
+
+let state: NativeSessionState = { session: null, status: "loading" };
+const listeners = new Set<() => void>();
+
+/** Fed by the native AuthProvider on mount / sign-in / sign-out. */
+export function setNativeSession(session: Session | null, status?: SessionStatus) {
+  state = {
+    session,
+    status: status ?? (session?.user ? "authenticated" : "unauthenticated"),
+  };
+  for (const l of listeners) l();
+}
+
+function subscribe(listener: () => void) {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
 
 export async function getSession() {
-  return null;
+  return state.session;
 }
 
 export function useSession<R extends boolean = false>(
   _options?: Record<string, unknown>,
 ): SessionContextValue<R> {
-  // On native, session is managed by AuthProvider (Expo auth client).
-  // Components consuming useSession outside AuthProvider get empty state.
-  return { session: null, status: "unauthenticated" };
+  return useSyncExternalStore(
+    subscribe,
+    () => state,
+    () => state,
+  );
 }

package/types/Authenticated.d.ts

@@ -0,0 +1,9 @@
+import { type ComponentType, type PropsWithChildren } from "react";
+export interface AuthenticatedProps extends PropsWithChildren {
+    disabled?: boolean;
+    loadingComponent?: ComponentType;
+    loggedOutComponent?: ComponentType;
+}
+export declare function Authenticated({ children, disabled, loggedOutComponent, loadingComponent, }: AuthenticatedProps): import("react/jsx-runtime").JSX.Element;
+export declare function withAuthenticated<P extends object>(Component: ComponentType<P>, options?: AuthenticatedProps): (props: P) => import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=Authenticated.d.ts.map

package/types/Authenticated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authenticated.d.ts","sourceRoot":"","sources":["../src/Authenticated.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAa,MAAM,OAAO,CAAC;AAO9E,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,aAAa,CAAC;IACjC,kBAAkB,CAAC,EAAE,aAAa,CAAC;CACpC;AAED,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,EACR,QAAQ,EACR,kBAAkB,EAClB,gBAAgB,GACjB,EAAE,kBAAkB,2CAoCpB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAChD,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAC3B,OAAO,GAAE,kBAAuB,IAExB,OAAO,CAAC,6CAKjB"}

package/types/Loading.d.ts

@@ -0,0 +1,6 @@
+import type { ComponentType } from "react";
+export interface LoadingProps {
+    loadingComponent?: ComponentType;
+}
+export declare function Loading({ loadingComponent }: LoadingProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=Loading.d.ts.map

package/types/Loading.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Loading.d.ts","sourceRoot":"","sources":["../src/Loading.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAO3C,MAAM,WAAW,YAAY;IAC3B,gBAAgB,CAAC,EAAE,aAAa,CAAC;CAClC;AAED,wBAAgB,OAAO,CAAC,EAAE,gBAAgB,EAAE,EAAE,YAAY,2CAYzD"}

package/types/authConfig.d.ts

@@ -0,0 +1,10 @@
+export declare const defaultAuthConfig: AuthConfig;
+export declare const AuthConfigContext: import("react").Context<AuthConfig>;
+export interface AuthConfig {
+    debug?: boolean;
+    disabled?: boolean;
+    iframeSso?: boolean;
+    loginRedirectUri?: string;
+    messageHandlerKeys?: string[];
+}
+//# sourceMappingURL=authConfig.d.ts.map

package/types/authConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authConfig.d.ts","sourceRoot":"","sources":["../src/authConfig.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iBAAiB,EAAE,UAAe,CAAC;AAEhD,eAAO,MAAM,iBAAiB,qCAA+C,CAAC;AAE9E,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B"}