@multiplatform.one/keycloak 6.1.0 → 6.4.0

package/README.md

@@ -0,0 +1,58 @@
+# @multiplatform.one/keycloak
+
+Keycloak authentication for the multiplatform.one ecosystem — a
+[Better Auth](https://better-auth.com)–powered client with a `useKeycloak()`
+hook, session hooks, route guards, and a server config factory for
+[One](https://onestack.dev) apps.
+
+## Install
+
+```bash
+pnpm add @multiplatform.one/keycloak
+```
+
+Peers: `react`, `@multiplatform.one/logger`, `@multiplatform.one/platform`.
+
+## What it owns
+
+- **`KeycloakProvider`** — auth context (`debug`, `disabled`, `iframeSso`,
+  `loginRedirectUri`, …); usually mounted for you by
+  `createApp({ keycloak: true })` from `@multiplatform.one/core`
+- **`useKeycloak()`** — the Keycloak client (login/logout, tokens); returns
+  `null` when auth is disabled
+- **`useSession()`**, `useAuthConfig()`, `useTokensFromQuery`,
+  `useTokensFromState`
+- **`Authenticated`** / `withAuthenticated` — render children only when
+  signed in
+- **Token helpers** — `isTokenExpired`, `validOrRefreshableToken`,
+  `getKeycloakBearerToken`, wallet-claim readers (`getWalletsFromToken`,
+  `getWalletAddresses`, `hasWallets`)
+- **`@multiplatform.one/keycloak/one`** — `createAuth()` Better Auth server
+  factory (stateless JWE sessions, Keycloak OAuth, Expo support)
+
+## What it must not do
+
+- No UI beyond the guard components — login screens belong to apps
+- No Frappe logic besides bearer-token bridging (`getKeycloakBearerToken`)
+
+## Usage
+
+```tsx
+import { Authenticated, useKeycloak } from "@multiplatform.one/keycloak";
+
+export function AccountMenu() {
+  const keycloak = useKeycloak();
+  if (!keycloak) return null; // auth disabled
+  return (
+    <Authenticated>
+      <button onClick={() => keycloak.logout()}>Sign out</button>
+    </Authenticated>
+  );
+}
+```
+
+Uses the patched adapter from `@multiplatform.one/keycloak-js` under the hood.
+
+## License
+
+Apache-2.0

package/dist/cjs/index.cjs

@@ -896,6 +896,33 @@ function KeycloakProvider({
 }
 
 // src/frappeToken.ts
+var cached;
 async function getKeycloakBearerToken() {
-  return void 0;
+  if (typeof window === "undefined") return void 0;
+  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
+  try {
+    const res = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ providerId: "keycloak" })
+    });
+    if (!res.ok) {
+      cached = void 0;
+      return void 0;
+    }
+    const data = await res.json().catch(() => null);
+    if (!data?.accessToken) {
+      cached = void 0;
+      return void 0;
+    }
+    cached = {
+      token: data.accessToken,
+      expiresAt: data.accessTokenExpiresAt ? new Date(data.accessTokenExpiresAt).getTime() : Date.now() + 6e4
+    };
+    return cached.token;
+  } catch {
+    cached = void 0;
+    return void 0;
+  }
 }

package/dist/cjs/index.native.cjs

@@ -416,6 +416,7 @@ function Loading({ loadingComponent }) {
 }
 
 // src/betterAuth/expoAuthFlow.native.ts
+var import_react_native3 = require("react-native");
 var Linking = __toESM(require("expo-linking"));
 var SecureStore = __toESM(require("expo-secure-store"));
 var WebBrowser = __toESM(require("expo-web-browser"));
@@ -495,7 +496,7 @@ function createExpoAuthFlow(baseURL, scheme) {
         ...cookie ? { cookie } : {},
         "expo-origin": origin(),
         "x-skip-oauth-proxy": "true",
-        ...init?.headers || {}
+        ...init?.headers
       }
     });
     absorbSetCookie(res.headers.get("set-cookie"));
@@ -518,11 +519,41 @@ function createExpoAuthFlow(baseURL, scheme) {
       const oauthState = getOAuthState();
       if (oauthState) params.append("oauthState", oauthState);
       const proxyURL = `${base}/api/auth/expo-authorization-proxy?${params.toString()}`;
-      const result = await WebBrowser.openAuthSessionAsync(proxyURL, to);
-      if (result.type !== "success") {
-        throw new Error(`sign-in ${result.type}`);
+      const toBase = to.split("?")[0];
+      let returnUrl;
+      if (import_react_native3.Platform.OS === "ios") {
+        returnUrl = await new Promise((resolve, reject) => {
+          let settled = false;
+          const linkSub = Linking.addEventListener("url", ({ url }) => {
+            if (settled || !url || !url.startsWith(toBase)) return;
+            settled = true;
+            try {
+              linkSub.remove();
+            } catch {
+            }
+            resolve(url);
+          });
+          Linking.openURL(proxyURL).catch((e) => {
+            if (settled) return;
+            settled = true;
+            try {
+              linkSub.remove();
+            } catch {
+            }
+            reject(e instanceof Error ? e : new Error(`sign-in openURL failed: ${e}`));
+          });
+        });
+      } else {
+        const result = await WebBrowser.openAuthSessionAsync(proxyURL, toBase, {
+          preferEphemeralSession: false
+          // keep the SSO + siww nonce cookie across the wallet bounce
+        });
+        returnUrl = result.type === "success" && "url" in result ? result.url : void 0;
       }
-      const cookie = new URL(result.url).searchParams.get("cookie");
+      if (!returnUrl) {
+        return;
+      }
+      const cookie = new URL(returnUrl).searchParams.get("cookie");
       if (cookie) absorbSetCookie(cookie);
     },
     async signOut() {

package/dist/esm/index.js

@@ -839,8 +839,35 @@ function KeycloakProvider({
 }
 
 // src/frappeToken.ts
+var cached;
 async function getKeycloakBearerToken() {
-  return void 0;
+  if (typeof window === "undefined") return void 0;
+  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
+  try {
+    const res = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ providerId: "keycloak" })
+    });
+    if (!res.ok) {
+      cached = void 0;
+      return void 0;
+    }
+    const data = await res.json().catch(() => null);
+    if (!data?.accessToken) {
+      cached = void 0;
+      return void 0;
+    }
+    cached = {
+      token: data.accessToken,
+      expiresAt: data.accessTokenExpiresAt ? new Date(data.accessTokenExpiresAt).getTime() : Date.now() + 6e4
+    };
+    return cached.token;
+  } catch {
+    cached = void 0;
+    return void 0;
+  }
 }
 export {
   AfterAuth,

package/dist/esm/index.native.js

@@ -357,6 +357,7 @@ function Loading({ loadingComponent }) {
 }
 
 // src/betterAuth/expoAuthFlow.native.ts
+import { Platform } from "react-native";
 import * as Linking from "expo-linking";
 import * as SecureStore from "expo-secure-store";
 import * as WebBrowser from "expo-web-browser";
@@ -436,7 +437,7 @@ function createExpoAuthFlow(baseURL, scheme) {
         ...cookie ? { cookie } : {},
         "expo-origin": origin(),
         "x-skip-oauth-proxy": "true",
-        ...init?.headers || {}
+        ...init?.headers
       }
     });
     absorbSetCookie(res.headers.get("set-cookie"));
@@ -459,11 +460,41 @@ function createExpoAuthFlow(baseURL, scheme) {
       const oauthState = getOAuthState();
       if (oauthState) params.append("oauthState", oauthState);
       const proxyURL = `${base}/api/auth/expo-authorization-proxy?${params.toString()}`;
-      const result = await WebBrowser.openAuthSessionAsync(proxyURL, to);
-      if (result.type !== "success") {
-        throw new Error(`sign-in ${result.type}`);
+      const toBase = to.split("?")[0];
+      let returnUrl;
+      if (Platform.OS === "ios") {
+        returnUrl = await new Promise((resolve, reject) => {
+          let settled = false;
+          const linkSub = Linking.addEventListener("url", ({ url }) => {
+            if (settled || !url || !url.startsWith(toBase)) return;
+            settled = true;
+            try {
+              linkSub.remove();
+            } catch {
+            }
+            resolve(url);
+          });
+          Linking.openURL(proxyURL).catch((e) => {
+            if (settled) return;
+            settled = true;
+            try {
+              linkSub.remove();
+            } catch {
+            }
+            reject(e instanceof Error ? e : new Error(`sign-in openURL failed: ${e}`));
+          });
+        });
+      } else {
+        const result = await WebBrowser.openAuthSessionAsync(proxyURL, toBase, {
+          preferEphemeralSession: false
+          // keep the SSO + siww nonce cookie across the wallet bounce
+        });
+        returnUrl = result.type === "success" && "url" in result ? result.url : void 0;
       }
-      const cookie = new URL(result.url).searchParams.get("cookie");
+      if (!returnUrl) {
+        return;
+      }
+      const cookie = new URL(returnUrl).searchParams.get("cookie");
       if (cookie) absorbSetCookie(cookie);
     },
     async signOut() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/keycloak",
-  "version": "6.1.0",
+  "version": "6.4.0",
   "description": "keycloak client for multiplatform.one ecosystem",
   "keywords": [
     "auth",
@@ -14,33 +14,35 @@
   "author": "BitSpur",
   "repository": {
     "type": "git",
-    "url": "https://gitlab.com/risserlabs/multiplatform.one/keycloak"
+    "url": "git+https://gitlab.com/bitspur/frappe/multiplatform.one.git",
+    "directory": "public/keycloak"
   },
   "source": "src/index.ts",
   "files": [
     "dist",
-    "routes",
     "src",
-    "types"
+    "types",
+    "!types/.tsbuildinfo"
   ],
   "sideEffects": false,
   "main": "src/index.ts",
   "module": "src/index.ts",
-  "types": "src/index.ts",
+  "types": "types/index.d.ts",
   "exports": {
     "./package.json": "./package.json",
     ".": {
       "react-native": {
+        "types": "./types/index.d.ts",
         "import": "./dist/esm/index.native.js",
         "require": "./dist/cjs/index.native.cjs"
       },
-      "types": "./src/index.ts",
+      "types": "./types/index.d.ts",
       "import": "./src/index.ts",
       "require": "./src/index.ts",
       "default": "./src/index.ts"
     },
     "./one": {
-      "types": "./src/one.ts",
+      "types": "./types/one.d.ts",
       "import": "./src/one.ts",
       "require": "./src/one.ts"
     }
@@ -52,8 +54,8 @@
     "@better-auth/expo": "^1.6.9",
     "better-auth": "^1.6.9",
     "jwt-decode": "^4.0.0",
-    "@multiplatform.one/keycloak-js": "6.1.0",
-    "@multiplatform.one/store": "6.1.0"
+    "@multiplatform.one/store": "6.4.0",
+    "@multiplatform.one/keycloak-js": "6.4.0"
   },
   "devDependencies": {
     "@tamagui/build": "2.0.0-rc.41",
@@ -68,15 +70,15 @@
     "react": "19.2.5",
     "typescript": "~5.9.3",
     "vitest": "^4.1.5",
-    "@multiplatform.one/config": "6.1.0",
-    "@multiplatform.one/test-utils": "6.1.0",
-    "@multiplatform.one/platform": "6.1.0",
-    "@multiplatform.one/logger": "6.1.0"
+    "@multiplatform.one/config": "6.4.0",
+    "@multiplatform.one/platform": "6.4.0",
+    "@multiplatform.one/test-utils": "6.4.0",
+    "@multiplatform.one/logger": "6.4.0"
   },
   "peerDependencies": {
     "react": "^19.1.0",
-    "@multiplatform.one/logger": "^6.1.0",
-    "@multiplatform.one/platform": "^6.1.0"
+    "@multiplatform.one/platform": "^6.4.0",
+    "@multiplatform.one/logger": "^6.4.0"
   },
   "optionalDependencies": {
     "expo-linking": "^55.0.15",
@@ -89,7 +91,7 @@
   "module:jsx": "dist/jsx",
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "build": "rm -rf dist types 2>/dev/null && node scripts/build.mjs",
+    "build": "rm -rf dist types 2>/dev/null && node scripts/build.mjs && tsc -p tsconfig.build.json",
     "test": "vitest run --coverage --coverage.provider=v8 --coverage.reporter=text --coverage.reporter=lcov --coverage.reporter=html"
   }
 }

package/src/betterAuth/expoAuthFlow.native.ts

@@ -11,6 +11,7 @@
  * session cookie back through the auth-session return URL.
  */
 
+import { Platform } from "react-native";
 import * as Linking from "expo-linking";
 import * as SecureStore from "expo-secure-store";
 import * as WebBrowser from "expo-web-browser";
@@ -118,7 +119,7 @@ export function createExpoAuthFlow(baseURL: string, scheme?: string): ExpoAuthFl
         ...(cookie ? { cookie } : {}),
         "expo-origin": origin(),
         "x-skip-oauth-proxy": "true",
-        ...(init?.headers || {}),
+        ...init?.headers,
       },
     });
     absorbSetCookie(res.headers.get("set-cookie"));
@@ -147,11 +148,61 @@ export function createExpoAuthFlow(baseURL: string, scheme?: string): ExpoAuthFl
       if (oauthState) params.append("oauthState", oauthState);
       const proxyURL = `${base}/api/auth/expo-authorization-proxy?${params.toString()}`;
 
-      const result = await WebBrowser.openAuthSessionAsync(proxyURL, to);
-      if (result.type !== "success") {
-        throw new Error(`sign-in ${result.type}`);
+      // Which browser opens the Keycloak login page differs by platform, because
+      // the wallet deeplink (metamask://connect?channelId=…, a CUSTOM scheme
+      // emitted by the classic @metamask/sdk connector) must be able to app-switch
+      // to MetaMask from inside it:
+      //
+      //  - ANDROID: a Chrome Custom Tab (openAuthSessionAsync). Custom Tabs DO
+      //    launch other apps via custom schemes, and the tab is hosted by + returns
+      //    to THIS app, so it stays warm across the wallet bounce and the KC page
+      //    receives the MetaMask-SDK relay response, then hands the custom-scheme
+      //    return URL (to?cookie=…) back to us.
+      //  - iOS: ASWebAuthenticationSession (what openAuthSessionAsync maps to)
+      //    REFUSES to launch other apps via custom schemes — it's an OAuth-return
+      //    surface only, so "Open MetaMask" does nothing (verified on-device:
+      //    SafariViewService never app-switches to io.metamask). Full system Safari
+      //    via Linking.openURL DOES app-switch to MetaMask (iOS shows an "Open in
+      //    MetaMask?" prompt for custom schemes). The wallet signs over the SDK
+      //    relay, KC verifies + redirects to the custom-scheme return URL, and
+      //    Safari hands that back to the app, caught by a Linking listener.
+      const toBase = to.split("?")[0];
+      let returnUrl: string | undefined;
+      if (Platform.OS === "ios") {
+        returnUrl = await new Promise<string | undefined>((resolve, reject) => {
+          let settled = false;
+          const linkSub = Linking.addEventListener("url", ({ url }) => {
+            if (settled || !url || !url.startsWith(toBase)) return;
+            settled = true;
+            try {
+              linkSub.remove();
+            } catch {
+              /* already removed */
+            }
+            resolve(url);
+          });
+          Linking.openURL(proxyURL).catch((e) => {
+            if (settled) return;
+            settled = true;
+            try {
+              linkSub.remove();
+            } catch {
+              /* already removed */
+            }
+            reject(e instanceof Error ? e : new Error(`sign-in openURL failed: ${e}`));
+          });
+        });
+      } else {
+        const result = await WebBrowser.openAuthSessionAsync(proxyURL, toBase, {
+          preferEphemeralSession: false, // keep the SSO + siww nonce cookie across the wallet bounce
+        });
+        returnUrl = result.type === "success" && "url" in result ? result.url : undefined;
       }
-      const cookie = new URL(result.url).searchParams.get("cookie");
+      if (!returnUrl) {
+        // dismissed / cancelled — treat as a no-op sign-in (user backed out)
+        return;
+      }
+      const cookie = new URL(returnUrl).searchParams.get("cookie");
       if (cookie) absorbSetCookie(cookie);
     },
 

package/src/frappeToken.ts

@@ -1,10 +1,87 @@
 /**
  * Keycloak access token for Frappe API requests — web variant.
  *
- * On web the app is same-origin with the bench (the :8000 proxy), so the
- * better-auth account cookie rides along automatically and the bench's
- * frappe_keycloak auth hook authenticates from it. No client-side token.
+ * Web HTTP requests to a same-origin bench could ride the better-auth
+ * account cookie, but the Socket.IO realtime handshake cannot: frappe's
+ * socketio auth middleware only accepts a frappe `sid` cookie or an
+ * `Authorization` header (it never forwards arbitrary cookies to the web
+ * server). So the web client fetches the Keycloak access token from
+ * better-auth's same-origin `/get-access-token` endpoint (which refreshes
+ * server-side when expired, authenticated by the better-auth session
+ * cookie) and sends `Authorization: Bearer <token>` on every REST request
+ * and socket handshake — the same transport native uses. The bench's
+ * frappe_keycloak auth hook validates the JWT against the realm public key.
+ */
+
+let cached: { token: string; expiresAt: number } | undefined;
+/** In-flight fetch, shared so parallel callers don't stampede the endpoint. */
+let pending: Promise<string | undefined> | undefined;
+/** After a signed-out answer, skip re-asking until this time (ms epoch). */
+let signedOutUntil = 0;
+
+const SIGNED_OUT_COOLDOWN_MS = 15_000;
+
+/**
+ * Returns a valid Keycloak access token, or undefined when signed out.
+ *
+ * Anonymous visitors get a single 401 per cooldown window instead of one per
+ * concurrent data request: parallel callers share the in-flight fetch, and a
+ * signed-out answer short-circuits further attempts for a few seconds. A real
+ * sign-in arrives via the OAuth redirect (full navigation), which resets this
+ * module state anyway.
  */
 export async function getKeycloakBearerToken(): Promise<string | undefined> {
-  return undefined;
+  if (typeof window === "undefined") return undefined;
+  // 60s slack so we never hand out a token that expires mid-request.
+  if (cached && cached.expiresAt - 60_000 > Date.now()) return cached.token;
+  if (Date.now() < signedOutUntil) return undefined;
+  if (pending) return pending;
+  pending = fetchToken().finally(() => {
+    pending = undefined;
+  });
+  return pending;
+}
+
+async function fetchToken(): Promise<string | undefined> {
+  try {
+    const res = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ providerId: "keycloak" }),
+    });
+    if (!res.ok) {
+      cached = undefined;
+      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
+      return undefined;
+    }
+    const data = (await res.json().catch(() => null)) as {
+      accessToken?: string;
+      accessTokenExpiresAt?: string;
+    } | null;
+    if (!data?.accessToken) {
+      cached = undefined;
+      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
+      return undefined;
+    }
+    cached = {
+      token: data.accessToken,
+      expiresAt: data.accessTokenExpiresAt
+        ? new Date(data.accessTokenExpiresAt).getTime()
+        : Date.now() + 60_000,
+    };
+    return cached.token;
+  } catch {
+    // Signed out / server unreachable -> guest requests.
+    cached = undefined;
+    signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
+    return undefined;
+  }
+}
+
+/** Drop the cached token (sign-out / fresh sign-in). */
+export function clearKeycloakBearerToken() {
+  cached = undefined;
+  pending = undefined;
+  signedOutUntil = 0;
 }

package/types/Authenticated.d.ts

@@ -0,0 +1,9 @@
+import { type ComponentType, type PropsWithChildren } from "react";
+export interface AuthenticatedProps extends PropsWithChildren {
+    disabled?: boolean;
+    loadingComponent?: ComponentType;
+    loggedOutComponent?: ComponentType;
+}
+export declare function Authenticated({ children, disabled, loggedOutComponent, loadingComponent, }: AuthenticatedProps): import("react/jsx-runtime").JSX.Element;
+export declare function withAuthenticated<P extends object>(Component: ComponentType<P>, options?: AuthenticatedProps): (props: P) => import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=Authenticated.d.ts.map

package/types/Authenticated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authenticated.d.ts","sourceRoot":"","sources":["../src/Authenticated.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAa,MAAM,OAAO,CAAC;AAO9E,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,aAAa,CAAC;IACjC,kBAAkB,CAAC,EAAE,aAAa,CAAC;CACpC;AAED,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,EACR,QAAQ,EACR,kBAAkB,EAClB,gBAAgB,GACjB,EAAE,kBAAkB,2CAoCpB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAChD,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAC3B,OAAO,GAAE,kBAAuB,IAExB,OAAO,CAAC,6CAKjB"}

package/types/Loading.d.ts

@@ -0,0 +1,6 @@
+import type { ComponentType } from "react";
+export interface LoadingProps {
+    loadingComponent?: ComponentType;
+}
+export declare function Loading({ loadingComponent }: LoadingProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=Loading.d.ts.map

package/types/Loading.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Loading.d.ts","sourceRoot":"","sources":["../src/Loading.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAO3C,MAAM,WAAW,YAAY;IAC3B,gBAAgB,CAAC,EAAE,aAAa,CAAC;CAClC;AAED,wBAAgB,OAAO,CAAC,EAAE,gBAAgB,EAAE,EAAE,YAAY,2CAYzD"}

package/types/authConfig.d.ts

@@ -0,0 +1,10 @@
+export declare const defaultAuthConfig: AuthConfig;
+export declare const AuthConfigContext: import("react").Context<AuthConfig>;
+export interface AuthConfig {
+    debug?: boolean;
+    disabled?: boolean;
+    iframeSso?: boolean;
+    loginRedirectUri?: string;
+    messageHandlerKeys?: string[];
+}
+//# sourceMappingURL=authConfig.d.ts.map

package/types/authConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authConfig.d.ts","sourceRoot":"","sources":["../src/authConfig.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iBAAiB,EAAE,UAAe,CAAC;AAEhD,eAAO,MAAM,iBAAiB,qCAA+C,CAAC;AAE9E,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B"}