npm - @multiplatform.one/keycloak - Versions diffs - 6.6.0 → 7.0.0 - Mend

@multiplatform.one/keycloak 6.6.0 → 7.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (82) hide show

package/dist/cjs/index.cjs +129 -55
package/dist/cjs/index.native.cjs +239 -130
package/dist/esm/index.js +131 -57
package/dist/esm/index.native.js +239 -130
package/package.json +16 -11
package/src/betterAuth/client.ts +3 -1
package/src/betterAuth/expoAuthFlow.native.spec.ts +307 -0
package/src/betterAuth/expoAuthFlow.native.ts +189 -55
package/src/frappeToken.native.spec.ts +104 -0
package/src/frappeToken.native.ts +46 -2
package/src/frappeToken.spec.ts +141 -0
package/src/frappeToken.ts +106 -14
package/src/index.ts +1 -1
package/src/keycloak/index.ts +24 -7
package/src/keycloak/index.webext.ts +16 -0
package/src/oauth/authorizationUrl.spec.ts +83 -0
package/src/oauth/authorizationUrl.ts +74 -0
package/src/oauth/callback.spec.ts +72 -0
package/src/oauth/callback.ts +46 -0
package/src/oauth/callbackPage.spec.ts +61 -0
package/src/oauth/callbackPage.ts +57 -0
package/src/oauth/endpoints.spec.ts +193 -0
package/src/oauth/endpoints.ts +135 -0
package/src/oauth/errors.ts +18 -0
package/src/oauth/form.spec.ts +35 -0
package/src/oauth/form.ts +30 -0
package/src/oauth/idToken.spec.ts +191 -0
package/src/oauth/idToken.ts +153 -0
package/src/oauth/index.ts +10 -0
package/src/oauth/jwt.ts +90 -0
package/src/oauth/loopbackFlow.spec.ts +226 -0
package/src/oauth/loopbackFlow.ts +114 -0
package/src/oauth/pkce.spec.ts +60 -0
package/src/oauth/pkce.ts +80 -0
package/src/oauth/tokenExchange.spec.ts +331 -0
package/src/oauth/tokenExchange.ts +232 -0
package/src/one.ts +30 -3
package/src/provider/AfterAuth.tsx +7 -0
package/src/provider/authProvider/index.native.tsx +37 -4
package/src/session/index.ts +2 -2
package/src/state.ts +5 -2
package/types/betterAuth/client.d.ts +2 -791
package/types/betterAuth/client.d.ts.map +1 -1
package/types/betterAuth/expoAuthFlow.native.d.ts +50 -3
package/types/betterAuth/expoAuthFlow.native.d.ts.map +1 -1
package/types/frappeToken.d.ts +14 -1
package/types/frappeToken.d.ts.map +1 -1
package/types/frappeToken.native.d.ts +16 -2
package/types/frappeToken.native.d.ts.map +1 -1
package/types/index.d.ts +1 -1
package/types/index.d.ts.map +1 -1
package/types/keycloak/index.d.ts.map +1 -1
package/types/keycloak/index.webext.d.ts.map +1 -1
package/types/oauth/authorizationUrl.d.ts +32 -0
package/types/oauth/authorizationUrl.d.ts.map +1 -0
package/types/oauth/callback.d.ts +26 -0
package/types/oauth/callback.d.ts.map +1 -0
package/types/oauth/callbackPage.d.ts +34 -0
package/types/oauth/callbackPage.d.ts.map +1 -0
package/types/oauth/endpoints.d.ts +68 -0
package/types/oauth/endpoints.d.ts.map +1 -0
package/types/oauth/errors.d.ts +17 -0
package/types/oauth/errors.d.ts.map +1 -0
package/types/oauth/form.d.ts +16 -0
package/types/oauth/form.d.ts.map +1 -0
package/types/oauth/idToken.d.ts +83 -0
package/types/oauth/idToken.d.ts.map +1 -0
package/types/oauth/index.d.ts +11 -0
package/types/oauth/index.d.ts.map +1 -0
package/types/oauth/jwt.d.ts +31 -0
package/types/oauth/jwt.d.ts.map +1 -0
package/types/oauth/loopbackFlow.d.ts +64 -0
package/types/oauth/loopbackFlow.d.ts.map +1 -0
package/types/oauth/pkce.d.ts +49 -0
package/types/oauth/pkce.d.ts.map +1 -0
package/types/oauth/tokenExchange.d.ts +89 -0
package/types/oauth/tokenExchange.d.ts.map +1 -0
package/types/one.d.ts +7 -0
package/types/one.d.ts.map +1 -1
package/types/provider/AfterAuth.d.ts.map +1 -1
package/types/provider/authProvider/index.native.d.ts.map +1 -1
package/types/state.d.ts.map +1 -1

package/src/oauth/tokenExchange.spec.ts ADDED Viewed

@@ -0,0 +1,331 @@
+import { describe, expect, it, vi } from "vitest";
+import { keycloakEndpoints } from "./endpoints";
+import { OAuthError } from "./errors";
+import {
+  endSession,
+  type ExchangeCodeParams,
+  exchangeAuthorizationCode,
+  type FetchLike,
+  refreshAccessToken,
+  type TokenSet,
+} from "./tokenExchange";
+const endpoints = keycloakEndpoints({ url: "https://kc.example.com", realm: "myrealm" });
+const now = 1_700_000_000;
+const nonce = "the-nonce";
+function jsonFetch(payload: unknown, { ok = true, status = 200 } = {}) {
+  return vi.fn(async () => ({
+    ok,
+    status,
+    json: async () => payload,
+    text: async () => JSON.stringify(payload),
+  })) as unknown as FetchLike & ReturnType<typeof vi.fn>;
+}
+/** A structurally real ID token — the shape Keycloak actually returns. */
+function mintIdToken(claims: Record<string, unknown> = {}): string {
+  const segment = (value: unknown) => Buffer.from(JSON.stringify(value)).toString("base64url");
+  return [
+    segment({ alg: "RS256", typ: "JWT", kid: "kid-1" }),
+    segment({
+      iss: endpoints.issuer,
+      aud: "app-public",
+      azp: "app-public",
+      sub: "3f6c1e2a-user",
+      exp: now + 300,
+      iat: now - 5,
+      nonce,
+      ...claims,
+    }),
+    "signature-we-do-not-verify",
+  ].join(".");
+}
+const idToken = mintIdToken();
+const successPayload = {
+  access_token: "at",
+  id_token: idToken,
+  refresh_token: "rt",
+  expires_in: 300,
+  refresh_expires_in: 1800,
+  token_type: "Bearer",
+  scope: "openid profile email",
+};
+const exchangeParams = {
+  endpoints,
+  clientId: "app-public",
+  code: "the-code",
+  codeVerifier: "the-verifier",
+  redirectUri: "http://127.0.0.1:41234/callback",
+  nonce,
+  now,
+};
+describe("exchangeAuthorizationCode", () => {
+  it("posts the PKCE verifier as a form-encoded body", async () => {
+    const fetchImpl = jsonFetch(successPayload);
+    await exchangeAuthorizationCode(fetchImpl, exchangeParams);
+    const [url, init] = fetchImpl.mock.calls[0];
+    expect(url).toBe(endpoints.token);
+    expect(init.method).toBe("POST");
+    expect(init.headers["Content-Type"]).toBe("application/x-www-form-urlencoded");
+    expect(Object.fromEntries(new URLSearchParams(init.body))).toEqual({
+      grant_type: "authorization_code",
+      client_id: "app-public",
+      code: "the-code",
+      code_verifier: "the-verifier",
+      redirect_uri: "http://127.0.0.1:41234/callback",
+    });
+  });
+  it("maps the snake_case wire format onto a TokenSet", async () => {
+    const tokens = await exchangeAuthorizationCode(jsonFetch(successPayload), exchangeParams);
+    expect(tokens).toMatchObject({
+      accessToken: "at",
+      idToken,
+      refreshToken: "rt",
+      expiresIn: 300,
+      refreshExpiresIn: 1800,
+      tokenType: "Bearer",
+      scope: "openid profile email",
+    });
+    expect(tokens.idTokenClaims?.sub).toBe("3f6c1e2a-user");
+  });
+  it("raises the server's OAuth error even though it arrives with a 400", async () => {
+    const fetchImpl = jsonFetch(
+      { error: "invalid_grant", error_description: "Code not valid" },
+      { ok: false, status: 400 },
+    );
+    await expect(exchangeAuthorizationCode(fetchImpl, exchangeParams)).rejects.toMatchObject({
+      code: "invalid_grant",
+      description: "Code not valid",
+    });
+  });
+  it("rejects a 200 that carries no access_token", async () => {
+    await expect(
+      exchangeAuthorizationCode(jsonFetch({ id_token: idToken }), exchangeParams),
+    ).rejects.toThrow(/no access_token/);
+  });
+  it("rejects a non-JSON body", async () => {
+    const fetchImpl = vi.fn(async () => ({
+      ok: false,
+      status: 502,
+      json: async () => {
+        throw new Error("not json");
+      },
+      text: async () => "<html>bad gateway</html>",
+    })) as unknown as FetchLike;
+    await expect(exchangeAuthorizationCode(fetchImpl, exchangeParams)).rejects.toBeInstanceOf(
+      OAuthError,
+    );
+  });
+  it("returns an access token unaccompanied by an id token untouched", async () => {
+    const tokens = await exchangeAuthorizationCode(
+      jsonFetch({ access_token: "at", expires_in: 300 }),
+      exchangeParams,
+    );
+    expect(tokens.idToken).toBeUndefined();
+    expect(tokens.idTokenClaims).toBeUndefined();
+  });
+});
+describe("exchangeAuthorizationCode id token validation", () => {
+  async function exchange(payloadIdToken: string) {
+    return exchangeAuthorizationCode(
+      jsonFetch({ ...successPayload, id_token: payloadIdToken }),
+      exchangeParams,
+    );
+  }
+  it("rejects an id token from a different issuer", async () => {
+    await expect(
+      exchange(mintIdToken({ iss: "https://evil.example.com/realms/x" })),
+    ).rejects.toMatchObject({ code: "invalid_id_token" });
+  });
+  it("rejects an id token minted for a different client in the same realm", async () => {
+    await expect(exchange(mintIdToken({ aud: "other", azp: "other" }))).rejects.toMatchObject({
+      code: "invalid_id_token",
+    });
+  });
+  it("rejects an expired id token", async () => {
+    await expect(exchange(mintIdToken({ exp: now - 3600 }))).rejects.toThrow(/exp is in the past/);
+  });
+  it("rejects an id token replayed from another login", async () => {
+    await expect(exchange(mintIdToken({ nonce: "someone-elses-nonce" }))).rejects.toThrow(
+      /nonce does not match/,
+    );
+  });
+  it("rejects an unsecured id token", async () => {
+    const unsecured = [
+      Buffer.from(JSON.stringify({ alg: "none" })).toString("base64url"),
+      Buffer.from(
+        JSON.stringify({
+          iss: endpoints.issuer,
+          aud: "app-public",
+          azp: "app-public",
+          sub: "u",
+          exp: now + 300,
+          iat: now,
+          nonce,
+        }),
+      ).toString("base64url"),
+      "",
+    ].join(".");
+    await expect(exchange(unsecured)).rejects.toThrow(/alg=none/);
+  });
+  it("rejects an id token that is not a jwt", async () => {
+    await expect(exchange("fake-id-token")).rejects.toMatchObject({ code: "invalid_token" });
+  });
+});
+/**
+ * `nonce` is non-optional on `ExchangeCodeParams`, which stops an in-repo
+ * caller forgetting it and stops nothing at all for the JavaScript consumers
+ * of a published package. The failure mode is quiet rather than loud:
+ * `validateIdToken` skips the nonce comparison when it has no nonce to
+ * compare against, so a missing one does not fail, it just drops the only
+ * check binding the returned ID token to THIS login. Every call below is
+ * cast, because a cast is exactly how the value gets in.
+ */
+describe("exchangeAuthorizationCode nonce requirement", () => {
+  function exchangeWith(params: Record<string, unknown>, payload: unknown = successPayload) {
+    return exchangeAuthorizationCode(jsonFetch(payload), params as unknown as ExchangeCodeParams);
+  }
+  it("refuses an explicitly undefined nonce", async () => {
+    await expect(exchangeWith({ ...exchangeParams, nonce: undefined })).rejects.toMatchObject({
+      code: "invalid_request",
+    });
+  });
+  it("refuses an omitted nonce", async () => {
+    const { nonce: _omitted, ...withoutNonce } = exchangeParams;
+    await expect(exchangeWith(withoutNonce)).rejects.toThrow(/nonce is required/);
+  });
+  it("refuses an empty nonce", async () => {
+    await expect(exchangeWith({ ...exchangeParams, nonce: "" })).rejects.toThrow(
+      /nonce is required/,
+    );
+  });
+  it("refuses before the code ever reaches the token endpoint", async () => {
+    const fetchImpl = jsonFetch(successPayload);
+    await expect(
+      exchangeAuthorizationCode(fetchImpl, {
+        ...exchangeParams,
+        nonce: undefined,
+      } as unknown as ExchangeCodeParams),
+    ).rejects.toBeInstanceOf(OAuthError);
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+  // What the guard is actually for. This id token is valid in every respect
+  // except that it was minted for a different authorization request; without
+  // the guard it comes back as a populated TokenSet.
+  it("refuses an id token bound to another login rather than accepting it", async () => {
+    await expect(
+      exchangeWith(
+        { ...exchangeParams, nonce: undefined },
+        {
+          ...successPayload,
+          id_token: mintIdToken({ nonce: "someone-elses-nonce" }),
+        },
+      ),
+    ).rejects.toThrow(/nonce is required/);
+  });
+});
+/**
+ * The brand is type-only, so this is checked by `tsc --noEmit` — which
+ * includes this file and runs in CI — rather than by the assertion below.
+ * Drop the brand from `TokenSet` and the literal becomes assignable, at
+ * which point tsc fails on an unused `@ts-expect-error`. That is the whole
+ * point: the docstring in tokenExchange.ts claims validation is unskippable,
+ * and this is what makes the claim the compiler's rather than the author's.
+ */
+describe("TokenSet is not constructible outside this module", () => {
+  it("refuses a hand-written object literal", () => {
+    // @ts-expect-error TokenSet is branded; toTokenSet is the only source
+    const forged: TokenSet = { accessToken: "at", idToken: "an.unvalidated.token" };
+    expect(forged.accessToken).toBe("at");
+  });
+});
+describe("refreshAccessToken", () => {
+  const refreshParams = { endpoints, clientId: "app-public", refreshToken: "old-rt", now };
+  it("posts the refresh_token grant", async () => {
+    const fetchImpl = jsonFetch(successPayload);
+    const tokens = await refreshAccessToken(fetchImpl, refreshParams);
+    expect(Object.fromEntries(new URLSearchParams(fetchImpl.mock.calls[0][1].body))).toEqual({
+      grant_type: "refresh_token",
+      client_id: "app-public",
+      refresh_token: "old-rt",
+    });
+    expect(tokens.accessToken).toBe("at");
+  });
+  it("surfaces an expired refresh token as invalid_grant", async () => {
+    const fetchImpl = jsonFetch({ error: "invalid_grant" }, { ok: false, status: 400 });
+    await expect(
+      refreshAccessToken(fetchImpl, { endpoints, clientId: "c", refreshToken: "dead" }),
+    ).rejects.toMatchObject({ code: "invalid_grant" });
+  });
+  it("validates the refreshed id token against the issuer and this client", async () => {
+    const fetchImpl = jsonFetch({
+      ...successPayload,
+      id_token: mintIdToken({ aud: "other", azp: "other" }),
+    });
+    await expect(refreshAccessToken(fetchImpl, refreshParams)).rejects.toMatchObject({
+      code: "invalid_id_token",
+    });
+  });
+  it("does not require a nonce, since a refresh has no authorization request", async () => {
+    const fetchImpl = jsonFetch({
+      ...successPayload,
+      id_token: mintIdToken({ nonce: "the-original-logins-nonce" }),
+    });
+    await expect(refreshAccessToken(fetchImpl, refreshParams)).resolves.toMatchObject({
+      accessToken: "at",
+    });
+  });
+});
+describe("endSession", () => {
+  it("posts the refresh token to the logout endpoint", async () => {
+    const fetchImpl = jsonFetch({});
+    await endSession(fetchImpl, { endpoints, clientId: "app-public", refreshToken: "rt" });
+    const [url, init] = fetchImpl.mock.calls[0];
+    expect(url).toBe(endpoints.endSession);
+    expect(Object.fromEntries(new URLSearchParams(init.body))).toEqual({
+      client_id: "app-public",
+      refresh_token: "rt",
+    });
+  });
+  it("throws when the server refuses the logout", async () => {
+    await expect(
+      endSession(jsonFetch({}, { ok: false, status: 400 }), {
+        endpoints,
+        clientId: "c",
+        refreshToken: "rt",
+      }),
+    ).rejects.toThrow(/end-session endpoint returned 400/);
+  });
+});

package/src/oauth/tokenExchange.ts ADDED Viewed

@@ -0,0 +1,232 @@
+/**
+ * File: /src/oauth/tokenExchange.ts
+ * Project: @multiplatform.one/keycloak
+ *
+ * The token endpoint calls, written against a minimal fetch shape so the GJS
+ * libsoup fetch shim satisfies it as readily as the platform fetch.
+ *
+ * This module is also where every ID token this package produces gets
+ * validated. Doing it here rather than in the flow is what makes the
+ * invariant checkable: a `TokenSet` whose `idToken` is set has had that token
+ * validated against the issuer and this client, because there is no other way
+ * to construct one — `toTokenSet` is module-private and `TokenSet` is branded,
+ * so a consumer cannot object-literal its way past the validation either. It
+ * is also the only place OIDC Core §3.1.3.7's "directly from the Token
+ * Endpoint" precondition is provably true — see idToken.ts for what that
+ * precondition buys and what it does not.
+ */
+import type { OidcEndpoints } from "./endpoints";
+import { OAuthError } from "./errors";
+import { encodeForm } from "./form";
+import { type IdTokenClaims, validateIdToken } from "./idToken";
+export interface FetchLikeResponse {
+  ok: boolean;
+  status: number;
+  json(): Promise<unknown>;
+  text(): Promise<string>;
+}
+export type FetchLike = (
+  url: string,
+  init: { method: string; headers: Record<string, string>; body: string },
+) => Promise<FetchLikeResponse>;
+declare const tokenSetBrand: unique symbol;
+export interface TokenSet {
+  /**
+   * Phantom brand — in the type, never on the object. It is what makes the
+   * invariant above checkable rather than merely stated: an object literal
+   * cannot satisfy this interface, so the only `TokenSet` that exists is one
+   * `toTokenSet` returned, and `toTokenSet` cannot return without having put
+   * any `idToken` through `validateIdToken` first.
+   */
+  readonly [tokenSetBrand]: true;
+  accessToken: string;
+  /**
+   * Present only when it passed `validateIdToken` — `iss`, `aud`, `azp`,
+   * `exp` and (on the authorization-code grant) `nonce` have all been
+   * checked. Its signature has not been verified; see idToken.ts for why
+   * that is sound here and what would break it.
+   */
+  idToken?: string;
+  /** Claims of the validated `idToken`, so callers need not re-decode it. */
+  idTokenClaims?: IdTokenClaims;
+  refreshToken?: string;
+  /** Access token lifetime in seconds, as reported by the server. */
+  expiresIn?: number;
+  refreshExpiresIn?: number;
+  tokenType?: string;
+  scope?: string;
+}
+interface RawTokenResponse {
+  access_token?: string;
+  id_token?: string;
+  refresh_token?: string;
+  expires_in?: number;
+  refresh_expires_in?: number;
+  token_type?: string;
+  scope?: string;
+  error?: string;
+  error_description?: string;
+}
+const formHeaders = {
+  "Content-Type": "application/x-www-form-urlencoded",
+  Accept: "application/json",
+};
+async function postForm(
+  fetchImpl: FetchLike,
+  endpoint: string,
+  form: Record<string, string>,
+): Promise<RawTokenResponse> {
+  const response = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: formHeaders,
+    body: encodeForm(form),
+  });
+  // Keycloak returns the OAuth error object with a 4xx, so parse the body
+  // before trusting `ok` — the error code is more useful than the status.
+  let payload: RawTokenResponse;
+  try {
+    payload = (await response.json()) as RawTokenResponse;
+  } catch {
+    throw new OAuthError(
+      "invalid_response",
+      `token endpoint returned ${response.status} with a non-JSON body`,
+    );
+  }
+  if (payload.error) {
+    throw new OAuthError(payload.error, undefined, payload.error_description);
+  }
+  if (!response.ok) {
+    throw new OAuthError("invalid_response", `token endpoint returned ${response.status}`);
+  }
+  return payload;
+}
+function toTokenSet(payload: RawTokenResponse, validation: IdTokenValidationContext): TokenSet {
+  if (!payload.access_token) {
+    throw new OAuthError("invalid_response", "token response had no access_token");
+  }
+  const claims = payload.id_token
+    ? validateIdToken(payload.id_token, {
+        issuer: validation.endpoints.issuer,
+        clientId: validation.clientId,
+        nonce: validation.nonce,
+        now: validation.now,
+      })
+    : undefined;
+  // The one place the brand is applied, and it is unreachable without the
+  // validation above. Type-only, so nothing is added at runtime.
+  return {
+    accessToken: payload.access_token,
+    idToken: payload.id_token,
+    idTokenClaims: claims,
+    refreshToken: payload.refresh_token,
+    expiresIn: payload.expires_in,
+    refreshExpiresIn: payload.refresh_expires_in,
+    tokenType: payload.token_type,
+    scope: payload.scope,
+  } as TokenSet;
+}
+interface IdTokenValidationContext {
+  endpoints: OidcEndpoints;
+  clientId: string;
+  nonce?: string;
+  now?: number;
+}
+export interface ExchangeCodeParams {
+  endpoints: OidcEndpoints;
+  clientId: string;
+  code: string;
+  codeVerifier: string;
+  redirectUri: string;
+  /**
+   * The nonce from the authorization request this code came back on.
+   * Required, not optional: it is the only thing binding the returned ID
+   * token to this login, and an optional parameter is one a caller forgets.
+   */
+  nonce: string;
+  /** Epoch seconds for the `exp`/`iat` checks. Injected by tests. */
+  now?: number;
+}
+export async function exchangeAuthorizationCode(
+  fetchImpl: FetchLike,
+  { endpoints, clientId, code, codeVerifier, redirectUri, nonce, now }: ExchangeCodeParams,
+): Promise<TokenSet> {
+  // `nonce` being non-optional on the type is not a control: this package is
+  // published, so a JavaScript consumer — or anything that got here through a
+  // cast — can pass `undefined`. `validateIdToken` skips the nonce comparison
+  // when it has nothing to compare against, so a missing nonce is not a
+  // failure but a silently weaker check: the ID token would only have to be
+  // for this client, not for THIS login. Fail closed instead.
+  if (!nonce) {
+    throw new OAuthError(
+      "invalid_request",
+      "nonce is required on the authorization-code grant — it is the only thing binding the id token to this login",
+    );
+  }
+  return toTokenSet(
+    await postForm(fetchImpl, endpoints.token, {
+      grant_type: "authorization_code",
+      client_id: clientId,
+      code,
+      code_verifier: codeVerifier,
+      redirect_uri: redirectUri,
+    }),
+    { endpoints, clientId, nonce, now },
+  );
+}
+export interface RefreshParams {
+  endpoints: OidcEndpoints;
+  clientId: string;
+  refreshToken: string;
+  /** Epoch seconds for the `exp`/`iat` checks. Injected by tests. */
+  now?: number;
+}
+export async function refreshAccessToken(
+  fetchImpl: FetchLike,
+  { endpoints, clientId, refreshToken, now }: RefreshParams,
+): Promise<TokenSet> {
+  return toTokenSet(
+    await postForm(fetchImpl, endpoints.token, {
+      grant_type: "refresh_token",
+      client_id: clientId,
+      refresh_token: refreshToken,
+    }),
+    // No nonce on the refresh grant: there is no fresh authorization request
+    // to bind to. Every other claim is still checked.
+    { endpoints, clientId, now },
+  );
+}
+/**
+ * End the Keycloak SSO session via back-channel logout. Preferred over opening
+ * the end-session URL in a browser on GNOME: there is no app window to return
+ * to, so a browser tab would just be left sitting on a logout page.
+ */
+export async function endSession(
+  fetchImpl: FetchLike,
+  { endpoints, clientId, refreshToken }: RefreshParams,
+): Promise<void> {
+  const response = await fetchImpl(endpoints.endSession, {
+    method: "POST",
+    headers: formHeaders,
+    body: encodeForm({ client_id: clientId, refresh_token: refreshToken }),
+  });
+  // A rejected logout leaves a server session we cannot reach again; the local
+  // tokens are still discarded by the caller, so surface it and move on.
+  if (!response.ok) {
+    throw new OAuthError("logout_failed", `end-session endpoint returned ${response.status}`);
+  }
+}

package/src/one.ts CHANGED Viewed

@@ -23,16 +23,36 @@ export function createAuth(config: AuthHandlerConfig) {
   const keycloakBaseUrl = config.keycloak?.baseUrl || `${baseUrl}/auth`;
   const realm = config.keycloak?.realm || "master";
   const issuer = `${keycloakBaseUrl}/realms/${realm}`;
+  // Extra origins (e.g. LAN devices hitting the server by IP) come from the
+  // KEYCLOAK_TRUSTED_ORIGINS env var (comma-separated) and/or the
+  // trustedOrigins option; both extend the always-trusted defaults.
+  const envTrustedOrigins = (
+    (typeof process !== "undefined" && process.env?.KEYCLOAK_TRUSTED_ORIGINS) ||
+    ""
+  )
+    .split(",")
+    .map((origin) => origin.trim())
+    .filter(Boolean);
   _auth = betterAuth({
     basePath: "/api/auth",
     baseURL: baseUrl,
     secret: config.secret || "",
     trustedOrigins: [
-      baseUrl,
-      keycloakBaseUrl,
-      ...(config.expoScheme ? [`${config.expoScheme}://`] : []),
+      ...new Set([
+        baseUrl,
+        keycloakBaseUrl,
+        ...(config.expoScheme ? [`${config.expoScheme}://`] : []),
+        ...envTrustedOrigins,
+        ...(config.trustedOrigins || []),
+      ]),
     ],
+    advanced: {
+      // better-auth skips origin checks entirely when NODE_ENV=test; pin the
+      // check on so the trustedOrigins contract is enforced (and testable)
+      // regardless of environment.
+      disableOriginCheck: false,
+    },
     session: {
       cookieCache: {
         enabled: true,
@@ -79,6 +99,13 @@ export interface AuthHandlerConfig {
   scopes?: string[];
   /** Expo deep-link scheme (e.g. "multiplatform-one") — added to trustedOrigins. */
   expoScheme?: string;
+  /**
+   * Additional origins allowed to hit the auth route (e.g. LAN device
+   * origins). Extends — never replaces — the defaults (baseUrl, keycloak
+   * URL, expo scheme). Also readable from the KEYCLOAK_TRUSTED_ORIGINS env
+   * var as a comma-separated list.
+   */
+  trustedOrigins?: string[];
 }
 export type Auth = ReturnType<typeof createAuth>;

package/src/provider/AfterAuth.tsx CHANGED Viewed

@@ -1,5 +1,6 @@
 import { logger } from "@multiplatform.one/logger";
 import { type ComponentType, type PropsWithChildren, useEffect } from "react";
+import { watchKeycloakBearerTokenRevalidate } from "../frappeToken";
 import { useAuthConfig } from "../hooks";
 import { useKeycloak } from "../keycloak/index";
 import { persist, useAuthStore } from "../state";
@@ -63,5 +64,11 @@ export function AfterAuth({ children, loadingComponent: _loadingComponent }: Aft
     }
   }, [authConfig.debug, keycloak]);
+  // Silent renew / SLO notice: when this tab is focused again, re-fetch the
+  // access token. A front-channel logout elsewhere (desk, another app on
+  // this host) revokes the refresh token; the server then clears the Better
+  // Auth session so the chrome flips to signed-out without a reload.
+  useEffect(() => watchKeycloakBearerTokenRevalidate(), []);
   return <>{children}</>;
 }