@multiplatform.one/keycloak 6.6.0 → 7.0.0

package/src/provider/authProvider/index.native.tsx

@@ -12,9 +12,14 @@
  */
 
 import { useEffect, useMemo, useState } from "react";
+import { AppState, type AppStateStatus } from "react-native";
 import * as Linking from "expo-linking";
 import { Loading } from "../../Loading";
-import { createExpoAuthFlow } from "../../betterAuth/expoAuthFlow.native";
+import {
+  createExpoAuthFlow,
+  rewriteLoopbackHostForNative,
+} from "../../betterAuth/expoAuthFlow.native";
+import { clearKeycloakBearerToken } from "../../frappeToken.native";
 import { KeycloakConfigContext } from "../../keycloak/config";
 import { Keycloak } from "../../keycloak/index";
 import type { KeycloakLoginOptions, KeycloakLogoutOptions } from "../../keycloak/base";
@@ -35,8 +40,12 @@ export function AuthProvider({
   // Resolve the Better Auth server base URL from keycloak config.
   // On native, the keycloakConfig.url is the Keycloak server — the Better Auth
   // server is the app backend (CreateApp wires BETTER_AUTH_BASE_URL/BASE_URL).
+  // Loopback hosts are rewritten for the device (127.0.0.1 / 10.0.2.2): see
+  // rewriteLoopbackHostForNative.
   const serverBaseUrl = useMemo(() => {
-    return keycloakConfig.betterAuthBaseUrl || "http://localhost:8000";
+    return rewriteLoopbackHostForNative(
+      keycloakConfig.betterAuthBaseUrl || "http://localhost:8000",
+    );
   }, [keycloakConfig]);
 
   const scheme = useMemo(() => keycloakConfig.expoScheme, [keycloakConfig]);
@@ -72,11 +81,24 @@ export function AuthProvider({
           // can only receive exp:// redirects (Linking.createURL derives
           // exp://<host>/--/ there; the bare app scheme in dev builds).
           await flow.signIn("keycloak", options.redirectUri || Linking.createURL("/"));
+          // Drop any signed-out cooldown/stale token so the first Frappe
+          // request after sign-in fetches a fresh Bearer token.
+          clearKeycloakBearerToken();
           await refresh();
           return undefined;
         },
-        async (_options: KeycloakLogoutOptions) => {
-          await flow.signOut();
+        async (options: KeycloakLogoutOptions) => {
+          // Single sign-out: ends the Better Auth session AND rides the
+          // Keycloak end-session endpoint through the system browser (see
+          // expoAuthFlow.signOut). Only custom-scheme URLs make sense as the
+          // post-logout return on native; web-style paths fall back to the
+          // app's own runtime URL.
+          const redirectUri =
+            options.redirectUri && options.redirectUri.includes("://")
+              ? options.redirectUri
+              : Linking.createURL("/");
+          await flow.signOut(redirectUri);
+          clearKeycloakBearerToken();
           await refresh();
           return undefined;
         },
@@ -105,8 +127,19 @@ export function AuthProvider({
     refresh().finally(() => {
       if (alive) setIsLoading(false);
     });
+
+    // Re-probe when the app returns to the foreground: covers a completed
+    // ASWebAuthenticationSession whose Linking event arrived after dismiss,
+    // and a user who abandoned the end-session page (local jar already
+    // empty; this just refreshes the header).
+    const onAppState = (next: AppStateStatus) => {
+      if (next === "active") refresh().catch(() => undefined);
+    };
+    const appSub = AppState.addEventListener("change", onAppState);
+
     return () => {
       alive = false;
+      appSub.remove();
     };
   }, [disabled, flow, keycloakConfig]);
 

package/src/session/index.ts

@@ -6,7 +6,7 @@
  * Replaces the previous next-auth/react useSession.
  */
 
-import { isBrowser, isTauri } from "@multiplatform.one/platform";
+import { isBrowser } from "@multiplatform.one/platform";
 import { getAuthClient } from "../betterAuth/client";
 
 export interface Session {
@@ -37,7 +37,7 @@ let useSession = <R extends boolean = false>(
   return { session: null, status: "unauthenticated" };
 };
 
-if (isBrowser && !isTauri) {
+if (isBrowser) {
   useSession = <R extends boolean = false>(
     _options?: Record<string, unknown>,
   ): SessionContextValue<R> => {

package/src/state.ts

@@ -1,7 +1,10 @@
 import { createStore, useStore } from "@multiplatform.one/store";
-import { isBrowser, isIframe, isServer, isTauri } from "@multiplatform.one/platform";
+import { isBrowser, isIframe, isServer } from "@multiplatform.one/platform";
 
-export const persist = isIframe || isTauri || (!isBrowser && !isServer);
+// Browsers keep the session in a Better Auth cookie, so nothing to persist.
+// Everywhere else (iframes fed tokens by a parent, native, and the GNOME/GJS
+// target) the tokens are the only session there is.
+export const persist = isIframe || (!isBrowser && !isServer);
 
 export interface AuthTokenState {
   idToken: string;