@multiplatform.one/keycloak 6.7.0 → 7.1.0

package/dist/cjs/index.cjs

@@ -51,6 +51,7 @@ __export(index_exports, {
   useTokensFromQuery: () => useTokensFromQuery,
   useTokensFromStore: () => useTokensFromStore,
   validOrRefreshableToken: () => validOrRefreshableToken,
+  watchKeycloakBearerTokenRevalidate: () => watchKeycloakBearerTokenRevalidate,
   withAuthenticated: () => withAuthenticated
 });
 module.exports = __toCommonJS(index_exports);
@@ -87,7 +88,7 @@ function useTokensFromQuery() {
 // src/state.ts
 var import_store = require("@multiplatform.one/store");
 var import_platform2 = require("@multiplatform.one/platform");
-var persist = import_platform2.isIframe || import_platform2.isTauri || !import_platform2.isBrowser && !import_platform2.isServer;
+var persist = import_platform2.isIframe || !import_platform2.isBrowser && !import_platform2.isServer;
 var authStore = (0, import_store.createStore)(
   { idToken: "", refreshToken: "", token: "" },
   { name: "auth", persist }
@@ -173,12 +174,122 @@ function getAuthClient(baseURL) {
   return _client;
 }
 
+// src/frappeToken.ts
+var cached;
+var pending;
+var signedOutUntil = 0;
+var unavailableUntil = 0;
+var SIGNED_OUT_COOLDOWN_MS = 15e3;
+var TRANSIENT_COOLDOWN_MS = 3e3;
+var RETRY_DELAYS_MS = [0, 400, 1e3];
+var FAILED_TO_GET_ACCESS_TOKEN = "FAILED_TO_GET_ACCESS_TOKEN";
+function classifyAccessTokenResponse(status, body) {
+  if (status === 401 || status === 403) return "signed-out";
+  if (status === 400 && body?.code === FAILED_TO_GET_ACCESS_TOKEN) return "signed-out";
+  return "transient";
+}
+function notifySessionInvalidated() {
+  try {
+    const client = getAuthClient();
+    client.$store?.notify?.("$sessionSignal");
+  } catch {
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function getKeycloakBearerToken() {
+  if (typeof window === "undefined") return void 0;
+  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
+  if (Date.now() < signedOutUntil) return void 0;
+  if (Date.now() < unavailableUntil) return void 0;
+  if (pending) return pending;
+  pending = fetchToken().finally(() => {
+    pending = void 0;
+  });
+  return pending;
+}
+async function fetchTokenOnce() {
+  try {
+    const res = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ providerId: "keycloak" })
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => null);
+      return { ok: false, kind: classifyAccessTokenResponse(res.status, body) };
+    }
+    const data = await res.json().catch(() => null);
+    if (!data?.accessToken) {
+      return { ok: false, kind: "signed-out" };
+    }
+    return {
+      ok: true,
+      token: data.accessToken,
+      expiresAt: data.accessTokenExpiresAt ? new Date(data.accessTokenExpiresAt).getTime() : Date.now() + 6e4
+    };
+  } catch {
+    return { ok: false, kind: "transient" };
+  }
+}
+async function fetchToken() {
+  let last = "transient";
+  for (let i = 0; i < RETRY_DELAYS_MS.length; i++) {
+    const wait = RETRY_DELAYS_MS[i];
+    if (wait) await sleep(wait);
+    const result = await fetchTokenOnce();
+    if (result.ok) {
+      cached = { token: result.token, expiresAt: result.expiresAt };
+      return result.token;
+    }
+    last = result.kind;
+    if (result.kind === "signed-out") {
+      cached = void 0;
+      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
+      notifySessionInvalidated();
+      return void 0;
+    }
+  }
+  cached = void 0;
+  if (last === "transient") {
+    unavailableUntil = Date.now() + TRANSIENT_COOLDOWN_MS;
+  }
+  return void 0;
+}
+function clearKeycloakBearerToken() {
+  cached = void 0;
+  pending = void 0;
+  signedOutUntil = 0;
+  unavailableUntil = 0;
+}
+function watchKeycloakBearerTokenRevalidate() {
+  if (typeof document === "undefined" || typeof window === "undefined") {
+    return () => {
+    };
+  }
+  const onVisible = () => {
+    if (document.visibilityState !== "visible") return;
+    cached = void 0;
+    signedOutUntil = 0;
+    unavailableUntil = 0;
+    void getKeycloakBearerToken();
+  };
+  document.addEventListener("visibilitychange", onVisible);
+  window.addEventListener("focus", onVisible);
+  return () => {
+    document.removeEventListener("visibilitychange", onVisible);
+    window.removeEventListener("focus", onVisible);
+  };
+}
+
 // src/session/index.ts
 var import_platform4 = require("@multiplatform.one/platform");
 var useSession = (_options) => {
   return { session: null, status: "unauthenticated" };
 };
-if (import_platform4.isBrowser && !import_platform4.isTauri) {
+if (import_platform4.isBrowser) {
   useSession = (_options) => {
     const client = getAuthClient();
     const { data, isPending, error: _error } = client.useSession();
@@ -369,21 +480,29 @@ var Keycloak = class extends BaseKeycloak {
   async logout(options = {}) {
     if (this._keycloakClient) {
       await this._keycloakClient.logout(options);
+    } else if (this._logout) {
+      await this._logout(options);
+    } else if (typeof window !== "undefined" && window.location?.href) {
+      clearKeycloakBearerToken();
+      const origin = window.location.origin;
+      let callbackURL = options.redirectUri || "/";
+      try {
+        const url = new URL(callbackURL, origin);
+        callbackURL = url.origin === origin ? `${url.pathname}${url.search}${url.hash}` || "/" : url.toString();
+      } catch {
+        callbackURL = "/";
+      }
+      window.location.href = `${origin}/api/auth/sign-out/sso?callbackURL=${encodeURIComponent(callbackURL)}`;
+      return;
     } else if (import_platform5.isBrowser && !import_platform5.isServer) {
       const client = getAuthClient();
       await client.signOut({
         fetchOptions: {
           onSuccess: () => {
-            if (options.redirectUri) {
-              if (import_platform5.isWeb) window.location.href = options.redirectUri;
-            } else {
-              if (import_platform5.isWeb) window.location.reload();
-            }
+            if (options.redirectUri && import_platform5.isWeb) window.location.href = options.redirectUri;
           }
         }
       });
-    } else {
-      await this._logout?.(options);
     }
     this._clear();
   }
@@ -497,6 +616,7 @@ function AfterAuth({ children, loadingComponent: _loadingComponent }) {
       import_logger.logger.debug("keycloak disabled");
     }
   }, [authConfig.debug, keycloak]);
+  (0, import_react9.useEffect)(() => watchKeycloakBearerTokenRevalidate(), []);
   return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_jsx_runtime2.Fragment, { children });
 }
 
@@ -894,49 +1014,3 @@ function KeycloakProvider({
     }
   ) });
 }
-
-// src/frappeToken.ts
-var cached;
-var pending;
-var signedOutUntil = 0;
-var SIGNED_OUT_COOLDOWN_MS = 15e3;
-async function getKeycloakBearerToken() {
-  if (typeof window === "undefined") return void 0;
-  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
-  if (Date.now() < signedOutUntil) return void 0;
-  if (pending) return pending;
-  pending = fetchToken().finally(() => {
-    pending = void 0;
-  });
-  return pending;
-}
-async function fetchToken() {
-  try {
-    const res = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
-      method: "POST",
-      credentials: "include",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ providerId: "keycloak" })
-    });
-    if (!res.ok) {
-      cached = void 0;
-      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
-      return void 0;
-    }
-    const data = await res.json().catch(() => null);
-    if (!data?.accessToken) {
-      cached = void 0;
-      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
-      return void 0;
-    }
-    cached = {
-      token: data.accessToken,
-      expiresAt: data.accessTokenExpiresAt ? new Date(data.accessTokenExpiresAt).getTime() : Date.now() + 6e4
-    };
-    return cached.token;
-  } catch {
-    cached = void 0;
-    signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
-    return void 0;
-  }
-}

package/dist/cjs/index.native.cjs

@@ -53,6 +53,7 @@ __export(index_exports, {
   useTokensFromQuery: () => useTokensFromQuery,
   useTokensFromStore: () => useTokensFromStore,
   validOrRefreshableToken: () => validOrRefreshableToken,
+  watchKeycloakBearerTokenRevalidate: () => watchKeycloakBearerTokenRevalidate,
   withAuthenticated: () => withAuthenticated
 });
 module.exports = __toCommonJS(index_exports);
@@ -81,7 +82,7 @@ var useTokensFromQuery = () => false;
 // src/state.ts
 var import_store = require("@multiplatform.one/store");
 var import_platform = require("@multiplatform.one/platform");
-var persist = import_platform.isIframe || import_platform.isTauri || !import_platform.isBrowser && !import_platform.isServer;
+var persist = import_platform.isIframe || !import_platform.isBrowser && !import_platform.isServer;
 var authStore = (0, import_store.createStore)(
   { idToken: "", refreshToken: "", token: "" },
   { name: "auth", persist }
@@ -344,82 +345,19 @@ function withAuthenticated(Component, options = {}) {
 // src/provider/AfterAuth.tsx
 var import_logger = require("@multiplatform.one/logger");
 var import_react8 = require("react");
-var import_jsx_runtime2 = require("react/jsx-runtime");
-function AfterAuth({ children, loadingComponent: _loadingComponent }) {
-  const authConfig = useAuthConfig();
-  const authStore2 = useAuthStore();
-  const keycloak = useKeycloak();
-  (0, import_react8.useEffect)(() => {
-    if (!persist || !keycloak?.authenticated) return;
-    if (keycloak.token) {
-      authStore2.setTokens({
-        token: keycloak.token,
-        ...keycloak.idToken && { idToken: keycloak.idToken },
-        ...keycloak.refreshToken && {
-          refreshToken: keycloak.refreshToken
-        }
-      });
-    }
-  }, [
-    authStore2,
-    persist,
-    keycloak?.authenticated,
-    keycloak?.token,
-    keycloak?.idToken,
-    keycloak?.refreshToken
-  ]);
-  (0, import_react8.useEffect)(() => {
-    if (authConfig.debug && keycloak?.token) {
-      import_logger.logger.debug("token", keycloak.token);
-    }
-  }, [authConfig.debug, keycloak?.token]);
-  (0, import_react8.useEffect)(() => {
-    if (authConfig.debug && keycloak?.idToken) {
-      import_logger.logger.debug("idToken", keycloak.idToken);
-    }
-  }, [authConfig.debug, keycloak?.idToken]);
-  (0, import_react8.useEffect)(() => {
-    if (authConfig.debug && keycloak?.refreshToken) {
-      import_logger.logger.debug("refreshToken", keycloak.refreshToken);
-    }
-  }, [authConfig.debug, keycloak?.refreshToken]);
-  (0, import_react8.useEffect)(() => {
-    if (authConfig.debug && keycloak?.authenticated) {
-      import_logger.logger.debug("authenticated", keycloak.authenticated);
-    }
-  }, [authConfig.debug, keycloak?.authenticated]);
-  (0, import_react8.useEffect)(() => {
-    if (authConfig.debug && keycloak === null) {
-      import_logger.logger.debug("keycloak disabled");
-    }
-  }, [authConfig.debug, keycloak]);
-  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_jsx_runtime2.Fragment, { children });
-}
 
-// src/provider/authProvider/index.native.tsx
-var import_react10 = require("react");
-var Linking2 = __toESM(require("expo-linking"));
-
-// src/Loading.tsx
-var import_react_native2 = require("react-native");
-var import_jsx_runtime3 = require("react/jsx-runtime");
-function Loading({ loadingComponent }) {
-  const { debug } = useAuthConfig();
-  const LoadingComponent = loadingComponent;
-  if (typeof LoadingComponent === "undefined") {
-    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_react_native2.View, { style: { flex: 1, alignItems: "center", justifyContent: "center" }, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_react_native2.ActivityIndicator, {}),
-      debug ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_react_native2.Text, { children: "loading" }) : null
-    ] });
-  }
-  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(LoadingComponent, {});
-}
+// src/frappeToken.native.ts
+var import_react_native3 = require("react-native");
 
 // src/betterAuth/expoAuthFlow.native.ts
-var import_react_native3 = require("react-native");
+var import_react_native2 = require("react-native");
 var Linking = __toESM(require("expo-linking"));
 var SecureStore = __toESM(require("expo-secure-store"));
 var WebBrowser = __toESM(require("expo-web-browser"));
+try {
+  WebBrowser.maybeCompleteAuthSession?.();
+} catch {
+}
 var COOKIE_KEY = "better-auth_cookie";
 var SECURE_COOKIE_PREFIX = "__Secure-";
 function readJar() {
@@ -479,6 +417,78 @@ function getOAuthState() {
   }
   return null;
 }
+function rewriteLoopbackHostForNative(configured) {
+  const deviceHost = import_react_native2.Platform.OS === "android" ? "10.0.2.2" : "127.0.0.1";
+  return configured.replace(/^(https?:\/\/)(localhost|127\.0\.0\.1)(?=[:/]|$)/i, `$1${deviceHost}`);
+}
+function normalizeForReturnMatch(url) {
+  return url.split("?")[0].split("#")[0].replace(/:\/{2,}/, "://").replace(/\/+$/, "");
+}
+function ensureReturnUrlAuthority(url, segment) {
+  return url.replace(/^([a-z0-9.+-]+:)\/{2,3}(?=\?|#|$)/i, `$1//${segment}`);
+}
+function extractCookieFromReturnUrl(returnUrl) {
+  const q = returnUrl.indexOf("?");
+  if (q === -1) return null;
+  const query = returnUrl.slice(q + 1).split("#")[0];
+  for (const part of query.split("&")) {
+    const eq = part.indexOf("=");
+    const key = eq === -1 ? part : part.slice(0, eq);
+    let decodedKey;
+    try {
+      decodedKey = decodeURIComponent(key.replace(/\+/g, " "));
+    } catch {
+      decodedKey = key;
+    }
+    if (decodedKey !== "cookie") continue;
+    const raw = eq === -1 ? "" : part.slice(eq + 1);
+    try {
+      return decodeURIComponent(raw.replace(/\+/g, " "));
+    } catch {
+      return raw;
+    }
+  }
+  return null;
+}
+async function openAuthBrowser(url, returnUrlBase, options) {
+  const returnBase = normalizeForReturnMatch(returnUrlBase);
+  let returned;
+  const linkSub = Linking.addEventListener("url", ({ url: next }) => {
+    if (!next || returned) return;
+    if (!normalizeForReturnMatch(next).startsWith(returnBase)) return;
+    returned = next;
+    try {
+      WebBrowser.dismissAuthSession();
+    } catch {
+    }
+  });
+  const timer = options?.timeoutMs ? setTimeout(() => {
+    if (returned) return;
+    returned = "";
+    try {
+      WebBrowser.dismissAuthSession();
+    } catch {
+    }
+  }, options.timeoutMs) : void 0;
+  try {
+    const result = await WebBrowser.openAuthSessionAsync(url, returnUrlBase, {
+      preferEphemeralSession: false
+    });
+    if (!returned && result.type === "success" && "url" in result && result.url) {
+      returned = result.url;
+    }
+    if (!returned) {
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    return returned || void 0;
+  } finally {
+    if (timer) clearTimeout(timer);
+    try {
+      linkSub.remove();
+    } catch {
+    }
+  }
+}
 var activeFlow = null;
 function getActiveExpoAuthFlow() {
   return activeFlow;
@@ -520,45 +530,32 @@ function createExpoAuthFlow(baseURL, scheme) {
       if (oauthState) params.append("oauthState", oauthState);
       const proxyURL = `${base}/api/auth/expo-authorization-proxy?${params.toString()}`;
       const toBase = to.split("?")[0];
-      let returnUrl;
-      if (import_react_native3.Platform.OS === "ios") {
-        returnUrl = await new Promise((resolve, reject) => {
-          let settled = false;
-          const linkSub = Linking.addEventListener("url", ({ url }) => {
-            if (settled || !url || !url.startsWith(toBase)) return;
-            settled = true;
-            try {
-              linkSub.remove();
-            } catch {
-            }
-            resolve(url);
-          });
-          Linking.openURL(proxyURL).catch((e) => {
-            if (settled) return;
-            settled = true;
-            try {
-              linkSub.remove();
-            } catch {
-            }
-            reject(e instanceof Error ? e : new Error(`sign-in openURL failed: ${e}`));
-          });
-        });
-      } else {
-        const result = await WebBrowser.openAuthSessionAsync(proxyURL, toBase, {
-          preferEphemeralSession: false
-          // keep the SSO + siww nonce cookie across the wallet bounce
-        });
-        returnUrl = result.type === "success" && "url" in result ? result.url : void 0;
-      }
+      const returnUrl = await openAuthBrowser(proxyURL, toBase);
       if (!returnUrl) {
         return;
       }
-      const cookie = new URL(returnUrl).searchParams.get("cookie");
+      const cookie = extractCookieFromReturnUrl(returnUrl);
       if (cookie) absorbSetCookie(cookie);
     },
-    async signOut() {
+    async signOut(postLogoutRedirectUri) {
+      const to = ensureReturnUrlAuthority(
+        postLogoutRedirectUri || Linking.createURL("/"),
+        "signed-out"
+      );
       try {
-        await authFetch("/sign-out", { method: "POST", body: "{}" });
+        const res = await authFetch(
+          `/sign-out/sso?mode=json&callbackURL=${encodeURIComponent(to)}`,
+          { method: "GET" }
+        );
+        if (!res.ok) throw new Error(`sign-out/sso failed (${res.status})`);
+        const data = await res.json().catch(() => null);
+        if (data?.redirect && data.url) {
+          await openAuthBrowser(data.url, to.split("?")[0], { timeoutMs: 12e4 }).catch(
+            () => void 0
+          );
+        }
+      } catch {
+        await authFetch("/sign-out", { method: "POST", body: "{}" }).catch(() => void 0);
       } finally {
         writeJar({});
       }
@@ -582,6 +579,131 @@ function createExpoAuthFlow(baseURL, scheme) {
   return flow;
 }
 
+// src/frappeToken.native.ts
+var cached;
+var pending;
+var signedOutUntil = 0;
+var SIGNED_OUT_COOLDOWN_MS = 15e3;
+async function getKeycloakBearerToken() {
+  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
+  if (Date.now() < signedOutUntil) return void 0;
+  if (pending) return pending;
+  pending = fetchToken().finally(() => {
+    pending = void 0;
+  });
+  return pending;
+}
+async function fetchToken() {
+  const flow = getActiveExpoAuthFlow();
+  if (!flow) return void 0;
+  try {
+    const res = await flow.getAccessToken("keycloak");
+    if (!res?.accessToken) {
+      cached = void 0;
+      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
+      return void 0;
+    }
+    cached = {
+      token: res.accessToken,
+      expiresAt: res.accessTokenExpiresAt ? new Date(res.accessTokenExpiresAt).getTime() : Date.now() + 6e4
+    };
+    return cached.token;
+  } catch {
+    cached = void 0;
+    signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
+    return void 0;
+  }
+}
+function clearKeycloakBearerToken() {
+  cached = void 0;
+  pending = void 0;
+  signedOutUntil = 0;
+}
+function watchKeycloakBearerTokenRevalidate() {
+  const onChange = (next) => {
+    if (next !== "active") return;
+    cached = void 0;
+    signedOutUntil = 0;
+    void getKeycloakBearerToken();
+  };
+  const sub = import_react_native3.AppState.addEventListener("change", onChange);
+  return () => sub.remove();
+}
+
+// src/provider/AfterAuth.tsx
+var import_jsx_runtime2 = require("react/jsx-runtime");
+function AfterAuth({ children, loadingComponent: _loadingComponent }) {
+  const authConfig = useAuthConfig();
+  const authStore2 = useAuthStore();
+  const keycloak = useKeycloak();
+  (0, import_react8.useEffect)(() => {
+    if (!persist || !keycloak?.authenticated) return;
+    if (keycloak.token) {
+      authStore2.setTokens({
+        token: keycloak.token,
+        ...keycloak.idToken && { idToken: keycloak.idToken },
+        ...keycloak.refreshToken && {
+          refreshToken: keycloak.refreshToken
+        }
+      });
+    }
+  }, [
+    authStore2,
+    persist,
+    keycloak?.authenticated,
+    keycloak?.token,
+    keycloak?.idToken,
+    keycloak?.refreshToken
+  ]);
+  (0, import_react8.useEffect)(() => {
+    if (authConfig.debug && keycloak?.token) {
+      import_logger.logger.debug("token", keycloak.token);
+    }
+  }, [authConfig.debug, keycloak?.token]);
+  (0, import_react8.useEffect)(() => {
+    if (authConfig.debug && keycloak?.idToken) {
+      import_logger.logger.debug("idToken", keycloak.idToken);
+    }
+  }, [authConfig.debug, keycloak?.idToken]);
+  (0, import_react8.useEffect)(() => {
+    if (authConfig.debug && keycloak?.refreshToken) {
+      import_logger.logger.debug("refreshToken", keycloak.refreshToken);
+    }
+  }, [authConfig.debug, keycloak?.refreshToken]);
+  (0, import_react8.useEffect)(() => {
+    if (authConfig.debug && keycloak?.authenticated) {
+      import_logger.logger.debug("authenticated", keycloak.authenticated);
+    }
+  }, [authConfig.debug, keycloak?.authenticated]);
+  (0, import_react8.useEffect)(() => {
+    if (authConfig.debug && keycloak === null) {
+      import_logger.logger.debug("keycloak disabled");
+    }
+  }, [authConfig.debug, keycloak]);
+  (0, import_react8.useEffect)(() => watchKeycloakBearerTokenRevalidate(), []);
+  return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_jsx_runtime2.Fragment, { children });
+}
+
+// src/provider/authProvider/index.native.tsx
+var import_react10 = require("react");
+var import_react_native5 = require("react-native");
+var Linking2 = __toESM(require("expo-linking"));
+
+// src/Loading.tsx
+var import_react_native4 = require("react-native");
+var import_jsx_runtime3 = require("react/jsx-runtime");
+function Loading({ loadingComponent }) {
+  const { debug } = useAuthConfig();
+  const LoadingComponent = loadingComponent;
+  if (typeof LoadingComponent === "undefined") {
+    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_react_native4.View, { style: { flex: 1, alignItems: "center", justifyContent: "center" }, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_react_native4.ActivityIndicator, {}),
+      debug ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_react_native4.Text, { children: "loading" }) : null
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(LoadingComponent, {});
+}
+
 // src/session/index.native.ts
 var import_react9 = require("react");
 var state = { session: null, status: "loading" };
@@ -619,7 +741,9 @@ function AuthProvider({
   const [keycloak, setKeycloak] = (0, import_react10.useState)();
   const [isLoading, setIsLoading] = (0, import_react10.useState)(true);
   const serverBaseUrl = (0, import_react10.useMemo)(() => {
-    return keycloakConfig.betterAuthBaseUrl || "http://localhost:8000";
+    return rewriteLoopbackHostForNative(
+      keycloakConfig.betterAuthBaseUrl || "http://localhost:8000"
+    );
   }, [keycloakConfig]);
   const scheme = (0, import_react10.useMemo)(() => keycloakConfig.expoScheme, [keycloakConfig]);
   const flow = (0, import_react10.useMemo)(
@@ -646,11 +770,14 @@ function AuthProvider({
         void 0,
         async (options) => {
           await flow.signIn("keycloak", options.redirectUri || Linking2.createURL("/"));
+          clearKeycloakBearerToken();
           await refresh();
           return void 0;
         },
-        async (_options) => {
-          await flow.signOut();
+        async (options) => {
+          const redirectUri = options.redirectUri && options.redirectUri.includes("://") ? options.redirectUri : Linking2.createURL("/");
+          await flow.signOut(redirectUri);
+          clearKeycloakBearerToken();
           await refresh();
           return void 0;
         }
@@ -676,8 +803,13 @@ function AuthProvider({
     refresh().finally(() => {
       if (alive) setIsLoading(false);
     });
+    const onAppState = (next) => {
+      if (next === "active") refresh().catch(() => void 0);
+    };
+    const appSub = import_react_native5.AppState.addEventListener("change", onAppState);
     return () => {
       alive = false;
+      appSub.remove();
     };
   }, [disabled, flow, keycloakConfig]);
   if (disabled) return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_jsx_runtime4.Fragment, { children });
@@ -723,26 +855,3 @@ function KeycloakProvider({
     }
   ) });
 }
-
-// src/frappeToken.native.ts
-var cached;
-async function getKeycloakBearerToken() {
-  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
-  const flow = getActiveExpoAuthFlow();
-  if (!flow) return void 0;
-  try {
-    const res = await flow.getAccessToken("keycloak");
-    if (!res?.accessToken) {
-      cached = void 0;
-      return void 0;
-    }
-    cached = {
-      token: res.accessToken,
-      expiresAt: res.accessTokenExpiresAt ? new Date(res.accessTokenExpiresAt).getTime() : Date.now() + 6e4
-    };
-    return cached.token;
-  } catch {
-    cached = void 0;
-    return void 0;
-  }
-}