@multiplatform.one/keycloak 6.7.0 → 7.1.0

package/dist/esm/index.js

@@ -29,8 +29,8 @@ function useTokensFromQuery() {
 
 // src/state.ts
 import { createStore, useStore } from "@multiplatform.one/store";
-import { isBrowser, isIframe as isIframe2, isServer, isTauri } from "@multiplatform.one/platform";
-var persist = isIframe2 || isTauri || !isBrowser && !isServer;
+import { isBrowser, isIframe as isIframe2, isServer } from "@multiplatform.one/platform";
+var persist = isIframe2 || !isBrowser && !isServer;
 var authStore = createStore(
   { idToken: "", refreshToken: "", token: "" },
   { name: "auth", persist }
@@ -116,12 +116,122 @@ function getAuthClient(baseURL) {
   return _client;
 }
 
+// src/frappeToken.ts
+var cached;
+var pending;
+var signedOutUntil = 0;
+var unavailableUntil = 0;
+var SIGNED_OUT_COOLDOWN_MS = 15e3;
+var TRANSIENT_COOLDOWN_MS = 3e3;
+var RETRY_DELAYS_MS = [0, 400, 1e3];
+var FAILED_TO_GET_ACCESS_TOKEN = "FAILED_TO_GET_ACCESS_TOKEN";
+function classifyAccessTokenResponse(status, body) {
+  if (status === 401 || status === 403) return "signed-out";
+  if (status === 400 && body?.code === FAILED_TO_GET_ACCESS_TOKEN) return "signed-out";
+  return "transient";
+}
+function notifySessionInvalidated() {
+  try {
+    const client = getAuthClient();
+    client.$store?.notify?.("$sessionSignal");
+  } catch {
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function getKeycloakBearerToken() {
+  if (typeof window === "undefined") return void 0;
+  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
+  if (Date.now() < signedOutUntil) return void 0;
+  if (Date.now() < unavailableUntil) return void 0;
+  if (pending) return pending;
+  pending = fetchToken().finally(() => {
+    pending = void 0;
+  });
+  return pending;
+}
+async function fetchTokenOnce() {
+  try {
+    const res = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ providerId: "keycloak" })
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => null);
+      return { ok: false, kind: classifyAccessTokenResponse(res.status, body) };
+    }
+    const data = await res.json().catch(() => null);
+    if (!data?.accessToken) {
+      return { ok: false, kind: "signed-out" };
+    }
+    return {
+      ok: true,
+      token: data.accessToken,
+      expiresAt: data.accessTokenExpiresAt ? new Date(data.accessTokenExpiresAt).getTime() : Date.now() + 6e4
+    };
+  } catch {
+    return { ok: false, kind: "transient" };
+  }
+}
+async function fetchToken() {
+  let last = "transient";
+  for (let i = 0; i < RETRY_DELAYS_MS.length; i++) {
+    const wait = RETRY_DELAYS_MS[i];
+    if (wait) await sleep(wait);
+    const result = await fetchTokenOnce();
+    if (result.ok) {
+      cached = { token: result.token, expiresAt: result.expiresAt };
+      return result.token;
+    }
+    last = result.kind;
+    if (result.kind === "signed-out") {
+      cached = void 0;
+      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
+      notifySessionInvalidated();
+      return void 0;
+    }
+  }
+  cached = void 0;
+  if (last === "transient") {
+    unavailableUntil = Date.now() + TRANSIENT_COOLDOWN_MS;
+  }
+  return void 0;
+}
+function clearKeycloakBearerToken() {
+  cached = void 0;
+  pending = void 0;
+  signedOutUntil = 0;
+  unavailableUntil = 0;
+}
+function watchKeycloakBearerTokenRevalidate() {
+  if (typeof document === "undefined" || typeof window === "undefined") {
+    return () => {
+    };
+  }
+  const onVisible = () => {
+    if (document.visibilityState !== "visible") return;
+    cached = void 0;
+    signedOutUntil = 0;
+    unavailableUntil = 0;
+    void getKeycloakBearerToken();
+  };
+  document.addEventListener("visibilitychange", onVisible);
+  window.addEventListener("focus", onVisible);
+  return () => {
+    document.removeEventListener("visibilitychange", onVisible);
+    window.removeEventListener("focus", onVisible);
+  };
+}
+
 // src/session/index.ts
-import { isBrowser as isBrowser2, isTauri as isTauri2 } from "@multiplatform.one/platform";
+import { isBrowser as isBrowser2 } from "@multiplatform.one/platform";
 var useSession = (_options) => {
   return { session: null, status: "unauthenticated" };
 };
-if (isBrowser2 && !isTauri2) {
+if (isBrowser2) {
   useSession = (_options) => {
     const client = getAuthClient();
     const { data, isPending, error: _error } = client.useSession();
@@ -312,21 +422,29 @@ var Keycloak = class extends BaseKeycloak {
   async logout(options = {}) {
     if (this._keycloakClient) {
       await this._keycloakClient.logout(options);
+    } else if (this._logout) {
+      await this._logout(options);
+    } else if (typeof window !== "undefined" && window.location?.href) {
+      clearKeycloakBearerToken();
+      const origin = window.location.origin;
+      let callbackURL = options.redirectUri || "/";
+      try {
+        const url = new URL(callbackURL, origin);
+        callbackURL = url.origin === origin ? `${url.pathname}${url.search}${url.hash}` || "/" : url.toString();
+      } catch {
+        callbackURL = "/";
+      }
+      window.location.href = `${origin}/api/auth/sign-out/sso?callbackURL=${encodeURIComponent(callbackURL)}`;
+      return;
     } else if (isBrowser3 && !isServer2) {
       const client = getAuthClient();
       await client.signOut({
         fetchOptions: {
           onSuccess: () => {
-            if (options.redirectUri) {
-              if (isWeb2) window.location.href = options.redirectUri;
-            } else {
-              if (isWeb2) window.location.reload();
-            }
+            if (options.redirectUri && isWeb2) window.location.href = options.redirectUri;
           }
         }
       });
-    } else {
-      await this._logout?.(options);
     }
     this._clear();
   }
@@ -440,6 +558,7 @@ function AfterAuth({ children, loadingComponent: _loadingComponent }) {
       logger.debug("keycloak disabled");
     }
   }, [authConfig.debug, keycloak]);
+  useEffect2(() => watchKeycloakBearerTokenRevalidate(), []);
   return /* @__PURE__ */ jsx2(Fragment2, { children });
 }
 
@@ -837,52 +956,6 @@ function KeycloakProvider({
     }
   ) });
 }
-
-// src/frappeToken.ts
-var cached;
-var pending;
-var signedOutUntil = 0;
-var SIGNED_OUT_COOLDOWN_MS = 15e3;
-async function getKeycloakBearerToken() {
-  if (typeof window === "undefined") return void 0;
-  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
-  if (Date.now() < signedOutUntil) return void 0;
-  if (pending) return pending;
-  pending = fetchToken().finally(() => {
-    pending = void 0;
-  });
-  return pending;
-}
-async function fetchToken() {
-  try {
-    const res = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
-      method: "POST",
-      credentials: "include",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ providerId: "keycloak" })
-    });
-    if (!res.ok) {
-      cached = void 0;
-      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
-      return void 0;
-    }
-    const data = await res.json().catch(() => null);
-    if (!data?.accessToken) {
-      cached = void 0;
-      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
-      return void 0;
-    }
-    cached = {
-      token: data.accessToken,
-      expiresAt: data.accessTokenExpiresAt ? new Date(data.accessTokenExpiresAt).getTime() : Date.now() + 6e4
-    };
-    return cached.token;
-  } catch {
-    cached = void 0;
-    signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
-    return void 0;
-  }
-}
 export {
   AfterAuth,
   AuthConfigContext,
@@ -905,5 +978,6 @@ export {
   useTokensFromQuery,
   useTokensFromStore,
   validOrRefreshableToken,
+  watchKeycloakBearerTokenRevalidate,
   withAuthenticated
 };

package/dist/esm/index.native.js

@@ -21,8 +21,8 @@ var useTokensFromQuery = () => false;
 
 // src/state.ts
 import { createStore, useStore } from "@multiplatform.one/store";
-import { isBrowser, isIframe, isServer, isTauri } from "@multiplatform.one/platform";
-var persist = isIframe || isTauri || !isBrowser && !isServer;
+import { isBrowser, isIframe, isServer } from "@multiplatform.one/platform";
+var persist = isIframe || !isBrowser && !isServer;
 var authStore = createStore(
   { idToken: "", refreshToken: "", token: "" },
   { name: "auth", persist }
@@ -285,82 +285,19 @@ function withAuthenticated(Component, options = {}) {
 // src/provider/AfterAuth.tsx
 import { logger } from "@multiplatform.one/logger";
 import { useEffect as useEffect2 } from "react";
-import { Fragment as Fragment2, jsx as jsx2 } from "react/jsx-runtime";
-function AfterAuth({ children, loadingComponent: _loadingComponent }) {
-  const authConfig = useAuthConfig();
-  const authStore2 = useAuthStore();
-  const keycloak = useKeycloak();
-  useEffect2(() => {
-    if (!persist || !keycloak?.authenticated) return;
-    if (keycloak.token) {
-      authStore2.setTokens({
-        token: keycloak.token,
-        ...keycloak.idToken && { idToken: keycloak.idToken },
-        ...keycloak.refreshToken && {
-          refreshToken: keycloak.refreshToken
-        }
-      });
-    }
-  }, [
-    authStore2,
-    persist,
-    keycloak?.authenticated,
-    keycloak?.token,
-    keycloak?.idToken,
-    keycloak?.refreshToken
-  ]);
-  useEffect2(() => {
-    if (authConfig.debug && keycloak?.token) {
-      logger.debug("token", keycloak.token);
-    }
-  }, [authConfig.debug, keycloak?.token]);
-  useEffect2(() => {
-    if (authConfig.debug && keycloak?.idToken) {
-      logger.debug("idToken", keycloak.idToken);
-    }
-  }, [authConfig.debug, keycloak?.idToken]);
-  useEffect2(() => {
-    if (authConfig.debug && keycloak?.refreshToken) {
-      logger.debug("refreshToken", keycloak.refreshToken);
-    }
-  }, [authConfig.debug, keycloak?.refreshToken]);
-  useEffect2(() => {
-    if (authConfig.debug && keycloak?.authenticated) {
-      logger.debug("authenticated", keycloak.authenticated);
-    }
-  }, [authConfig.debug, keycloak?.authenticated]);
-  useEffect2(() => {
-    if (authConfig.debug && keycloak === null) {
-      logger.debug("keycloak disabled");
-    }
-  }, [authConfig.debug, keycloak]);
-  return /* @__PURE__ */ jsx2(Fragment2, { children });
-}
-
-// src/provider/authProvider/index.native.tsx
-import { useEffect as useEffect3, useMemo, useState } from "react";
-import * as Linking2 from "expo-linking";
 
-// src/Loading.tsx
-import { ActivityIndicator, Text as Text2, View } from "react-native";
-import { jsx as jsx3, jsxs } from "react/jsx-runtime";
-function Loading({ loadingComponent }) {
-  const { debug } = useAuthConfig();
-  const LoadingComponent = loadingComponent;
-  if (typeof LoadingComponent === "undefined") {
-    return /* @__PURE__ */ jsxs(View, { style: { flex: 1, alignItems: "center", justifyContent: "center" }, children: [
-      /* @__PURE__ */ jsx3(ActivityIndicator, {}),
-      debug ? /* @__PURE__ */ jsx3(Text2, { children: "loading" }) : null
-    ] });
-  }
-  return /* @__PURE__ */ jsx3(LoadingComponent, {});
-}
+// src/frappeToken.native.ts
+import { AppState } from "react-native";
 
 // src/betterAuth/expoAuthFlow.native.ts
 import { Platform } from "react-native";
 import * as Linking from "expo-linking";
 import * as SecureStore from "expo-secure-store";
 import * as WebBrowser from "expo-web-browser";
+try {
+  WebBrowser.maybeCompleteAuthSession?.();
+} catch {
+}
 var COOKIE_KEY = "better-auth_cookie";
 var SECURE_COOKIE_PREFIX = "__Secure-";
 function readJar() {
@@ -420,6 +357,78 @@ function getOAuthState() {
   }
   return null;
 }
+function rewriteLoopbackHostForNative(configured) {
+  const deviceHost = Platform.OS === "android" ? "10.0.2.2" : "127.0.0.1";
+  return configured.replace(/^(https?:\/\/)(localhost|127\.0\.0\.1)(?=[:/]|$)/i, `$1${deviceHost}`);
+}
+function normalizeForReturnMatch(url) {
+  return url.split("?")[0].split("#")[0].replace(/:\/{2,}/, "://").replace(/\/+$/, "");
+}
+function ensureReturnUrlAuthority(url, segment) {
+  return url.replace(/^([a-z0-9.+-]+:)\/{2,3}(?=\?|#|$)/i, `$1//${segment}`);
+}
+function extractCookieFromReturnUrl(returnUrl) {
+  const q = returnUrl.indexOf("?");
+  if (q === -1) return null;
+  const query = returnUrl.slice(q + 1).split("#")[0];
+  for (const part of query.split("&")) {
+    const eq = part.indexOf("=");
+    const key = eq === -1 ? part : part.slice(0, eq);
+    let decodedKey;
+    try {
+      decodedKey = decodeURIComponent(key.replace(/\+/g, " "));
+    } catch {
+      decodedKey = key;
+    }
+    if (decodedKey !== "cookie") continue;
+    const raw = eq === -1 ? "" : part.slice(eq + 1);
+    try {
+      return decodeURIComponent(raw.replace(/\+/g, " "));
+    } catch {
+      return raw;
+    }
+  }
+  return null;
+}
+async function openAuthBrowser(url, returnUrlBase, options) {
+  const returnBase = normalizeForReturnMatch(returnUrlBase);
+  let returned;
+  const linkSub = Linking.addEventListener("url", ({ url: next }) => {
+    if (!next || returned) return;
+    if (!normalizeForReturnMatch(next).startsWith(returnBase)) return;
+    returned = next;
+    try {
+      WebBrowser.dismissAuthSession();
+    } catch {
+    }
+  });
+  const timer = options?.timeoutMs ? setTimeout(() => {
+    if (returned) return;
+    returned = "";
+    try {
+      WebBrowser.dismissAuthSession();
+    } catch {
+    }
+  }, options.timeoutMs) : void 0;
+  try {
+    const result = await WebBrowser.openAuthSessionAsync(url, returnUrlBase, {
+      preferEphemeralSession: false
+    });
+    if (!returned && result.type === "success" && "url" in result && result.url) {
+      returned = result.url;
+    }
+    if (!returned) {
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    return returned || void 0;
+  } finally {
+    if (timer) clearTimeout(timer);
+    try {
+      linkSub.remove();
+    } catch {
+    }
+  }
+}
 var activeFlow = null;
 function getActiveExpoAuthFlow() {
   return activeFlow;
@@ -461,45 +470,32 @@ function createExpoAuthFlow(baseURL, scheme) {
       if (oauthState) params.append("oauthState", oauthState);
       const proxyURL = `${base}/api/auth/expo-authorization-proxy?${params.toString()}`;
       const toBase = to.split("?")[0];
-      let returnUrl;
-      if (Platform.OS === "ios") {
-        returnUrl = await new Promise((resolve, reject) => {
-          let settled = false;
-          const linkSub = Linking.addEventListener("url", ({ url }) => {
-            if (settled || !url || !url.startsWith(toBase)) return;
-            settled = true;
-            try {
-              linkSub.remove();
-            } catch {
-            }
-            resolve(url);
-          });
-          Linking.openURL(proxyURL).catch((e) => {
-            if (settled) return;
-            settled = true;
-            try {
-              linkSub.remove();
-            } catch {
-            }
-            reject(e instanceof Error ? e : new Error(`sign-in openURL failed: ${e}`));
-          });
-        });
-      } else {
-        const result = await WebBrowser.openAuthSessionAsync(proxyURL, toBase, {
-          preferEphemeralSession: false
-          // keep the SSO + siww nonce cookie across the wallet bounce
-        });
-        returnUrl = result.type === "success" && "url" in result ? result.url : void 0;
-      }
+      const returnUrl = await openAuthBrowser(proxyURL, toBase);
       if (!returnUrl) {
         return;
       }
-      const cookie = new URL(returnUrl).searchParams.get("cookie");
+      const cookie = extractCookieFromReturnUrl(returnUrl);
       if (cookie) absorbSetCookie(cookie);
     },
-    async signOut() {
+    async signOut(postLogoutRedirectUri) {
+      const to = ensureReturnUrlAuthority(
+        postLogoutRedirectUri || Linking.createURL("/"),
+        "signed-out"
+      );
       try {
-        await authFetch("/sign-out", { method: "POST", body: "{}" });
+        const res = await authFetch(
+          `/sign-out/sso?mode=json&callbackURL=${encodeURIComponent(to)}`,
+          { method: "GET" }
+        );
+        if (!res.ok) throw new Error(`sign-out/sso failed (${res.status})`);
+        const data = await res.json().catch(() => null);
+        if (data?.redirect && data.url) {
+          await openAuthBrowser(data.url, to.split("?")[0], { timeoutMs: 12e4 }).catch(
+            () => void 0
+          );
+        }
+      } catch {
+        await authFetch("/sign-out", { method: "POST", body: "{}" }).catch(() => void 0);
       } finally {
         writeJar({});
       }
@@ -523,6 +519,131 @@ function createExpoAuthFlow(baseURL, scheme) {
   return flow;
 }
 
+// src/frappeToken.native.ts
+var cached;
+var pending;
+var signedOutUntil = 0;
+var SIGNED_OUT_COOLDOWN_MS = 15e3;
+async function getKeycloakBearerToken() {
+  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
+  if (Date.now() < signedOutUntil) return void 0;
+  if (pending) return pending;
+  pending = fetchToken().finally(() => {
+    pending = void 0;
+  });
+  return pending;
+}
+async function fetchToken() {
+  const flow = getActiveExpoAuthFlow();
+  if (!flow) return void 0;
+  try {
+    const res = await flow.getAccessToken("keycloak");
+    if (!res?.accessToken) {
+      cached = void 0;
+      signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
+      return void 0;
+    }
+    cached = {
+      token: res.accessToken,
+      expiresAt: res.accessTokenExpiresAt ? new Date(res.accessTokenExpiresAt).getTime() : Date.now() + 6e4
+    };
+    return cached.token;
+  } catch {
+    cached = void 0;
+    signedOutUntil = Date.now() + SIGNED_OUT_COOLDOWN_MS;
+    return void 0;
+  }
+}
+function clearKeycloakBearerToken() {
+  cached = void 0;
+  pending = void 0;
+  signedOutUntil = 0;
+}
+function watchKeycloakBearerTokenRevalidate() {
+  const onChange = (next) => {
+    if (next !== "active") return;
+    cached = void 0;
+    signedOutUntil = 0;
+    void getKeycloakBearerToken();
+  };
+  const sub = AppState.addEventListener("change", onChange);
+  return () => sub.remove();
+}
+
+// src/provider/AfterAuth.tsx
+import { Fragment as Fragment2, jsx as jsx2 } from "react/jsx-runtime";
+function AfterAuth({ children, loadingComponent: _loadingComponent }) {
+  const authConfig = useAuthConfig();
+  const authStore2 = useAuthStore();
+  const keycloak = useKeycloak();
+  useEffect2(() => {
+    if (!persist || !keycloak?.authenticated) return;
+    if (keycloak.token) {
+      authStore2.setTokens({
+        token: keycloak.token,
+        ...keycloak.idToken && { idToken: keycloak.idToken },
+        ...keycloak.refreshToken && {
+          refreshToken: keycloak.refreshToken
+        }
+      });
+    }
+  }, [
+    authStore2,
+    persist,
+    keycloak?.authenticated,
+    keycloak?.token,
+    keycloak?.idToken,
+    keycloak?.refreshToken
+  ]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.token) {
+      logger.debug("token", keycloak.token);
+    }
+  }, [authConfig.debug, keycloak?.token]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.idToken) {
+      logger.debug("idToken", keycloak.idToken);
+    }
+  }, [authConfig.debug, keycloak?.idToken]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.refreshToken) {
+      logger.debug("refreshToken", keycloak.refreshToken);
+    }
+  }, [authConfig.debug, keycloak?.refreshToken]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak?.authenticated) {
+      logger.debug("authenticated", keycloak.authenticated);
+    }
+  }, [authConfig.debug, keycloak?.authenticated]);
+  useEffect2(() => {
+    if (authConfig.debug && keycloak === null) {
+      logger.debug("keycloak disabled");
+    }
+  }, [authConfig.debug, keycloak]);
+  useEffect2(() => watchKeycloakBearerTokenRevalidate(), []);
+  return /* @__PURE__ */ jsx2(Fragment2, { children });
+}
+
+// src/provider/authProvider/index.native.tsx
+import { useEffect as useEffect3, useMemo, useState } from "react";
+import { AppState as AppState2 } from "react-native";
+import * as Linking2 from "expo-linking";
+
+// src/Loading.tsx
+import { ActivityIndicator, Text as Text2, View } from "react-native";
+import { jsx as jsx3, jsxs } from "react/jsx-runtime";
+function Loading({ loadingComponent }) {
+  const { debug } = useAuthConfig();
+  const LoadingComponent = loadingComponent;
+  if (typeof LoadingComponent === "undefined") {
+    return /* @__PURE__ */ jsxs(View, { style: { flex: 1, alignItems: "center", justifyContent: "center" }, children: [
+      /* @__PURE__ */ jsx3(ActivityIndicator, {}),
+      debug ? /* @__PURE__ */ jsx3(Text2, { children: "loading" }) : null
+    ] });
+  }
+  return /* @__PURE__ */ jsx3(LoadingComponent, {});
+}
+
 // src/session/index.native.ts
 import { useSyncExternalStore } from "react";
 var state = { session: null, status: "loading" };
@@ -560,7 +681,9 @@ function AuthProvider({
   const [keycloak, setKeycloak] = useState();
   const [isLoading, setIsLoading] = useState(true);
   const serverBaseUrl = useMemo(() => {
-    return keycloakConfig.betterAuthBaseUrl || "http://localhost:8000";
+    return rewriteLoopbackHostForNative(
+      keycloakConfig.betterAuthBaseUrl || "http://localhost:8000"
+    );
   }, [keycloakConfig]);
   const scheme = useMemo(() => keycloakConfig.expoScheme, [keycloakConfig]);
   const flow = useMemo(
@@ -587,11 +710,14 @@ function AuthProvider({
         void 0,
         async (options) => {
           await flow.signIn("keycloak", options.redirectUri || Linking2.createURL("/"));
+          clearKeycloakBearerToken();
           await refresh();
           return void 0;
         },
-        async (_options) => {
-          await flow.signOut();
+        async (options) => {
+          const redirectUri = options.redirectUri && options.redirectUri.includes("://") ? options.redirectUri : Linking2.createURL("/");
+          await flow.signOut(redirectUri);
+          clearKeycloakBearerToken();
           await refresh();
           return void 0;
         }
@@ -617,8 +743,13 @@ function AuthProvider({
     refresh().finally(() => {
       if (alive) setIsLoading(false);
     });
+    const onAppState = (next) => {
+      if (next === "active") refresh().catch(() => void 0);
+    };
+    const appSub = AppState2.addEventListener("change", onAppState);
     return () => {
       alive = false;
+      appSub.remove();
     };
   }, [disabled, flow, keycloakConfig]);
   if (disabled) return /* @__PURE__ */ jsx4(Fragment3, { children });
@@ -664,29 +795,6 @@ function KeycloakProvider({
     }
   ) });
 }
-
-// src/frappeToken.native.ts
-var cached;
-async function getKeycloakBearerToken() {
-  if (cached && cached.expiresAt - 6e4 > Date.now()) return cached.token;
-  const flow = getActiveExpoAuthFlow();
-  if (!flow) return void 0;
-  try {
-    const res = await flow.getAccessToken("keycloak");
-    if (!res?.accessToken) {
-      cached = void 0;
-      return void 0;
-    }
-    cached = {
-      token: res.accessToken,
-      expiresAt: res.accessTokenExpiresAt ? new Date(res.accessTokenExpiresAt).getTime() : Date.now() + 6e4
-    };
-    return cached.token;
-  } catch {
-    cached = void 0;
-    return void 0;
-  }
-}
 export {
   AfterAuth,
   AuthConfigContext,
@@ -711,5 +819,6 @@ export {
   useTokensFromQuery,
   useTokensFromStore,
   validOrRefreshableToken,
+  watchKeycloakBearerTokenRevalidate,
   withAuthenticated
 };