@multiplatform.one/keycloak 7.34.4 → 7.35.0

package/dist/esm/index.native.js

@@ -482,8 +482,9 @@ var BaseKeycloak = class {
     this._clear();
     if (this._keycloakClient) {
       await this._keycloakClient.login(options);
-    } else {
-      await this._login?.(options);
+    } else if (this._login) {
+      await this._login(options);
+      return;
     }
     this._sync();
   }
@@ -673,6 +674,32 @@ async function requestAccessToken(providerId, send, userId) {
   return second;
 }
 
+// src/session/authError.ts
+import { useSyncExternalStore } from "react";
+var error;
+var listeners = /* @__PURE__ */ new Set();
+var AuthTimeoutError = class extends Error {
+  constructor(timeoutMs = 1e4) {
+    super(`Authentication request timed out after ${timeoutMs}ms`);
+    this.name = "AuthTimeoutError";
+  }
+};
+function setAuthError(next) {
+  if (error === next) return;
+  error = next;
+  for (const listener of listeners) listener();
+}
+function getAuthError() {
+  return error;
+}
+function subscribe(listener) {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+function useAuthError() {
+  return useSyncExternalStore(subscribe, getAuthError, getAuthError);
+}
+
 // src/betterAuth/expoAuthFlow.native.ts
 try {
   WebBrowser.maybeCompleteAuthSession?.();
@@ -813,24 +840,50 @@ var activeFlow = null;
 function getActiveExpoAuthFlow() {
   return activeFlow;
 }
-function createExpoAuthFlow(baseURL, scheme) {
+function createExpoAuthFlow(baseURL, scheme, options) {
   const base = baseURL.replace(/\/$/, "");
   const origin = () => Linking.createURL("/", scheme ? { scheme } : void 0);
   async function authFetch(path, init) {
-    const cookie = cookieHeader();
-    const res = await fetch(`${base}/api/auth${path}`, {
-      ...init,
-      credentials: "omit",
-      headers: {
-        "Content-Type": "application/json",
-        ...cookie ? { cookie } : {},
-        "expo-origin": origin(),
-        "x-skip-oauth-proxy": "true",
-        ...init?.headers
-      }
+    const controller = new AbortController();
+    const timeoutMs = options?.timeoutMs ?? 1e4;
+    let timer;
+    const deadline = new Promise((_resolve, reject) => {
+      timer = setTimeout(() => {
+        reject(new AuthTimeoutError(timeoutMs));
+        controller.abort();
+      }, timeoutMs);
     });
-    absorbSetCookie(res.headers.get("set-cookie"));
-    return res;
+    try {
+      const buffered = await Promise.race([
+        (async () => {
+          const cookie = cookieHeader();
+          const response = await fetch(`${base}/api/auth${path}`, {
+            ...init,
+            signal: controller.signal,
+            credentials: "omit",
+            headers: {
+              "Content-Type": "application/json",
+              ...cookie ? { cookie } : {},
+              "expo-origin": origin(),
+              "x-skip-oauth-proxy": "true",
+              ...init?.headers
+            }
+          });
+          const text = await response.text();
+          return { response, text };
+        })(),
+        deadline
+      ]);
+      absorbSetCookie(buffered.response.headers.get("set-cookie"));
+      return {
+        status: buffered.response.status,
+        ok: buffered.response.ok,
+        text: buffered.text,
+        json: () => buffered.text.trim() ? JSON.parse(buffered.text) : null
+      };
+    } finally {
+      clearTimeout(timer);
+    }
   }
   const flow = {
     async signIn(provider, callbackURL) {
@@ -840,10 +893,10 @@ function createExpoAuthFlow(baseURL, scheme) {
         body: JSON.stringify({ provider, callbackURL: to })
       });
       if (!res.ok) {
-        const body = await res.text().catch(() => "");
+        const body = res.text;
         throw new Error(`sign-in failed (${res.status}): ${body.slice(0, 200)}`);
       }
-      const data = await res.json();
+      const data = res.json();
       if (!data?.url) throw new Error("sign-in response had no authorization url");
       const params = new URLSearchParams({ authorizationURL: data.url });
       const oauthState = getOAuthState();
@@ -862,28 +915,31 @@ function createExpoAuthFlow(baseURL, scheme) {
         postLogoutRedirectUri || Linking.createURL("/"),
         "signed-out"
       );
+      let missingSso = false;
       try {
         const res = await authFetch(
           `/sign-out/sso?mode=json&callbackURL=${encodeURIComponent(to)}`,
           { method: "GET" }
         );
+        missingSso = res.status === 404 || res.status === 405;
         if (!res.ok) throw new Error(`sign-out/sso failed (${res.status})`);
-        const data = await res.json().catch(() => null);
+        const data = res.json();
         if (data?.redirect && data.url) {
-          await openAuthBrowser(data.url, to.split("?")[0], { timeoutMs: 12e4 }).catch(
-            () => void 0
-          );
+          await openAuthBrowser(data.url, to.split("?")[0], { timeoutMs: 12e4 });
         }
-      } catch {
-        await authFetch("/sign-out", { method: "POST", body: "{}" }).catch(() => void 0);
+      } catch (error2) {
+        const fallback = await authFetch("/sign-out", { method: "POST", body: "{}" });
+        if (!fallback.ok) throw new Error(`sign-out failed (${fallback.status})`);
+        if (!missingSso) throw error2;
       } finally {
         writeJar({});
       }
     },
     async getSession() {
       const res = await authFetch("/get-session");
-      if (!res.ok) return null;
-      const data = await res.json().catch(() => null);
+      if (res.status === 401) return null;
+      if (!res.ok) throw new Error(`get-session failed (${res.status})`);
+      const data = res.json();
       return data && Object.keys(data).length ? data : null;
     },
     async getAccessToken(providerId) {
@@ -893,7 +949,15 @@ function createExpoAuthFlow(baseURL, scheme) {
           method: "POST",
           body: JSON.stringify(body)
         });
-        payload = await response.json().catch(() => null);
+        if (response.status >= 500) {
+          throw new Error(`get-access-token failed (${response.status})`);
+        }
+        try {
+          payload = response.json();
+        } catch (error2) {
+          if (response.ok) throw error2;
+          payload = null;
+        }
         return { status: response.status, body: payload };
       });
       if (res.status < 200 || res.status >= 300) return null;
@@ -1014,139 +1078,200 @@ import { useEffect as useEffect3, useMemo, useState } from "react";
 import { AppState as AppState2 } from "react-native";
 import * as Linking2 from "expo-linking";
 
-// src/Loading.tsx
-import { ActivityIndicator, Text as Text2, View } from "react-native";
-import { jsx as jsx3, jsxs } from "react/jsx-runtime";
-function Loading({ loadingComponent }) {
-  const { debug } = useAuthConfig();
-  const LoadingComponent = loadingComponent;
-  if (typeof LoadingComponent === "undefined") {
-    return /* @__PURE__ */ jsxs(View, { style: { flex: 1, alignItems: "center", justifyContent: "center" }, children: [
-      /* @__PURE__ */ jsx3(ActivityIndicator, {}),
-      debug ? /* @__PURE__ */ jsx3(Text2, { children: "loading" }) : null
-    ] });
-  }
-  return /* @__PURE__ */ jsx3(LoadingComponent, {});
-}
-
 // src/session/index.native.ts
-import { useSyncExternalStore } from "react";
+import { useSyncExternalStore as useSyncExternalStore2 } from "react";
 var state = { session: null, status: "loading" };
-var listeners = /* @__PURE__ */ new Set();
+var listeners2 = /* @__PURE__ */ new Set();
 function setNativeSession(session, status) {
   state = {
     session,
     status: status ?? (session?.user ? "authenticated" : "unauthenticated")
   };
-  for (const l of listeners) l();
+  for (const l of listeners2) l();
 }
-function subscribe(listener) {
-  listeners.add(listener);
-  return () => listeners.delete(listener);
+function subscribe2(listener) {
+  listeners2.add(listener);
+  return () => listeners2.delete(listener);
 }
 async function getSession() {
   return state.session;
 }
 function useSession(_options) {
-  return useSyncExternalStore(
-    subscribe,
+  const session = useSyncExternalStore2(
+    subscribe2,
     () => state,
     () => state
   );
+  const error2 = useAuthError();
+  return { ...session, error: error2 };
 }
 
 // src/provider/authProvider/index.native.tsx
-import { Fragment as Fragment3, jsx as jsx4 } from "react/jsx-runtime";
+import { Fragment as Fragment3, jsx as jsx3, jsxs } from "react/jsx-runtime";
+function createController(config, disabled, notify) {
+  const flow = disabled ? null : createExpoAuthFlow(
+    rewriteLoopbackHostForNative(config.betterAuthBaseUrl || "http://localhost:8000"),
+    config.expoScheme
+  );
+  let active = true;
+  let sequence = 0;
+  let interactive = false;
+  let session = null;
+  const current = (request) => active && request === sequence;
+  const controller = {
+    keycloak: makeKeycloak(null),
+    loading: !disabled,
+    start() {
+      active = true;
+      if (!flow) {
+        publish(null);
+      } else if (!interactive) {
+        void refresh().catch(() => void 0);
+      }
+    },
+    stop() {
+      active = false;
+      sequence++;
+      interactive = false;
+    },
+    refresh
+  };
+  function makeKeycloak(next) {
+    const keycloak = new Keycloak(config, void 0, void 0, void 0, login, logout);
+    if (next?.user) {
+      keycloak.authenticated = true;
+      keycloak.subject = next.user.id;
+      keycloak.email = next.user.email ?? void 0;
+      keycloak.username = next.user.name ?? void 0;
+    }
+    return keycloak;
+  }
+  function publish(next, error2) {
+    session = next;
+    controller.keycloak = makeKeycloak(next);
+    controller.loading = false;
+    setAuthError(error2);
+    setNativeSession(next);
+    notify();
+  }
+  function begin() {
+    const request = ++sequence;
+    controller.loading = true;
+    setAuthError();
+    setNativeSession(session, "loading");
+    notify();
+    return request;
+  }
+  async function probe(request) {
+    const next = await flow.getSession();
+    if (!current(request)) return;
+    publish(
+      next?.user ? {
+        user: {
+          id: next.user.id,
+          name: next.user.name ?? null,
+          email: next.user.email ?? null
+        }
+      } : null
+    );
+  }
+  function fail(request, cause) {
+    const error2 = cause instanceof Error ? cause : new Error(String(cause));
+    if (current(request)) publish(null, error2);
+    throw error2;
+  }
+  async function refresh() {
+    if (!active || !flow || interactive) return;
+    const request = begin();
+    try {
+      await probe(request);
+    } catch (error2) {
+      fail(request, error2);
+    }
+  }
+  async function login(options) {
+    if (!active || !flow) return void 0;
+    interactive = true;
+    const request = begin();
+    try {
+      await flow.signIn("keycloak", options.redirectUri || Linking2.createURL("/"));
+      if (!current(request)) return void 0;
+      clearKeycloakBearerToken();
+      await probe(request);
+    } catch (error2) {
+      fail(request, error2);
+    } finally {
+      if (current(request)) interactive = false;
+    }
+    return void 0;
+  }
+  async function logout(options) {
+    if (!active || !flow) return void 0;
+    interactive = true;
+    const request = ++sequence;
+    clearKeycloakBearerToken();
+    publish(null);
+    try {
+      const redirectUri = options.redirectUri?.includes("://") ? options.redirectUri : Linking2.createURL("/");
+      await flow.signOut(redirectUri);
+    } catch (error2) {
+      fail(request, error2);
+    } finally {
+      if (current(request)) {
+        clearKeycloakBearerToken();
+        interactive = false;
+      }
+    }
+    return void 0;
+  }
+  return controller;
+}
 function AuthProvider({
   children,
   disabled,
   keycloakConfig,
-  loadingComponent
+  loadingComponent: LoadingComponent
 }) {
-  const [keycloak, setKeycloak] = useState();
-  const [isLoading, setIsLoading] = useState(true);
-  const serverBaseUrl = useMemo(() => {
-    return rewriteLoopbackHostForNative(
-      keycloakConfig.betterAuthBaseUrl || "http://localhost:8000"
-    );
-  }, [keycloakConfig]);
-  const scheme = useMemo(() => keycloakConfig.expoScheme, [keycloakConfig]);
-  const flow = useMemo(
-    () => disabled ? null : createExpoAuthFlow(serverBaseUrl, scheme),
-    [disabled, serverBaseUrl, scheme]
+  const [, setRevision] = useState(0);
+  const { url, realm, clientId, publicClientId, betterAuthBaseUrl, expoScheme } = keycloakConfig;
+  const scopes = JSON.stringify(keycloakConfig.scopes);
+  const controller = useMemo(
+    () => createController(
+      {
+        url,
+        realm,
+        clientId,
+        publicClientId,
+        betterAuthBaseUrl,
+        expoScheme,
+        scopes: scopes ? JSON.parse(scopes) : void 0
+      },
+      disabled,
+      () => setRevision((revision) => revision + 1)
+    ),
+    [url, realm, clientId, publicClientId, betterAuthBaseUrl, expoScheme, scopes, disabled]
   );
   useEffect3(() => {
-    if (disabled || !flow) {
-      setIsLoading(false);
-      return;
-    }
-    let alive = true;
-    const refresh = async () => {
-      let session = null;
-      try {
-        session = await flow.getSession();
-      } catch (err) {
-        console.error("[keycloak] native session check failed:", err);
-      }
-      const _keycloak = new Keycloak(
-        keycloakConfig,
-        void 0,
-        void 0,
-        void 0,
-        async (options) => {
-          await flow.signIn("keycloak", options.redirectUri || Linking2.createURL("/"));
-          clearKeycloakBearerToken();
-          await refresh();
-          return void 0;
-        },
-        async (options) => {
-          const redirectUri = options.redirectUri && options.redirectUri.includes("://") ? options.redirectUri : Linking2.createURL("/");
-          await flow.signOut(redirectUri);
-          clearKeycloakBearerToken();
-          await refresh();
-          return void 0;
-        }
-      );
-      if (session?.user) {
-        _keycloak.authenticated = true;
-        _keycloak.email = session.user.email || void 0;
-        _keycloak.username = session.user.name || void 0;
-        _keycloak.subject = session.user.id;
-      }
-      if (!alive) return;
-      setNativeSession(
-        session?.user ? {
-          user: {
-            id: session.user.id,
-            name: session.user.name ?? null,
-            email: session.user.email ?? null
-          }
-        } : null
-      );
-      setKeycloak(_keycloak);
-    };
-    refresh().finally(() => {
-      if (alive) setIsLoading(false);
+    if (disabled) return;
+    controller.start();
+    const appSub = AppState2.addEventListener("change", (next) => {
+      if (next === "active") void controller.refresh().catch(() => void 0);
     });
-    const onAppState = (next) => {
-      if (next === "active") refresh().catch(() => void 0);
-    };
-    const appSub = AppState2.addEventListener("change", onAppState);
     return () => {
-      alive = false;
+      controller.stop();
       appSub.remove();
     };
-  }, [disabled, flow, keycloakConfig]);
-  if (disabled) return /* @__PURE__ */ jsx4(Fragment3, { children });
-  if (isLoading || !keycloak) {
-    return /* @__PURE__ */ jsx4(Loading, { loadingComponent });
-  }
-  return /* @__PURE__ */ jsx4(KeycloakConfigContext.Provider, { value: keycloakConfig, children: /* @__PURE__ */ jsx4(KeycloakContext.Provider, { value: keycloak, children: /* @__PURE__ */ jsx4(AfterAuth, { children }) }) });
+  }, [controller, disabled]);
+  if (disabled) return /* @__PURE__ */ jsx3(Fragment3, { children });
+  return /* @__PURE__ */ jsx3(KeycloakConfigContext.Provider, { value: controller.keycloak.config, children: /* @__PURE__ */ jsxs(KeycloakContext.Provider, { value: controller.keycloak, children: [
+    /* @__PURE__ */ jsx3(AfterAuth, { children }),
+    controller.loading && LoadingComponent ? /* @__PURE__ */ jsx3(LoadingComponent, {}) : null
+  ] }) });
 }
 
 // src/provider/KeycloakProvider.tsx
 import { useMemo as useMemo2 } from "react";
-import { jsx as jsx5 } from "react/jsx-runtime";
+import { jsx as jsx4 } from "react/jsx-runtime";
 function KeycloakProvider({
   baseUrl,
   betterAuthBaseUrl,
@@ -1154,6 +1279,7 @@ function KeycloakProvider({
   clientId,
   expoScheme,
   loginRedirectUri,
+  loadingComponent,
   debug,
   disabled,
   iframeSso,
@@ -1164,18 +1290,23 @@ function KeycloakProvider({
     () => ({ debug, disabled, iframeSso, loginRedirectUri }),
     [debug, disabled, iframeSso, loginRedirectUri]
   );
-  return /* @__PURE__ */ jsx5(AuthConfigContext.Provider, { value: authConfig, children: /* @__PURE__ */ jsx5(
+  const keycloakConfig = useMemo2(
+    () => ({
+      clientId: clientId || "app",
+      publicClientId,
+      realm: realm || "main",
+      url: baseUrl ?? "",
+      betterAuthBaseUrl,
+      expoScheme
+    }),
+    [clientId, publicClientId, realm, baseUrl, betterAuthBaseUrl, expoScheme]
+  );
+  return /* @__PURE__ */ jsx4(AuthConfigContext.Provider, { value: authConfig, children: /* @__PURE__ */ jsx4(
     AuthProvider,
     {
       disabled,
-      keycloakConfig: {
-        clientId: clientId || "app",
-        publicClientId,
-        realm: realm || "main",
-        url: baseUrl ?? "",
-        betterAuthBaseUrl,
-        expoScheme
-      },
+      keycloakConfig,
+      loadingComponent,
       children
     }
   ) });
@@ -1184,6 +1315,7 @@ export {
   AfterAuth,
   AuthConfigContext,
   AuthProvider,
+  AuthTimeoutError,
   Authenticated,
   BaseKeycloak,
   Keycloak,
@@ -1191,14 +1323,17 @@ export {
   KeycloakProvider,
   defaultAuthConfig,
   getAllWalletAddresses,
+  getAuthError,
   getKeycloakBearerToken,
   getSession,
   getWalletAddresses,
   getWalletsFromToken,
   hasWallets,
   isTokenExpired,
+  setAuthError,
   setNativeSession,
   useAuthConfig,
+  useAuthError,
   useKeycloak,
   useSession,
   useTokensFromQuery,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/keycloak",
-  "version": "7.34.4",
+  "version": "7.35.0",
   "description": "keycloak client for multiplatform.one ecosystem",
   "keywords": [
     "auth",
@@ -57,16 +57,16 @@
   },
   "dependencies": {
     "@better-auth/expo": "~1.6.33",
-    "@multiplatform.one/keycloak-js": "^7.34.4",
-    "@multiplatform.one/store": "^7.34.4",
+    "@multiplatform.one/keycloak-js": "^7.35.0",
+    "@multiplatform.one/store": "^7.35.0",
     "better-auth": "~1.6.33",
     "jwt-decode": "^4.0.0"
   },
   "devDependencies": {
-    "@multiplatform.one/config": "7.34.4",
-    "@multiplatform.one/logger": "7.34.4",
-    "@multiplatform.one/platform": "7.34.4",
-    "@multiplatform.one/test-utils": "7.34.4",
+    "@multiplatform.one/config": "7.35.0",
+    "@multiplatform.one/logger": "7.35.0",
+    "@multiplatform.one/platform": "7.35.0",
+    "@multiplatform.one/test-utils": "7.35.0",
     "@tamagui/build": "2.7.6",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",
@@ -80,8 +80,8 @@
     "vitest": "^4.1.5"
   },
   "peerDependencies": {
-    "@multiplatform.one/logger": "^7.34.4",
-    "@multiplatform.one/platform": "^7.34.4",
+    "@multiplatform.one/logger": "^7.35.0",
+    "@multiplatform.one/platform": "^7.35.0",
     "react": "^19.1.0",
     "react-native": ">=0.83.0"
   },