@multiplatform.one/keycloak 7.34.4 → 7.35.0

package/src/betterAuth/expoAuthFlow.deadline.spec.ts

@@ -0,0 +1,230 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createExpoAuthFlow } from "./expoAuthFlow.native";
+import { resetAccessTokenSelection } from "./accountSelection";
+
+const { jar, browser } = vi.hoisted(() => ({
+  jar: new Map<string, string>(),
+  browser: vi.fn(),
+}));
+vi.mock("expo-secure-store", () => ({
+  getItem: (key: string) => jar.get(key),
+  setItem: (key: string, value: string) => jar.set(key, value),
+}));
+vi.mock("expo-linking", () => ({
+  createURL: () => "test://home",
+  addEventListener: () => ({ remove() {} }),
+}));
+vi.mock("expo-web-browser", () => ({
+  openAuthSessionAsync: browser,
+  dismissAuthSession: vi.fn(),
+}));
+
+const base = "https://app.test/prefix";
+const json = (data: unknown, status = 200) => new Response(JSON.stringify(data), { status });
+const operations = {
+  session: (flow: ReturnType<typeof createExpoAuthFlow>) => flow.getSession(),
+  token: (flow: ReturnType<typeof createExpoAuthFlow>) => flow.getAccessToken("keycloak"),
+  login: (flow: ReturnType<typeof createExpoAuthFlow>) => flow.signIn("keycloak"),
+  logout: (flow: ReturnType<typeof createExpoAuthFlow>) => flow.signOut(),
+};
+
+beforeEach(() => {
+  vi.useFakeTimers();
+  jar.clear();
+  browser.mockReset();
+  resetAccessTokenSelection();
+});
+afterEach(() => {
+  vi.useRealTimers();
+  vi.unstubAllGlobals();
+});
+
+describe("native auth deadlines", () => {
+  for (const [name, operation] of Object.entries(operations)) {
+    for (const stage of ["fetch", "body"] as const) {
+      it(`bounds ${name} when ${stage} ignores abort`, async () => {
+        const signals: AbortSignal[] = [];
+        const fetchMock = vi.fn((_url: string, init: RequestInit) => {
+          signals.push(init.signal as AbortSignal);
+          if (stage === "fetch") return new Promise<Response>(() => {});
+          return Promise.resolve({
+            ok: true,
+            status: 200,
+            headers: new Headers(),
+            text: () => new Promise<string>(() => {}),
+            json: () => new Promise<unknown>(() => {}),
+          });
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        const outcome = vi.fn();
+        void operation(createExpoAuthFlow(base, undefined, { timeoutMs: 20 })).then(
+          outcome,
+          outcome,
+        );
+        await vi.advanceTimersByTimeAsync(41);
+        expect(outcome).toHaveBeenCalledWith(expect.objectContaining({ name: "AuthTimeoutError" }));
+        expect(signals.every((signal) => signal?.aborted)).toBe(true);
+        expect(vi.getTimerCount()).toBe(0);
+      });
+    }
+  }
+
+  it("defaults to ten seconds and ignores late response cookies", async () => {
+    let resolve!: (value: Response) => void;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        () =>
+          new Promise<Response>((done) => {
+            resolve = done;
+          }),
+      ),
+    );
+    const outcome = vi.fn();
+    void createExpoAuthFlow(base).getSession().then(outcome, outcome);
+    await vi.advanceTimersByTimeAsync(9999);
+    expect(outcome).not.toHaveBeenCalled();
+    await vi.advanceTimersByTimeAsync(1);
+    expect(outcome).toHaveBeenCalledWith(expect.objectContaining({ name: "AuthTimeoutError" }));
+    resolve(new Response("null", { headers: { "set-cookie": "late=bad" } }));
+    await vi.advanceTimersByTimeAsync(0);
+    expect(jar.size).toBe(0);
+    expect(vi.getTimerCount()).toBe(0);
+  });
+
+  it("ignores late body cookies", async () => {
+    let resolve!: (value: string) => void;
+    const body = new Promise<string>((done) => {
+      resolve = done;
+    });
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => ({
+        ok: true,
+        status: 200,
+        headers: new Headers({ "set-cookie": "late=bad" }),
+        text: () => body,
+        json: () => body.then(JSON.parse),
+      })),
+    );
+    const outcome = vi.fn();
+    void createExpoAuthFlow(base, undefined, { timeoutMs: 20 }).getSession().then(outcome, outcome);
+    await vi.advanceTimersByTimeAsync(20);
+    resolve("null");
+    await vi.advanceTimersByTimeAsync(0);
+    expect(outcome).toHaveBeenCalledWith(expect.objectContaining({ name: "AuthTimeoutError" }));
+    expect(jar.size).toBe(0);
+  });
+
+  it("clears timers on success and network rejection", async () => {
+    const failure = new Error("offline");
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValueOnce(json(null)).mockRejectedValueOnce(failure),
+    );
+    const flow = createExpoAuthFlow(base);
+    await expect(flow.getSession()).resolves.toBeNull();
+    expect(vi.getTimerCount()).toBe(0);
+    await expect(flow.getSession()).rejects.toBe(failure);
+    expect(vi.getTimerCount()).toBe(0);
+  });
+
+  it("bounds the negotiated token retry", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(json({ code: "VALIDATION_ERROR" }, 400))
+      .mockImplementationOnce(() => new Promise(() => {}));
+    vi.stubGlobal("fetch", fetchMock);
+    const outcome = vi.fn();
+    void createExpoAuthFlow(base, undefined, { timeoutMs: 20 })
+      .getAccessToken("keycloak")
+      .then(outcome, outcome);
+    await vi.advanceTimersByTimeAsync(20);
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(outcome).toHaveBeenCalledWith(expect.objectContaining({ name: "AuthTimeoutError" }));
+    expect(vi.getTimerCount()).toBe(0);
+  });
+
+  it("does not time out the interactive sign-in browser", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => json({ url: "https://idp.test/login" })),
+    );
+    let finish!: (result: unknown) => void;
+    browser.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve;
+        }),
+    );
+    const outcome = vi.fn();
+    void createExpoAuthFlow(base, undefined, { timeoutMs: 20 })
+      .signIn("keycloak")
+      .then(outcome, outcome);
+    await vi.advanceTimersByTimeAsync(60_000);
+    expect(browser).toHaveBeenCalledOnce();
+    expect(outcome).not.toHaveBeenCalled();
+    finish({ type: "success", url: "test://home?cookie=session=ok" });
+    await vi.advanceTimersByTimeAsync(0);
+    expect(outcome).toHaveBeenCalledWith(undefined);
+  });
+});
+
+describe("native auth failures", () => {
+  it.each(["null", "", "{}"])("accepts signed-out session body %j", async (body) => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response(body)),
+    );
+    await expect(createExpoAuthFlow(base).getSession()).resolves.toBeNull();
+  });
+  it("accepts a 401 session response", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response("unauthorized", { status: 401 })),
+    );
+    await expect(createExpoAuthFlow(base).getSession()).resolves.toBeNull();
+  });
+  it.each(["session", "token"] as const)("rejects HTTP failures for %s", async (name) => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response("unavailable", { status: 503 })),
+    );
+    await expect(operations[name](createExpoAuthFlow(base))).rejects.toThrow(/503/);
+  });
+  it.each(["session", "token"] as const)("rejects invalid successful JSON for %s", async (name) => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response("<html>error</html>")),
+    );
+    await expect(operations[name](createExpoAuthFlow(base))).rejects.toThrow();
+  });
+  it("preserves signed-out token responses", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => json({ code: "UNAUTHORIZED" }, 401)),
+    );
+    await expect(createExpoAuthFlow(base).getAccessToken("keycloak")).resolves.toBeNull();
+  });
+  it("rejects when both sign-out endpoints fail and still clears local cookies", async () => {
+    jar.set("better-auth_cookie", '{"session":{"value":"old","expires":null}}');
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response("offline", { status: 503 })),
+    );
+    await expect(createExpoAuthFlow(base).signOut()).rejects.toThrow(/503/);
+    expect(jar.get("better-auth_cookie")).toBe("{}");
+  });
+  it("rejects a network failure even when plain sign-out succeeds", async () => {
+    const failure = new Error("SSO offline");
+    vi.stubGlobal(
+      "fetch",
+      vi
+        .fn()
+        .mockRejectedValueOnce(failure)
+        .mockResolvedValueOnce(json({ success: true })),
+    );
+    await expect(createExpoAuthFlow(base).signOut()).rejects.toBe(failure);
+    expect(jar.get("better-auth_cookie")).toBe("{}");
+  });
+});

package/src/betterAuth/expoAuthFlow.native.ts

@@ -17,6 +17,7 @@ import * as Linking from "expo-linking";
 import * as SecureStore from "expo-secure-store";
 import * as WebBrowser from "expo-web-browser";
 import { requestAccessToken } from "./accountSelection";
+import { AuthTimeoutError } from "../session/authError";
 
 try {
   WebBrowser.maybeCompleteAuthSession?.();
@@ -264,25 +265,55 @@ export function getActiveExpoAuthFlow(): ExpoAuthFlow | null {
   return activeFlow;
 }
 
-export function createExpoAuthFlow(baseURL: string, scheme?: string): ExpoAuthFlow {
+export function createExpoAuthFlow(
+  baseURL: string,
+  scheme?: string,
+  options?: { timeoutMs?: number },
+): ExpoAuthFlow {
   const base = baseURL.replace(/\/$/, "");
   const origin = () => Linking.createURL("/", scheme ? { scheme } : undefined);
 
   async function authFetch(path: string, init?: RequestInit) {
-    const cookie = cookieHeader();
-    const res = await fetch(`${base}/api/auth${path}`, {
-      ...init,
-      credentials: "omit",
-      headers: {
-        "Content-Type": "application/json",
-        ...(cookie ? { cookie } : {}),
-        "expo-origin": origin(),
-        "x-skip-oauth-proxy": "true",
-        ...init?.headers,
-      },
+    const controller = new AbortController();
+    const timeoutMs = options?.timeoutMs ?? 10_000;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const deadline = new Promise<never>((_resolve, reject) => {
+      timer = setTimeout(() => {
+        reject(new AuthTimeoutError(timeoutMs));
+        controller.abort();
+      }, timeoutMs);
     });
-    absorbSetCookie(res.headers.get("set-cookie"));
-    return res;
+    try {
+      const buffered = await Promise.race([
+        (async () => {
+          const cookie = cookieHeader();
+          const response = await fetch(`${base}/api/auth${path}`, {
+            ...init,
+            signal: controller.signal,
+            credentials: "omit",
+            headers: {
+              "Content-Type": "application/json",
+              ...(cookie ? { cookie } : {}),
+              "expo-origin": origin(),
+              "x-skip-oauth-proxy": "true",
+              ...init?.headers,
+            },
+          });
+          const text = await response.text();
+          return { response, text };
+        })(),
+        deadline,
+      ]);
+      absorbSetCookie(buffered.response.headers.get("set-cookie"));
+      return {
+        status: buffered.response.status,
+        ok: buffered.response.ok,
+        text: buffered.text,
+        json: () => (buffered.text.trim() ? JSON.parse(buffered.text) : null),
+      };
+    } finally {
+      clearTimeout(timer);
+    }
   }
 
   const flow: ExpoAuthFlow = {
@@ -293,10 +324,10 @@ export function createExpoAuthFlow(baseURL: string, scheme?: string): ExpoAuthFl
         body: JSON.stringify({ provider, callbackURL: to }),
       });
       if (!res.ok) {
-        const body = await res.text().catch(() => "");
+        const body = res.text;
         throw new Error(`sign-in failed (${res.status}): ${body.slice(0, 200)}`);
       }
-      const data = (await res.json()) as { url?: string; redirect?: boolean };
+      const data = res.json() as { url?: string; redirect?: boolean };
       if (!data?.url) throw new Error("sign-in response had no authorization url");
 
       // The server's expo plugin proxies the IdP redirect and forwards the
@@ -323,6 +354,7 @@ export function createExpoAuthFlow(baseURL: string, scheme?: string): ExpoAuthFl
         postLogoutRedirectUri || Linking.createURL("/"),
         "signed-out",
       );
+      let missingSso = false;
       try {
         // Single sign-out via the server's keycloak-sso plugin: the fetch
         // (carrying the SecureStore session cookies) revokes the Better Auth
@@ -334,22 +366,21 @@ export function createExpoAuthFlow(baseURL: string, scheme?: string): ExpoAuthFl
           `/sign-out/sso?mode=json&callbackURL=${encodeURIComponent(to)}`,
           { method: "GET" },
         );
+        missingSso = res.status === 404 || res.status === 405;
         if (!res.ok) throw new Error(`sign-out/sso failed (${res.status})`);
-        const data = (await res.json().catch(() => null)) as {
+        const data = res.json() as {
           redirect?: boolean;
           url?: string;
         } | null;
         if (data?.redirect && data.url) {
           // User backing out of the browser is fine: the local session is
           // already dead; only the KC SSO cookie may survive.
-          await openAuthBrowser(data.url, to.split("?")[0], { timeoutMs: 120_000 }).catch(
-            () => undefined,
-          );
+          await openAuthBrowser(data.url, to.split("?")[0], { timeoutMs: 120_000 });
         }
-      } catch {
-        // Server without the keycloak-sso plugin (or unreachable): fall back
-        // to the plain Better Auth sign-out so the local session still dies.
-        await authFetch("/sign-out", { method: "POST", body: "{}" }).catch(() => undefined);
+      } catch (error) {
+        const fallback = await authFetch("/sign-out", { method: "POST", body: "{}" });
+        if (!fallback.ok) throw new Error(`sign-out failed (${fallback.status})`);
+        if (!missingSso) throw error;
       } finally {
         writeJar({});
       }
@@ -357,8 +388,9 @@ export function createExpoAuthFlow(baseURL: string, scheme?: string): ExpoAuthFl
 
     async getSession() {
       const res = await authFetch("/get-session");
-      if (!res.ok) return null;
-      const data = await res.json().catch(() => null);
+      if (res.status === 401) return null;
+      if (!res.ok) throw new Error(`get-session failed (${res.status})`);
+      const data = res.json();
       return data && Object.keys(data).length ? data : null;
     },
 
@@ -369,7 +401,15 @@ export function createExpoAuthFlow(baseURL: string, scheme?: string): ExpoAuthFl
           method: "POST",
           body: JSON.stringify(body),
         });
-        payload = await response.json().catch(() => null);
+        if (response.status >= 500) {
+          throw new Error(`get-access-token failed (${response.status})`);
+        }
+        try {
+          payload = response.json();
+        } catch (error) {
+          if (response.ok) throw error;
+          payload = null;
+        }
         return { status: response.status, body: payload as { code?: string } | null };
       });
       if (res.status < 200 || res.status >= 300) return null;

package/src/keycloak/base.ts

@@ -156,8 +156,9 @@ export class BaseKeycloak {
     this._clear();
     if (this._keycloakClient) {
       await this._keycloakClient.login(options);
-    } else {
-      await this._login?.(options);
+    } else if (this._login) {
+      await this._login(options);
+      return;
     }
     this._sync();
   }

package/src/keycloak/context.ts

@@ -1,4 +1,4 @@
 import { createContext } from "react";
-import type { Keycloak } from ".";
+import type { BaseKeycloak } from "./base";
 
-export const KeycloakContext = createContext<Keycloak | undefined>(undefined);
+export const KeycloakContext = createContext<BaseKeycloak | undefined>(undefined);

package/src/keycloak/index.ts

@@ -13,6 +13,7 @@ import { getAuthClient } from "../betterAuth/client";
 import { clearKeycloakBearerToken } from "../frappeToken";
 import { useAuthConfig } from "../hooks/index";
 import type { Session } from "../session/index";
+import { setAuthError } from "../session/authError";
 import { useSession } from "../session/index";
 import type { KeycloakMock } from "../types";
 import { BaseKeycloak, type KeycloakLoginOptions, type KeycloakLogoutOptions } from "./base";
@@ -35,19 +36,31 @@ export class Keycloak extends BaseKeycloak {
   }
 
   async login(options: KeycloakLoginOptions = {}) {
-    this._clear();
-    if (this._keycloakClient) {
-      await this._keycloakClient.login(options);
-    } else if (isBrowser && !isServer) {
-      const client = getAuthClient();
-      await client.signIn.social({
-        provider: "keycloak" as any,
-        callbackURL: options.redirectUri || (isWeb ? window.location.href : ""),
-      });
-    } else {
-      await this._login?.(options);
+    setAuthError();
+    try {
+      this._clear();
+      if (this._keycloakClient) {
+        await this._keycloakClient.login(options);
+        this._sync();
+      } else if (this._login) {
+        await this._login(options);
+      } else if (isBrowser && !isServer) {
+        const client = getAuthClient();
+        const result = await client.signIn.social({
+          provider: "keycloak" as any,
+          callbackURL: options.redirectUri || (isWeb ? window.location.href : ""),
+        });
+        if (result?.error) {
+          throw result.error instanceof Error
+            ? result.error
+            : new Error(result.error.message || "Sign-in failed");
+        }
+      }
+    } catch (cause) {
+      const error = cause instanceof Error ? cause : new Error(String(cause));
+      setAuthError(error);
+      throw error;
     }
-    this._sync();
   }
 
   async logout(options: KeycloakLogoutOptions = {}) {
@@ -93,9 +106,9 @@ export function useKeycloak() {
   const keycloak = useContext(KeycloakContext);
   const keycloakConfig = useContext(KeycloakConfigContext);
   const { disabled } = useAuthConfig();
+  const { session, status } = useSession();
   if (disabled) return null;
   if (keycloak) return keycloak;
-  const { session, status } = useSession();
   if (isStorybook) {
     return new Keycloak(keycloakConfig, {
       email: "storybook@example.com",

package/src/keycloak/login.error.spec.tsx

@@ -0,0 +1,85 @@
+// @vitest-environment happy-dom
+import { act, cleanup, renderHook } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { Keycloak } from "./index";
+import { useSession } from "../session";
+
+const { social, session } = vi.hoisted(() => ({
+  social: vi.fn(),
+  session: {
+    data: null as null | { user: { id: string } },
+    isPending: false,
+    error: null as Error | null,
+  },
+}));
+vi.mock("@multiplatform.one/platform", () => ({ isBrowser: true, isServer: false, isWeb: true }));
+vi.mock("../betterAuth/client", () => ({
+  getAuthClient: () => ({ signIn: { social }, useSession: () => session }),
+}));
+vi.mock("../hooks/index", () => ({ useAuthConfig: () => ({}) }));
+vi.mock("../frappeToken", () => ({ clearKeycloakBearerToken: vi.fn() }));
+const config = { url: "https://idp.test", realm: "test", clientId: "app" };
+beforeEach(() => {
+  social.mockReset();
+  session.error = null;
+  session.isPending = false;
+  session.data = null;
+});
+afterEach(cleanup);
+
+describe("browser reactive auth errors", () => {
+  it.each(["returned", "thrown"])(
+    "publishes and rejects the same %s login failure, clearing on retry",
+    async (mode) => {
+      const failure = new Error("login failed");
+      if (mode === "thrown") social.mockRejectedValueOnce(failure);
+      else social.mockResolvedValueOnce({ error: failure });
+      const { result } = renderHook(() => useSession());
+      const keycloak = new Keycloak(config);
+      let rejected: unknown;
+      await act(async () => {
+        try {
+          await keycloak.login();
+        } catch (error) {
+          rejected = error;
+        }
+      });
+      expect(rejected).toBe(failure);
+      expect(result.current.error).toBe(failure);
+      social.mockResolvedValueOnce({ data: {} });
+      await act(async () => {
+        await keycloak.login();
+      });
+      expect(result.current.error).toBeUndefined();
+    },
+  );
+  it("turns a returned error payload into the Error it publishes", async () => {
+    social.mockResolvedValueOnce({ error: { message: "denied", code: "DENIED" } });
+    const { result } = renderHook(() => useSession());
+    let rejected: unknown;
+    await act(async () => {
+      try {
+        await new Keycloak(config).login();
+      } catch (error) {
+        rejected = error;
+      }
+    });
+    expect(rejected).toBeInstanceOf(Error);
+    expect(result.current.error).toBe(rejected);
+    expect(result.current.error?.message).toBe("denied");
+  });
+  it("reports Better Auth session errors without changing hook ordering across states", () => {
+    session.error = new Error("session offline");
+    session.isPending = true;
+    const { result, rerender } = renderHook(() => useSession());
+    expect(result.current.error).toBe(session.error);
+    session.isPending = false;
+    rerender();
+    expect(result.current.status).toBe("unauthenticated");
+    expect(result.current.error).toBe(session.error);
+    session.error = null;
+    session.data = { user: { id: "signed-in" } };
+    rerender();
+    expect(result.current.status).toBe("authenticated");
+  });
+});

package/src/provider/KeycloakProvider.loading.spec.tsx

@@ -0,0 +1,37 @@
+// @vitest-environment happy-dom
+import { cleanup, render, screen } from "@testing-library/react";
+import { afterEach, expect, it, vi } from "vitest";
+import { KeycloakProvider } from "./KeycloakProvider";
+import type { AuthProviderProps } from "./authProvider/shared";
+
+const { configs } = vi.hoisted(() => ({ configs: [] as AuthProviderProps["keycloakConfig"][] }));
+vi.mock("./authProvider", () => ({
+  AuthProvider: ({ children, loadingComponent: Slot, keycloakConfig }: AuthProviderProps) => {
+    configs.push(keycloakConfig);
+    return (
+      <>
+        {children}
+        {Slot && <Slot />}
+      </>
+    );
+  },
+}));
+afterEach(() => {
+  cleanup();
+  configs.length = 0;
+});
+it("forwards the loading slot and keeps equivalent keycloak config stable", () => {
+  const Slot = () => <div>loading slot</div>;
+  const view = render(
+    <KeycloakProvider loadingComponent={Slot}>
+      <span>child</span>
+    </KeycloakProvider>,
+  );
+  expect(screen.queryByText("loading slot")).not.toBeNull();
+  view.rerender(
+    <KeycloakProvider loadingComponent={Slot}>
+      <span>updated child</span>
+    </KeycloakProvider>,
+  );
+  expect(configs[1]).toBe(configs[0]);
+});

package/src/provider/KeycloakProvider.tsx

@@ -1,4 +1,4 @@
-import type { PropsWithChildren } from "react";
+import type { ComponentType, PropsWithChildren } from "react";
 import { useMemo } from "react";
 import type { AuthConfig } from "../authConfig";
 import { AuthConfigContext } from "../authConfig";
@@ -6,6 +6,7 @@ import { AuthProvider } from "./authProvider";
 
 export interface KeycloakProviderProps extends PropsWithChildren, AuthConfig {
   baseUrl?: string;
+  loadingComponent?: ComponentType;
   clientId?: string;
   publicClientId?: string;
   realm?: string;
@@ -25,6 +26,7 @@ export function KeycloakProvider({
   clientId,
   expoScheme,
   loginRedirectUri,
+  loadingComponent,
   debug,
   disabled,
   iframeSso,
@@ -35,18 +37,23 @@ export function KeycloakProvider({
     () => ({ debug, disabled, iframeSso, loginRedirectUri }),
     [debug, disabled, iframeSso, loginRedirectUri],
   );
+  const keycloakConfig = useMemo(
+    () => ({
+      clientId: clientId || "app",
+      publicClientId,
+      realm: realm || "main",
+      url: baseUrl ?? "",
+      betterAuthBaseUrl,
+      expoScheme,
+    }),
+    [clientId, publicClientId, realm, baseUrl, betterAuthBaseUrl, expoScheme],
+  );
   return (
     <AuthConfigContext.Provider value={authConfig}>
       <AuthProvider
         disabled={disabled}
-        keycloakConfig={{
-          clientId: clientId || "app",
-          publicClientId,
-          realm: realm || "main",
-          url: baseUrl ?? "",
-          betterAuthBaseUrl,
-          expoScheme,
-        }}
+        keycloakConfig={keycloakConfig}
+        loadingComponent={loadingComponent}
       >
         {children}
       </AuthProvider>