@multiplatform.one/keycloak 7.34.4 → 7.36.0

package/dist/cjs/index.native.cjs

@@ -33,6 +33,7 @@ __export(index_exports, {
   AfterAuth: () => AfterAuth,
   AuthConfigContext: () => AuthConfigContext,
   AuthProvider: () => AuthProvider,
+  AuthTimeoutError: () => AuthTimeoutError,
   Authenticated: () => Authenticated,
   BaseKeycloak: () => BaseKeycloak,
   Keycloak: () => Keycloak,
@@ -40,14 +41,17 @@ __export(index_exports, {
   KeycloakProvider: () => KeycloakProvider,
   defaultAuthConfig: () => defaultAuthConfig,
   getAllWalletAddresses: () => getAllWalletAddresses,
+  getAuthError: () => getAuthError,
   getKeycloakBearerToken: () => getKeycloakBearerToken,
   getSession: () => getSession,
   getWalletAddresses: () => getWalletAddresses,
   getWalletsFromToken: () => getWalletsFromToken,
   hasWallets: () => hasWallets,
   isTokenExpired: () => isTokenExpired,
+  setAuthError: () => setAuthError,
   setNativeSession: () => setNativeSession,
   useAuthConfig: () => useAuthConfig,
+  useAuthError: () => useAuthError,
   useKeycloak: () => useKeycloak,
   useSession: () => useSession,
   useTokensFromQuery: () => useTokensFromQuery,
@@ -527,8 +531,9 @@ var BaseKeycloak = class {
     this._clear();
     if (this._keycloakClient) {
       await this._keycloakClient.login(options);
-    } else {
-      await this._login?.(options);
+    } else if (this._login) {
+      await this._login(options);
+      return;
     }
     this._sync();
   }
@@ -680,7 +685,7 @@ var Logger = class extends BaseLogger {
 var logger = new Logger();
 
 // src/provider/AfterAuth.tsx
-var import_react8 = require("react");
+var import_react9 = require("react");
 
 // src/frappeToken.native.ts
 var import_react_native3 = require("react-native");
@@ -718,6 +723,32 @@ async function requestAccessToken(providerId, send, userId) {
   return second;
 }
 
+// src/session/authError.ts
+var import_react8 = require("react");
+var error;
+var listeners = /* @__PURE__ */ new Set();
+var AuthTimeoutError = class extends Error {
+  constructor(timeoutMs = 1e4) {
+    super(`Authentication request timed out after ${timeoutMs}ms`);
+    this.name = "AuthTimeoutError";
+  }
+};
+function setAuthError(next) {
+  if (error === next) return;
+  error = next;
+  for (const listener of listeners) listener();
+}
+function getAuthError() {
+  return error;
+}
+function subscribe(listener) {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+function useAuthError() {
+  return (0, import_react8.useSyncExternalStore)(subscribe, getAuthError, getAuthError);
+}
+
 // src/betterAuth/expoAuthFlow.native.ts
 try {
   WebBrowser.maybeCompleteAuthSession?.();
@@ -858,24 +889,50 @@ var activeFlow = null;
 function getActiveExpoAuthFlow() {
   return activeFlow;
 }
-function createExpoAuthFlow(baseURL, scheme) {
+function createExpoAuthFlow(baseURL, scheme, options) {
   const base = baseURL.replace(/\/$/, "");
   const origin = () => Linking.createURL("/", scheme ? { scheme } : void 0);
   async function authFetch(path, init) {
-    const cookie = cookieHeader();
-    const res = await fetch(`${base}/api/auth${path}`, {
-      ...init,
-      credentials: "omit",
-      headers: {
-        "Content-Type": "application/json",
-        ...cookie ? { cookie } : {},
-        "expo-origin": origin(),
-        "x-skip-oauth-proxy": "true",
-        ...init?.headers
-      }
+    const controller = new AbortController();
+    const timeoutMs = options?.timeoutMs ?? 1e4;
+    let timer;
+    const deadline = new Promise((_resolve, reject) => {
+      timer = setTimeout(() => {
+        reject(new AuthTimeoutError(timeoutMs));
+        controller.abort();
+      }, timeoutMs);
     });
-    absorbSetCookie(res.headers.get("set-cookie"));
-    return res;
+    try {
+      const buffered = await Promise.race([
+        (async () => {
+          const cookie = cookieHeader();
+          const response = await fetch(`${base}/api/auth${path}`, {
+            ...init,
+            signal: controller.signal,
+            credentials: "omit",
+            headers: {
+              "Content-Type": "application/json",
+              ...cookie ? { cookie } : {},
+              "expo-origin": origin(),
+              "x-skip-oauth-proxy": "true",
+              ...init?.headers
+            }
+          });
+          const text = await response.text();
+          return { response, text };
+        })(),
+        deadline
+      ]);
+      absorbSetCookie(buffered.response.headers.get("set-cookie"));
+      return {
+        status: buffered.response.status,
+        ok: buffered.response.ok,
+        text: buffered.text,
+        json: () => buffered.text.trim() ? JSON.parse(buffered.text) : null
+      };
+    } finally {
+      clearTimeout(timer);
+    }
   }
   const flow = {
     async signIn(provider, callbackURL) {
@@ -885,10 +942,10 @@ function createExpoAuthFlow(baseURL, scheme) {
         body: JSON.stringify({ provider, callbackURL: to })
       });
       if (!res.ok) {
-        const body = await res.text().catch(() => "");
+        const body = res.text;
         throw new Error(`sign-in failed (${res.status}): ${body.slice(0, 200)}`);
       }
-      const data = await res.json();
+      const data = res.json();
       if (!data?.url) throw new Error("sign-in response had no authorization url");
       const params = new URLSearchParams({ authorizationURL: data.url });
       const oauthState = getOAuthState();
@@ -907,28 +964,31 @@ function createExpoAuthFlow(baseURL, scheme) {
         postLogoutRedirectUri || Linking.createURL("/"),
         "signed-out"
       );
+      let missingSso = false;
       try {
         const res = await authFetch(
           `/sign-out/sso?mode=json&callbackURL=${encodeURIComponent(to)}`,
           { method: "GET" }
         );
+        missingSso = res.status === 404 || res.status === 405;
         if (!res.ok) throw new Error(`sign-out/sso failed (${res.status})`);
-        const data = await res.json().catch(() => null);
+        const data = res.json();
         if (data?.redirect && data.url) {
-          await openAuthBrowser(data.url, to.split("?")[0], { timeoutMs: 12e4 }).catch(
-            () => void 0
-          );
+          await openAuthBrowser(data.url, to.split("?")[0], { timeoutMs: 12e4 });
         }
-      } catch {
-        await authFetch("/sign-out", { method: "POST", body: "{}" }).catch(() => void 0);
+      } catch (error2) {
+        const fallback = await authFetch("/sign-out", { method: "POST", body: "{}" });
+        if (!fallback.ok) throw new Error(`sign-out failed (${fallback.status})`);
+        if (!missingSso) throw error2;
       } finally {
         writeJar({});
       }
     },
     async getSession() {
       const res = await authFetch("/get-session");
-      if (!res.ok) return null;
-      const data = await res.json().catch(() => null);
+      if (res.status === 401) return null;
+      if (!res.ok) throw new Error(`get-session failed (${res.status})`);
+      const data = res.json();
       return data && Object.keys(data).length ? data : null;
     },
     async getAccessToken(providerId) {
@@ -938,7 +998,15 @@ function createExpoAuthFlow(baseURL, scheme) {
           method: "POST",
           body: JSON.stringify(body)
         });
-        payload = await response.json().catch(() => null);
+        if (response.status >= 500) {
+          throw new Error(`get-access-token failed (${response.status})`);
+        }
+        try {
+          payload = response.json();
+        } catch (error2) {
+          if (response.ok) throw error2;
+          payload = null;
+        }
         return { status: response.status, body: payload };
       });
       if (res.status < 200 || res.status >= 300) return null;
@@ -1006,7 +1074,7 @@ function AfterAuth({ children, loadingComponent: _loadingComponent }) {
   const authConfig = useAuthConfig();
   const authStore2 = useAuthStore();
   const keycloak = useKeycloak();
-  (0, import_react8.useEffect)(() => {
+  (0, import_react9.useEffect)(() => {
     if (!persist || !keycloak?.authenticated) return;
     if (keycloak.token) {
       authStore2.setTokens({
@@ -1025,173 +1093,234 @@ function AfterAuth({ children, loadingComponent: _loadingComponent }) {
     keycloak?.idToken,
     keycloak?.refreshToken
   ]);
-  (0, import_react8.useEffect)(() => {
+  (0, import_react9.useEffect)(() => {
     if (authConfig.debug && keycloak?.token) {
       logger.debug("token", keycloak.token);
     }
   }, [authConfig.debug, keycloak?.token]);
-  (0, import_react8.useEffect)(() => {
+  (0, import_react9.useEffect)(() => {
     if (authConfig.debug && keycloak?.idToken) {
       logger.debug("idToken", keycloak.idToken);
     }
   }, [authConfig.debug, keycloak?.idToken]);
-  (0, import_react8.useEffect)(() => {
+  (0, import_react9.useEffect)(() => {
     if (authConfig.debug && keycloak?.refreshToken) {
       logger.debug("refreshToken", keycloak.refreshToken);
     }
   }, [authConfig.debug, keycloak?.refreshToken]);
-  (0, import_react8.useEffect)(() => {
+  (0, import_react9.useEffect)(() => {
     if (authConfig.debug && keycloak?.authenticated) {
       logger.debug("authenticated", keycloak.authenticated);
     }
   }, [authConfig.debug, keycloak?.authenticated]);
-  (0, import_react8.useEffect)(() => {
+  (0, import_react9.useEffect)(() => {
     if (authConfig.debug && keycloak === null) {
       logger.debug("keycloak disabled");
     }
   }, [authConfig.debug, keycloak]);
-  (0, import_react8.useEffect)(() => watchKeycloakBearerTokenRevalidate(), []);
+  (0, import_react9.useEffect)(() => watchKeycloakBearerTokenRevalidate(), []);
   return /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_jsx_runtime2.Fragment, { children });
 }
 
 // src/provider/authProvider/index.native.tsx
-var import_react10 = require("react");
-var import_react_native5 = require("react-native");
-var Linking2 = __toESM(require("expo-linking"));
-
-// src/Loading.tsx
+var import_react11 = require("react");
 var import_react_native4 = require("react-native");
-var import_jsx_runtime3 = require("react/jsx-runtime");
-function Loading({ loadingComponent }) {
-  const { debug } = useAuthConfig();
-  const LoadingComponent = loadingComponent;
-  if (typeof LoadingComponent === "undefined") {
-    return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_react_native4.View, { style: { flex: 1, alignItems: "center", justifyContent: "center" }, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_react_native4.ActivityIndicator, {}),
-      debug ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_react_native4.Text, { children: "loading" }) : null
-    ] });
-  }
-  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(LoadingComponent, {});
-}
+var Linking2 = __toESM(require("expo-linking"));
 
 // src/session/index.native.ts
-var import_react9 = require("react");
+var import_react10 = require("react");
 var state = { session: null, status: "loading" };
-var listeners = /* @__PURE__ */ new Set();
+var listeners2 = /* @__PURE__ */ new Set();
 function setNativeSession(session, status) {
   state = {
     session,
     status: status ?? (session?.user ? "authenticated" : "unauthenticated")
   };
-  for (const l of listeners) l();
+  for (const l of listeners2) l();
 }
-function subscribe(listener) {
-  listeners.add(listener);
-  return () => listeners.delete(listener);
+function subscribe2(listener) {
+  listeners2.add(listener);
+  return () => listeners2.delete(listener);
 }
 async function getSession() {
   return state.session;
 }
 function useSession(_options) {
-  return (0, import_react9.useSyncExternalStore)(
-    subscribe,
+  const session = (0, import_react10.useSyncExternalStore)(
+    subscribe2,
     () => state,
     () => state
   );
+  const error2 = useAuthError();
+  return { ...session, error: error2 };
 }
 
 // src/provider/authProvider/index.native.tsx
-var import_jsx_runtime4 = require("react/jsx-runtime");
+var import_jsx_runtime3 = require("react/jsx-runtime");
+function createController(config, disabled, notify) {
+  const flow = disabled ? null : createExpoAuthFlow(
+    rewriteLoopbackHostForNative(config.betterAuthBaseUrl || "http://localhost:8000"),
+    config.expoScheme
+  );
+  let active = true;
+  let sequence = 0;
+  let interactive = false;
+  let session = null;
+  const current = (request) => active && request === sequence;
+  const controller = {
+    keycloak: makeKeycloak(null),
+    loading: !disabled,
+    start() {
+      active = true;
+      if (!flow) {
+        publish(null);
+      } else if (!interactive) {
+        void refresh().catch(() => void 0);
+      }
+    },
+    stop() {
+      active = false;
+      sequence++;
+      interactive = false;
+    },
+    refresh
+  };
+  function makeKeycloak(next) {
+    const keycloak = new Keycloak(config, void 0, void 0, void 0, login, logout);
+    if (next?.user) {
+      keycloak.authenticated = true;
+      keycloak.subject = next.user.id;
+      keycloak.email = next.user.email ?? void 0;
+      keycloak.username = next.user.name ?? void 0;
+    }
+    return keycloak;
+  }
+  function publish(next, error2) {
+    session = next;
+    controller.keycloak = makeKeycloak(next);
+    controller.loading = false;
+    setAuthError(error2);
+    setNativeSession(next);
+    notify();
+  }
+  function begin() {
+    const request = ++sequence;
+    controller.loading = true;
+    setAuthError();
+    setNativeSession(session, "loading");
+    notify();
+    return request;
+  }
+  async function probe(request) {
+    const next = await flow.getSession();
+    if (!current(request)) return;
+    publish(
+      next?.user ? {
+        user: {
+          id: next.user.id,
+          name: next.user.name ?? null,
+          email: next.user.email ?? null
+        }
+      } : null
+    );
+  }
+  function fail(request, cause) {
+    const error2 = cause instanceof Error ? cause : new Error(String(cause));
+    if (current(request)) publish(null, error2);
+    throw error2;
+  }
+  async function refresh() {
+    if (!active || !flow || interactive) return;
+    const request = begin();
+    try {
+      await probe(request);
+    } catch (error2) {
+      fail(request, error2);
+    }
+  }
+  async function login(options) {
+    if (!active || !flow) return void 0;
+    interactive = true;
+    const request = begin();
+    try {
+      await flow.signIn("keycloak", options.redirectUri || Linking2.createURL("/"));
+      if (!current(request)) return void 0;
+      clearKeycloakBearerToken();
+      await probe(request);
+    } catch (error2) {
+      fail(request, error2);
+    } finally {
+      if (current(request)) interactive = false;
+    }
+    return void 0;
+  }
+  async function logout(options) {
+    if (!active || !flow) return void 0;
+    interactive = true;
+    const request = ++sequence;
+    clearKeycloakBearerToken();
+    publish(null);
+    try {
+      const redirectUri = options.redirectUri?.includes("://") ? options.redirectUri : Linking2.createURL("/");
+      await flow.signOut(redirectUri);
+    } catch (error2) {
+      fail(request, error2);
+    } finally {
+      if (current(request)) {
+        clearKeycloakBearerToken();
+        interactive = false;
+      }
+    }
+    return void 0;
+  }
+  return controller;
+}
 function AuthProvider({
   children,
   disabled,
   keycloakConfig,
-  loadingComponent
+  loadingComponent: LoadingComponent
 }) {
-  const [keycloak, setKeycloak] = (0, import_react10.useState)();
-  const [isLoading, setIsLoading] = (0, import_react10.useState)(true);
-  const serverBaseUrl = (0, import_react10.useMemo)(() => {
-    return rewriteLoopbackHostForNative(
-      keycloakConfig.betterAuthBaseUrl || "http://localhost:8000"
-    );
-  }, [keycloakConfig]);
-  const scheme = (0, import_react10.useMemo)(() => keycloakConfig.expoScheme, [keycloakConfig]);
-  const flow = (0, import_react10.useMemo)(
-    () => disabled ? null : createExpoAuthFlow(serverBaseUrl, scheme),
-    [disabled, serverBaseUrl, scheme]
+  const [, setRevision] = (0, import_react11.useState)(0);
+  const { url, realm, clientId, publicClientId, betterAuthBaseUrl, expoScheme } = keycloakConfig;
+  const scopes = JSON.stringify(keycloakConfig.scopes);
+  const controller = (0, import_react11.useMemo)(
+    () => createController(
+      {
+        url,
+        realm,
+        clientId,
+        publicClientId,
+        betterAuthBaseUrl,
+        expoScheme,
+        scopes: scopes ? JSON.parse(scopes) : void 0
+      },
+      disabled,
+      () => setRevision((revision) => revision + 1)
+    ),
+    [url, realm, clientId, publicClientId, betterAuthBaseUrl, expoScheme, scopes, disabled]
   );
-  (0, import_react10.useEffect)(() => {
-    if (disabled || !flow) {
-      setIsLoading(false);
-      return;
-    }
-    let alive = true;
-    const refresh = async () => {
-      let session = null;
-      try {
-        session = await flow.getSession();
-      } catch (err) {
-        console.error("[keycloak] native session check failed:", err);
-      }
-      const _keycloak = new Keycloak(
-        keycloakConfig,
-        void 0,
-        void 0,
-        void 0,
-        async (options) => {
-          await flow.signIn("keycloak", options.redirectUri || Linking2.createURL("/"));
-          clearKeycloakBearerToken();
-          await refresh();
-          return void 0;
-        },
-        async (options) => {
-          const redirectUri = options.redirectUri && options.redirectUri.includes("://") ? options.redirectUri : Linking2.createURL("/");
-          await flow.signOut(redirectUri);
-          clearKeycloakBearerToken();
-          await refresh();
-          return void 0;
-        }
-      );
-      if (session?.user) {
-        _keycloak.authenticated = true;
-        _keycloak.email = session.user.email || void 0;
-        _keycloak.username = session.user.name || void 0;
-        _keycloak.subject = session.user.id;
-      }
-      if (!alive) return;
-      setNativeSession(
-        session?.user ? {
-          user: {
-            id: session.user.id,
-            name: session.user.name ?? null,
-            email: session.user.email ?? null
-          }
-        } : null
-      );
-      setKeycloak(_keycloak);
-    };
-    refresh().finally(() => {
-      if (alive) setIsLoading(false);
+  (0, import_react11.useEffect)(() => {
+    if (disabled) return;
+    controller.start();
+    const appSub = import_react_native4.AppState.addEventListener("change", (next) => {
+      if (next === "active") void controller.refresh().catch(() => void 0);
     });
-    const onAppState = (next) => {
-      if (next === "active") refresh().catch(() => void 0);
-    };
-    const appSub = import_react_native5.AppState.addEventListener("change", onAppState);
     return () => {
-      alive = false;
+      controller.stop();
       appSub.remove();
     };
-  }, [disabled, flow, keycloakConfig]);
-  if (disabled) return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(import_jsx_runtime4.Fragment, { children });
-  if (isLoading || !keycloak) {
-    return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(Loading, { loadingComponent });
-  }
-  return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(KeycloakConfigContext.Provider, { value: keycloakConfig, children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(KeycloakContext.Provider, { value: keycloak, children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(AfterAuth, { children }) }) });
+  }, [controller, disabled]);
+  if (disabled) return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_jsx_runtime3.Fragment, { children });
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(KeycloakConfigContext.Provider, { value: controller.keycloak.config, children: /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(KeycloakContext.Provider, { value: controller.keycloak, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(AfterAuth, { children }),
+    controller.loading && LoadingComponent ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(LoadingComponent, {}) : null
+  ] }) });
 }
 
 // src/provider/KeycloakProvider.tsx
-var import_react11 = require("react");
-var import_jsx_runtime5 = require("react/jsx-runtime");
+var import_react12 = require("react");
+var import_jsx_runtime4 = require("react/jsx-runtime");
 function KeycloakProvider({
   baseUrl,
   betterAuthBaseUrl,
@@ -1199,28 +1328,34 @@ function KeycloakProvider({
   clientId,
   expoScheme,
   loginRedirectUri,
+  loadingComponent,
   debug,
   disabled,
   iframeSso,
   publicClientId,
   realm
 }) {
-  const authConfig = (0, import_react11.useMemo)(
+  const authConfig = (0, import_react12.useMemo)(
     () => ({ debug, disabled, iframeSso, loginRedirectUri }),
     [debug, disabled, iframeSso, loginRedirectUri]
   );
-  return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(AuthConfigContext.Provider, { value: authConfig, children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+  const keycloakConfig = (0, import_react12.useMemo)(
+    () => ({
+      clientId: clientId || "app",
+      publicClientId,
+      realm: realm || "main",
+      url: baseUrl ?? "",
+      betterAuthBaseUrl,
+      expoScheme
+    }),
+    [clientId, publicClientId, realm, baseUrl, betterAuthBaseUrl, expoScheme]
+  );
+  return /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(AuthConfigContext.Provider, { value: authConfig, children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)(
     AuthProvider,
     {
       disabled,
-      keycloakConfig: {
-        clientId: clientId || "app",
-        publicClientId,
-        realm: realm || "main",
-        url: baseUrl ?? "",
-        betterAuthBaseUrl,
-        expoScheme
-      },
+      keycloakConfig,
+      loadingComponent,
       children
     }
   ) });