@multiplatform.one/keycloak 7.6.3 → 7.7.0

package/dist/esm/index.native.js

@@ -1,5 +1,140 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// ../platform/src/platform/platformBase.ts
+import {
+  isChrome,
+  isClient,
+  isServer,
+  isTouchable,
+  isWeb,
+  isWebTouchable,
+  isWindowDefined
+} from "@tamagui/constants";
+var platformOrder = [
+  "Ios",
+  "Android",
+  // Gnome outranks Native: the GTK target reports isNative (it is not a
+  // browser) but "gnome" is the precise answer callers want.
+  "Gnome",
+  "Native",
+  // Tauri outranks Desktop/Web the same way: the webview host reports isWeb
+  // and isDesktop, but "tauri" is the precise answer.
+  "Tauri",
+  "Desktop",
+  "ChromeExtension",
+  "FirefoxExtension",
+  "WebExtension",
+  "Next",
+  "Expo",
+  "Chrome",
+  "Firefox",
+  "Web",
+  "Browser",
+  "Client",
+  "Server",
+  "Iframe",
+  "Storybook"
+];
+var platformBase = {
+  isAndroid: false,
+  isBrowser: false,
+  isChrome,
+  isChromeExtension: false,
+  isClient,
+  isDesktop: false,
+  isExpo: false,
+  isFirefox: false,
+  isFirefoxExtension: false,
+  isGnome: false,
+  isIframe: false,
+  isIos: false,
+  isNative: false,
+  isNext: false,
+  isServer,
+  isStorybook: isWindowDefined && typeof window.__STORYBOOK_ADDONS_PREVIEW === "object",
+  isTauri: false,
+  isTouchable,
+  isWeb,
+  isWebExtension: false,
+  isWebTouchable,
+  isWindowDefined,
+  preciseName: "unknown",
+  broadName: "unknown"
+};
+function getPreciseName(platform2) {
+  const flags = platform2;
+  for (const name of platformOrder) {
+    if (flags[`is${name}`]) {
+      return `${name[0].toLowerCase()}${name.slice(1)}`;
+    }
+  }
+  return "unknown";
+}
+function getBroadName(platform2) {
+  const flags = platform2;
+  for (const name of platformOrder.slice().reverse()) {
+    if (flags[`is${name}`]) {
+      return `${name[0].toLowerCase()}${name.slice(1)}`;
+    }
+  }
+  return "unknown";
+}
+
+// ../platform/src/platform/index.ts
+var isIframe = (() => {
+  if (!platformBase.isWindowDefined) return false;
+  try {
+    return window.self !== window.top;
+  } catch {
+    return true;
+  }
+})();
+var isWebExtension = !!(typeof chrome !== "undefined" && !!chrome?.runtime?.id || typeof browser !== "undefined" && !!browser?.runtime?.id);
+var platform = {
+  ...platformBase,
+  isChromeExtension: typeof chrome !== "undefined" && !!chrome?.runtime?.id,
+  isFirefoxExtension: typeof browser !== "undefined" && !!browser?.runtime?.id,
+  isIframe,
+  isWebExtension,
+  isBrowser: !!(platformBase.isWeb && platformBase.isWindowDefined && !isWebExtension),
+  isNext: platformBase.isWeb && (!platformBase.isWindowDefined || typeof window.__NEXT_DATA__ === "object"),
+  isFirefox: platformBase.isWindowDefined && !!(window?.navigator?.userAgent?.toLowerCase().indexOf("firefox") > -1)
+};
+platform.preciseName = getPreciseName(platform);
+platform.broadName = getBroadName(platform);
+
+// ../platform/src/index.ts
+var {
+  isAndroid,
+  isBrowser,
+  isChrome: isChrome2,
+  isChromeExtension,
+  isClient: isClient2,
+  isExpo,
+  isFirefox,
+  isFirefoxExtension,
+  isGnome,
+  isIframe: isIframe2,
+  isIos,
+  isNative,
+  isNext,
+  isServer: isServer2,
+  isStorybook,
+  isTauri,
+  isDesktop,
+  isTouchable: isTouchable2,
+  isWeb: isWeb2,
+  isWebExtension: isWebExtension2,
+  isWebTouchable: isWebTouchable2,
+  isWindowDefined: isWindowDefined2
+} = platform;
+
 // src/Authenticated.tsx
-import { isIframe as isIframe2, isServer as isServer2 } from "@multiplatform.one/platform";
 import { useEffect } from "react";
 import { Text } from "react-native";
 
@@ -19,16 +154,155 @@ function useAuthConfig() {
 // src/hooks/useTokensFromQuery/index.native.ts
 var useTokensFromQuery = () => false;
 
+// ../store/src/createStore.ts
+import { Store as Store2 } from "@tanstack/store";
+
+// ../store/src/persist.ts
+import { Store } from "@tanstack/store";
+function createPersistStore(initialState, persistOptions) {
+  const { key, storage: storage2, serialize = JSON.stringify, deserialize = JSON.parse } = persistOptions;
+  let hydrated = false;
+  const store = new Store(initialState);
+  store.subscribe(() => {
+    if (hydrated) {
+      const serialized = serialize(store.state);
+      void Promise.resolve(storage2.setItem(key, serialized));
+    }
+  });
+  const rehydrate = async () => {
+    const raw = await Promise.resolve(storage2.getItem(key));
+    if (raw !== null) {
+      const deserialized = deserialize(raw);
+      store.setState(() => deserialized);
+    }
+    hydrated = true;
+  };
+  const clearPersistedState = async () => {
+    await Promise.resolve(storage2.removeItem(key));
+  };
+  void rehydrate();
+  const persistStore = store;
+  persistStore.rehydrate = rehydrate;
+  persistStore.clearPersistedState = clearPersistedState;
+  return persistStore;
+}
+
+// ../store/src/storage/index.native.ts
+var defaultLoaders = {
+  // Literal require(...) calls on purpose: metro resolves them natively and
+  // vxrn/rolldown rewrites literal requires into bundled module inits (a
+  // passed-around `require` reference would survive as a bare identifier and
+  // crash). Lazy so a genuinely missing native module throws HERE — inside
+  // the try/catch — instead of at bundle evaluation.
+  loadMMKV: () => __require("react-native-mmkv"),
+  loadAsyncStorage: () => __require("@react-native-async-storage/async-storage")
+};
+function resolveNativeStorage(loaders = defaultLoaders) {
+  const errors = {};
+  try {
+    const mmkvModule = loaders.loadMMKV();
+    if (typeof mmkvModule?.createMMKV !== "function") {
+      throw new Error("no createMMKV() export (react-native-mmkv v4 API expected)");
+    }
+    const mmkv = mmkvModule.createMMKV();
+    return {
+      backend: "mmkv",
+      errors,
+      storage: {
+        getItem: (name) => mmkv.getString(name) ?? null,
+        setItem: (name, value) => {
+          mmkv.set(name, value);
+        },
+        removeItem: (name) => {
+          mmkv.remove(name);
+        }
+      }
+    };
+  } catch (err) {
+    errors.mmkv = err;
+  }
+  try {
+    const asyncStorageModule = loaders.loadAsyncStorage();
+    const asyncStorage = asyncStorageModule?.default;
+    if (!asyncStorage || typeof asyncStorage.getItem !== "function") {
+      throw new Error("no usable default export on @react-native-async-storage/async-storage");
+    }
+    return {
+      backend: "async-storage",
+      errors,
+      storage: {
+        getItem: (name) => asyncStorage.getItem(name),
+        setItem: (name, value) => asyncStorage.setItem(name, value),
+        removeItem: (name) => asyncStorage.removeItem(name)
+      }
+    };
+  } catch (err) {
+    errors.asyncStorage = err;
+  }
+  const map = /* @__PURE__ */ new Map();
+  return {
+    backend: "memory",
+    errors,
+    storage: {
+      getItem: (name) => map.get(name) ?? null,
+      setItem: (name, value) => {
+        map.set(name, value);
+      },
+      removeItem: (name) => {
+        map.delete(name);
+      }
+    }
+  };
+}
+function describeError(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function logNativeStorageResolution(resolution2, logger2 = console) {
+  if (resolution2.backend === "mmkv") {
+    logger2.info("[@multiplatform.one/store] native storage backend: mmkv");
+    return;
+  }
+  const causes = [`react-native-mmkv unavailable: ${describeError(resolution2.errors.mmkv)}`];
+  if (resolution2.backend === "memory") {
+    causes.push(`async-storage unavailable: ${describeError(resolution2.errors.asyncStorage)}`);
+  }
+  logger2.warn(
+    `[@multiplatform.one/store] native storage fell back to ${resolution2.backend}` + (resolution2.backend === "memory" ? " \u2014 persisted state will NOT survive app restarts" : "") + ` (${causes.join("; ")})`
+  );
+}
+var resolution = resolveNativeStorage();
+if (process.env.NODE_ENV !== "production" && process.env.NODE_ENV !== "test") {
+  logNativeStorageResolution(resolution);
+}
+var storage = resolution.storage;
+
+// ../store/src/createStore.ts
+function createStore(initialState, options) {
+  if (options?.persist) {
+    return createPersistStore(initialState, {
+      key: options.name,
+      storage: options.storage ?? storage
+    });
+  }
+  return new Store2(initialState);
+}
+
+// ../store/src/index.ts
+import { Store as Store3, batch, createStore as createStore2 } from "@tanstack/store";
+import { useStore } from "@tanstack/react-store";
+import { useStore as tanstackUseStore } from "@tanstack/react-store";
+function useStore2(store, selector) {
+  return tanstackUseStore(store, selector ?? ((s) => s));
+}
+
 // src/state.ts
-import { createStore, useStore } from "@multiplatform.one/store";
-import { isBrowser, isIframe, isServer } from "@multiplatform.one/platform";
-var persist = isIframe || !isBrowser && !isServer;
+var persist = isIframe2 || !isBrowser && !isServer2;
 var authStore = createStore(
   { idToken: "", refreshToken: "", token: "" },
   { name: "auth", persist }
 );
 function useAuthStore() {
-  const state2 = useStore(authStore);
+  const state2 = useStore2(authStore);
   return {
     ...state2,
     setIdToken: (idToken) => authStore.setState((prev) => ({ ...prev, idToken })),
@@ -91,7 +365,6 @@ function useTokensFromStore() {
 }
 
 // src/keycloak/index.native.ts
-import { isStorybook } from "@multiplatform.one/platform";
 import { useContext as useContext3 } from "react";
 
 // src/keycloak/base.ts
@@ -282,8 +555,86 @@ function withAuthenticated(Component, options = {}) {
   return (props) => /* @__PURE__ */ jsx(Authenticated, { ...options, children: /* @__PURE__ */ jsx(Component, { ...props }) });
 }
 
+// ../logger/src/base.ts
+import log from "loglevel";
+var defaultLoggerConfig = {
+  name: "default",
+  type: "pretty",
+  level: process.env.NODE_ENV === "development" ? 1 /* Debug */ : 2 /* Info */
+};
+var BaseLogger = class {
+  constructor(config = {}) {
+    const { metadata, name, level } = typeof config === "string" ? { metadata: void 0, name: config, level: void 0 } : config;
+    this.metadata = metadata || {};
+    this.name = name || "default";
+    this.logger = name ? log.getLogger(name) : log;
+    if (level !== void 0) this.logger.setLevel(level);
+    this.transport = this.createTransport?.();
+  }
+  trace(...args) {
+    this.logger.trace(...args);
+    this.sendToTransport(0 /* Trace */, args);
+  }
+  debug(...args) {
+    this.logger.debug(...args);
+    this.sendToTransport(1 /* Debug */, args);
+  }
+  info(...args) {
+    this.logger.info(...args);
+    this.sendToTransport(2 /* Info */, args);
+  }
+  warn(...args) {
+    this.logger.warn(...args);
+    this.sendToTransport(3 /* Warn */, args);
+  }
+  error(...args) {
+    this.logger.error(...args);
+    this.sendToTransport(4 /* Error */, args);
+  }
+  log(...args) {
+    this.logger.debug(...args);
+    this.sendToTransport(1 /* Debug */, args);
+  }
+  sendToTransport(level, args) {
+    if (this.transport) {
+      this.transport.send({
+        level,
+        message: args[0],
+        args: args.slice(1),
+        platform: platform.preciseName,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+  }
+  getSubLogger(input) {
+    const subConfig = typeof input === "string" ? {
+      name: input,
+      metadata: this.metadata,
+      level: this.logger.getLevel()
+    } : {
+      ...input,
+      metadata: { ...this.metadata, ...input.metadata }
+    };
+    return new this.constructor(subConfig);
+  }
+};
+
+// ../logger/src/index.ts
+var Logger = class extends BaseLogger {
+  constructor(config = {}) {
+    const metadata = {
+      platform: platform.preciseName
+    };
+    super({
+      name: metadata.platform,
+      ...typeof config === "string" ? { name: config } : config,
+      metadata
+    });
+  }
+};
+var logger = new Logger();
+
 // src/provider/AfterAuth.tsx
-import { logger } from "@multiplatform.one/logger";
 import { useEffect as useEffect2 } from "react";
 
 // src/frappeToken.native.ts
@@ -294,6 +645,35 @@ import { Platform } from "react-native";
 import * as Linking from "expo-linking";
 import * as SecureStore from "expo-secure-store";
 import * as WebBrowser from "expo-web-browser";
+
+// src/betterAuth/accountSelection.ts
+var validationErrorCode = "VALIDATION_ERROR";
+var known;
+function currentSelection(userId) {
+  return userId ? { useAccountCookie: true, userId } : { useAccountCookie: true };
+}
+function legacySelection(providerId, userId) {
+  return userId ? { providerId, userId } : { providerId };
+}
+function isBodyRefusal(res) {
+  return res.status === 400 && res.body?.code === validationErrorCode;
+}
+async function requestAccessToken(providerId, send, userId) {
+  const current = () => currentSelection(userId);
+  const legacy = () => legacySelection(providerId, userId);
+  if (known === "legacy") return send(legacy());
+  if (known === "current") return send(current());
+  const first = await send(current());
+  if (!isBodyRefusal(first)) {
+    if (first.status !== 400) known = "current";
+    return first;
+  }
+  const second = await send(legacy());
+  if (!isBodyRefusal(second)) known = "legacy";
+  return second;
+}
+
+// src/betterAuth/expoAuthFlow.native.ts
 try {
   WebBrowser.maybeCompleteAuthSession?.();
 } catch {
@@ -507,12 +887,17 @@ function createExpoAuthFlow(baseURL, scheme) {
       return data && Object.keys(data).length ? data : null;
     },
     async getAccessToken(providerId) {
-      const res = await authFetch("/get-access-token", {
-        method: "POST",
-        body: JSON.stringify({ providerId })
+      let payload = null;
+      const res = await requestAccessToken(providerId, async (body) => {
+        const response = await authFetch("/get-access-token", {
+          method: "POST",
+          body: JSON.stringify(body)
+        });
+        payload = await response.json().catch(() => null);
+        return { status: response.status, body: payload };
       });
-      if (!res.ok) return null;
-      return await res.json().catch(() => null);
+      if (res.status < 200 || res.status >= 300) return null;
+      return payload;
     }
   };
   activeFlow = flow;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/keycloak",
-  "version": "7.6.3",
+  "version": "7.7.0",
   "description": "keycloak client for multiplatform.one ecosystem",
   "keywords": [
     "auth",
@@ -59,8 +59,8 @@
     "@better-auth/expo": "^1.6.9",
     "better-auth": "^1.6.9",
     "jwt-decode": "^4.0.0",
-    "@multiplatform.one/keycloak-js": "7.6.3",
-    "@multiplatform.one/store": "7.6.3"
+    "@multiplatform.one/keycloak-js": "7.7.0",
+    "@multiplatform.one/store": "7.7.0"
   },
   "devDependencies": {
     "@tamagui/build": "2.7.6",
@@ -68,22 +68,21 @@
     "@testing-library/react": "^16.3.2",
     "@types/lodash.camelcase": "^4.3.9",
     "@types/lodash.startcase": "^4.4.9",
-    "@types/react": "~19.2.14",
     "@vitejs/plugin-react": "^6.0.1",
     "esbuild": "^0.28.0",
     "one": "^1.16.5",
     "react": "19.2.5",
     "typescript": "~5.9.3",
     "vitest": "^4.1.5",
-    "@multiplatform.one/config": "7.6.3",
-    "@multiplatform.one/logger": "7.6.3",
-    "@multiplatform.one/platform": "7.6.3",
-    "@multiplatform.one/test-utils": "7.6.3"
+    "@multiplatform.one/config": "7.7.0",
+    "@multiplatform.one/logger": "7.7.0",
+    "@multiplatform.one/platform": "7.7.0",
+    "@multiplatform.one/test-utils": "7.7.0"
   },
   "peerDependencies": {
     "react": "^19.1.0",
-    "@multiplatform.one/logger": "^7.6.3",
-    "@multiplatform.one/platform": "^7.6.3"
+    "@multiplatform.one/logger": "^7.7.0",
+    "@multiplatform.one/platform": "^7.7.0"
   },
   "optionalDependencies": {
     "expo-linking": "^55.0.15",

package/src/betterAuth/accountSelection.spec.ts

@@ -0,0 +1,131 @@
+/**
+ * Contract test for the `/get-access-token` request body.
+ *
+ * This is the test that was missing. Both token clients mocked
+ * `getAccessToken` wholesale, so nothing compared the body we send with the
+ * body a server accepts — and they silently diverged when Better Auth 1.7
+ * replaced `{ providerId }` with a strict account-selection union. Every
+ * token fetch then 400'd at validation, the Frappe layer fell back to guest
+ * cookies, and a signed-in user was told to sign in.
+ *
+ * The last case drives the REAL Better Auth router that `createAuth` builds,
+ * so the shape is checked against the installed version rather than against a
+ * hand-copied schema. A 400 VALIDATION_ERROR fails; 401 is the pass, because
+ * the request is unauthenticated by design — the point is that the body
+ * reached the auth check at all.
+ */
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { createAuth } from "../one";
+import {
+  currentSelection,
+  isBodyRefusal,
+  legacySelection,
+  requestAccessToken,
+  resetAccessTokenSelection,
+} from "./accountSelection";
+
+const baseUrl = "http://localhost:3000";
+
+const refusal = { status: 400, body: { code: "VALIDATION_ERROR" } };
+const unauthorized = { status: 401, body: null };
+const ok = { status: 200, body: null };
+
+beforeEach(() => resetAccessTokenSelection());
+
+describe("selection shapes", () => {
+  it("prefers the >=1.7 signed-cookie arm", () => {
+    expect(currentSelection()).toEqual({ useAccountCookie: true });
+    // Both 1.7 arms are strictObject, so a stray key is as fatal as a wrong
+    // one: assert the exact key set, not just the absence of providerId.
+    expect(Object.keys(currentSelection())).toEqual(["useAccountCookie"]);
+  });
+
+  it("falls back to the <=1.6 provider-id body", () => {
+    expect(legacySelection("keycloak")).toEqual({ providerId: "keycloak" });
+  });
+
+  it("carries userId where a caller has no session to identify by", () => {
+    expect(currentSelection("u1")).toEqual({ useAccountCookie: true, userId: "u1" });
+    expect(legacySelection("keycloak", "u1")).toEqual({ providerId: "keycloak", userId: "u1" });
+  });
+
+  it("treats only a 400 VALIDATION_ERROR as a wire-shape refusal", () => {
+    expect(isBodyRefusal(refusal)).toBe(true);
+    expect(isBodyRefusal(unauthorized)).toBe(false);
+    expect(isBodyRefusal({ status: 400, body: { code: "FAILED_TO_GET_ACCESS_TOKEN" } })).toBe(
+      false,
+    );
+  });
+});
+
+describe("requestAccessToken negotiation", () => {
+  it("sends one request when the server takes the current body", async () => {
+    const send = vi.fn().mockResolvedValue(ok);
+    await requestAccessToken("keycloak", send);
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(send).toHaveBeenCalledWith({ useAccountCookie: true });
+  });
+
+  it("retries with the legacy body when the current one is refused", async () => {
+    const send = vi.fn().mockResolvedValueOnce(refusal).mockResolvedValueOnce(ok);
+    const res = await requestAccessToken("keycloak", send);
+    expect(send).toHaveBeenNthCalledWith(1, { useAccountCookie: true });
+    expect(send).toHaveBeenNthCalledWith(2, { providerId: "keycloak" });
+    expect(res).toEqual(ok);
+  });
+
+  it("remembers the legacy server and stops paying the extra round trip", async () => {
+    const send = vi.fn().mockResolvedValueOnce(refusal).mockResolvedValue(unauthorized);
+    await requestAccessToken("keycloak", send);
+    send.mockClear();
+    await requestAccessToken("keycloak", send);
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(send).toHaveBeenCalledWith({ providerId: "keycloak" });
+  });
+
+  it("does not retry a 401 — that is an answer about the session, not the body", async () => {
+    const send = vi.fn().mockResolvedValue(unauthorized);
+    await requestAccessToken("keycloak", send);
+    expect(send).toHaveBeenCalledTimes(1);
+  });
+
+  it("returns the second refusal rather than looping when neither shape lands", async () => {
+    const send = vi.fn().mockResolvedValue(refusal);
+    const res = await requestAccessToken("keycloak", send);
+    expect(send).toHaveBeenCalledTimes(2);
+    expect(res).toEqual(refusal);
+  });
+});
+
+describe("against the installed Better Auth router", () => {
+  const auth = createAuth({
+    baseUrl,
+    secret: "test-secret-not-a-real-one-0123456789",
+    expoScheme: "test",
+    keycloak: {
+      baseUrl: "https://auth.example.test",
+      realm: "test",
+      clientId: "test-client",
+      clientSecret: "",
+    },
+  });
+
+  it("negotiates a body this server validates", async () => {
+    const res = await requestAccessToken("keycloak", async (body) => {
+      const response = await auth.handler(
+        new Request(`${baseUrl}/api/auth/get-access-token`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Origin: baseUrl },
+          body: JSON.stringify(body),
+        }),
+      );
+      return {
+        status: response.status,
+        body: (await response.json().catch(() => null)) as { code?: string } | null,
+      };
+    });
+    // 401: the body got past validation and the endpoint asked for a session.
+    expect(res.status).toBe(401);
+  });
+});