@multiplatform.one/keycloak 7.6.3 → 7.7.1

package/src/betterAuth/accountSelection.ts

@@ -0,0 +1,99 @@
+/**
+ * How we ask Better Auth's `/get-access-token` for a provider access token.
+ *
+ * Better Auth changed this body between minors and the two shapes are
+ * mutually exclusive:
+ *
+ *   <=1.6  body: z.object({ providerId, accountId?, userId? })
+ *   >=1.7  body: z.union([ z.strictObject({ accountId, userId? }),
+ *                          z.strictObject({ useAccountCookie: true, userId? }) ])
+ *
+ * 1.7 dropped `providerId` (it survives only as a response field) and made
+ * both arms STRICT, so a 1.6 body fails 1.7 outright; and 1.6 requires
+ * `providerId`, so a 1.7 body fails 1.6. No single body satisfies both.
+ *
+ * We are a library. The server version is whatever the consuming app's
+ * lockfile resolved, and we do not get to know it — which is exactly how this
+ * broke in the first place: the client kept sending the 1.6 body while an
+ * app's `^1.6.9` floated its deployed server to 1.7, every token fetch 400'd
+ * at body validation, and the Frappe layer fell back to guest cookies while
+ * the UI still said the user was signed in.
+ *
+ * So negotiate instead of guessing: send the current shape, and on a body
+ * validation refusal send the legacy one, remembering the answer for the rest
+ * of the process. At most one extra request per process, and an app that
+ * upgrades or downgrades Better Auth keeps working with no code change.
+ *
+ * The cookie arm is the only 1.7 arm we can use: `createAuth` runs stateless
+ * with `account.storeAccountCookie`, so there is no account row to address by
+ * id.
+ */
+
+export type AccessTokenSelection =
+  | { useAccountCookie: true; userId?: string }
+  | { providerId: string; userId?: string };
+
+export type AccessTokenResponse = {
+  status: number;
+  body: { code?: string } | null;
+};
+
+/** Better Auth's code for a body that failed the endpoint's schema. */
+const validationErrorCode = "VALIDATION_ERROR";
+
+/** Which body shape this server accepted, once we know. */
+let known: "current" | "legacy" | undefined;
+
+/** Forget the negotiated shape (tests, and a server swapped under a client). */
+export function resetAccessTokenSelection() {
+  known = undefined;
+}
+
+/** The >=1.7 body: the account comes from its signed cookie. */
+export function currentSelection(userId?: string): AccessTokenSelection {
+  return userId ? { useAccountCookie: true, userId } : { useAccountCookie: true };
+}
+
+/** The <=1.6 body: the account is chosen by provider id. */
+export function legacySelection(providerId: string, userId?: string): AccessTokenSelection {
+  return userId ? { providerId, userId } : { providerId };
+}
+
+/**
+ * True for "this server does not understand that body" — the only answer
+ * worth retrying with the other shape. A 401, a 403 or a dead refresh token
+ * are real answers about the session, not about the wire format.
+ */
+export function isBodyRefusal(res: AccessTokenResponse): boolean {
+  return res.status === 400 && res.body?.code === validationErrorCode;
+}
+
+/**
+ * Ask for an access token, negotiating the body shape.
+ *
+ * `send` posts one body and reports the status plus the parsed JSON (null
+ * when there is no JSON to parse). It is called at most twice, and only twice
+ * on the first call of a process against a server whose shape we have not
+ * learned yet.
+ */
+export async function requestAccessToken(
+  providerId: string,
+  send: (body: AccessTokenSelection) => Promise<AccessTokenResponse>,
+  userId?: string,
+): Promise<AccessTokenResponse> {
+  const current = () => currentSelection(userId);
+  const legacy = () => legacySelection(providerId, userId);
+
+  if (known === "legacy") return send(legacy());
+  if (known === "current") return send(current());
+
+  const first = await send(current());
+  if (!isBodyRefusal(first)) {
+    if (first.status !== 400) known = "current";
+    return first;
+  }
+
+  const second = await send(legacy());
+  if (!isBodyRefusal(second)) known = "legacy";
+  return second;
+}

package/src/betterAuth/expoAuthFlow.native.ts

@@ -16,6 +16,7 @@ import { Platform } from "react-native";
 import * as Linking from "expo-linking";
 import * as SecureStore from "expo-secure-store";
 import * as WebBrowser from "expo-web-browser";
+import { requestAccessToken } from "./accountSelection";
 
 try {
   WebBrowser.maybeCompleteAuthSession?.();
@@ -104,7 +105,13 @@ export interface ExpoAuthFlow {
    */
   signOut(postLogoutRedirectUri?: string): Promise<void>;
   getSession(): Promise<{ user?: { id: string; email?: string; name?: string } } | null>;
-  /** Valid provider access token (server refreshes when expired). */
+  /**
+   * Valid provider access token (server refreshes when expired).
+   *
+   * `providerId` is kept for call-site readability only. The server picks the
+   * account from its signed account cookie, which is the sole selector a
+   * stateless Better Auth deployment has — see `accountSelection.ts`.
+   */
   getAccessToken(
     providerId: string,
   ): Promise<{ accessToken?: string; accessTokenExpiresAt?: string } | null>;
@@ -356,12 +363,17 @@ export function createExpoAuthFlow(baseURL: string, scheme?: string): ExpoAuthFl
     },
 
     async getAccessToken(providerId: string) {
-      const res = await authFetch("/get-access-token", {
-        method: "POST",
-        body: JSON.stringify({ providerId }),
+      let payload: unknown = null;
+      const res = await requestAccessToken(providerId, async (body) => {
+        const response = await authFetch("/get-access-token", {
+          method: "POST",
+          body: JSON.stringify(body),
+        });
+        payload = await response.json().catch(() => null);
+        return { status: response.status, body: payload as { code?: string } | null };
       });
-      if (!res.ok) return null;
-      return (await res.json().catch(() => null)) as {
+      if (res.status < 200 || res.status >= 300) return null;
+      return payload as {
         accessToken?: string;
         accessTokenExpiresAt?: string;
       } | null;

package/src/frappeToken.ts

@@ -19,6 +19,7 @@
  *   backoff, keep the session. A Keycloak restart must not look like logout.
  */
 
+import { requestAccessToken } from "./betterAuth/accountSelection";
 import { getAuthClient } from "./betterAuth/client";
 
 let cached: { token: string; expiresAt: number } | undefined;
@@ -92,17 +93,21 @@ async function fetchTokenOnce(): Promise<
   { ok: true; token: string; expiresAt: number } | { ok: false; kind: FailureKind }
 > {
   try {
-    const res = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
-      method: "POST",
-      credentials: "include",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ providerId: "keycloak" }),
+    let payload: unknown = null;
+    const res = await requestAccessToken("keycloak", async (selection) => {
+      const response = await fetch(`${window.location.origin}/api/auth/get-access-token`, {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(selection),
+      });
+      payload = await response.json().catch(() => null);
+      return { status: response.status, body: payload as { code?: string } | null };
     });
-    if (!res.ok) {
-      const body = (await res.json().catch(() => null)) as { code?: string } | null;
-      return { ok: false, kind: classifyAccessTokenResponse(res.status, body) };
+    if (res.status < 200 || res.status >= 300) {
+      return { ok: false, kind: classifyAccessTokenResponse(res.status, res.body) };
     }
-    const data = (await res.json().catch(() => null)) as {
+    const data = payload as {
       accessToken?: string;
       accessTokenExpiresAt?: string;
     } | null;

package/types/betterAuth/accountSelection.d.ts

@@ -0,0 +1,65 @@
+/**
+ * How we ask Better Auth's `/get-access-token` for a provider access token.
+ *
+ * Better Auth changed this body between minors and the two shapes are
+ * mutually exclusive:
+ *
+ *   <=1.6  body: z.object({ providerId, accountId?, userId? })
+ *   >=1.7  body: z.union([ z.strictObject({ accountId, userId? }),
+ *                          z.strictObject({ useAccountCookie: true, userId? }) ])
+ *
+ * 1.7 dropped `providerId` (it survives only as a response field) and made
+ * both arms STRICT, so a 1.6 body fails 1.7 outright; and 1.6 requires
+ * `providerId`, so a 1.7 body fails 1.6. No single body satisfies both.
+ *
+ * We are a library. The server version is whatever the consuming app's
+ * lockfile resolved, and we do not get to know it — which is exactly how this
+ * broke in the first place: the client kept sending the 1.6 body while an
+ * app's `^1.6.9` floated its deployed server to 1.7, every token fetch 400'd
+ * at body validation, and the Frappe layer fell back to guest cookies while
+ * the UI still said the user was signed in.
+ *
+ * So negotiate instead of guessing: send the current shape, and on a body
+ * validation refusal send the legacy one, remembering the answer for the rest
+ * of the process. At most one extra request per process, and an app that
+ * upgrades or downgrades Better Auth keeps working with no code change.
+ *
+ * The cookie arm is the only 1.7 arm we can use: `createAuth` runs stateless
+ * with `account.storeAccountCookie`, so there is no account row to address by
+ * id.
+ */
+export type AccessTokenSelection = {
+    useAccountCookie: true;
+    userId?: string;
+} | {
+    providerId: string;
+    userId?: string;
+};
+export type AccessTokenResponse = {
+    status: number;
+    body: {
+        code?: string;
+    } | null;
+};
+/** Forget the negotiated shape (tests, and a server swapped under a client). */
+export declare function resetAccessTokenSelection(): void;
+/** The >=1.7 body: the account comes from its signed cookie. */
+export declare function currentSelection(userId?: string): AccessTokenSelection;
+/** The <=1.6 body: the account is chosen by provider id. */
+export declare function legacySelection(providerId: string, userId?: string): AccessTokenSelection;
+/**
+ * True for "this server does not understand that body" — the only answer
+ * worth retrying with the other shape. A 401, a 403 or a dead refresh token
+ * are real answers about the session, not about the wire format.
+ */
+export declare function isBodyRefusal(res: AccessTokenResponse): boolean;
+/**
+ * Ask for an access token, negotiating the body shape.
+ *
+ * `send` posts one body and reports the status plus the parsed JSON (null
+ * when there is no JSON to parse). It is called at most twice, and only twice
+ * on the first call of a process against a server whose shape we have not
+ * learned yet.
+ */
+export declare function requestAccessToken(providerId: string, send: (body: AccessTokenSelection) => Promise<AccessTokenResponse>, userId?: string): Promise<AccessTokenResponse>;
+//# sourceMappingURL=accountSelection.d.ts.map

package/types/betterAuth/accountSelection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountSelection.d.ts","sourceRoot":"","sources":["../../src/betterAuth/accountSelection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,gBAAgB,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAChC,CAAC;AAQF,gFAAgF;AAChF,wBAAgB,yBAAyB,SAExC;AAED,gEAAgE;AAChE,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,oBAAoB,CAEtE;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,oBAAoB,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAE/D;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,OAAO,CAAC,mBAAmB,CAAC,EAClE,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CAgB9B"}

package/types/betterAuth/expoAuthFlow.native.d.ts

@@ -28,7 +28,13 @@ export interface ExpoAuthFlow {
             name?: string;
         };
     } | null>;
-    /** Valid provider access token (server refreshes when expired). */
+    /**
+     * Valid provider access token (server refreshes when expired).
+     *
+     * `providerId` is kept for call-site readability only. The server picks the
+     * account from its signed account cookie, which is the sole selector a
+     * stateless Better Auth deployment has — see `accountSelection.ts`.
+     */
     getAccessToken(providerId: string): Promise<{
         accessToken?: string;
         accessTokenExpiresAt?: string;

package/types/betterAuth/expoAuthFlow.native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"expoAuthFlow.native.d.ts","sourceRoot":"","sources":["../../src/betterAuth/expoAuthFlow.native.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAmFH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,UAAU,IAAI,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACvF,mEAAmE;IACnE,cAAc,CACZ,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGvE;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsB3E;AAqED,wBAAgB,qBAAqB,IAAI,YAAY,GAAG,IAAI,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAgHjF"}
+{"version":3,"file":"expoAuthFlow.native.d.ts","sourceRoot":"","sources":["../../src/betterAuth/expoAuthFlow.native.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoFH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,UAAU,IAAI,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACvF;;;;;;OAMG;IACH,cAAc,CACZ,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGvE;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsB3E;AAqED,wBAAgB,qBAAqB,IAAI,YAAY,GAAG,IAAI,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAqHjF"}

package/types/frappeToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frappeToken.d.ts","sourceRoot":"","sources":["../src/frappeToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAgDH;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW1E;AA4DD,wDAAwD;AACxD,wBAAgB,wBAAwB,SAKvC;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,IAAI,MAAM,IAAI,CAiB/D"}
+{"version":3,"file":"frappeToken.d.ts","sourceRoot":"","sources":["../src/frappeToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiDH;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW1E;AAgED,wDAAwD;AACxD,wBAAgB,wBAAwB,SAKvC;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,IAAI,MAAM,IAAI,CAiB/D"}