@multiplatform.one/keycloak 7.83.1 → 7.83.2

package/dist/cjs/oauth/index.cjs

@@ -0,0 +1,454 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/oauth/index.ts
+var oauth_exports = {};
+__export(oauth_exports, {
+  OAuthError: () => OAuthError,
+  assertSecureIssuer: () => assertSecureIssuer,
+  base64UrlDecode: () => base64UrlDecode,
+  base64UrlEncode: () => base64UrlEncode,
+  buildAuthorizationUrl: () => buildAuthorizationUrl,
+  buildLogoutUrl: () => buildLogoutUrl,
+  callbackPageFailure: () => callbackPageFailure,
+  callbackPageSuccess: () => callbackPageSuccess,
+  createNonce: () => createNonce,
+  createPkcePair: () => createPkcePair,
+  createStateToken: () => createStateToken,
+  decodeJwt: () => decodeJwt,
+  defaultScopes: () => defaultScopes,
+  endSession: () => endSession,
+  escapeHtml: () => escapeHtml,
+  exchangeAuthorizationCode: () => exchangeAuthorizationCode,
+  isCallbackForState: () => isCallbackForState,
+  keycloakEndpoints: () => keycloakEndpoints,
+  parseAuthorizationCallback: () => parseAuthorizationCallback,
+  refreshAccessToken: () => refreshAccessToken,
+  renderCallbackPage: () => renderCallbackPage,
+  runLoopbackLogin: () => runLoopbackLogin,
+  validateIdToken: () => validateIdToken
+});
+module.exports = __toCommonJS(oauth_exports);
+
+// src/oauth/form.ts
+function encodeForm(params) {
+  return Object.entries(params).map(([key, value]) => `${encodeFormComponent(key)}=${encodeFormComponent(value)}`).join("&");
+}
+function encodeFormComponent(value) {
+  return encodeURIComponent(value).replace(/%20/g, "+").replace(/[!'()~]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+
+// src/oauth/authorizationUrl.ts
+var defaultScopes = ["openid", "profile", "email"];
+function buildAuthorizationUrl({
+  endpoints,
+  clientId,
+  redirectUri,
+  state,
+  codeChallenge,
+  nonce,
+  scopes = defaultScopes,
+  prompt,
+  loginHint
+}) {
+  return `${endpoints.authorization}?${encodeForm({
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    response_type: "code",
+    scope: scopes.join(" "),
+    state,
+    nonce,
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    ...prompt ? { prompt } : {},
+    ...loginHint ? { login_hint: loginHint } : {}
+  })}`;
+}
+function buildLogoutUrl({
+  endpoints,
+  clientId,
+  idToken,
+  postLogoutRedirectUri
+}) {
+  return `${endpoints.endSession}?${encodeForm({
+    client_id: clientId,
+    ...idToken ? { id_token_hint: idToken } : {},
+    ...postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}
+  })}`;
+}
+
+// src/oauth/errors.ts
+var OAuthError = class extends Error {
+  constructor(code, message, description) {
+    super(message ?? description ?? code);
+    this.name = "OAuthError";
+    this.code = code;
+    this.description = description;
+  }
+};
+
+// src/oauth/callback.ts
+function isCallbackForState(query, expectedState) {
+  return !!expectedState && query.state === expectedState;
+}
+function parseAuthorizationCallback(query, expectedState) {
+  if (query.error) {
+    throw new OAuthError(query.error, void 0, query.error_description);
+  }
+  if (!query.state) {
+    throw new OAuthError("invalid_state", "authorization response had no state parameter");
+  }
+  if (query.state !== expectedState) {
+    throw new OAuthError("invalid_state", "authorization response state did not match the request");
+  }
+  if (!query.code) {
+    throw new OAuthError("invalid_request", "authorization response had no code parameter");
+  }
+  return query.code;
+}
+
+// src/oauth/callbackPage.ts
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var callbackPageSuccess = {
+  heading: "Signed in",
+  detail: "You can close this tab and return to the app."
+};
+var callbackPageFailure = {
+  heading: "Sign-in failed",
+  detail: "Return to the app for the reason. You can close this tab."
+};
+function renderCallbackPage({ heading, detail }) {
+  return `<!doctype html><meta charset="utf-8"><title>${escapeHtml(heading)}</title><body style="font-family:system-ui,sans-serif;text-align:center;margin-top:4rem"><h1>${escapeHtml(heading)}</h1><p>${escapeHtml(detail)}</p>`;
+}
+
+// src/oauth/endpoints.ts
+var originPattern = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/([^/?#]*)/;
+var ipv4LoopbackPattern = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+function hostOf(authority) {
+  const afterUserinfo = authority.slice(authority.lastIndexOf("@") + 1);
+  if (afterUserinfo.startsWith("[")) {
+    return afterUserinfo.slice(1, afterUserinfo.indexOf("]")).toLowerCase();
+  }
+  const colon = afterUserinfo.indexOf(":");
+  return (colon === -1 ? afterUserinfo : afterUserinfo.slice(0, colon)).toLowerCase();
+}
+function isLoopbackHost(host) {
+  return host === "localhost" || host === "::1" || ipv4LoopbackPattern.test(host);
+}
+function assertSecureIssuer({ url, allowInsecureLoopbackHttp }) {
+  const match = originPattern.exec(url);
+  if (!match) {
+    throw new OAuthError(
+      "insecure_issuer",
+      `keycloak url must be an absolute http(s) url, got ${JSON.stringify(url)}`
+    );
+  }
+  const scheme = match[1].toLowerCase();
+  if (scheme === "https") return;
+  if (scheme !== "http") {
+    throw new OAuthError("insecure_issuer", `keycloak url must use https, got ${scheme}://`);
+  }
+  const host = hostOf(match[2]);
+  if (!isLoopbackHost(host)) {
+    throw new OAuthError(
+      "insecure_issuer",
+      `keycloak url must use https \u2014 refusing plaintext http to ${host}`
+    );
+  }
+  if (!allowInsecureLoopbackHttp) {
+    throw new OAuthError(
+      "insecure_issuer",
+      `keycloak url must use https \u2014 plaintext http to the loopback host ${host} needs an explicit allowInsecureLoopbackHttp`
+    );
+  }
+}
+function keycloakEndpoints(location) {
+  assertSecureIssuer(location);
+  const issuer = `${location.url.replace(/\/+$/, "")}/realms/${encodeURIComponent(location.realm)}`;
+  const base = `${issuer}/protocol/openid-connect`;
+  return {
+    issuer,
+    authorization: `${base}/auth`,
+    token: `${base}/token`,
+    endSession: `${base}/logout`,
+    userinfo: `${base}/userinfo`,
+    revocation: `${base}/revoke`
+  };
+}
+
+// src/oauth/jwt.ts
+var base64UrlAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var base64UrlValues = {};
+for (let i = 0; i < base64UrlAlphabet.length; i++) base64UrlValues[base64UrlAlphabet[i]] = i;
+function base64UrlDecode(value) {
+  const input = value.replace(/=+$/, "");
+  if (input.length % 4 === 1) {
+    throw new OAuthError("invalid_token", "base64url input has an impossible length");
+  }
+  const bytes = new Uint8Array(Math.floor(input.length * 3 / 4));
+  let out = 0;
+  for (let i = 0; i < input.length; i += 4) {
+    const remaining = input.length - i;
+    let chunk = 0;
+    for (let j = 0; j < 4; j++) {
+      const sextet = j < remaining ? base64UrlValues[input[i + j]] : 0;
+      if (sextet === void 0) {
+        throw new OAuthError(
+          "invalid_token",
+          "base64url input has a character outside the alphabet"
+        );
+      }
+      chunk = chunk << 6 | sextet;
+    }
+    bytes[out++] = chunk >> 16 & 255;
+    if (remaining > 2) bytes[out++] = chunk >> 8 & 255;
+    if (remaining > 3) bytes[out++] = chunk & 255;
+  }
+  return bytes;
+}
+function decodeJsonSegment(segment, what) {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(base64UrlDecode(segment)));
+  } catch {
+    throw new OAuthError("invalid_token", `jwt ${what} is not base64url-encoded json`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new OAuthError("invalid_token", `jwt ${what} is not a json object`);
+  }
+  return parsed;
+}
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1]) {
+    throw new OAuthError("invalid_token", "jwt is not three base64url segments");
+  }
+  return {
+    header: decodeJsonSegment(parts[0], "header"),
+    payload: decodeJsonSegment(parts[1], "payload"),
+    signature: parts[2]
+  };
+}
+
+// src/oauth/idToken.ts
+var defaultClockToleranceSeconds = 60;
+function reject(detail) {
+  throw new OAuthError("invalid_id_token", `id token rejected: ${detail}`);
+}
+function numericClaim(claims, name) {
+  const value = claims[name];
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    reject(`${name} is not a number`);
+  }
+  return value;
+}
+function validateIdToken(idToken, validation) {
+  const { header, payload } = decodeJwt(idToken);
+  const claims = payload;
+  const now = validation.now ?? Math.floor(Date.now() / 1e3);
+  const tolerance = validation.clockToleranceSeconds ?? defaultClockToleranceSeconds;
+  const alg = header.alg;
+  if (typeof alg !== "string" || !alg) reject("header has no alg");
+  if (alg.toLowerCase() === "none") reject("header declares alg=none");
+  if (claims.iss !== validation.issuer) {
+    reject(`iss ${JSON.stringify(claims.iss)} is not ${JSON.stringify(validation.issuer)}`);
+  }
+  const audiences = typeof claims.aud === "string" ? [claims.aud] : Array.isArray(claims.aud) ? claims.aud : [];
+  if (!audiences.length) reject("aud is missing");
+  if (!audiences.includes(validation.clientId)) {
+    reject(`aud ${JSON.stringify(claims.aud)} does not include ${validation.clientId}`);
+  }
+  if (claims.azp === void 0) {
+    if (audiences.length > 1) reject("aud has multiple values but azp is missing");
+  } else if (claims.azp !== validation.clientId) {
+    reject(`azp ${JSON.stringify(claims.azp)} is not ${validation.clientId}`);
+  }
+  const exp = numericClaim(claims, "exp");
+  if (exp === void 0) reject("exp is missing");
+  if (now >= exp + tolerance) reject("exp is in the past");
+  const iat = numericClaim(claims, "iat");
+  if (iat === void 0) reject("iat is missing");
+  if (iat > now + tolerance) reject("iat is in the future");
+  const nbf = numericClaim(claims, "nbf");
+  if (nbf !== void 0 && now < nbf - tolerance) reject("nbf is in the future");
+  if (validation.nonce !== void 0 && claims.nonce !== validation.nonce) {
+    reject("nonce does not match the authorization request");
+  }
+  if (typeof claims.sub !== "string" || !claims.sub) reject("sub is missing");
+  return claims;
+}
+
+// src/oauth/pkce.ts
+var base64UrlAlphabet2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function base64UrlEncode(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const remaining = bytes.length - i;
+    const chunk = bytes[i] << 16 | (remaining > 1 ? bytes[i + 1] : 0) << 8 | (remaining > 2 ? bytes[i + 2] : 0);
+    out += base64UrlAlphabet2[chunk >> 18 & 63];
+    out += base64UrlAlphabet2[chunk >> 12 & 63];
+    if (remaining > 1) out += base64UrlAlphabet2[chunk >> 6 & 63];
+    if (remaining > 2) out += base64UrlAlphabet2[chunk & 63];
+  }
+  return out;
+}
+function createPkcePair(crypto) {
+  const verifier = base64UrlEncode(crypto.randomBytes(32));
+  const challenge = base64UrlEncode(crypto.sha256(new TextEncoder().encode(verifier)));
+  return { verifier, challenge, method: "S256" };
+}
+function createStateToken(crypto) {
+  return base64UrlEncode(crypto.randomBytes(16));
+}
+function createNonce(crypto) {
+  return base64UrlEncode(crypto.randomBytes(16));
+}
+
+// src/oauth/tokenExchange.ts
+var formHeaders = {
+  "Content-Type": "application/x-www-form-urlencoded",
+  Accept: "application/json"
+};
+async function postForm(fetchImpl, endpoint, form) {
+  const response = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: formHeaders,
+    body: encodeForm(form)
+  });
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    throw new OAuthError(
+      "invalid_response",
+      `token endpoint returned ${response.status} with a non-JSON body`
+    );
+  }
+  if (payload.error) {
+    throw new OAuthError(payload.error, void 0, payload.error_description);
+  }
+  if (!response.ok) {
+    throw new OAuthError("invalid_response", `token endpoint returned ${response.status}`);
+  }
+  return payload;
+}
+function toTokenSet(payload, validation) {
+  if (!payload.access_token) {
+    throw new OAuthError("invalid_response", "token response had no access_token");
+  }
+  const claims = payload.id_token ? validateIdToken(payload.id_token, {
+    issuer: validation.endpoints.issuer,
+    clientId: validation.clientId,
+    nonce: validation.nonce,
+    now: validation.now
+  }) : void 0;
+  return {
+    accessToken: payload.access_token,
+    idToken: payload.id_token,
+    idTokenClaims: claims,
+    refreshToken: payload.refresh_token,
+    expiresIn: payload.expires_in,
+    refreshExpiresIn: payload.refresh_expires_in,
+    tokenType: payload.token_type,
+    scope: payload.scope
+  };
+}
+async function exchangeAuthorizationCode(fetchImpl, { endpoints, clientId, code, codeVerifier, redirectUri, nonce, now }) {
+  if (!nonce) {
+    throw new OAuthError(
+      "invalid_request",
+      "nonce is required on the authorization-code grant \u2014 it is the only thing binding the id token to this login"
+    );
+  }
+  return toTokenSet(
+    await postForm(fetchImpl, endpoints.token, {
+      grant_type: "authorization_code",
+      client_id: clientId,
+      code,
+      code_verifier: codeVerifier,
+      redirect_uri: redirectUri
+    }),
+    { endpoints, clientId, nonce, now }
+  );
+}
+async function refreshAccessToken(fetchImpl, { endpoints, clientId, refreshToken, now }) {
+  return toTokenSet(
+    await postForm(fetchImpl, endpoints.token, {
+      grant_type: "refresh_token",
+      client_id: clientId,
+      refresh_token: refreshToken
+    }),
+    // No nonce on the refresh grant: there is no fresh authorization request
+    // to bind to. Every other claim is still checked.
+    { endpoints, clientId, now }
+  );
+}
+async function endSession(fetchImpl, { endpoints, clientId, refreshToken }) {
+  const response = await fetchImpl(endpoints.endSession, {
+    method: "POST",
+    headers: formHeaders,
+    body: encodeForm({ client_id: clientId, refresh_token: refreshToken })
+  });
+  if (!response.ok) {
+    throw new OAuthError("logout_failed", `end-session endpoint returned ${response.status}`);
+  }
+}
+
+// src/oauth/loopbackFlow.ts
+async function runLoopbackLogin(transport, config) {
+  const endpoints = keycloakEndpoints(config);
+  const pkce = createPkcePair(transport.crypto);
+  const state = createStateToken(transport.crypto);
+  const nonce = createNonce(transport.crypto);
+  const scopes = config.scopes ?? defaultScopes;
+  const listener = await transport.listen(state);
+  try {
+    await transport.openBrowser(
+      buildAuthorizationUrl({
+        endpoints,
+        clientId: config.clientId,
+        redirectUri: listener.redirectUri,
+        state,
+        codeChallenge: pkce.challenge,
+        nonce,
+        scopes,
+        prompt: config.prompt,
+        loginHint: config.loginHint
+      })
+    );
+    const code = parseAuthorizationCallback(await listener.waitForCallback(), state);
+    const tokens = await exchangeAuthorizationCode(transport.fetch, {
+      endpoints,
+      clientId: config.clientId,
+      code,
+      codeVerifier: pkce.verifier,
+      redirectUri: listener.redirectUri,
+      nonce
+    });
+    if (scopes.includes("openid") && !tokens.idToken) {
+      throw new OAuthError("invalid_response", "openid was requested but no id_token came back");
+    }
+    return tokens;
+  } finally {
+    listener.close();
+  }
+}

package/dist/cjs/one.cjs

@@ -0,0 +1,82 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/one.ts
+var one_exports = {};
+__export(one_exports, {
+  createAuth: () => createAuth
+});
+module.exports = __toCommonJS(one_exports);
+var import_better_auth = require("better-auth");
+var import_plugins = require("better-auth/plugins");
+var import_expo = require("@better-auth/expo");
+var _auth;
+function createAuth(config) {
+  if (_auth) return _auth;
+  const baseUrl = config.baseUrl || (typeof process !== "undefined" ? process.env?.BASE_URL || `http://localhost:${process.env?.ONE_PORT || "3000"}` : "http://localhost:3000");
+  const keycloakBaseUrl = config.keycloak?.baseUrl || `${baseUrl}/auth`;
+  const realm = config.keycloak?.realm || "master";
+  const issuer = `${keycloakBaseUrl}/realms/${realm}`;
+  const envTrustedOrigins = (typeof process !== "undefined" && process.env?.KEYCLOAK_TRUSTED_ORIGINS || "").split(",").map((origin) => origin.trim()).filter(Boolean);
+  _auth = (0, import_better_auth.betterAuth)({
+    basePath: "/api/auth",
+    baseURL: baseUrl,
+    secret: config.secret || "",
+    trustedOrigins: [
+      .../* @__PURE__ */ new Set([
+        baseUrl,
+        keycloakBaseUrl,
+        ...config.expoScheme ? [`${config.expoScheme}://`] : [],
+        ...envTrustedOrigins,
+        ...config.trustedOrigins || []
+      ])
+    ],
+    advanced: {
+      // better-auth skips origin checks entirely when NODE_ENV=test; pin the
+      // check on so the trustedOrigins contract is enforced (and testable)
+      // regardless of environment.
+      disableOriginCheck: false
+    },
+    session: {
+      cookieCache: {
+        enabled: true,
+        maxAge: 7 * 24 * 60 * 60,
+        strategy: "jwe",
+        refreshCache: true
+      }
+    },
+    account: {
+      storeStateStrategy: "cookie",
+      storeAccountCookie: true
+    },
+    plugins: [
+      (0, import_expo.expo)(),
+      (0, import_plugins.genericOAuth)({
+        config: [
+          (0, import_plugins.keycloak)({
+            clientId: config.keycloak.clientId || "",
+            clientSecret: config.keycloak.clientSecret || "",
+            issuer
+          })
+        ]
+      })
+    ]
+  });
+  return _auth;
+}

package/dist/esm/oauth/index.mjs

@@ -0,0 +1,431 @@
+// src/oauth/form.ts
+function encodeForm(params) {
+  return Object.entries(params).map(([key, value]) => `${encodeFormComponent(key)}=${encodeFormComponent(value)}`).join("&");
+}
+function encodeFormComponent(value) {
+  return encodeURIComponent(value).replace(/%20/g, "+").replace(/[!'()~]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+
+// src/oauth/authorizationUrl.ts
+var defaultScopes = ["openid", "profile", "email"];
+function buildAuthorizationUrl({
+  endpoints,
+  clientId,
+  redirectUri,
+  state,
+  codeChallenge,
+  nonce,
+  scopes = defaultScopes,
+  prompt,
+  loginHint
+}) {
+  return `${endpoints.authorization}?${encodeForm({
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    response_type: "code",
+    scope: scopes.join(" "),
+    state,
+    nonce,
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    ...prompt ? { prompt } : {},
+    ...loginHint ? { login_hint: loginHint } : {}
+  })}`;
+}
+function buildLogoutUrl({
+  endpoints,
+  clientId,
+  idToken,
+  postLogoutRedirectUri
+}) {
+  return `${endpoints.endSession}?${encodeForm({
+    client_id: clientId,
+    ...idToken ? { id_token_hint: idToken } : {},
+    ...postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}
+  })}`;
+}
+
+// src/oauth/errors.ts
+var OAuthError = class extends Error {
+  constructor(code, message, description) {
+    super(message ?? description ?? code);
+    this.name = "OAuthError";
+    this.code = code;
+    this.description = description;
+  }
+};
+
+// src/oauth/callback.ts
+function isCallbackForState(query, expectedState) {
+  return !!expectedState && query.state === expectedState;
+}
+function parseAuthorizationCallback(query, expectedState) {
+  if (query.error) {
+    throw new OAuthError(query.error, void 0, query.error_description);
+  }
+  if (!query.state) {
+    throw new OAuthError("invalid_state", "authorization response had no state parameter");
+  }
+  if (query.state !== expectedState) {
+    throw new OAuthError("invalid_state", "authorization response state did not match the request");
+  }
+  if (!query.code) {
+    throw new OAuthError("invalid_request", "authorization response had no code parameter");
+  }
+  return query.code;
+}
+
+// src/oauth/callbackPage.ts
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var callbackPageSuccess = {
+  heading: "Signed in",
+  detail: "You can close this tab and return to the app."
+};
+var callbackPageFailure = {
+  heading: "Sign-in failed",
+  detail: "Return to the app for the reason. You can close this tab."
+};
+function renderCallbackPage({ heading, detail }) {
+  return `<!doctype html><meta charset="utf-8"><title>${escapeHtml(heading)}</title><body style="font-family:system-ui,sans-serif;text-align:center;margin-top:4rem"><h1>${escapeHtml(heading)}</h1><p>${escapeHtml(detail)}</p>`;
+}
+
+// src/oauth/endpoints.ts
+var originPattern = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/([^/?#]*)/;
+var ipv4LoopbackPattern = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+function hostOf(authority) {
+  const afterUserinfo = authority.slice(authority.lastIndexOf("@") + 1);
+  if (afterUserinfo.startsWith("[")) {
+    return afterUserinfo.slice(1, afterUserinfo.indexOf("]")).toLowerCase();
+  }
+  const colon = afterUserinfo.indexOf(":");
+  return (colon === -1 ? afterUserinfo : afterUserinfo.slice(0, colon)).toLowerCase();
+}
+function isLoopbackHost(host) {
+  return host === "localhost" || host === "::1" || ipv4LoopbackPattern.test(host);
+}
+function assertSecureIssuer({ url, allowInsecureLoopbackHttp }) {
+  const match = originPattern.exec(url);
+  if (!match) {
+    throw new OAuthError(
+      "insecure_issuer",
+      `keycloak url must be an absolute http(s) url, got ${JSON.stringify(url)}`
+    );
+  }
+  const scheme = match[1].toLowerCase();
+  if (scheme === "https") return;
+  if (scheme !== "http") {
+    throw new OAuthError("insecure_issuer", `keycloak url must use https, got ${scheme}://`);
+  }
+  const host = hostOf(match[2]);
+  if (!isLoopbackHost(host)) {
+    throw new OAuthError(
+      "insecure_issuer",
+      `keycloak url must use https \u2014 refusing plaintext http to ${host}`
+    );
+  }
+  if (!allowInsecureLoopbackHttp) {
+    throw new OAuthError(
+      "insecure_issuer",
+      `keycloak url must use https \u2014 plaintext http to the loopback host ${host} needs an explicit allowInsecureLoopbackHttp`
+    );
+  }
+}
+function keycloakEndpoints(location) {
+  assertSecureIssuer(location);
+  const issuer = `${location.url.replace(/\/+$/, "")}/realms/${encodeURIComponent(location.realm)}`;
+  const base = `${issuer}/protocol/openid-connect`;
+  return {
+    issuer,
+    authorization: `${base}/auth`,
+    token: `${base}/token`,
+    endSession: `${base}/logout`,
+    userinfo: `${base}/userinfo`,
+    revocation: `${base}/revoke`
+  };
+}
+
+// src/oauth/jwt.ts
+var base64UrlAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var base64UrlValues = {};
+for (let i = 0; i < base64UrlAlphabet.length; i++) base64UrlValues[base64UrlAlphabet[i]] = i;
+function base64UrlDecode(value) {
+  const input = value.replace(/=+$/, "");
+  if (input.length % 4 === 1) {
+    throw new OAuthError("invalid_token", "base64url input has an impossible length");
+  }
+  const bytes = new Uint8Array(Math.floor(input.length * 3 / 4));
+  let out = 0;
+  for (let i = 0; i < input.length; i += 4) {
+    const remaining = input.length - i;
+    let chunk = 0;
+    for (let j = 0; j < 4; j++) {
+      const sextet = j < remaining ? base64UrlValues[input[i + j]] : 0;
+      if (sextet === void 0) {
+        throw new OAuthError(
+          "invalid_token",
+          "base64url input has a character outside the alphabet"
+        );
+      }
+      chunk = chunk << 6 | sextet;
+    }
+    bytes[out++] = chunk >> 16 & 255;
+    if (remaining > 2) bytes[out++] = chunk >> 8 & 255;
+    if (remaining > 3) bytes[out++] = chunk & 255;
+  }
+  return bytes;
+}
+function decodeJsonSegment(segment, what) {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(base64UrlDecode(segment)));
+  } catch {
+    throw new OAuthError("invalid_token", `jwt ${what} is not base64url-encoded json`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new OAuthError("invalid_token", `jwt ${what} is not a json object`);
+  }
+  return parsed;
+}
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1]) {
+    throw new OAuthError("invalid_token", "jwt is not three base64url segments");
+  }
+  return {
+    header: decodeJsonSegment(parts[0], "header"),
+    payload: decodeJsonSegment(parts[1], "payload"),
+    signature: parts[2]
+  };
+}
+
+// src/oauth/idToken.ts
+var defaultClockToleranceSeconds = 60;
+function reject(detail) {
+  throw new OAuthError("invalid_id_token", `id token rejected: ${detail}`);
+}
+function numericClaim(claims, name) {
+  const value = claims[name];
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    reject(`${name} is not a number`);
+  }
+  return value;
+}
+function validateIdToken(idToken, validation) {
+  const { header, payload } = decodeJwt(idToken);
+  const claims = payload;
+  const now = validation.now ?? Math.floor(Date.now() / 1e3);
+  const tolerance = validation.clockToleranceSeconds ?? defaultClockToleranceSeconds;
+  const alg = header.alg;
+  if (typeof alg !== "string" || !alg) reject("header has no alg");
+  if (alg.toLowerCase() === "none") reject("header declares alg=none");
+  if (claims.iss !== validation.issuer) {
+    reject(`iss ${JSON.stringify(claims.iss)} is not ${JSON.stringify(validation.issuer)}`);
+  }
+  const audiences = typeof claims.aud === "string" ? [claims.aud] : Array.isArray(claims.aud) ? claims.aud : [];
+  if (!audiences.length) reject("aud is missing");
+  if (!audiences.includes(validation.clientId)) {
+    reject(`aud ${JSON.stringify(claims.aud)} does not include ${validation.clientId}`);
+  }
+  if (claims.azp === void 0) {
+    if (audiences.length > 1) reject("aud has multiple values but azp is missing");
+  } else if (claims.azp !== validation.clientId) {
+    reject(`azp ${JSON.stringify(claims.azp)} is not ${validation.clientId}`);
+  }
+  const exp = numericClaim(claims, "exp");
+  if (exp === void 0) reject("exp is missing");
+  if (now >= exp + tolerance) reject("exp is in the past");
+  const iat = numericClaim(claims, "iat");
+  if (iat === void 0) reject("iat is missing");
+  if (iat > now + tolerance) reject("iat is in the future");
+  const nbf = numericClaim(claims, "nbf");
+  if (nbf !== void 0 && now < nbf - tolerance) reject("nbf is in the future");
+  if (validation.nonce !== void 0 && claims.nonce !== validation.nonce) {
+    reject("nonce does not match the authorization request");
+  }
+  if (typeof claims.sub !== "string" || !claims.sub) reject("sub is missing");
+  return claims;
+}
+
+// src/oauth/pkce.ts
+var base64UrlAlphabet2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function base64UrlEncode(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const remaining = bytes.length - i;
+    const chunk = bytes[i] << 16 | (remaining > 1 ? bytes[i + 1] : 0) << 8 | (remaining > 2 ? bytes[i + 2] : 0);
+    out += base64UrlAlphabet2[chunk >> 18 & 63];
+    out += base64UrlAlphabet2[chunk >> 12 & 63];
+    if (remaining > 1) out += base64UrlAlphabet2[chunk >> 6 & 63];
+    if (remaining > 2) out += base64UrlAlphabet2[chunk & 63];
+  }
+  return out;
+}
+function createPkcePair(crypto) {
+  const verifier = base64UrlEncode(crypto.randomBytes(32));
+  const challenge = base64UrlEncode(crypto.sha256(new TextEncoder().encode(verifier)));
+  return { verifier, challenge, method: "S256" };
+}
+function createStateToken(crypto) {
+  return base64UrlEncode(crypto.randomBytes(16));
+}
+function createNonce(crypto) {
+  return base64UrlEncode(crypto.randomBytes(16));
+}
+
+// src/oauth/tokenExchange.ts
+var formHeaders = {
+  "Content-Type": "application/x-www-form-urlencoded",
+  Accept: "application/json"
+};
+async function postForm(fetchImpl, endpoint, form) {
+  const response = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: formHeaders,
+    body: encodeForm(form)
+  });
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    throw new OAuthError(
+      "invalid_response",
+      `token endpoint returned ${response.status} with a non-JSON body`
+    );
+  }
+  if (payload.error) {
+    throw new OAuthError(payload.error, void 0, payload.error_description);
+  }
+  if (!response.ok) {
+    throw new OAuthError("invalid_response", `token endpoint returned ${response.status}`);
+  }
+  return payload;
+}
+function toTokenSet(payload, validation) {
+  if (!payload.access_token) {
+    throw new OAuthError("invalid_response", "token response had no access_token");
+  }
+  const claims = payload.id_token ? validateIdToken(payload.id_token, {
+    issuer: validation.endpoints.issuer,
+    clientId: validation.clientId,
+    nonce: validation.nonce,
+    now: validation.now
+  }) : void 0;
+  return {
+    accessToken: payload.access_token,
+    idToken: payload.id_token,
+    idTokenClaims: claims,
+    refreshToken: payload.refresh_token,
+    expiresIn: payload.expires_in,
+    refreshExpiresIn: payload.refresh_expires_in,
+    tokenType: payload.token_type,
+    scope: payload.scope
+  };
+}
+async function exchangeAuthorizationCode(fetchImpl, { endpoints, clientId, code, codeVerifier, redirectUri, nonce, now }) {
+  if (!nonce) {
+    throw new OAuthError(
+      "invalid_request",
+      "nonce is required on the authorization-code grant \u2014 it is the only thing binding the id token to this login"
+    );
+  }
+  return toTokenSet(
+    await postForm(fetchImpl, endpoints.token, {
+      grant_type: "authorization_code",
+      client_id: clientId,
+      code,
+      code_verifier: codeVerifier,
+      redirect_uri: redirectUri
+    }),
+    { endpoints, clientId, nonce, now }
+  );
+}
+async function refreshAccessToken(fetchImpl, { endpoints, clientId, refreshToken, now }) {
+  return toTokenSet(
+    await postForm(fetchImpl, endpoints.token, {
+      grant_type: "refresh_token",
+      client_id: clientId,
+      refresh_token: refreshToken
+    }),
+    // No nonce on the refresh grant: there is no fresh authorization request
+    // to bind to. Every other claim is still checked.
+    { endpoints, clientId, now }
+  );
+}
+async function endSession(fetchImpl, { endpoints, clientId, refreshToken }) {
+  const response = await fetchImpl(endpoints.endSession, {
+    method: "POST",
+    headers: formHeaders,
+    body: encodeForm({ client_id: clientId, refresh_token: refreshToken })
+  });
+  if (!response.ok) {
+    throw new OAuthError("logout_failed", `end-session endpoint returned ${response.status}`);
+  }
+}
+
+// src/oauth/loopbackFlow.ts
+async function runLoopbackLogin(transport, config) {
+  const endpoints = keycloakEndpoints(config);
+  const pkce = createPkcePair(transport.crypto);
+  const state = createStateToken(transport.crypto);
+  const nonce = createNonce(transport.crypto);
+  const scopes = config.scopes ?? defaultScopes;
+  const listener = await transport.listen(state);
+  try {
+    await transport.openBrowser(
+      buildAuthorizationUrl({
+        endpoints,
+        clientId: config.clientId,
+        redirectUri: listener.redirectUri,
+        state,
+        codeChallenge: pkce.challenge,
+        nonce,
+        scopes,
+        prompt: config.prompt,
+        loginHint: config.loginHint
+      })
+    );
+    const code = parseAuthorizationCallback(await listener.waitForCallback(), state);
+    const tokens = await exchangeAuthorizationCode(transport.fetch, {
+      endpoints,
+      clientId: config.clientId,
+      code,
+      codeVerifier: pkce.verifier,
+      redirectUri: listener.redirectUri,
+      nonce
+    });
+    if (scopes.includes("openid") && !tokens.idToken) {
+      throw new OAuthError("invalid_response", "openid was requested but no id_token came back");
+    }
+    return tokens;
+  } finally {
+    listener.close();
+  }
+}
+export {
+  OAuthError,
+  assertSecureIssuer,
+  base64UrlDecode,
+  base64UrlEncode,
+  buildAuthorizationUrl,
+  buildLogoutUrl,
+  callbackPageFailure,
+  callbackPageSuccess,
+  createNonce,
+  createPkcePair,
+  createStateToken,
+  decodeJwt,
+  defaultScopes,
+  endSession,
+  escapeHtml,
+  exchangeAuthorizationCode,
+  isCallbackForState,
+  keycloakEndpoints,
+  parseAuthorizationCallback,
+  refreshAccessToken,
+  renderCallbackPage,
+  runLoopbackLogin,
+  validateIdToken
+};

package/dist/esm/one.mjs

@@ -0,0 +1,61 @@
+// src/one.ts
+import { betterAuth } from "better-auth";
+import { genericOAuth, keycloak } from "better-auth/plugins";
+import { expo } from "@better-auth/expo";
+var _auth;
+function createAuth(config) {
+  if (_auth) return _auth;
+  const baseUrl = config.baseUrl || (typeof process !== "undefined" ? process.env?.BASE_URL || `http://localhost:${process.env?.ONE_PORT || "3000"}` : "http://localhost:3000");
+  const keycloakBaseUrl = config.keycloak?.baseUrl || `${baseUrl}/auth`;
+  const realm = config.keycloak?.realm || "master";
+  const issuer = `${keycloakBaseUrl}/realms/${realm}`;
+  const envTrustedOrigins = (typeof process !== "undefined" && process.env?.KEYCLOAK_TRUSTED_ORIGINS || "").split(",").map((origin) => origin.trim()).filter(Boolean);
+  _auth = betterAuth({
+    basePath: "/api/auth",
+    baseURL: baseUrl,
+    secret: config.secret || "",
+    trustedOrigins: [
+      .../* @__PURE__ */ new Set([
+        baseUrl,
+        keycloakBaseUrl,
+        ...config.expoScheme ? [`${config.expoScheme}://`] : [],
+        ...envTrustedOrigins,
+        ...config.trustedOrigins || []
+      ])
+    ],
+    advanced: {
+      // better-auth skips origin checks entirely when NODE_ENV=test; pin the
+      // check on so the trustedOrigins contract is enforced (and testable)
+      // regardless of environment.
+      disableOriginCheck: false
+    },
+    session: {
+      cookieCache: {
+        enabled: true,
+        maxAge: 7 * 24 * 60 * 60,
+        strategy: "jwe",
+        refreshCache: true
+      }
+    },
+    account: {
+      storeStateStrategy: "cookie",
+      storeAccountCookie: true
+    },
+    plugins: [
+      expo(),
+      genericOAuth({
+        config: [
+          keycloak({
+            clientId: config.keycloak.clientId || "",
+            clientSecret: config.keycloak.clientSecret || "",
+            issuer
+          })
+        ]
+      })
+    ]
+  });
+  return _auth;
+}
+export {
+  createAuth
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/keycloak",
-  "version": "7.83.1",
+  "version": "7.83.2",
   "description": "keycloak client for multiplatform.one ecosystem",
   "keywords": [
     "auth",
@@ -31,25 +31,30 @@
   "exports": {
     "./package.json": "./package.json",
     ".": {
+      "source": "./src/index.ts",
       "react-native": {
         "types": "./types/index.d.ts",
         "import": "./dist/esm/index.native.js",
         "require": "./dist/cjs/index.native.cjs"
       },
       "types": "./types/index.d.ts",
-      "import": "./src/index.ts",
-      "require": "./src/index.ts",
-      "default": "./src/index.ts"
+      "import": "./dist/esm/index.mjs",
+      "require": "./dist/cjs/index.cjs",
+      "default": "./dist/esm/index.mjs"
     },
     "./one": {
+      "source": "./src/one.ts",
       "types": "./types/one.d.ts",
-      "import": "./src/one.ts",
-      "require": "./src/one.ts"
+      "import": "./dist/esm/one.mjs",
+      "require": "./dist/cjs/one.cjs",
+      "default": "./dist/esm/one.mjs"
     },
     "./oauth": {
+      "source": "./src/oauth/index.ts",
       "types": "./types/oauth/index.d.ts",
-      "import": "./src/oauth/index.ts",
-      "require": "./src/oauth/index.ts"
+      "import": "./dist/esm/oauth/index.mjs",
+      "require": "./dist/cjs/oauth/index.cjs",
+      "default": "./dist/esm/oauth/index.mjs"
     }
   },
   "publishConfig": {
@@ -57,16 +62,16 @@
   },
   "dependencies": {
     "@better-auth/expo": "~1.6.33",
-    "@multiplatform.one/keycloak-js": "^7.83.1",
-    "@multiplatform.one/store": "^7.83.1",
+    "@multiplatform.one/keycloak-js": "^7.83.2",
+    "@multiplatform.one/store": "^7.83.2",
     "better-auth": "~1.6.33",
     "jwt-decode": "^4.0.0"
   },
   "devDependencies": {
-    "@multiplatform.one/config": "7.83.1",
-    "@multiplatform.one/logger": "7.83.1",
-    "@multiplatform.one/platform": "7.83.1",
-    "@multiplatform.one/test-utils": "7.83.1",
+    "@multiplatform.one/config": "7.83.2",
+    "@multiplatform.one/logger": "7.83.2",
+    "@multiplatform.one/platform": "7.83.2",
+    "@multiplatform.one/test-utils": "7.83.2",
     "@tamagui/build": "2.7.6",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",
@@ -80,8 +85,8 @@
     "vitest": "^4.1.5"
   },
   "peerDependencies": {
-    "@multiplatform.one/logger": "^7.83.1",
-    "@multiplatform.one/platform": "^7.83.1",
+    "@multiplatform.one/logger": "^7.83.2",
+    "@multiplatform.one/platform": "^7.83.2",
     "react": "^19.1.0",
     "react-native": ">=0.83.0"
   },