@multiplatform.one/keycloak 7.87.1 → 7.88.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/keycloak",
-  "version": "7.87.1",
+  "version": "7.88.1",
   "description": "keycloak client for multiplatform.one ecosystem",
   "keywords": [
     "auth",
@@ -62,16 +62,16 @@
   },
   "dependencies": {
     "@better-auth/expo": "~1.6.33",
-    "@multiplatform.one/keycloak-js": "^7.87.1",
-    "@multiplatform.one/store": "^7.87.1",
+    "@multiplatform.one/keycloak-js": "^7.88.1",
+    "@multiplatform.one/store": "^7.88.1",
     "better-auth": "~1.6.33",
     "jwt-decode": "^4.0.0"
   },
   "devDependencies": {
-    "@multiplatform.one/config": "7.87.1",
-    "@multiplatform.one/logger": "7.87.1",
-    "@multiplatform.one/platform": "7.87.1",
-    "@multiplatform.one/test-utils": "7.87.1",
+    "@multiplatform.one/config": "7.88.1",
+    "@multiplatform.one/logger": "7.88.1",
+    "@multiplatform.one/platform": "7.88.1",
+    "@multiplatform.one/test-utils": "7.88.1",
     "@tamagui/build": "2.7.6",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",
@@ -85,8 +85,8 @@
     "vitest": "^4.1.12"
   },
   "peerDependencies": {
-    "@multiplatform.one/logger": "^7.87.1",
-    "@multiplatform.one/platform": "^7.87.1",
+    "@multiplatform.one/logger": "^7.88.1",
+    "@multiplatform.one/platform": "^7.88.1",
     "react": "^19.1.0",
     "react-native": ">=0.83.0"
   },

package/src/one.expoCallback.spec.ts

@@ -0,0 +1,107 @@
+// @vitest-environment jsdom
+// jsdom, not the package's happy-dom: happy-dom's Request and Response drop
+// Cookie and Set-Cookie (forbidden headers in a browser), and the cookies are
+// the point here. jsdom leaves Node's own fetch classes in place.
+/**
+ * FZ-8696: native sign-in through createAuth must come back signed in.
+ *
+ * createAuth wires Keycloak through Better Auth's genericOAuth, whose callback
+ * is /oauth2/callback/keycloak. @better-auth/expo hands the session to the
+ * app by appending ?cookie=<set-cookie> to the app-scheme redirect, but only
+ * on the callback paths its after-hook matches. Under better-auth 1.6.30 that
+ * was /callback* alone, so the genericOAuth callback came back as a bare
+ * <scheme>:/// and the app stayed signed out with no error (Lookout FZ-8618).
+ *
+ * This drives the real sign-in and callback against a stubbed Keycloak, under
+ * whatever better-auth version MPO pins, and checks the session rides the
+ * redirect.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createAuth } from "./one";
+
+const appUrl = "http://app.test";
+const keycloakUrl = "http://kc.test/auth";
+const realm = "mpo";
+const issuer = `${keycloakUrl}/realms/${realm}`;
+const scheme = "mpo-test";
+
+function stubKeycloak() {
+  const realFetch = globalThis.fetch;
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+      const json = (body: unknown) =>
+        new Response(JSON.stringify(body), { headers: { "content-type": "application/json" } });
+      if (url === `${issuer}/.well-known/openid-configuration`) {
+        return json({
+          issuer,
+          authorization_endpoint: `${issuer}/protocol/openid-connect/auth`,
+          token_endpoint: `${issuer}/protocol/openid-connect/token`,
+          userinfo_endpoint: `${issuer}/protocol/openid-connect/userinfo`,
+        });
+      }
+      if (url === `${issuer}/protocol/openid-connect/token`) {
+        return json({ access_token: "access", token_type: "Bearer", expires_in: 300 });
+      }
+      if (url === `${issuer}/protocol/openid-connect/userinfo`) {
+        return json({
+          sub: "user-1",
+          email: "ada@example.test",
+          name: "Ada",
+          email_verified: true,
+        });
+      }
+      return realFetch(input, init);
+    }),
+  );
+}
+
+beforeEach(stubKeycloak);
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe("createAuth native sign-in (FZ-8696)", () => {
+  it("hands the session back on the genericOAuth callback's app-scheme redirect", async () => {
+    const auth = createAuth({
+      baseUrl: appUrl,
+      secret: "a-test-secret-that-is-long-enough-32",
+      expoScheme: scheme,
+      keycloak: { baseUrl: keycloakUrl, realm, clientId: "app", clientSecret: "secret" },
+    });
+
+    const signIn = await auth.handler(
+      new Request(`${appUrl}/api/auth/sign-in/oauth2`, {
+        method: "POST",
+        headers: { "content-type": "application/json", "expo-origin": `${scheme}://` },
+        body: JSON.stringify({
+          providerId: "keycloak",
+          callbackURL: `${scheme}://`,
+          disableRedirect: true,
+        }),
+      }),
+    );
+    expect(signIn.status).toBe(200);
+    const { url } = (await signIn.json()) as { url: string };
+    const state = new URL(url).searchParams.get("state");
+    expect(state).toBeTruthy();
+    const cookies = signIn.headers
+      .getSetCookie()
+      .map((cookie) => cookie.split(";")[0])
+      .join("; ");
+    expect(cookies).toMatch(/oauth_state=/);
+
+    const callback = await auth.handler(
+      new Request(`${appUrl}/api/auth/oauth2/callback/keycloak?code=abc&state=${state}`, {
+        headers: { cookie: cookies },
+      }),
+    );
+    expect(callback.status).toBe(302);
+    const location = new URL(callback.headers.get("location") ?? "");
+    expect(location.protocol).toBe(`${scheme}:`);
+    const handedBack = location.searchParams.get("cookie") ?? "";
+    expect(handedBack, `redirect was ${location.href}`).toMatch(/better-auth\.session_token=/);
+  });
+});