@multiplatform.one/wallet 7.7.2

package/src/main/java/com/bitspur/keycloak/siwe/siu/authenticators/browser/SiuBrowserAuthenticatorFactory.java

@@ -0,0 +1,96 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siu/authenticators/browser/SiuBrowserAuthenticatorFactory.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * Factory for the SIU browser authenticator.
+ */
+
+package com.bitspur.keycloak.siwe.siu.authenticators.browser;
+
+import java.util.List;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.Authenticator;
+import org.keycloak.authentication.AuthenticatorFactory;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+
+/**
+ * Factory for creating SIU browser authenticator instances.
+ */
+public class SiuBrowserAuthenticatorFactory implements AuthenticatorFactory {
+    public static final String ID = "siu-browser-authenticator";
+    public static final String DISPLAY_NAME = "SIU Browser Authenticator";
+
+    private static final SiuBrowserAuthenticator SINGLETON = new SiuBrowserAuthenticator();
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+    @Override
+    public String getDisplayType() {
+        return DISPLAY_NAME;
+    }
+
+    @Override
+    public String getHelpText() {
+        return "Authenticator for Sign-In With Sui (SIU) in browser flows.";
+    }
+
+    @Override
+    public String getReferenceCategory() {
+        return "siu";
+    }
+
+    @Override
+    public boolean isConfigurable() {
+        return false;
+    }
+
+    @Override
+    public AuthenticationExecutionModel.Requirement[] getRequirementChoices() {
+        return new AuthenticationExecutionModel.Requirement[] {
+            AuthenticationExecutionModel.Requirement.REQUIRED,
+            AuthenticationExecutionModel.Requirement.ALTERNATIVE,
+            AuthenticationExecutionModel.Requirement.DISABLED
+        };
+    }
+
+    @Override
+    public boolean isUserSetupAllowed() {
+        return false;
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return null;
+    }
+
+    @Override
+    public Authenticator create(KeycloakSession session) {
+        return SINGLETON;
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        // No initialization needed
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        // No post-initialization needed
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siu/authenticators/directgrant/SiuDirectGrantAuthenticator.java

@@ -0,0 +1,169 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siu/authenticators/directgrant/SiuDirectGrantAuthenticator.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * Direct grant authenticator for Sign-In With Sui (SIU).
+ * Used for API-based authentication (mobile apps, programmatic access).
+ */
+
+package com.bitspur.keycloak.siwe.siu.authenticators.directgrant;
+
+import static org.keycloak.authentication.authenticators.util.AuthenticatorUtils.getDisabledByBruteForceEventError;
+
+import com.bitspur.keycloak.siwe.Errors.SiweKeycloakException;
+import com.bitspur.keycloak.siwe.siu.SiuCredentials;
+import com.bitspur.keycloak.siwe.siu.SiuUtil;
+
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
+
+import org.jboss.logging.Logger;
+import org.keycloak.authentication.AuthenticationFlowContext;
+import org.keycloak.authentication.AuthenticationFlowError;
+import org.keycloak.authentication.Authenticator;
+import org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.http.HttpRequest;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
+import org.keycloak.services.managers.AuthenticationManager;
+
+/**
+ * Direct grant SIU authenticator for API/programmatic access.
+ * Accepts signature and message as form parameters.
+ */
+public class SiuDirectGrantAuthenticator implements Authenticator {
+    private static final Logger logger = Logger.getLogger(SiuDirectGrantAuthenticator.class);
+
+    @Override
+    public void authenticate(AuthenticationFlowContext context) {
+        String password = retrievePassword(context);
+        String username = retrieveUsername(context);
+        KeycloakSession session = context.getSession();
+        RealmModel realm = context.getRealm();
+
+        if (username == null) {
+            context.getEvent().error(Errors.USER_NOT_FOUND);
+            Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED, "invalid_request",
+                    "Missing parameter: username");
+            context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse);
+            return;
+        }
+
+        try {
+            SiuCredentials siuCredentials = new SiuCredentials(username, password);
+            String address = siuCredentials.message.getAddress();
+            context.getEvent().detail(Details.USERNAME, address);
+            context.getAuthenticationSession().setAuthNote(AbstractUsernameFormAuthenticator.ATTEMPTED_USERNAME, address);
+
+            UserModel user = SiuUtil.findOrCreateUser(context, siuCredentials, false);
+            if (user == null) {
+                context.getEvent().error(Errors.USER_NOT_FOUND);
+                Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED, "invalid_grant",
+                        "Invalid user credentials");
+                context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse);
+                return;
+            }
+
+            // Check brute force protection
+            String bruteForceError = getDisabledByBruteForceEventError(context.getProtector(), session, realm, user);
+            if (bruteForceError != null) {
+                context.getEvent().user(user);
+                context.getEvent().error(bruteForceError);
+                Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED, "invalid_grant",
+                        "Invalid user credentials");
+                context.forceChallenge(challengeResponse);
+                return;
+            }
+
+            // Check if user is enabled
+            if (!user.isEnabled()) {
+                context.getEvent().user(user);
+                context.getEvent().error(Errors.USER_DISABLED);
+                Response challengeResponse = errorResponse(Response.Status.BAD_REQUEST, "invalid_grant",
+                        "Account disabled");
+                context.forceChallenge(challengeResponse);
+                return;
+            }
+
+            context.setUser(user);
+
+            // Verify credentials
+            if (!SiuUtil.verify(context.getSession(), context.getAuthenticatorConfig(), siuCredentials)) {
+                context.getEvent().user(context.getUser());
+                context.getEvent().error(Errors.INVALID_USER_CREDENTIALS);
+                Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED, "invalid_grant",
+                        "Invalid user credentials");
+                context.failure(AuthenticationFlowError.INVALID_CREDENTIALS, challengeResponse);
+                return;
+            }
+        } catch (SiweKeycloakException e) {
+            logger.error(e);
+            context.getEvent().user(context.getUser());
+            context.getEvent().error(Errors.INVALID_USER_CREDENTIALS);
+            Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED, "invalid_grant",
+                    e.getMessage());
+            context.failure(AuthenticationFlowError.INVALID_CREDENTIALS, challengeResponse);
+            return;
+        }
+        context.success();
+    }
+
+    @Override
+    public void action(AuthenticationFlowContext context) {
+        // Direct grant flows don't use action
+    }
+
+    @Override
+    public boolean requiresUser() {
+        return false;
+    }
+
+    @Override
+    public boolean configuredFor(KeycloakSession session, RealmModel realm, UserModel user) {
+        return true;
+    }
+
+    @Override
+    public void setRequiredActions(KeycloakSession session, RealmModel realm, UserModel user) {
+        // No required actions
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+
+    protected String retrieveUsername(AuthenticationFlowContext context) {
+        HttpRequest request = context.getHttpRequest();
+        MultivaluedMap<String, String> formData = request.getDecodedFormParameters();
+        String username = formData.getFirst(AuthenticationManager.FORM_USERNAME);
+        if (username == null) {
+            return null;
+        }
+        return username.trim();
+    }
+
+    protected String retrievePassword(AuthenticationFlowContext context) {
+        MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();
+        String password = formData.getFirst(CredentialRepresentation.PASSWORD);
+        if (password == null) {
+            return null;
+        }
+        return password.trim();
+    }
+
+    protected Response errorResponse(Response.Status status, String error, String errorDescription) {
+        OAuth2ErrorRepresentation errorRep = new OAuth2ErrorRepresentation(error, errorDescription);
+        return Response.status(status).entity(errorRep).type(MediaType.APPLICATION_JSON_TYPE).build();
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siu/authenticators/directgrant/SiuDirectGrantAuthenticatorFactory.java

@@ -0,0 +1,96 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siu/authenticators/directgrant/SiuDirectGrantAuthenticatorFactory.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * Factory for the SIU direct grant authenticator.
+ */
+
+package com.bitspur.keycloak.siwe.siu.authenticators.directgrant;
+
+import java.util.List;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.Authenticator;
+import org.keycloak.authentication.AuthenticatorFactory;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+
+/**
+ * Factory for creating SIU direct grant authenticator instances.
+ */
+public class SiuDirectGrantAuthenticatorFactory implements AuthenticatorFactory {
+    public static final String ID = "siu-direct-grant-authenticator";
+    public static final String DISPLAY_NAME = "SIU Direct Grant Authenticator";
+
+    private static final SiuDirectGrantAuthenticator SINGLETON = new SiuDirectGrantAuthenticator();
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+    @Override
+    public String getDisplayType() {
+        return DISPLAY_NAME;
+    }
+
+    @Override
+    public String getHelpText() {
+        return "Authenticator for Sign-In With Sui (SIU) in direct grant flows.";
+    }
+
+    @Override
+    public String getReferenceCategory() {
+        return "siu";
+    }
+
+    @Override
+    public boolean isConfigurable() {
+        return false;
+    }
+
+    @Override
+    public AuthenticationExecutionModel.Requirement[] getRequirementChoices() {
+        return new AuthenticationExecutionModel.Requirement[] {
+            AuthenticationExecutionModel.Requirement.REQUIRED,
+            AuthenticationExecutionModel.Requirement.ALTERNATIVE,
+            AuthenticationExecutionModel.Requirement.DISABLED
+        };
+    }
+
+    @Override
+    public boolean isUserSetupAllowed() {
+        return false;
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return null;
+    }
+
+    @Override
+    public Authenticator create(KeycloakSession session) {
+        return SINGLETON;
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        // No initialization needed
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        // No post-initialization needed
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siu/resource/SiuResource.java

@@ -0,0 +1,244 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siu/resource/SiuResource.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * REST endpoints for Sign-In With Sui (SIU).
+ */
+
+package com.bitspur.keycloak.siwe.siu.resource;
+
+import com.bitspur.keycloak.siwe.Errors.SiweKeycloakException;
+import com.bitspur.keycloak.siwe.LiteAuthenticationService;
+import com.bitspur.keycloak.siwe.SiweSession;
+import com.bitspur.keycloak.siwe.siu.SiuCredentials;
+import com.bitspur.keycloak.siwe.siu.SiuUtil;
+
+import jakarta.json.Json;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.io.StringReader;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.UserModel;
+import org.keycloak.services.managers.AuthenticationManager.AuthResult;
+
+/**
+ * REST resource for SIU operations.
+ * Provides endpoints for nonce generation, session management, and wallet registration.
+ */
+@Path("/siu")
+public class SiuResource {
+    private static final Logger logger = Logger.getLogger(SiuResource.class);
+
+    private final KeycloakSession session;
+    private final LiteAuthenticationService authService;
+
+    public SiuResource(KeycloakSession session) {
+        this.session = session;
+        this.authService = new LiteAuthenticationService(session);
+    }
+
+    /**
+     * GET /siu/nonce
+     * Generates a new nonce for SIU authentication.
+     *
+     * @return The nonce as plain text, sets SIU session cookie
+     */
+    @GET
+    @Path("/nonce")
+    @Produces(MediaType.TEXT_PLAIN)
+    public Response getNonce() {
+        SiweSession siuSession = SiuUtil.generateSiuSession(session);
+        String nonce = siuSession.getNonce();
+        String sessionKey = siuSession.getKey();
+
+        // Create secure HTTP-only cookie using Set-Cookie header
+        String cookieString = String.format("%s=%s; Path=/; Secure; HttpOnly; SameSite=None",
+                SiuUtil.KEYCLOAK_SESSION_SIU, sessionKey);
+
+        return Response.ok(nonce)
+                .header("Set-Cookie", cookieString)
+                .header("Access-Control-Allow-Origin", "*")
+                .header("Access-Control-Allow-Credentials", "true")
+                .build();
+    }
+
+    /**
+     * GET /siu/session
+     * Returns the current user's session information.
+     *
+     * @return JSON with address and chainId
+     */
+    @GET
+    @Path("/session")
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response getSession() {
+        try {
+            UserModel user = getCurrentUser();
+            if (user == null) {
+                return Response.status(Response.Status.UNAUTHORIZED)
+                        .entity("{\"error\":\"Not authenticated\"}")
+                        .build();
+            }
+
+            // Get user's Sui wallet addresses
+            var wallets = SiuUtil.getWalletAddresses(session, user);
+            String address = wallets.isEmpty() ? null : wallets.get(0).getAddress();
+
+            String jsonResponse = "{\"address\":\"" + (address != null ? address : "") +
+                    "\",\"chainId\":\"sui:mainnet\"}";
+
+            return Response.ok(jsonResponse).build();
+        } catch (Exception e) {
+            logger.error("Error getting SIU session", e);
+            return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
+                    .entity("{\"error\":\"" + e.getMessage() + "\"}")
+                    .build();
+        }
+    }
+
+    /**
+     * POST /siu/register
+     * Registers a new Sui wallet address for the authenticated user.
+     *
+     * @param body JSON with message (base64) and signature (base64)
+     * @return JSON with registered status
+     */
+    @POST
+    @Path("/register")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response registerWallet(String body) {
+        try {
+            UserModel user = getCurrentUser();
+            if (user == null) {
+                return Response.status(Response.Status.UNAUTHORIZED)
+                        .entity("{\"error\":\"Not authenticated\"}")
+                        .build();
+            }
+
+            JsonReader jsonReader = Json.createReader(new StringReader(body));
+            JsonObject jsonObject = jsonReader.readObject();
+            jsonReader.close();
+
+            String message = jsonObject.getString("message", null);
+            String signature = jsonObject.getString("signature", null);
+
+            if (message == null || signature == null) {
+                return Response.status(Response.Status.BAD_REQUEST)
+                        .entity("{\"error\":\"Missing message or signature\"}")
+                        .build();
+            }
+
+            SiuCredentials credentials = new SiuCredentials(signature, message);
+            String address = credentials.message.getAddress();
+
+            // Verify the signature
+            if (!SiuUtil.verifySiuCredentials(session, SiuUtil.getAuthenticatorConfig(session, false), credentials)) {
+                return Response.status(Response.Status.BAD_REQUEST)
+                        .entity("{\"error\":\"Invalid signature\"}")
+                        .build();
+            }
+
+            // Check if wallet is already registered to another user
+            UserModel existingUser = SiuUtil.findUserByWalletAddress(session, address);
+            if (existingUser != null && !existingUser.getId().equals(user.getId())) {
+                return Response.status(Response.Status.CONFLICT)
+                        .entity("{\"error\":\"Wallet already registered to another user\"}")
+                        .build();
+            }
+
+            // Register the wallet
+            boolean registered = SiuUtil.addWalletAddress(session, user, address);
+
+            return Response.ok("{\"registered\":" + registered + "}").build();
+        } catch (SiweKeycloakException e) {
+            logger.error("Error registering SIU wallet", e);
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity("{\"error\":\"" + e.getMessage() + "\"}")
+                    .build();
+        } catch (Exception e) {
+            logger.error("Unexpected error registering SIU wallet", e);
+            return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
+                    .entity("{\"error\":\"Internal server error\"}")
+                    .build();
+        }
+    }
+
+    /**
+     * POST /siu/unregister
+     * Unregisters a Sui wallet address from the authenticated user.
+     *
+     * @param body JSON with address
+     * @return JSON with unregistered status
+     */
+    @POST
+    @Path("/unregister")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response unregisterWallet(String body) {
+        try {
+            UserModel user = getCurrentUser();
+            if (user == null) {
+                return Response.status(Response.Status.UNAUTHORIZED)
+                        .entity("{\"error\":\"Not authenticated\"}")
+                        .build();
+            }
+
+            JsonReader jsonReader = Json.createReader(new StringReader(body));
+            JsonObject jsonObject = jsonReader.readObject();
+            jsonReader.close();
+
+            String address = jsonObject.getString("address", null);
+
+            if (address == null) {
+                return Response.status(Response.Status.BAD_REQUEST)
+                        .entity("{\"error\":\"Missing address\"}")
+                        .build();
+            }
+
+            // Verify the wallet belongs to the current user
+            var wallets = SiuUtil.getWalletAddresses(session, user);
+            boolean ownsWallet = wallets.stream()
+                    .anyMatch(w -> w.getAddress().equalsIgnoreCase(address.trim()));
+
+            if (!ownsWallet) {
+                return Response.status(Response.Status.NOT_FOUND)
+                        .entity("{\"error\":\"Wallet not found for current user\"}")
+                        .build();
+            }
+
+            boolean unregistered = SiuUtil.removeWalletAddress(session, address);
+
+            return Response.ok("{\"unregistered\":" + unregistered + "}").build();
+        } catch (Exception e) {
+            logger.error("Error unregistering SIU wallet", e);
+            return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
+                    .entity("{\"error\":\"" + e.getMessage() + "\"}")
+                    .build();
+        }
+    }
+
+    private UserModel getCurrentUser() {
+        AuthResult authResult = authService.resolveAuthentication(
+                session.getContext().getRequestHeaders(),
+                session.getContext().getConnection());
+        if (authResult == null) {
+            return null;
+        }
+        return authResult.getUser();
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siu/resource/SiuResourceProvider.java

@@ -0,0 +1,34 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siu/resource/SiuResourceProvider.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ */
+
+package com.bitspur.keycloak.siwe.siu.resource;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.services.resource.RealmResourceProvider;
+
+/**
+ * Provider for SIU REST resources.
+ */
+public class SiuResourceProvider implements RealmResourceProvider {
+    private final KeycloakSession session;
+
+    public SiuResourceProvider(KeycloakSession session) {
+        this.session = session;
+    }
+
+    @Override
+    public Object getResource() {
+        return new SiuResource(session);
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siu/resource/SiuResourceProviderFactory.java

@@ -0,0 +1,48 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siu/resource/SiuResourceProviderFactory.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ */
+
+package com.bitspur.keycloak.siwe.siu.resource;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.services.resource.RealmResourceProvider;
+import org.keycloak.services.resource.RealmResourceProviderFactory;
+
+/**
+ * Factory for creating SIU resource providers.
+ */
+public class SiuResourceProviderFactory implements RealmResourceProviderFactory {
+    public static final String ID = "siu";
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+    @Override
+    public RealmResourceProvider create(KeycloakSession session) {
+        return new SiuResourceProvider(session);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        // No initialization needed
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        // No post-initialization needed
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+}