@multiplatform.one/wallet 7.7.2

package/src/main/java/com/bitspur/keycloak/siwe/siws/authenticators/browser/SiwsBrowserAuthenticatorFactory.java

@@ -0,0 +1,96 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siws/authenticators/browser/SiwsBrowserAuthenticatorFactory.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * Factory for the SIWS browser authenticator.
+ */
+
+package com.bitspur.keycloak.siwe.siws.authenticators.browser;
+
+import java.util.List;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.Authenticator;
+import org.keycloak.authentication.AuthenticatorFactory;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+
+/**
+ * Factory for creating SIWS browser authenticator instances.
+ */
+public class SiwsBrowserAuthenticatorFactory implements AuthenticatorFactory {
+    public static final String ID = "siws-browser-authenticator";
+    public static final String DISPLAY_NAME = "SIWS Browser Authenticator";
+
+    private static final SiwsBrowserAuthenticator SINGLETON = new SiwsBrowserAuthenticator();
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+    @Override
+    public String getDisplayType() {
+        return DISPLAY_NAME;
+    }
+
+    @Override
+    public String getHelpText() {
+        return "Authenticator for Sign-In With Solana (SIWS) in browser flows.";
+    }
+
+    @Override
+    public String getReferenceCategory() {
+        return "siws";
+    }
+
+    @Override
+    public boolean isConfigurable() {
+        return false;
+    }
+
+    @Override
+    public AuthenticationExecutionModel.Requirement[] getRequirementChoices() {
+        return new AuthenticationExecutionModel.Requirement[] {
+            AuthenticationExecutionModel.Requirement.REQUIRED,
+            AuthenticationExecutionModel.Requirement.ALTERNATIVE,
+            AuthenticationExecutionModel.Requirement.DISABLED
+        };
+    }
+
+    @Override
+    public boolean isUserSetupAllowed() {
+        return false;
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return null;
+    }
+
+    @Override
+    public Authenticator create(KeycloakSession session) {
+        return SINGLETON;
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        // No initialization needed
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        // No post-initialization needed
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siws/authenticators/directgrant/SiwsDirectGrantAuthenticator.java

@@ -0,0 +1,169 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siws/authenticators/directgrant/SiwsDirectGrantAuthenticator.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * Direct grant authenticator for Sign-In With Solana (SIWS).
+ * Used for API-based authentication (mobile apps, programmatic access).
+ */
+
+package com.bitspur.keycloak.siwe.siws.authenticators.directgrant;
+
+import static org.keycloak.authentication.authenticators.util.AuthenticatorUtils.getDisabledByBruteForceEventError;
+
+import com.bitspur.keycloak.siwe.Errors.SiweKeycloakException;
+import com.bitspur.keycloak.siwe.siws.SiwsCredentials;
+import com.bitspur.keycloak.siwe.siws.SiwsUtil;
+
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
+
+import org.jboss.logging.Logger;
+import org.keycloak.authentication.AuthenticationFlowContext;
+import org.keycloak.authentication.AuthenticationFlowError;
+import org.keycloak.authentication.Authenticator;
+import org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.http.HttpRequest;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
+import org.keycloak.services.managers.AuthenticationManager;
+
+/**
+ * Direct grant SIWS authenticator for API/programmatic access.
+ * Accepts signature and message as form parameters.
+ */
+public class SiwsDirectGrantAuthenticator implements Authenticator {
+    private static final Logger logger = Logger.getLogger(SiwsDirectGrantAuthenticator.class);
+
+    @Override
+    public void authenticate(AuthenticationFlowContext context) {
+        String password = retrievePassword(context);
+        String username = retrieveUsername(context);
+        KeycloakSession session = context.getSession();
+        RealmModel realm = context.getRealm();
+
+        if (username == null) {
+            context.getEvent().error(Errors.USER_NOT_FOUND);
+            Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED, "invalid_request",
+                    "Missing parameter: username");
+            context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse);
+            return;
+        }
+
+        try {
+            SiwsCredentials siwsCredentials = new SiwsCredentials(username, password);
+            String address = siwsCredentials.message.getAddress();
+            context.getEvent().detail(Details.USERNAME, address);
+            context.getAuthenticationSession().setAuthNote(AbstractUsernameFormAuthenticator.ATTEMPTED_USERNAME, address);
+
+            UserModel user = SiwsUtil.findOrCreateUser(context, siwsCredentials, false);
+            if (user == null) {
+                context.getEvent().error(Errors.USER_NOT_FOUND);
+                Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED, "invalid_grant",
+                        "Invalid user credentials");
+                context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse);
+                return;
+            }
+
+            // Check brute force protection
+            String bruteForceError = getDisabledByBruteForceEventError(context.getProtector(), session, realm, user);
+            if (bruteForceError != null) {
+                context.getEvent().user(user);
+                context.getEvent().error(bruteForceError);
+                Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED, "invalid_grant",
+                        "Invalid user credentials");
+                context.forceChallenge(challengeResponse);
+                return;
+            }
+
+            // Check if user is enabled
+            if (!user.isEnabled()) {
+                context.getEvent().user(user);
+                context.getEvent().error(Errors.USER_DISABLED);
+                Response challengeResponse = errorResponse(Response.Status.BAD_REQUEST, "invalid_grant",
+                        "Account disabled");
+                context.forceChallenge(challengeResponse);
+                return;
+            }
+
+            context.setUser(user);
+
+            // Verify credentials
+            if (!SiwsUtil.verify(context.getSession(), context.getAuthenticatorConfig(), siwsCredentials)) {
+                context.getEvent().user(context.getUser());
+                context.getEvent().error(Errors.INVALID_USER_CREDENTIALS);
+                Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED, "invalid_grant",
+                        "Invalid user credentials");
+                context.failure(AuthenticationFlowError.INVALID_CREDENTIALS, challengeResponse);
+                return;
+            }
+        } catch (SiweKeycloakException e) {
+            logger.error(e);
+            context.getEvent().user(context.getUser());
+            context.getEvent().error(Errors.INVALID_USER_CREDENTIALS);
+            Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED, "invalid_grant",
+                    e.getMessage());
+            context.failure(AuthenticationFlowError.INVALID_CREDENTIALS, challengeResponse);
+            return;
+        }
+        context.success();
+    }
+
+    @Override
+    public void action(AuthenticationFlowContext context) {
+        // Direct grant flows don't use action
+    }
+
+    @Override
+    public boolean requiresUser() {
+        return false;
+    }
+
+    @Override
+    public boolean configuredFor(KeycloakSession session, RealmModel realm, UserModel user) {
+        return true;
+    }
+
+    @Override
+    public void setRequiredActions(KeycloakSession session, RealmModel realm, UserModel user) {
+        // No required actions
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+
+    protected String retrieveUsername(AuthenticationFlowContext context) {
+        HttpRequest request = context.getHttpRequest();
+        MultivaluedMap<String, String> formData = request.getDecodedFormParameters();
+        String username = formData.getFirst(AuthenticationManager.FORM_USERNAME);
+        if (username == null) {
+            return null;
+        }
+        return username.trim();
+    }
+
+    protected String retrievePassword(AuthenticationFlowContext context) {
+        MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();
+        String password = formData.getFirst(CredentialRepresentation.PASSWORD);
+        if (password == null) {
+            return null;
+        }
+        return password.trim();
+    }
+
+    protected Response errorResponse(Response.Status status, String error, String errorDescription) {
+        OAuth2ErrorRepresentation errorRep = new OAuth2ErrorRepresentation(error, errorDescription);
+        return Response.status(status).entity(errorRep).type(MediaType.APPLICATION_JSON_TYPE).build();
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siws/authenticators/directgrant/SiwsDirectGrantAuthenticatorFactory.java

@@ -0,0 +1,96 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siws/authenticators/directgrant/SiwsDirectGrantAuthenticatorFactory.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * Factory for the SIWS direct grant authenticator.
+ */
+
+package com.bitspur.keycloak.siwe.siws.authenticators.directgrant;
+
+import java.util.List;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.Authenticator;
+import org.keycloak.authentication.AuthenticatorFactory;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+
+/**
+ * Factory for creating SIWS direct grant authenticator instances.
+ */
+public class SiwsDirectGrantAuthenticatorFactory implements AuthenticatorFactory {
+    public static final String ID = "siws-direct-grant-authenticator";
+    public static final String DISPLAY_NAME = "SIWS Direct Grant Authenticator";
+
+    private static final SiwsDirectGrantAuthenticator SINGLETON = new SiwsDirectGrantAuthenticator();
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+    @Override
+    public String getDisplayType() {
+        return DISPLAY_NAME;
+    }
+
+    @Override
+    public String getHelpText() {
+        return "Authenticator for Sign-In With Solana (SIWS) in direct grant flows (API/mobile).";
+    }
+
+    @Override
+    public String getReferenceCategory() {
+        return "siws";
+    }
+
+    @Override
+    public boolean isConfigurable() {
+        return false;
+    }
+
+    @Override
+    public AuthenticationExecutionModel.Requirement[] getRequirementChoices() {
+        return new AuthenticationExecutionModel.Requirement[] {
+            AuthenticationExecutionModel.Requirement.REQUIRED,
+            AuthenticationExecutionModel.Requirement.ALTERNATIVE,
+            AuthenticationExecutionModel.Requirement.DISABLED
+        };
+    }
+
+    @Override
+    public boolean isUserSetupAllowed() {
+        return false;
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return null;
+    }
+
+    @Override
+    public Authenticator create(KeycloakSession session) {
+        return SINGLETON;
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        // No initialization needed
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        // No post-initialization needed
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siws/resource/SiwsResource.java

@@ -0,0 +1,244 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siws/resource/SiwsResource.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ *
+ * REST endpoints for Sign-In With Solana (SIWS).
+ */
+
+package com.bitspur.keycloak.siwe.siws.resource;
+
+import com.bitspur.keycloak.siwe.Errors.SiweKeycloakException;
+import com.bitspur.keycloak.siwe.LiteAuthenticationService;
+import com.bitspur.keycloak.siwe.SiweSession;
+import com.bitspur.keycloak.siwe.siws.SiwsCredentials;
+import com.bitspur.keycloak.siwe.siws.SiwsUtil;
+
+import jakarta.json.Json;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.io.StringReader;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.UserModel;
+import org.keycloak.services.managers.AuthenticationManager.AuthResult;
+
+/**
+ * REST resource for SIWS operations.
+ * Provides endpoints for nonce generation, session management, and wallet registration.
+ */
+@Path("/siws")
+public class SiwsResource {
+    private static final Logger logger = Logger.getLogger(SiwsResource.class);
+
+    private final KeycloakSession session;
+    private final LiteAuthenticationService authService;
+
+    public SiwsResource(KeycloakSession session) {
+        this.session = session;
+        this.authService = new LiteAuthenticationService(session);
+    }
+
+    /**
+     * GET /siws/nonce
+     * Generates a new nonce for SIWS authentication.
+     *
+     * @return The nonce as plain text, sets SIWS session cookie
+     */
+    @GET
+    @Path("/nonce")
+    @Produces(MediaType.TEXT_PLAIN)
+    public Response getNonce() {
+        SiweSession siwsSession = SiwsUtil.generateSiwsSession(session);
+        String nonce = siwsSession.getNonce();
+        String sessionKey = siwsSession.getKey();
+
+        // Create secure HTTP-only cookie using Set-Cookie header
+        String cookieString = String.format("%s=%s; Path=/; Secure; HttpOnly; SameSite=None",
+                SiwsUtil.KEYCLOAK_SESSION_SIWS, sessionKey);
+
+        return Response.ok(nonce)
+                .header("Set-Cookie", cookieString)
+                .header("Access-Control-Allow-Origin", "*")
+                .header("Access-Control-Allow-Credentials", "true")
+                .build();
+    }
+
+    /**
+     * GET /siws/session
+     * Returns the current user's session information.
+     *
+     * @return JSON with address and chainId
+     */
+    @GET
+    @Path("/session")
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response getSession() {
+        try {
+            UserModel user = getCurrentUser();
+            if (user == null) {
+                return Response.status(Response.Status.UNAUTHORIZED)
+                        .entity("{\"error\":\"Not authenticated\"}")
+                        .build();
+            }
+
+            // Get user's Solana wallet addresses
+            var wallets = SiwsUtil.getWalletAddresses(session, user);
+            String address = wallets.isEmpty() ? null : wallets.get(0).getAddress();
+
+            String jsonResponse = "{\"address\":\"" + (address != null ? address : "") +
+                    "\",\"chainId\":\"mainnet-beta\"}";
+
+            return Response.ok(jsonResponse).build();
+        } catch (Exception e) {
+            logger.error("Error getting SIWS session", e);
+            return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
+                    .entity("{\"error\":\"" + e.getMessage() + "\"}")
+                    .build();
+        }
+    }
+
+    /**
+     * POST /siws/register
+     * Registers a new Solana wallet address for the authenticated user.
+     *
+     * @param body JSON with message (base64) and signature (base58)
+     * @return JSON with registered status
+     */
+    @POST
+    @Path("/register")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response registerWallet(String body) {
+        try {
+            UserModel user = getCurrentUser();
+            if (user == null) {
+                return Response.status(Response.Status.UNAUTHORIZED)
+                        .entity("{\"error\":\"Not authenticated\"}")
+                        .build();
+            }
+
+            JsonReader jsonReader = Json.createReader(new StringReader(body));
+            JsonObject jsonObject = jsonReader.readObject();
+            jsonReader.close();
+
+            String message = jsonObject.getString("message", null);
+            String signature = jsonObject.getString("signature", null);
+
+            if (message == null || signature == null) {
+                return Response.status(Response.Status.BAD_REQUEST)
+                        .entity("{\"error\":\"Missing message or signature\"}")
+                        .build();
+            }
+
+            SiwsCredentials credentials = new SiwsCredentials(signature, message);
+            String address = credentials.message.getAddress();
+
+            // Verify the signature
+            if (!SiwsUtil.verifySiwsCredentials(session, SiwsUtil.getAuthenticatorConfig(session, false), credentials)) {
+                return Response.status(Response.Status.BAD_REQUEST)
+                        .entity("{\"error\":\"Invalid signature\"}")
+                        .build();
+            }
+
+            // Check if wallet is already registered to another user
+            UserModel existingUser = SiwsUtil.findUserByWalletAddress(session, address);
+            if (existingUser != null && !existingUser.getId().equals(user.getId())) {
+                return Response.status(Response.Status.CONFLICT)
+                        .entity("{\"error\":\"Wallet already registered to another user\"}")
+                        .build();
+            }
+
+            // Register the wallet
+            boolean registered = SiwsUtil.addWalletAddress(session, user, address);
+
+            return Response.ok("{\"registered\":" + registered + "}").build();
+        } catch (SiweKeycloakException e) {
+            logger.error("Error registering SIWS wallet", e);
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity("{\"error\":\"" + e.getMessage() + "\"}")
+                    .build();
+        } catch (Exception e) {
+            logger.error("Unexpected error registering SIWS wallet", e);
+            return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
+                    .entity("{\"error\":\"Internal server error\"}")
+                    .build();
+        }
+    }
+
+    /**
+     * POST /siws/unregister
+     * Unregisters a Solana wallet address from the authenticated user.
+     *
+     * @param body JSON with address
+     * @return JSON with unregistered status
+     */
+    @POST
+    @Path("/unregister")
+    @Consumes(MediaType.APPLICATION_JSON)
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response unregisterWallet(String body) {
+        try {
+            UserModel user = getCurrentUser();
+            if (user == null) {
+                return Response.status(Response.Status.UNAUTHORIZED)
+                        .entity("{\"error\":\"Not authenticated\"}")
+                        .build();
+            }
+
+            JsonReader jsonReader = Json.createReader(new StringReader(body));
+            JsonObject jsonObject = jsonReader.readObject();
+            jsonReader.close();
+
+            String address = jsonObject.getString("address", null);
+
+            if (address == null) {
+                return Response.status(Response.Status.BAD_REQUEST)
+                        .entity("{\"error\":\"Missing address\"}")
+                        .build();
+            }
+
+            // Verify the wallet belongs to the current user
+            var wallets = SiwsUtil.getWalletAddresses(session, user);
+            boolean ownsWallet = wallets.stream()
+                    .anyMatch(w -> w.getAddress().equalsIgnoreCase(address.trim()));
+
+            if (!ownsWallet) {
+                return Response.status(Response.Status.NOT_FOUND)
+                        .entity("{\"error\":\"Wallet not found for current user\"}")
+                        .build();
+            }
+
+            boolean unregistered = SiwsUtil.removeWalletAddress(session, address);
+
+            return Response.ok("{\"unregistered\":" + unregistered + "}").build();
+        } catch (Exception e) {
+            logger.error("Error unregistering SIWS wallet", e);
+            return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
+                    .entity("{\"error\":\"" + e.getMessage() + "\"}")
+                    .build();
+        }
+    }
+
+    private UserModel getCurrentUser() {
+        AuthResult authResult = authService.resolveAuthentication(
+                session.getContext().getRequestHeaders(),
+                session.getContext().getConnection());
+        if (authResult == null) {
+            return null;
+        }
+        return authResult.getUser();
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siws/resource/SiwsResourceProvider.java

@@ -0,0 +1,34 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siws/resource/SiwsResourceProvider.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ */
+
+package com.bitspur.keycloak.siwe.siws.resource;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.services.resource.RealmResourceProvider;
+
+/**
+ * Provider for SIWS REST resources.
+ */
+public class SiwsResourceProvider implements RealmResourceProvider {
+    private final KeycloakSession session;
+
+    public SiwsResourceProvider(KeycloakSession session) {
+        this.session = session;
+    }
+
+    @Override
+    public Object getResource() {
+        return new SiwsResource(session);
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+}

package/src/main/java/com/bitspur/keycloak/siwe/siws/resource/SiwsResourceProviderFactory.java

@@ -0,0 +1,48 @@
+/**
+ * File: /src/main/java/com/bitspur/keycloak/siwe/siws/resource/SiwsResourceProviderFactory.java
+ * Project: siwe-keycloak
+ * File Created: 24-01-2026
+ * Author: Clay Risser
+ * -----
+ * BitSpur (c) Copyright 2022 - 2026
+ */
+
+package com.bitspur.keycloak.siwe.siws.resource;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.services.resource.RealmResourceProvider;
+import org.keycloak.services.resource.RealmResourceProviderFactory;
+
+/**
+ * Factory for creating SIWS resource providers.
+ */
+public class SiwsResourceProviderFactory implements RealmResourceProviderFactory {
+    public static final String ID = "siws";
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+    @Override
+    public RealmResourceProvider create(KeycloakSession session) {
+        return new SiwsResourceProvider(session);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        // No initialization needed
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        // No post-initialization needed
+    }
+
+    @Override
+    public void close() {
+        // Nothing to close
+    }
+}

package/src/main/resources/META-INF/keycloak-themes.json

@@ -0,0 +1,8 @@
+{
+  "themes": [
+    {
+      "name": "siwe",
+      "types": ["login"]
+    }
+  ]
+}