antaeus.keycloak.react 1.0.7 → 2.1.0

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { useCallback, useMemo, useEffect, useState, useRef } from 'react';
+import { useState, useRef, useCallback, useEffect, useMemo } from 'react';
 import { useAuth as useAuth$1, AuthProvider } from 'react-oidc-context';
-import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
+import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 import { useLocation } from 'react-router-dom';
 import { QRCodeSVG } from 'qrcode.react';
 import { User } from 'oidc-client-ts';
@@ -14,14 +14,20 @@ var defaultConfig = {
   scope: "openid profile email offline_access",
   features: {
     deviceFlow: false,
-    sessionMonitor: false,
+    sessionMonitor: true,
     autoRefresh: true
   },
   silentRenew: {
     enabled: true,
     silentRedirectUri: typeof window !== "undefined" ? window.location.origin + "/silent-renew.html" : "/silent-renew.html",
-    thresholdSeconds: 300
+    thresholdSeconds: 300,
     // 5 minutes
+    refreshStrategy: "both",
+    // Check on startup AND retry on 401
+    maxRefreshTokenLifetime: 2592e3,
+    // 30 days in seconds
+    showLoadingIndicator: false,
+    loadingMessage: "Refreshing session..."
   },
   advanced: {
     responseType: "code",
@@ -53,7 +59,11 @@ var KeycloakConfigBuilder = class {
       scope: config.scope,
       automaticSilentRenew: config.silentRenew.enabled,
       loadUserInfo: config.advanced.loadUserInfo,
-      silent_redirect_uri: config.silentRenew.silentRedirectUri
+      silent_redirect_uri: config.silentRenew.silentRedirectUri,
+      // Add PKCE support (required for public clients)
+      ...config.advanced.codeChallengeMethod && {
+        response_mode: "query"
+      }
     };
     return oidcSettings;
   }
@@ -125,16 +135,711 @@ function getConfigFromEnv() {
     }
   };
 }
-var KeycloakProvider = ({
+var useAuth = useAuth$1;
+
+// src/hooks/useTokenLifecycle.ts
+var STORAGE_KEY_PREFIX = "keycloak_first_login_";
+function useTokenLifecycle(options) {
+  const {
+    config,
+    debug = false,
+    onRefreshStart,
+    onRefreshSuccess,
+    onRefreshError,
+    onRefreshTokenExpired
+  } = options;
+  const auth = useAuth();
+  const [isRefreshing, setIsRefreshing] = useState(false);
+  const [isRefreshTokenExpired, setIsRefreshTokenExpired] = useState(false);
+  const hasCheckedOnStartup = useRef(false);
+  const log = useCallback(
+    (message, ...args) => {
+      if (debug) {
+        console.log("[TokenLifecycle]", message, ...args);
+      }
+    },
+    [debug]
+  );
+  const getStorageKey = useCallback(() => {
+    const authority = config.authority;
+    const clientId = config.clientId;
+    return `${STORAGE_KEY_PREFIX}${authority}_${clientId}`;
+  }, [config.authority, config.clientId]);
+  const storeFirstLoginTime = useCallback(() => {
+    const key = getStorageKey();
+    const existingTime = localStorage.getItem(key);
+    if (!existingTime) {
+      const now = Date.now();
+      localStorage.setItem(key, now.toString());
+      log("Stored first login time:", new Date(now).toISOString());
+    }
+  }, [getStorageKey, log]);
+  const checkRefreshTokenLifetime = useCallback(() => {
+    const maxLifetime = config.silentRenew?.maxRefreshTokenLifetime;
+    if (!maxLifetime || maxLifetime <= 0) {
+      return false;
+    }
+    const key = getStorageKey();
+    const firstLoginStr = localStorage.getItem(key);
+    if (!firstLoginStr) {
+      storeFirstLoginTime();
+      return false;
+    }
+    const firstLoginTime = parseInt(firstLoginStr, 10);
+    const now = Date.now();
+    const elapsedSeconds = (now - firstLoginTime) / 1e3;
+    log("Refresh token lifetime check:", {
+      firstLogin: new Date(firstLoginTime).toISOString(),
+      elapsedSeconds,
+      maxLifetime,
+      isExpired: elapsedSeconds >= maxLifetime
+    });
+    return elapsedSeconds >= maxLifetime;
+  }, [config.silentRenew?.maxRefreshTokenLifetime, getStorageKey, log, storeFirstLoginTime]);
+  const refreshToken = useCallback(async () => {
+    if (isRefreshing) {
+      log("Refresh already in progress, skipping");
+      return;
+    }
+    if (checkRefreshTokenLifetime()) {
+      log("Refresh token exceeded max lifetime, cannot refresh");
+      setIsRefreshTokenExpired(true);
+      onRefreshTokenExpired?.();
+      return;
+    }
+    try {
+      setIsRefreshing(true);
+      onRefreshStart?.();
+      log("Starting token refresh");
+      await auth.signinSilent();
+      log("Token refresh successful");
+      onRefreshSuccess?.();
+    } catch (error) {
+      const err = error instanceof Error ? error : new Error(String(error));
+      log("Token refresh failed:", err.message);
+      onRefreshError?.(err);
+      throw err;
+    } finally {
+      setIsRefreshing(false);
+    }
+  }, [
+    isRefreshing,
+    auth,
+    checkRefreshTokenLifetime,
+    onRefreshStart,
+    onRefreshSuccess,
+    onRefreshError,
+    onRefreshTokenExpired,
+    log
+  ]);
+  const checkAndRefreshTokens = useCallback(async () => {
+    if (!auth.user) {
+      log("No user session, skipping token check");
+      return false;
+    }
+    if (checkRefreshTokenLifetime()) {
+      log("Refresh token exceeded max lifetime");
+      setIsRefreshTokenExpired(true);
+      onRefreshTokenExpired?.();
+      const key = getStorageKey();
+      localStorage.removeItem(key);
+      try {
+        await auth.removeUser();
+      } catch (error) {
+        log("Error removing user after max lifetime:", error);
+      }
+      return false;
+    }
+    const expiresAt = auth.user.expires_at;
+    if (!expiresAt) {
+      log("No expiration time found, skipping token check");
+      return false;
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    const threshold = config.silentRenew?.thresholdSeconds || 300;
+    const timeUntilExpiry = expiresAt - now;
+    log("Token expiration check:", {
+      expiresAt: new Date(expiresAt * 1e3).toISOString(),
+      now: new Date(now * 1e3).toISOString(),
+      timeUntilExpiry,
+      threshold,
+      needsRefresh: timeUntilExpiry <= threshold
+    });
+    if (timeUntilExpiry <= threshold) {
+      try {
+        await refreshToken();
+        return true;
+      } catch (error) {
+        log("Failed to refresh tokens:", error);
+        return false;
+      }
+    }
+    log("Tokens are still valid, no refresh needed");
+    return false;
+  }, [
+    auth,
+    config.silentRenew?.thresholdSeconds,
+    checkRefreshTokenLifetime,
+    refreshToken,
+    onRefreshTokenExpired,
+    getStorageKey,
+    log
+  ]);
+  useEffect(() => {
+    const strategy = config.silentRenew?.refreshStrategy || "both";
+    const shouldCheckOnStartup = strategy === "startup" || strategy === "both";
+    if (!shouldCheckOnStartup || hasCheckedOnStartup.current) {
+      return;
+    }
+    if (!auth.isAuthenticated || auth.isLoading) {
+      return;
+    }
+    hasCheckedOnStartup.current = true;
+    log("Running startup token check with strategy:", strategy);
+    checkAndRefreshTokens().catch((error) => {
+      log("Startup token check failed:", error);
+    });
+  }, [
+    auth.isAuthenticated,
+    auth.isLoading,
+    config.silentRenew?.refreshStrategy,
+    checkAndRefreshTokens,
+    log
+  ]);
+  useEffect(() => {
+    if (auth.user && !auth.isLoading) {
+      storeFirstLoginTime();
+    }
+  }, [auth.user, auth.isLoading, storeFirstLoginTime]);
+  useEffect(() => {
+    if (!auth.isAuthenticated || auth.isLoading) {
+      return;
+    }
+    const maxLifetime = config.silentRenew?.maxRefreshTokenLifetime;
+    if (!maxLifetime || maxLifetime <= 0) {
+      return;
+    }
+    const intervalId = setInterval(() => {
+      if (checkRefreshTokenLifetime()) {
+        log("Refresh token expired during periodic check");
+        setIsRefreshTokenExpired(true);
+        onRefreshTokenExpired?.();
+        const key = getStorageKey();
+        localStorage.removeItem(key);
+        auth.removeUser().catch((error) => {
+          log("Error removing user during periodic check:", error);
+        });
+      }
+    }, 5 * 60 * 1e3);
+    return () => clearInterval(intervalId);
+  }, [
+    auth,
+    config.silentRenew?.maxRefreshTokenLifetime,
+    checkRefreshTokenLifetime,
+    onRefreshTokenExpired,
+    getStorageKey,
+    log
+  ]);
+  return {
+    isRefreshing,
+    isRefreshTokenExpired,
+    refreshToken,
+    checkAndRefreshTokens
+  };
+}
+var TokenLifecycleManager = ({
   config,
   children,
   debug = false
 }) => {
+  const [showLoading, setShowLoading] = useState(false);
+  const handleRefreshStart = useCallback(() => {
+    if (config.silentRenew?.showLoadingIndicator) {
+      setShowLoading(true);
+    }
+  }, [config.silentRenew?.showLoadingIndicator]);
+  const handleRefreshSuccess = useCallback(() => {
+    setShowLoading(false);
+  }, []);
+  const handleRefreshError = useCallback((error) => {
+    setShowLoading(false);
+    if (debug) {
+      console.error("[TokenLifecycleManager] Token refresh failed:", error);
+    }
+    config.events?.onSilentRenewError?.(error);
+  }, [config.events, debug]);
+  const handleRefreshTokenExpired = useCallback(() => {
+    setShowLoading(false);
+    if (debug) {
+      console.warn("[TokenLifecycleManager] Refresh token exceeded max lifetime");
+    }
+    config.events?.onTokenExpired?.();
+  }, [config.events, debug]);
+  const { isRefreshing, isRefreshTokenExpired } = useTokenLifecycle({
+    config,
+    debug,
+    onRefreshStart: handleRefreshStart,
+    onRefreshSuccess: handleRefreshSuccess,
+    onRefreshError: handleRefreshError,
+    onRefreshTokenExpired: handleRefreshTokenExpired
+  });
+  if (isRefreshTokenExpired) {
+    return /* @__PURE__ */ jsx(
+      "div",
+      {
+        style: {
+          display: "flex",
+          flexDirection: "column",
+          alignItems: "center",
+          justifyContent: "center",
+          height: "100vh",
+          fontFamily: "system-ui, -apple-system, sans-serif",
+          backgroundColor: "#f5f5f5",
+          padding: "20px",
+          textAlign: "center"
+        },
+        children: /* @__PURE__ */ jsxs(
+          "div",
+          {
+            style: {
+              backgroundColor: "white",
+              padding: "40px",
+              borderRadius: "8px",
+              boxShadow: "0 2px 8px rgba(0,0,0,0.1)",
+              maxWidth: "400px"
+            },
+            children: [
+              /* @__PURE__ */ jsx("h2", { style: { margin: "0 0 16px 0", color: "#333" }, children: "Session Expired" }),
+              /* @__PURE__ */ jsx("p", { style: { margin: "0 0 24px 0", color: "#666" }, children: "Your session has been inactive for too long. Please sign in again to continue." }),
+              /* @__PURE__ */ jsx(
+                "button",
+                {
+                  onClick: () => window.location.reload(),
+                  style: {
+                    padding: "12px 24px",
+                    backgroundColor: "#007bff",
+                    color: "white",
+                    border: "none",
+                    borderRadius: "4px",
+                    fontSize: "16px",
+                    cursor: "pointer",
+                    fontWeight: "500"
+                  },
+                  children: "Sign In Again"
+                }
+              )
+            ]
+          }
+        )
+      }
+    );
+  }
+  if (showLoading && isRefreshing) {
+    const message = config.silentRenew?.loadingMessage || "Refreshing session...";
+    return /* @__PURE__ */ jsxs(
+      "div",
+      {
+        style: {
+          display: "flex",
+          flexDirection: "column",
+          alignItems: "center",
+          justifyContent: "center",
+          height: "100vh",
+          fontFamily: "system-ui, -apple-system, sans-serif",
+          backgroundColor: "#f5f5f5"
+        },
+        children: [
+          /* @__PURE__ */ jsxs(
+            "div",
+            {
+              style: {
+                display: "flex",
+                flexDirection: "column",
+                alignItems: "center",
+                gap: "16px"
+              },
+              children: [
+                /* @__PURE__ */ jsx(
+                  "div",
+                  {
+                    style: {
+                      width: "40px",
+                      height: "40px",
+                      border: "4px solid #e0e0e0",
+                      borderTop: "4px solid #007bff",
+                      borderRadius: "50%",
+                      animation: "spin 1s linear infinite"
+                    }
+                  }
+                ),
+                /* @__PURE__ */ jsx("p", { style: { margin: 0, color: "#666", fontSize: "16px" }, children: message })
+              ]
+            }
+          ),
+          /* @__PURE__ */ jsx("style", { children: `
+            @keyframes spin {
+              0% { transform: rotate(0deg); }
+              100% { transform: rotate(360deg); }
+            }
+          ` })
+        ]
+      }
+    );
+  }
+  return /* @__PURE__ */ jsx(Fragment, { children });
+};
+var SessionMonitor = ({
+  position = "top-right",
+  warningThreshold = 300,
+  // 5 minutes
+  criticalThreshold = 60,
+  // 1 minute
+  showProgressBar = true,
+  minimizable = true,
+  startMinimized = false,
+  className = "",
+  onWarning,
+  onCritical,
+  onExpired,
+  style
+}) => {
+  const auth = useAuth();
+  const [timeRemaining, setTimeRemaining] = useState(null);
+  const [initialTimeRemaining, setInitialTimeRemaining] = useState(null);
+  const [minimized, setMinimized] = useState(startMinimized);
+  const [warningTriggered, setWarningTriggered] = useState(false);
+  const [criticalTriggered, setCriticalTriggered] = useState(false);
+  useEffect(() => {
+    if (!auth.isAuthenticated || !auth.user?.expires_at) {
+      setTimeRemaining(null);
+      setInitialTimeRemaining(null);
+      return;
+    }
+    let logoutTimeoutId = null;
+    const updateTimeRemaining = () => {
+      const expiresAt = auth.user.expires_at;
+      const now = Math.floor(Date.now() / 1e3);
+      const remaining = expiresAt - now;
+      if (initialTimeRemaining === null && remaining > 0) {
+        setInitialTimeRemaining(remaining);
+      }
+      if (remaining <= 0) {
+        setTimeRemaining(0);
+        onExpired?.();
+        logoutTimeoutId = setTimeout(() => {
+          auth.signoutRedirect();
+        }, 2e3);
+      } else {
+        setTimeRemaining(remaining);
+        if (remaining <= criticalThreshold && !criticalTriggered) {
+          setCriticalTriggered(true);
+          onCritical?.(remaining);
+        } else if (remaining <= warningThreshold && !warningTriggered) {
+          setWarningTriggered(true);
+          onWarning?.(remaining);
+        }
+      }
+    };
+    updateTimeRemaining();
+    const interval = setInterval(updateTimeRemaining, 1e3);
+    return () => {
+      clearInterval(interval);
+      if (logoutTimeoutId) {
+        clearTimeout(logoutTimeoutId);
+      }
+    };
+  }, [
+    auth,
+    warningThreshold,
+    criticalThreshold,
+    warningTriggered,
+    criticalTriggered,
+    initialTimeRemaining,
+    onWarning,
+    onCritical,
+    onExpired
+  ]);
+  useEffect(() => {
+    if (timeRemaining && timeRemaining > warningThreshold) {
+      setWarningTriggered(false);
+      setCriticalTriggered(false);
+    }
+  }, [timeRemaining, warningThreshold]);
+  const formatTime = useCallback((seconds) => {
+    const mins = Math.floor(seconds / 60);
+    const secs = seconds % 60;
+    return `${mins}:${secs.toString().padStart(2, "0")}`;
+  }, []);
+  const getStatusClass = useCallback(() => {
+    if (!timeRemaining) return "normal";
+    if (timeRemaining <= criticalThreshold) return "critical";
+    if (timeRemaining <= warningThreshold) return "warning";
+    return "normal";
+  }, [timeRemaining, warningThreshold, criticalThreshold]);
+  const getProgress = useCallback(() => {
+    if (!timeRemaining || !initialTimeRemaining) return 100;
+    return Math.max(0, Math.min(100, timeRemaining / initialTimeRemaining * 100));
+  }, [timeRemaining, initialTimeRemaining]);
+  if (!auth.isAuthenticated || timeRemaining === null) {
+    return null;
+  }
+  const baseClass = "kc-session-monitor";
+  const positionClass = `kc-session-monitor--${position}`;
+  const statusClass = `kc-session-monitor--${getStatusClass()}`;
+  const minimizedClass = minimized ? "kc-session-monitor--minimized" : "";
+  const classes = `${baseClass} ${positionClass} ${statusClass} ${minimizedClass} ${className}`.trim();
+  const progress = getProgress();
+  return /* @__PURE__ */ jsxs("div", { className: classes, style, children: [
+    minimizable && /* @__PURE__ */ jsx(
+      "button",
+      {
+        className: "kc-session-monitor__toggle",
+        onClick: () => setMinimized(!minimized),
+        "aria-label": minimized ? "Expand session monitor" : "Minimize session monitor",
+        title: minimized ? "Expand" : "Minimize",
+        children: minimized ? "\u25B2" : "\u25BC"
+      }
+    ),
+    !minimized && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsxs("div", { className: "kc-session-monitor__content", children: [
+        /* @__PURE__ */ jsx("span", { className: "kc-session-monitor__label", children: timeRemaining === 0 ? "Session expired" : "Session expires in:" }),
+        /* @__PURE__ */ jsx("span", { className: "kc-session-monitor__time", children: formatTime(timeRemaining) })
+      ] }),
+      showProgressBar && /* @__PURE__ */ jsx("div", { className: "kc-session-monitor__progress-bar", children: /* @__PURE__ */ jsx(
+        "div",
+        {
+          className: "kc-session-monitor__progress-fill",
+          style: { width: `${progress}%` },
+          role: "progressbar",
+          "aria-valuenow": progress,
+          "aria-valuemin": 0,
+          "aria-valuemax": 100
+        }
+      ) })
+    ] })
+  ] });
+};
+
+// src/config/presets.ts
+var CONFIG_PRESETS = {
+  /**
+   * Default preset - Balanced configuration for most applications
+   *
+   * Features:
+   * - 30-day refresh token lifetime
+   * - Proactive token refresh on startup + reactive on 401
+   * - Silent background token refresh
+   * - Session monitoring enabled
+   * - Auto token refresh enabled
+   *
+   * Best for: Most web applications, dashboards, internal tools
+   */
+  default: {
+    scope: "openid profile email offline_access",
+    features: {
+      autoRefresh: true,
+      sessionMonitor: true,
+      deviceFlow: false
+    },
+    silentRenew: {
+      enabled: true,
+      thresholdSeconds: 300,
+      // 5 minutes
+      refreshStrategy: "both",
+      maxRefreshTokenLifetime: 2592e3,
+      // 30 days
+      showLoadingIndicator: false,
+      loadingMessage: "Refreshing session..."
+    },
+    advanced: {
+      responseType: "code",
+      codeChallengeMethod: "S256",
+      loadUserInfo: true,
+      automaticSilentSignIn: false
+    }
+  },
+  /**
+   * Mobile/PWA preset - Optimized for mobile and progressive web apps
+   *
+   * Features:
+   * - 30-day refresh token lifetime
+   * - Proactive startup refresh (apps close frequently)
+   * - Loading indicator during refresh (better UX for app reopening)
+   * - Session monitoring enabled
+   *
+   * Best for: Mobile apps, PWAs, apps that frequently close/reopen
+   */
+  mobile: {
+    scope: "openid profile email offline_access",
+    features: {
+      autoRefresh: true,
+      sessionMonitor: true,
+      deviceFlow: false
+    },
+    silentRenew: {
+      enabled: true,
+      thresholdSeconds: 300,
+      refreshStrategy: "startup",
+      // Focus on startup refresh
+      maxRefreshTokenLifetime: 2592e3,
+      // 30 days
+      showLoadingIndicator: true,
+      // Show loading for better UX
+      loadingMessage: "Restoring your session..."
+    },
+    advanced: {
+      responseType: "code",
+      codeChallengeMethod: "S256",
+      loadUserInfo: true,
+      automaticSilentSignIn: false
+    }
+  },
+  /**
+   * High Security preset - Strict security for sensitive applications
+   *
+   * Features:
+   * - 24-hour forced re-authentication
+   * - Proactive + reactive token refresh
+   * - 10-minute refresh threshold (earlier refresh)
+   * - Silent refresh (no UI hints about security measures)
+   * - Session monitoring enabled
+   *
+   * Best for: Banking, healthcare, admin panels, sensitive data applications
+   */
+  "high-security": {
+    scope: "openid profile email offline_access",
+    features: {
+      autoRefresh: true,
+      sessionMonitor: true,
+      deviceFlow: false
+    },
+    silentRenew: {
+      enabled: true,
+      thresholdSeconds: 600,
+      // 10 minutes (more aggressive)
+      refreshStrategy: "both",
+      maxRefreshTokenLifetime: 86400,
+      // 24 hours only
+      showLoadingIndicator: false,
+      // Silent for security
+      loadingMessage: "Validating session..."
+    },
+    advanced: {
+      responseType: "code",
+      codeChallengeMethod: "S256",
+      loadUserInfo: true,
+      automaticSilentSignIn: false
+    }
+  },
+  /**
+   * Long-Running preset - Optimized for desktop apps and long sessions
+   *
+   * Features:
+   * - 7-day refresh token lifetime
+   * - Proactive + reactive token refresh
+   * - Silent background refresh
+   * - Session monitoring enabled
+   *
+   * Best for: Desktop applications, monitoring dashboards, always-on tools
+   */
+  "long-running": {
+    scope: "openid profile email offline_access",
+    features: {
+      autoRefresh: true,
+      sessionMonitor: true,
+      deviceFlow: false
+    },
+    silentRenew: {
+      enabled: true,
+      thresholdSeconds: 300,
+      refreshStrategy: "both",
+      maxRefreshTokenLifetime: 604800,
+      // 7 days
+      showLoadingIndicator: false,
+      loadingMessage: "Refreshing session..."
+    },
+    advanced: {
+      responseType: "code",
+      codeChallengeMethod: "S256",
+      loadUserInfo: true,
+      automaticSilentSignIn: false
+    }
+  },
+  /**
+   * Development preset - Convenient settings for development
+   *
+   * Features:
+   * - No refresh token lifetime limit (never expires)
+   * - Proactive + reactive token refresh
+   * - Loading indicators visible (easier debugging)
+   * - Session monitoring enabled
+   * - More verbose feedback
+   *
+   * Best for: Local development, testing, debugging
+   * WARNING: Do not use in production!
+   */
+  development: {
+    scope: "openid profile email offline_access",
+    features: {
+      autoRefresh: true,
+      sessionMonitor: true,
+      deviceFlow: false
+    },
+    silentRenew: {
+      enabled: true,
+      thresholdSeconds: 300,
+      refreshStrategy: "both",
+      maxRefreshTokenLifetime: 0,
+      // No limit (for convenience)
+      showLoadingIndicator: true,
+      // Show for debugging
+      loadingMessage: "[DEV] Refreshing tokens..."
+    },
+    advanced: {
+      responseType: "code",
+      codeChallengeMethod: "S256",
+      loadUserInfo: true,
+      automaticSilentSignIn: false
+    }
+  }
+};
+function getConfigPreset(preset) {
+  return CONFIG_PRESETS[preset];
+}
+function mergeWithPreset(preset, customConfig) {
+  const presetConfig = getConfigPreset(preset);
+  return {
+    ...presetConfig,
+    ...customConfig,
+    features: {
+      ...presetConfig.features,
+      ...customConfig.features
+    },
+    silentRenew: {
+      ...presetConfig.silentRenew,
+      ...customConfig.silentRenew
+    },
+    advanced: {
+      ...presetConfig.advanced,
+      ...customConfig.advanced
+    },
+    events: {
+      ...presetConfig.events,
+      ...customConfig.events
+    }
+  };
+}
+function isZeroConfig(props) {
+  return "authority" in props && "clientId" in props;
+}
+var KeycloakProvider = (props) => {
+  const { children, debug = false } = props;
+  const config = isZeroConfig(props) ? buildZeroConfig(props) : props.config;
   const oidcConfig = KeycloakConfigBuilder.build(config);
   const log = useCallback(
     (level, message, ...args) => {
       if (debug) {
-        const prefix = "[Keycloak]";
+        const prefix = "[KeycloakProvider]";
         switch (level) {
           case "info":
             console.log(prefix, message, ...args);
@@ -162,11 +867,13 @@ var KeycloakProvider = ({
   );
   const onSignoutCallback = useCallback(() => {
     log("info", "Sign out successful");
+    window.history.replaceState({}, document.title, window.location.pathname);
     config.events?.onLogout?.();
   }, [config.events, log]);
   const onRemoveUser = useCallback(() => {
-    log("info", "User removed");
+    log("warn", "User removed from storage - token validation likely failed");
   }, [log]);
+  const showSessionMonitor = config.features?.sessionMonitor !== false;
   return /* @__PURE__ */ jsx(
     AuthProvider,
     {
@@ -174,11 +881,41 @@ var KeycloakProvider = ({
       onSigninCallback,
       onSignoutCallback,
       onRemoveUser,
-      children
+      children: /* @__PURE__ */ jsxs(TokenLifecycleManager, { config, debug, children: [
+        showSessionMonitor && /* @__PURE__ */ jsx(SessionMonitor, {}),
+        children
+      ] })
     }
   );
 };
-var useAuth = useAuth$1;
+function buildZeroConfig(props) {
+  const { authority, clientId, preset = "default", config: overrides = {} } = props;
+  const presetConfig = mergeWithPreset(preset, overrides);
+  const fullConfig = {
+    authority,
+    clientId,
+    redirectUri: presetConfig.redirectUri || defaultConfig.redirectUri || (typeof window !== "undefined" ? window.location.origin + "/" : "/"),
+    postLogoutRedirectUri: presetConfig.postLogoutRedirectUri || defaultConfig.postLogoutRedirectUri || (typeof window !== "undefined" ? window.location.origin + "/" : "/"),
+    scope: presetConfig.scope || defaultConfig.scope,
+    features: {
+      ...defaultConfig.features,
+      ...presetConfig.features
+    },
+    silentRenew: {
+      ...defaultConfig.silentRenew,
+      ...presetConfig.silentRenew
+    },
+    advanced: {
+      ...defaultConfig.advanced,
+      ...presetConfig.advanced
+    },
+    events: {
+      ...defaultConfig.events,
+      ...presetConfig.events
+    }
+  };
+  return fullConfig;
+}
 function useRoles() {
   const auth = useAuth();
   const roles = useMemo(() => {
@@ -270,6 +1007,7 @@ var ProtectedRoute = ({
   const { hasAnyRole, hasAllRoles } = useRoles();
   const { hasAnyScope, hasAllScopes } = useScopes();
   const location = useLocation();
+  const hasRedirected = useRef(false);
   const isAuthenticated = !auth.isLoading && auth.isAuthenticated;
   const policyAccess = policy && auth.user ? policy(auth.user, { location }) : null;
   const roleAccess = requiredRoles.length > 0 ? requireAllRoles ? hasAllRoles(requiredRoles) : hasAnyRole(requiredRoles) : null;
@@ -281,12 +1019,21 @@ var ProtectedRoute = ({
     }
   }, [unauthorizedReason, onUnauthorized]);
   useEffect(() => {
-    if (!auth.isLoading && !auth.isAuthenticated) {
+    if (!auth.isLoading && !auth.isAuthenticated && !hasRedirected.current) {
+      hasRedirected.current = true;
       auth.signinRedirect({
         redirect_uri: window.location.origin + location.pathname + location.search
+      }).catch((error) => {
+        hasRedirected.current = false;
+        console.error("[ProtectedRoute] Signin redirect failed:", error);
       });
     }
-  }, [auth.isLoading, auth.isAuthenticated, auth, location.pathname, location.search]);
+  }, [auth.isLoading, auth.isAuthenticated, location.pathname, location.search]);
+  useEffect(() => {
+    if (auth.isAuthenticated) {
+      hasRedirected.current = false;
+    }
+  }, [auth.isAuthenticated]);
   if (auth.isLoading) {
     return /* @__PURE__ */ jsx(Fragment, { children: loadingComponent || /* @__PURE__ */ jsx(DefaultLoadingComponent, {}) });
   }
@@ -506,125 +1253,6 @@ function getInitials(name) {
   }
   return (parts[0][0] + parts[parts.length - 1][0]).toUpperCase();
 }
-var SessionMonitor = ({
-  position = "top-right",
-  warningThreshold = 300,
-  // 5 minutes
-  criticalThreshold = 60,
-  // 1 minute
-  showProgressBar = true,
-  minimizable = true,
-  startMinimized = false,
-  className = "",
-  onWarning,
-  onCritical,
-  onExpired,
-  style
-}) => {
-  const auth = useAuth();
-  const [timeRemaining, setTimeRemaining] = useState(null);
-  const [minimized, setMinimized] = useState(startMinimized);
-  const [warningTriggered, setWarningTriggered] = useState(false);
-  const [criticalTriggered, setCriticalTriggered] = useState(false);
-  useEffect(() => {
-    if (!auth.isAuthenticated || !auth.user?.expires_at) {
-      setTimeRemaining(null);
-      return;
-    }
-    const updateTimeRemaining = () => {
-      const expiresAt = auth.user.expires_at;
-      const now = Math.floor(Date.now() / 1e3);
-      const remaining = expiresAt - now;
-      if (remaining <= 0) {
-        setTimeRemaining(0);
-        onExpired?.();
-        setTimeout(() => {
-          auth.signoutRedirect();
-        }, 2e3);
-      } else {
-        setTimeRemaining(remaining);
-        if (remaining <= criticalThreshold && !criticalTriggered) {
-          setCriticalTriggered(true);
-          onCritical?.(remaining);
-        } else if (remaining <= warningThreshold && !warningTriggered) {
-          setWarningTriggered(true);
-          onWarning?.(remaining);
-        }
-      }
-    };
-    updateTimeRemaining();
-    const interval = setInterval(updateTimeRemaining, 1e3);
-    return () => clearInterval(interval);
-  }, [
-    auth,
-    warningThreshold,
-    criticalThreshold,
-    warningTriggered,
-    criticalTriggered,
-    onWarning,
-    onCritical,
-    onExpired
-  ]);
-  useEffect(() => {
-    if (timeRemaining && timeRemaining > warningThreshold) {
-      setWarningTriggered(false);
-      setCriticalTriggered(false);
-    }
-  }, [timeRemaining, warningThreshold]);
-  const formatTime = useCallback((seconds) => {
-    const mins = Math.floor(seconds / 60);
-    const secs = seconds % 60;
-    return `${mins}:${secs.toString().padStart(2, "0")}`;
-  }, []);
-  const getStatusClass = useCallback(() => {
-    if (!timeRemaining) return "normal";
-    if (timeRemaining <= criticalThreshold) return "critical";
-    if (timeRemaining <= warningThreshold) return "warning";
-    return "normal";
-  }, [timeRemaining, warningThreshold, criticalThreshold]);
-  const getProgress = useCallback(() => {
-    if (!timeRemaining || !auth.user?.expires_in) return 100;
-    return timeRemaining / auth.user.expires_in * 100;
-  }, [timeRemaining, auth.user]);
-  if (!auth.isAuthenticated || timeRemaining === null) {
-    return null;
-  }
-  const baseClass = "kc-session-monitor";
-  const positionClass = `kc-session-monitor--${position}`;
-  const statusClass = `kc-session-monitor--${getStatusClass()}`;
-  const minimizedClass = minimized ? "kc-session-monitor--minimized" : "";
-  const classes = `${baseClass} ${positionClass} ${statusClass} ${minimizedClass} ${className}`.trim();
-  const progress = getProgress();
-  return /* @__PURE__ */ jsxs("div", { className: classes, style, children: [
-    minimizable && /* @__PURE__ */ jsx(
-      "button",
-      {
-        className: "kc-session-monitor__toggle",
-        onClick: () => setMinimized(!minimized),
-        "aria-label": minimized ? "Expand session monitor" : "Minimize session monitor",
-        title: minimized ? "Expand" : "Minimize",
-        children: minimized ? "\u25B2" : "\u25BC"
-      }
-    ),
-    !minimized && /* @__PURE__ */ jsxs(Fragment, { children: [
-      /* @__PURE__ */ jsxs("div", { className: "kc-session-monitor__content", children: [
-        /* @__PURE__ */ jsx("span", { className: "kc-session-monitor__label", children: timeRemaining === 0 ? "Session expired" : "Session expires in:" }),
-        /* @__PURE__ */ jsx("span", { className: "kc-session-monitor__time", children: formatTime(timeRemaining) })
-      ] }),
-      showProgressBar && /* @__PURE__ */ jsx("div", { className: "kc-session-monitor__progress-bar", children: /* @__PURE__ */ jsx(
-        "div",
-        {
-          className: "kc-session-monitor__progress-fill",
-          style: { width: `${progress}%` },
-          role: "progressbar",
-          "aria-valuenow": progress,
-          "aria-valuemin": 0,
-          "aria-valuemax": 100
-        }
-      ) })
-    ] })
-  ] });
-};
 
 // src/utils/deviceFlow.ts
 async function requestDeviceCode(apiBaseUrl) {
@@ -861,14 +1489,14 @@ function useProtectedFetch(options = {}) {
     },
     [baseUrl]
   );
-  const getAuthHeader = useCallback(() => {
+  const getAuthHeader = () => {
     if (!auth.user?.access_token) {
       return {};
     }
     return {
       Authorization: `Bearer ${auth.user.access_token}`
     };
-  }, [auth.user]);
+  };
   const buildHeaders = useCallback(
     (requestHeaders) => {
       const headers = new Headers(requestHeaders);
@@ -881,7 +1509,7 @@ function useProtectedFetch(options = {}) {
       });
       return headers;
     },
-    [getAuthHeader, customHeaders]
+    [customHeaders]
   );
   const protectedFetch = useCallback(
     async (url, init) => {
@@ -932,6 +1560,6 @@ function useProtectedFetch(options = {}) {
   };
 }
 
-export { DeviceLogin, KeycloakConfigBuilder, KeycloakProvider, LoginButton, LogoutButton, ProtectedRoute, SessionMonitor, UserProfile, defaultConfig, fetchUserInfo, getConfigFromEnv, pollForToken, requestDeviceCode, useAuth, useProtectedFetch, useRoles, useScopes };
+export { CONFIG_PRESETS, DeviceLogin, KeycloakConfigBuilder, KeycloakProvider, LoginButton, LogoutButton, ProtectedRoute, SessionMonitor, TokenLifecycleManager, UserProfile, defaultConfig, fetchUserInfo, getConfigFromEnv, getConfigPreset, mergeWithPreset, pollForToken, requestDeviceCode, useAuth, useProtectedFetch, useRoles, useScopes, useTokenLifecycle };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map