next-auth-heksso 1.1.11 → 1.2.0

package/.eslintrc.json

@@ -1,3 +1,3 @@
-{
-  "extends": "next/core-web-vitals"
-}
+{
+  "extends": "next/core-web-vitals"
+}

package/README.md

@@ -1,11 +1,11 @@
-# Next-Auth config for use with HEKsso (Keycloak)
-
-The rollowing environment variables are required:
-
-    NEXTAUTH_SECRET
-    NEXTAUTH_URL
-    KEYCLOAK_ISSUER
-    KEYCLOAK_CLIENT_ID
-    KEYCLOAK_CLIENT_SECRET
-
+# Next-Auth config for use with HEKsso (Keycloak)
+
+The following environment variables are required:
+
+    NEXTAUTH_SECRET
+    NEXTAUTH_URL
+    KEYCLOAK_ISSUER
+    KEYCLOAK_CLIENT_ID
+    KEYCLOAK_CLIENT_SECRET
+
 See `.env.example`

package/api/federatedLogout.d.ts

@@ -1,8 +1,7 @@
 import { NextApiRequest, NextApiResponse } from "next";
 /**
  * Provides a next api route for performing a federated logout of the user (logs ouf of keycloak)
- * @param req NextApiRequest
- * @param res NextApiRequest
+ * @param logoutPath Post redirect URI
  * @returns
  */
 export declare function federatedLogout(logoutPath: string): (req: NextApiRequest, res: NextApiResponse) => Promise<NextApiResponse<any> | undefined>;

package/api/federatedLogout.js

@@ -15,13 +15,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -36,8 +46,7 @@ exports.federatedLogout = federatedLogout;
 const jwt = __importStar(require("next-auth/jwt"));
 /**
  * Provides a next api route for performing a federated logout of the user (logs ouf of keycloak)
- * @param req NextApiRequest
- * @param res NextApiRequest
+ * @param logoutPath Post redirect URI
  * @returns
  */
 function federatedLogout(logoutPath) {

package/package.json

@@ -1,35 +1,39 @@
-{
-  "name": "next-auth-heksso",
-  "author": {
-    "name": "Voakie",
-    "email": "contact@voakie.com"
-  },
-  "license": "MIT",
-  "version": "1.1.11",
-  "scripts": {
-    "prepublish": "run-script-os",
-    "prepublish:default": "rm api/ -r && rm react/ -r && tsc",
-    "prepublish:windows": "del /s /q api && del /s /q react",
-    "build": "tsc",
-    "clean": "run-script-os",
-    "clean:default": "rm api/ -r && rm react/ -r -r",
-    "clean:windows": "del /s /q api && del /s /q react"
-  },
-  "main": "api/index.js",
-  "types": "api/index.d.ts",
-  "dependencies": {
-    "@types/node": "^18.11.18",
-    "@types/react": "^18.3.3",
-    "@types/react-dom": "^18.3.0",
-    "eslint": "^8.0.0",
-    "eslint-config-next": "^14.2.5",
-    "next": "^14.2.5",
-    "next-auth": "^4.24.7",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
-    "typescript": "^5.5.4"
-  },
-  "devDependencies": {
-    "run-script-os": "^1.1.6"
-  }
-}
+{
+  "name": "next-auth-heksso",
+  "author": {
+    "name": "Voakie",
+    "email": "contact@voakie.com"
+  },
+  "license": "MIT",
+  "version": "1.2.0",
+  "type": "module",
+  "scripts": {
+    "prepublish": "run-script-os",
+    "prepublish:default": "rm -rf api/ && rm -rf react/ && tsc",
+    "prepublish:windows": "del /s /q api && del /s /q react",
+    "build": "tsc",
+    "clean": "run-script-os",
+    "clean:default": "rm api/ -r && rm react/ -r -r",
+    "clean:windows": "del /s /q api && del /s /q react"
+  },
+  "main": "api/index.js",
+  "types": "api/index.d.ts",
+  "dependencies": {
+
+  },
+  "devDependencies": {
+    "run-script-os": "^1.1.6",
+    "@types/node": "^24",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "eslint": "^9.13.0",
+    "eslint-config-next": "^16",
+    "typescript": "^5.6.3"
+  },
+  "peerDependencies": {
+    "next": "^15 || ^16",
+    "next-auth": "^4",
+    "react": "^18 || ^19",
+    "react-dom": "^18 || ^19"
+  }
+}

package/react/KeycloakSessionContext.js

@@ -15,13 +15,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {

package/src/api/federatedLogout.ts

@@ -1,40 +1,39 @@
-// /api/auth/federated-logout
-import { NextApiRequest, NextApiResponse } from "next"
-import * as jwt from "next-auth/jwt"
-
-/**
- * Provides a next api route for performing a federated logout of the user (logs ouf of keycloak)
- * @param req NextApiRequest
- * @param res NextApiRequest
- * @returns
- */
-export function federatedLogout(logoutPath: string) {
-    return async function (req: NextApiRequest, res: NextApiResponse) {
-        try {
-            const token = await jwt.getToken({ req, secret: process.env.NEXTAUTH_SECRET })
-            if (!token) {
-                console.warn("No JWT token found when calling /federated-logout endpoint")
-                return res.redirect(process.env.NEXTAUTH_URL || "")
-            }
-
-            const endsessionURL = `${process.env.KEYCLOAK_ISSUER}/protocol/openid-connect/logout`
-
-            if (token.idToken) {
-                console.warn(
-                    "Without an id_token the user won't be redirected back from the IdP after logout."
-                )
-
-                const endsessionParams = new URLSearchParams({
-                    id_token_hint: token.idToken as string,
-                    post_logout_redirect_uri: process.env.NEXTAUTH_URL + logoutPath || ""
-                })
-                return res.redirect(`${endsessionURL}?${endsessionParams}`)
-            } else {
-                return res.redirect(`${endsessionURL}`)
-            }
-        } catch (error) {
-            console.error(error)
-            res.redirect(process.env.NEXTAUTH_URL || "")
-        }
-    }
-}
+// /api/auth/federated-logout
+import { NextApiRequest, NextApiResponse } from "next"
+import * as jwt from "next-auth/jwt"
+
+/**
+ * Provides a next api route for performing a federated logout of the user (logs ouf of keycloak)
+ * @param logoutPath Post redirect URI
+ * @returns
+ */
+export function federatedLogout(logoutPath: string) {
+    return async function (req: NextApiRequest, res: NextApiResponse) {
+        try {
+            const token = await jwt.getToken({ req, secret: process.env.NEXTAUTH_SECRET })
+            if (!token) {
+                console.warn("No JWT token found when calling /federated-logout endpoint")
+                return res.redirect(process.env.NEXTAUTH_URL || "")
+            }
+
+            const endsessionURL = `${process.env.KEYCLOAK_ISSUER}/protocol/openid-connect/logout`
+
+            if (token.idToken) {
+                console.warn(
+                    "Without an id_token the user won't be redirected back from the IdP after logout."
+                )
+
+                const endsessionParams = new URLSearchParams({
+                    id_token_hint: token.idToken as string,
+                    post_logout_redirect_uri: process.env.NEXTAUTH_URL + logoutPath || ""
+                })
+                return res.redirect(`${endsessionURL}?${endsessionParams}`)
+            } else {
+                return res.redirect(`${endsessionURL}`)
+            }
+        } catch (error) {
+            console.error(error)
+            res.redirect(process.env.NEXTAUTH_URL || "")
+        }
+    }
+}

package/src/api/index.ts

@@ -1,2 +1,2 @@
-export * from "./federatedLogout"
-export * from "./nextAuthConfig"
+export * from "./federatedLogout"
+export * from "./nextAuthConfig"

package/src/api/nextAuthConfig.ts

@@ -1,67 +1,67 @@
-import { NextAuthOptions } from "next-auth"
-import KeycloakProvider from "next-auth/providers/keycloak"
-import { refreshAccessToken } from "./refreshAccessToken"
-
-/**
- * Provides authOptions for next-auth that configures it for use with the typical HEKsso setup
- */
-export function configureAuthOptions(options?: Partial<NextAuthOptions>): NextAuthOptions {
-    let callbacks: NextAuthOptions["callbacks"] | undefined = undefined
-
-    if (options && "callbacks" in options) {
-        callbacks = options.callbacks
-    }
-
-    return {
-        ...options,
-        secret: process.env.NEXTAUTH_SECRET,
-        providers: [
-            KeycloakProvider({
-                clientId: process.env.KEYCLOAK_CLIENT_ID || "",
-                clientSecret: process.env.KEYCLOAK_CLIENT_SECRET || "",
-                issuer: process.env.KEYCLOAK_ISSUER, // something like "http://localhost:8080/realms/master"
-                authorization: { params: { scope: "openid email profile roles" } }
-            })
-        ],
-        callbacks: {
-            async jwt(data) {
-                const hekGroups = (data.profile as any)?.hekGroups
-
-                // Persist the OAuth access_token to the token right after signin
-                if (data.account && data.user) {
-                    data.token.idToken = data.account?.id_token
-                    data.token.accessToken = data.account.access_token
-                    data.token.hekGroups = hekGroups
-                    data.token.username = (
-                        data.profile as { [key: string]: string }
-                    ).preferred_username
-
-                    if (data.account.expires_at)
-                        data.token.accessTokenExpires = data.account.expires_at * 1000
-
-                    data.token.refreshToken = data.account.refresh_token
-                    return data.token
-                }
-
-                // Return previous token if the access token has not expired yet
-                if (Date.now() < (data.token.accessTokenExpires as number)) {
-                    return data.token
-                }
-
-                // Access token has expired, try to update it
-                return refreshAccessToken(data.token)
-            },
-            async session({ session, token }) {
-                // Send properties to the client, like an access_token from a provider.
-                const _session = session as any
-                _session.accessToken = token.accessToken
-                _session.accessTokenExpires = token.accessTokenExpires
-                _session.hekGroups = token.hekGroups || []
-                _session.username = token.username
-                if (token.error) _session.error = token.error
-                return _session
-            },
-            ...callbacks
-        }
-    }
-}
+import { NextAuthOptions } from "next-auth"
+import KeycloakProvider from "next-auth/providers/keycloak"
+import { refreshAccessToken } from "./refreshAccessToken"
+
+/**
+ * Provides authOptions for next-auth that configures it for use with the typical HEKsso setup
+ */
+export function configureAuthOptions(options?: Partial<NextAuthOptions>): NextAuthOptions {
+    let callbacks: NextAuthOptions["callbacks"] | undefined = undefined
+
+    if (options && "callbacks" in options) {
+        callbacks = options.callbacks
+    }
+
+    return {
+        ...options,
+        secret: process.env.NEXTAUTH_SECRET,
+        providers: [
+            KeycloakProvider({
+                clientId: process.env.KEYCLOAK_CLIENT_ID || "",
+                clientSecret: process.env.KEYCLOAK_CLIENT_SECRET || "",
+                issuer: process.env.KEYCLOAK_ISSUER, // something like "http://localhost:8080/realms/master"
+                authorization: { params: { scope: "openid email profile roles" } }
+            })
+        ],
+        callbacks: {
+            async jwt(data) {
+                const hekGroups = (data.profile as any)?.hekGroups
+
+                // Persist the OAuth access_token to the token right after signin
+                if (data.account && data.user) {
+                    data.token.idToken = data.account?.id_token
+                    data.token.accessToken = data.account.access_token
+                    data.token.hekGroups = hekGroups
+                    data.token.username = (
+                        data.profile as { [key: string]: string }
+                    ).preferred_username
+
+                    if (data.account.expires_at)
+                        data.token.accessTokenExpires = data.account.expires_at * 1000
+
+                    data.token.refreshToken = data.account.refresh_token
+                    return data.token
+                }
+
+                // Return previous token if the access token has not expired yet
+                if (Date.now() < (data.token.accessTokenExpires as number)) {
+                    return data.token
+                }
+
+                // Access token has expired, try to update it
+                return refreshAccessToken(data.token)
+            },
+            async session({ session, token }) {
+                // Send properties to the client, like an access_token from a provider.
+                const _session = session as any
+                _session.accessToken = token.accessToken
+                _session.accessTokenExpires = token.accessTokenExpires
+                _session.hekGroups = token.hekGroups || []
+                _session.username = token.username
+                if (token.error) _session.error = token.error
+                return _session
+            },
+            ...callbacks
+        }
+    }
+}

package/src/api/refreshAccessToken.ts

@@ -1,47 +1,47 @@
-import { JWT } from "next-auth/jwt"
-
-/**
- * Takes a token, and returns a new token with updated
- * `accessToken` and `accessTokenExpires`. If an error occurs,
- * returns the old token and an error property
- * 
- * This is a utility function and not an API route
- */
-export async function refreshAccessToken(token: JWT) {
-    try {
-        const url = process.env.KEYCLOAK_ISSUER + "/protocol/openid-connect/token?"
-
-        const response = await fetch(url, {
-            headers: {
-                "Content-Type": "application/x-www-form-urlencoded"
-            },
-            method: "POST",
-            body: new URLSearchParams({
-                client_id: process.env.KEYCLOAK_CLIENT_ID || "",
-                client_secret: process.env.KEYCLOAK_CLIENT_SECRET || "",
-                grant_type: "refresh_token",
-                refresh_token: token.refreshToken as string
-            })
-        })
-
-        const refreshedTokens = await response.json()
-
-        if (!response.ok) {
-            throw refreshedTokens
-        }
-
-        return {
-            ...token,
-            accessToken: refreshedTokens.access_token,
-            accessTokenExpires: Date.now() + refreshedTokens.expires_in * 1000,
-            refreshToken: refreshedTokens.refresh_token ?? token.refreshToken // Fall back to old refresh token
-        }
-    } catch (error) {
-        console.log(error)
-
-        return {
-            ...token,
-            error: "RefreshAccessTokenError"
-        }
-    }
+import { JWT } from "next-auth/jwt"
+
+/**
+ * Takes a token, and returns a new token with updated
+ * `accessToken` and `accessTokenExpires`. If an error occurs,
+ * returns the old token and an error property
+ * 
+ * This is a utility function and not an API route
+ */
+export async function refreshAccessToken(token: JWT) {
+    try {
+        const url = process.env.KEYCLOAK_ISSUER + "/protocol/openid-connect/token?"
+
+        const response = await fetch(url, {
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded"
+            },
+            method: "POST",
+            body: new URLSearchParams({
+                client_id: process.env.KEYCLOAK_CLIENT_ID || "",
+                client_secret: process.env.KEYCLOAK_CLIENT_SECRET || "",
+                grant_type: "refresh_token",
+                refresh_token: token.refreshToken as string
+            })
+        })
+
+        const refreshedTokens = await response.json()
+
+        if (!response.ok) {
+            throw refreshedTokens
+        }
+
+        return {
+            ...token,
+            accessToken: refreshedTokens.access_token,
+            accessTokenExpires: Date.now() + refreshedTokens.expires_in * 1000,
+            refreshToken: refreshedTokens.refresh_token ?? token.refreshToken // Fall back to old refresh token
+        }
+    } catch (error) {
+        console.log(error)
+
+        return {
+            ...token,
+            error: "RefreshAccessTokenError"
+        }
+    }
 }

package/src/react/KeycloakSessionContext.tsx

@@ -1,192 +1,192 @@
-import type { signOut as nextAuthSignOut, useSession } from "next-auth/react"
-import React, { Component, createContext, PropsWithChildren, useContext } from "react"
-
-type NextAuthSession = ReturnType<typeof useSession>
-
-export interface KeycloakSession {
-    accessTokenError: boolean
-    getAccessToken: () => Promise<string>
-}
-
-export const KeycloakSessionContext = createContext<KeycloakSession>({
-    accessTokenError: false,
-    getAccessToken: async () => {
-        return ""
-    }
-})
-
-export function useKeycloakSession(): KeycloakSession {
-    return useContext(KeycloakSessionContext)
-}
-
-async function refreshAccessToken() {
-    try {
-        const response = await fetch("/api/auth/session", {
-            method: "GET",
-            headers: {
-                "Content-Type": "application/json"
-            }
-        })
-
-        const data = await response.json()
-
-        if (data.error) {
-            console.error(data.error)
-            return undefined
-        }
-
-        return { accessToken: data.accessToken, accessTokenExpires: data.accessTokenExpires }
-    } catch (e: unknown) {
-        console.error(e)
-        return undefined
-    }
-}
-
-interface KeycloakSessionProviderProps {
-    session: ReturnType<typeof useSession>
-    signOut: typeof nextAuthSignOut
-}
-
-interface KeycloakSessionProviderState {
-    accessToken?: string
-    accessTokenError: boolean
-    accessTokenExpires?: number
-}
-
-/**
- * Provider for the useKeycloakSession react hook. Has to directly hook into next-auth and next/router
- * @param router Next.js router (retrieve with `useRouter()`)
- * @param session Next Auth Session (retrieve with `useSession()`)
- * @param signOut Next Auth Sign Out function (exported by "next-auth/react")
- * @param children
- * @constructor
- */
-export function KeycloakSessionProvider({
-    session,
-    signOut,
-    children
-}: PropsWithChildren<{
-    session: NextAuthSession
-    signOut: typeof nextAuthSignOut
-}>) {
-    return (
-        <_KeycloakSessionProvider session={session} signOut={signOut}>
-            {children}
-        </_KeycloakSessionProvider>
-    )
-}
-
-// Proxy class component to prevent unnecessary re-renders
-class _KeycloakSessionProvider extends Component<
-    PropsWithChildren<KeycloakSessionProviderProps>,
-    KeycloakSessionProviderState
-> {
-    private contextValue
-
-    constructor(props: KeycloakSessionProviderProps) {
-        super(props)
-
-        this.state = {
-            accessTokenError: false
-        }
-
-        this.getAccessToken = this.getAccessToken.bind(this)
-        this.getContextValue = this.getContextValue.bind(this)
-
-        this.contextValue = {
-            getAccessToken: this.getAccessToken,
-            accessTokenError: false
-        }
-    }
-
-    private getContextValue() {
-        if (this.state.accessTokenError !== this.contextValue.accessTokenError) {
-            this.contextValue = {
-                getAccessToken: this.getAccessToken,
-                accessTokenError: this.state.accessTokenError
-            }
-        }
-
-        return this.contextValue
-    }
-
-    async getAccessToken() {
-        if (
-            !this.state.accessToken ||
-            (this.state.accessTokenExpires && Date.now() >= this.state.accessTokenExpires)
-        ) {
-            try {
-                const refreshed = await refreshAccessToken()
-
-                if (refreshed) {
-                    this.setState({
-                        accessTokenError: false,
-                        accessToken: refreshed.accessToken,
-                        accessTokenExpires: refreshed.accessTokenExpires
-                    })
-                    return refreshed.accessToken
-                } else {
-                    // Refresh failed due to network error
-                    return undefined
-                }
-            } catch (e) {
-                // Refresh failed because keycloak denied the request
-                console.error(e)
-                this.setState({
-                    accessTokenError: true,
-                    accessToken: undefined,
-                    accessTokenExpires: undefined
-                })
-                return undefined
-            }
-        } else return this.state.accessToken
-    }
-
-    componentDidUpdate() {
-        if (sessionDataGuard(this.props.session.data)) {
-            const { error, accessToken, accessTokenExpires } = this.props.session.data
-
-            if (error === "RefreshAccessTokenError") {
-                // Force sign in to get a new refresh token
-                this.props.signOut({ redirect: true, callbackUrl: "/" }).then()
-            } else if (accessToken && accessToken != this.state.accessToken) {
-                this.setState({
-                    accessToken,
-                    accessTokenExpires
-                })
-            } else if (!accessToken) {
-                this.setState({
-                    accessToken: undefined,
-                    accessTokenExpires: undefined
-                })
-            }
-        }
-    }
-
-    render() {
-        return (
-            <KeycloakSessionContext.Provider value={this.getContextValue()}>
-                {this.props.children}
-            </KeycloakSessionContext.Provider>
-        )
-    }
-}
-
-function sessionDataGuard(
-    sessionData: unknown
-): sessionData is { error?: string; accessToken?: string; accessTokenExpires?: number } {
-    if (sessionData && typeof sessionData === "object") {
-        if (!("error" in sessionData) || typeof sessionData.error === "string") {
-            if (!("accessToken" in sessionData) || typeof sessionData.accessToken === "string") {
-                if (
-                    !("accessTokenExpires" in sessionData) ||
-                    typeof sessionData.accessTokenExpires === "number"
-                ) {
-                    return true
-                }
-            }
-        }
-    }
-
-    return false
-}
+import type { signOut as nextAuthSignOut, useSession } from "next-auth/react"
+import React, { Component, createContext, PropsWithChildren, useContext } from "react"
+
+type NextAuthSession = ReturnType<typeof useSession>
+
+export interface KeycloakSession {
+    accessTokenError: boolean
+    getAccessToken: () => Promise<string>
+}
+
+export const KeycloakSessionContext = createContext<KeycloakSession>({
+    accessTokenError: false,
+    getAccessToken: async () => {
+        return ""
+    }
+})
+
+export function useKeycloakSession(): KeycloakSession {
+    return useContext(KeycloakSessionContext)
+}
+
+async function refreshAccessToken() {
+    try {
+        const response = await fetch("/api/auth/session", {
+            method: "GET",
+            headers: {
+                "Content-Type": "application/json"
+            }
+        })
+
+        const data = await response.json()
+
+        if (data.error) {
+            console.error(data.error)
+            return undefined
+        }
+
+        return { accessToken: data.accessToken, accessTokenExpires: data.accessTokenExpires }
+    } catch (e: unknown) {
+        console.error(e)
+        return undefined
+    }
+}
+
+interface KeycloakSessionProviderProps {
+    session: ReturnType<typeof useSession>
+    signOut: typeof nextAuthSignOut
+}
+
+interface KeycloakSessionProviderState {
+    accessToken?: string
+    accessTokenError: boolean
+    accessTokenExpires?: number
+}
+
+/**
+ * Provider for the useKeycloakSession react hook. Has to directly hook into next-auth and next/router
+ * @param router Next.js router (retrieve with `useRouter()`)
+ * @param session Next Auth Session (retrieve with `useSession()`)
+ * @param signOut Next Auth Sign Out function (exported by "next-auth/react")
+ * @param children
+ * @constructor
+ */
+export function KeycloakSessionProvider({
+    session,
+    signOut,
+    children
+}: PropsWithChildren<{
+    session: NextAuthSession
+    signOut: typeof nextAuthSignOut
+}>) {
+    return (
+        <_KeycloakSessionProvider session={session} signOut={signOut}>
+            {children}
+        </_KeycloakSessionProvider>
+    )
+}
+
+// Proxy class component to prevent unnecessary re-renders
+class _KeycloakSessionProvider extends Component<
+    PropsWithChildren<KeycloakSessionProviderProps>,
+    KeycloakSessionProviderState
+> {
+    private contextValue
+
+    constructor(props: KeycloakSessionProviderProps) {
+        super(props)
+
+        this.state = {
+            accessTokenError: false
+        }
+
+        this.getAccessToken = this.getAccessToken.bind(this)
+        this.getContextValue = this.getContextValue.bind(this)
+
+        this.contextValue = {
+            getAccessToken: this.getAccessToken,
+            accessTokenError: false
+        }
+    }
+
+    private getContextValue() {
+        if (this.state.accessTokenError !== this.contextValue.accessTokenError) {
+            this.contextValue = {
+                getAccessToken: this.getAccessToken,
+                accessTokenError: this.state.accessTokenError
+            }
+        }
+
+        return this.contextValue
+    }
+
+    async getAccessToken() {
+        if (
+            !this.state.accessToken ||
+            (this.state.accessTokenExpires && Date.now() >= this.state.accessTokenExpires)
+        ) {
+            try {
+                const refreshed = await refreshAccessToken()
+
+                if (refreshed) {
+                    this.setState({
+                        accessTokenError: false,
+                        accessToken: refreshed.accessToken,
+                        accessTokenExpires: refreshed.accessTokenExpires
+                    })
+                    return refreshed.accessToken
+                } else {
+                    // Refresh failed due to network error
+                    return undefined
+                }
+            } catch (e) {
+                // Refresh failed because keycloak denied the request
+                console.error(e)
+                this.setState({
+                    accessTokenError: true,
+                    accessToken: undefined,
+                    accessTokenExpires: undefined
+                })
+                return undefined
+            }
+        } else return this.state.accessToken
+    }
+
+    componentDidUpdate() {
+        if (sessionDataGuard(this.props.session.data)) {
+            const { error, accessToken, accessTokenExpires } = this.props.session.data
+
+            if (error === "RefreshAccessTokenError") {
+                // Force sign in to get a new refresh token
+                this.props.signOut({ redirect: true, callbackUrl: "/" }).then()
+            } else if (accessToken && accessToken != this.state.accessToken) {
+                this.setState({
+                    accessToken,
+                    accessTokenExpires
+                })
+            } else if (!accessToken) {
+                this.setState({
+                    accessToken: undefined,
+                    accessTokenExpires: undefined
+                })
+            }
+        }
+    }
+
+    render() {
+        return (
+            <KeycloakSessionContext.Provider value={this.getContextValue()}>
+                {this.props.children}
+            </KeycloakSessionContext.Provider>
+        )
+    }
+}
+
+function sessionDataGuard(
+    sessionData: unknown
+): sessionData is { error?: string; accessToken?: string; accessTokenExpires?: number } {
+    if (sessionData && typeof sessionData === "object") {
+        if (!("error" in sessionData) || typeof sessionData.error === "string") {
+            if (!("accessToken" in sessionData) || typeof sessionData.accessToken === "string") {
+                if (
+                    !("accessTokenExpires" in sessionData) ||
+                    typeof sessionData.accessTokenExpires === "number"
+                ) {
+                    return true
+                }
+            }
+        }
+    }
+
+    return false
+}

package/tsconfig.json

@@ -1,104 +1,104 @@
-{
-  "compilerOptions": {
-    /* Visit https://aka.ms/tsconfig to read more about this file */
-
-    /* Projects */
-    // "incremental": true,                              /* Save .tsbuildinfo files to allow for incremental compilation of projects. */
-    // "composite": true,                                /* Enable constraints that allow a TypeScript project to be used with project references. */
-    // "tsBuildInfoFile": "./.tsbuildinfo",              /* Specify the path to .tsbuildinfo incremental compilation file. */
-    // "disableSourceOfProjectReferenceRedirect": true,  /* Disable preferring source files instead of declaration files when referencing composite projects. */
-    // "disableSolutionSearching": true,                 /* Opt a project out of multi-project reference checking when editing. */
-    // "disableReferencedProjectLoad": true,             /* Reduce the number of projects loaded automatically by TypeScript. */
-
-    /* Language and Environment */
-    "target": "es2016",                                  /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */
-    // "lib": [],                                        /* Specify a set of bundled library declaration files that describe the target runtime environment. */
-    "jsx": "react",                                /* Specify what JSX code is generated. */
-    // "experimentalDecorators": true,                   /* Enable experimental support for TC39 stage 2 draft decorators. */
-    // "emitDecoratorMetadata": true,                    /* Emit design-type metadata for decorated declarations in source files. */
-    // "jsxFactory": "",                                 /* Specify the JSX factory function used when targeting React JSX emit, e.g. 'React.createElement' or 'h'. */
-    // "jsxFragmentFactory": "",                         /* Specify the JSX Fragment reference used for fragments when targeting React JSX emit e.g. 'React.Fragment' or 'Fragment'. */
-    // "jsxImportSource": "",                            /* Specify module specifier used to import the JSX factory functions when using 'jsx: react-jsx*'. */
-    // "reactNamespace": "",                             /* Specify the object invoked for 'createElement'. This only applies when targeting 'react' JSX emit. */
-    // "noLib": true,                                    /* Disable including any library files, including the default lib.d.ts. */
-    // "useDefineForClassFields": true,                  /* Emit ECMAScript-standard-compliant class fields. */
-    // "moduleDetection": "auto",                        /* Control what method is used to detect module-format JS files. */
-
-    /* Modules */
-    "module": "commonjs",                                /* Specify what module code is generated. */
-    "rootDir": "./src",                                  /* Specify the root folder within your source files. */
-    // "moduleResolution": "node",                       /* Specify how TypeScript looks up a file from a given module specifier. */
-    // "baseUrl": "./",                                  /* Specify the base directory to resolve non-relative module names. */
-    // "paths": {},                                      /* Specify a set of entries that re-map imports to additional lookup locations. */
-    // "rootDirs": [],                                   /* Allow multiple folders to be treated as one when resolving modules. */
-    // "typeRoots": [],                                  /* Specify multiple folders that act like './node_modules/@types'. */
-    // "types": [],                                      /* Specify type package names to be included without being referenced in a source file. */
-    // "allowUmdGlobalAccess": true,                     /* Allow accessing UMD globals from modules. */
-    // "moduleSuffixes": [],                             /* List of file name suffixes to search when resolving a module. */
-    // "resolveJsonModule": true,                        /* Enable importing .json files. */
-    // "noResolve": true,                                /* Disallow 'import's, 'require's or '<reference>'s from expanding the number of files TypeScript should add to a project. */
-
-    /* JavaScript Support */
-    // "allowJs": true,                                  /* Allow JavaScript files to be a part of your program. Use the 'checkJS' option to get errors from these files. */
-    // "checkJs": true,                                  /* Enable error reporting in type-checked JavaScript files. */
-    // "maxNodeModuleJsDepth": 1,                        /* Specify the maximum folder depth used for checking JavaScript files from 'node_modules'. Only applicable with 'allowJs'. */
-
-    /* Emit */
-    "declaration": true,                                 /* Generate .d.ts files from TypeScript and JavaScript files in your project. */
-    // "declarationMap": true,                           /* Create sourcemaps for d.ts files. */
-    // "emitDeclarationOnly": true,                      /* Only output d.ts files and not JavaScript files. */
-    // "sourceMap": true,                                /* Create source map files for emitted JavaScript files. */
-    // "outFile": "./lib/index.js",                      /* Specify a file that bundles all outputs into one JavaScript file. If 'declaration' is true, also designates a file that bundles all .d.ts output. */
-    "outDir": ".",                                   /* Specify an output folder for all emitted files. */
-    // "removeComments": true,                           /* Disable emitting comments. */
-    // "noEmit": true,                                   /* Disable emitting files from a compilation. */
-    // "importHelpers": true,                            /* Allow importing helper functions from tslib once per project, instead of including them per-file. */
-    // "importsNotUsedAsValues": "remove",               /* Specify emit/checking behavior for imports that are only used for types. */
-    // "downlevelIteration": true,                       /* Emit more compliant, but verbose and less performant JavaScript for iteration. */
-    // "sourceRoot": "",                                 /* Specify the root path for debuggers to find the reference source code. */
-    // "mapRoot": "",                                    /* Specify the location where debugger should locate map files instead of generated locations. */
-    // "inlineSourceMap": true,                          /* Include sourcemap files inside the emitted JavaScript. */
-    // "inlineSources": true,                            /* Include source code in the sourcemaps inside the emitted JavaScript. */
-    // "emitBOM": true,                                  /* Emit a UTF-8 Byte Order Mark (BOM) in the beginning of output files. */
-    // "newLine": "crlf",                                /* Set the newline character for emitting files. */
-    // "stripInternal": true,                            /* Disable emitting declarations that have '@internal' in their JSDoc comments. */
-    // "noEmitHelpers": true,                            /* Disable generating custom helper functions like '__extends' in compiled output. */
-    // "noEmitOnError": true,                            /* Disable emitting files if any type checking errors are reported. */
-    // "preserveConstEnums": true,                       /* Disable erasing 'const enum' declarations in generated code. */
-    // "declarationDir": "./",                           /* Specify the output directory for generated declaration files. */
-    // "preserveValueImports": true,                     /* Preserve unused imported values in the JavaScript output that would otherwise be removed. */
-
-    /* Interop Constraints */
-    // "isolatedModules": true,                          /* Ensure that each file can be safely transpiled without relying on other imports. */
-    // "allowSyntheticDefaultImports": true,             /* Allow 'import x from y' when a module doesn't have a default export. */
-    "esModuleInterop": true,                             /* Emit additional JavaScript to ease support for importing CommonJS modules. This enables 'allowSyntheticDefaultImports' for type compatibility. */
-    // "preserveSymlinks": true,                         /* Disable resolving symlinks to their realpath. This correlates to the same flag in node. */
-    "forceConsistentCasingInFileNames": true,            /* Ensure that casing is correct in imports. */
-
-    /* Type Checking */
-    "strict": true,                                      /* Enable all strict type-checking options. */
-    // "noImplicitAny": true,                            /* Enable error reporting for expressions and declarations with an implied 'any' type. */
-    // "strictNullChecks": true,                         /* When type checking, take into account 'null' and 'undefined'. */
-    // "strictFunctionTypes": true,                      /* When assigning functions, check to ensure parameters and the return values are subtype-compatible. */
-    // "strictBindCallApply": true,                      /* Check that the arguments for 'bind', 'call', and 'apply' methods match the original function. */
-    // "strictPropertyInitialization": true,             /* Check for class properties that are declared but not set in the constructor. */
-    // "noImplicitThis": true,                           /* Enable error reporting when 'this' is given the type 'any'. */
-    // "useUnknownInCatchVariables": true,               /* Default catch clause variables as 'unknown' instead of 'any'. */
-    // "alwaysStrict": true,                             /* Ensure 'use strict' is always emitted. */
-    // "noUnusedLocals": true,                           /* Enable error reporting when local variables aren't read. */
-    // "noUnusedParameters": true,                       /* Raise an error when a function parameter isn't read. */
-    // "exactOptionalPropertyTypes": true,               /* Interpret optional property types as written, rather than adding 'undefined'. */
-    // "noImplicitReturns": true,                        /* Enable error reporting for codepaths that do not explicitly return in a function. */
-    // "noFallthroughCasesInSwitch": true,               /* Enable error reporting for fallthrough cases in switch statements. */
-    // "noUncheckedIndexedAccess": true,                 /* Add 'undefined' to a type when accessed using an index. */
-    // "noImplicitOverride": true,                       /* Ensure overriding members in derived classes are marked with an override modifier. */
-    // "noPropertyAccessFromIndexSignature": true,       /* Enforces using indexed accessors for keys declared using an indexed type. */
-    // "allowUnusedLabels": true,                        /* Disable error reporting for unused labels. */
-    // "allowUnreachableCode": true,                     /* Disable error reporting for unreachable code. */
-
-    /* Completeness */
-    // "skipDefaultLibCheck": true,                      /* Skip type checking .d.ts files that are included with TypeScript. */
-    "skipLibCheck": true                                 /* Skip type checking all .d.ts files. */
-  },
-  "exclude": ["api", "react", "node_modules"]
-}
+{
+  "compilerOptions": {
+    /* Visit https://aka.ms/tsconfig to read more about this file */
+
+    /* Projects */
+    // "incremental": true,                              /* Save .tsbuildinfo files to allow for incremental compilation of projects. */
+    // "composite": true,                                /* Enable constraints that allow a TypeScript project to be used with project references. */
+    // "tsBuildInfoFile": "./.tsbuildinfo",              /* Specify the path to .tsbuildinfo incremental compilation file. */
+    // "disableSourceOfProjectReferenceRedirect": true,  /* Disable preferring source files instead of declaration files when referencing composite projects. */
+    // "disableSolutionSearching": true,                 /* Opt a project out of multi-project reference checking when editing. */
+    // "disableReferencedProjectLoad": true,             /* Reduce the number of projects loaded automatically by TypeScript. */
+
+    /* Language and Environment */
+    "target": "es2016",                                  /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */
+    // "lib": [],                                        /* Specify a set of bundled library declaration files that describe the target runtime environment. */
+    "jsx": "react",                                /* Specify what JSX code is generated. */
+    // "experimentalDecorators": true,                   /* Enable experimental support for TC39 stage 2 draft decorators. */
+    // "emitDecoratorMetadata": true,                    /* Emit design-type metadata for decorated declarations in source files. */
+    // "jsxFactory": "",                                 /* Specify the JSX factory function used when targeting React JSX emit, e.g. 'React.createElement' or 'h'. */
+    // "jsxFragmentFactory": "",                         /* Specify the JSX Fragment reference used for fragments when targeting React JSX emit e.g. 'React.Fragment' or 'Fragment'. */
+    // "jsxImportSource": "",                            /* Specify module specifier used to import the JSX factory functions when using 'jsx: react-jsx*'. */
+    // "reactNamespace": "",                             /* Specify the object invoked for 'createElement'. This only applies when targeting 'react' JSX emit. */
+    // "noLib": true,                                    /* Disable including any library files, including the default lib.d.ts. */
+    // "useDefineForClassFields": true,                  /* Emit ECMAScript-standard-compliant class fields. */
+    // "moduleDetection": "auto",                        /* Control what method is used to detect module-format JS files. */
+
+    /* Modules */
+    "module": "commonjs",                                /* Specify what module code is generated. */
+    "rootDir": "./src",                                  /* Specify the root folder within your source files. */
+    // "moduleResolution": "node",                       /* Specify how TypeScript looks up a file from a given module specifier. */
+    // "baseUrl": "./",                                  /* Specify the base directory to resolve non-relative module names. */
+    // "paths": {},                                      /* Specify a set of entries that re-map imports to additional lookup locations. */
+    // "rootDirs": [],                                   /* Allow multiple folders to be treated as one when resolving modules. */
+    // "typeRoots": [],                                  /* Specify multiple folders that act like './node_modules/@types'. */
+    // "types": [],                                      /* Specify type package names to be included without being referenced in a source file. */
+    // "allowUmdGlobalAccess": true,                     /* Allow accessing UMD globals from modules. */
+    // "moduleSuffixes": [],                             /* List of file name suffixes to search when resolving a module. */
+    // "resolveJsonModule": true,                        /* Enable importing .json files. */
+    // "noResolve": true,                                /* Disallow 'import's, 'require's or '<reference>'s from expanding the number of files TypeScript should add to a project. */
+
+    /* JavaScript Support */
+    // "allowJs": true,                                  /* Allow JavaScript files to be a part of your program. Use the 'checkJS' option to get errors from these files. */
+    // "checkJs": true,                                  /* Enable error reporting in type-checked JavaScript files. */
+    // "maxNodeModuleJsDepth": 1,                        /* Specify the maximum folder depth used for checking JavaScript files from 'node_modules'. Only applicable with 'allowJs'. */
+
+    /* Emit */
+    "declaration": true,                                 /* Generate .d.ts files from TypeScript and JavaScript files in your project. */
+    // "declarationMap": true,                           /* Create sourcemaps for d.ts files. */
+    // "emitDeclarationOnly": true,                      /* Only output d.ts files and not JavaScript files. */
+    // "sourceMap": true,                                /* Create source map files for emitted JavaScript files. */
+    // "outFile": "./lib/index.js",                      /* Specify a file that bundles all outputs into one JavaScript file. If 'declaration' is true, also designates a file that bundles all .d.ts output. */
+    "outDir": ".",                                   /* Specify an output folder for all emitted files. */
+    // "removeComments": true,                           /* Disable emitting comments. */
+    // "noEmit": true,                                   /* Disable emitting files from a compilation. */
+    // "importHelpers": true,                            /* Allow importing helper functions from tslib once per project, instead of including them per-file. */
+    // "importsNotUsedAsValues": "remove",               /* Specify emit/checking behavior for imports that are only used for types. */
+    // "downlevelIteration": true,                       /* Emit more compliant, but verbose and less performant JavaScript for iteration. */
+    // "sourceRoot": "",                                 /* Specify the root path for debuggers to find the reference source code. */
+    // "mapRoot": "",                                    /* Specify the location where debugger should locate map files instead of generated locations. */
+    // "inlineSourceMap": true,                          /* Include sourcemap files inside the emitted JavaScript. */
+    // "inlineSources": true,                            /* Include source code in the sourcemaps inside the emitted JavaScript. */
+    // "emitBOM": true,                                  /* Emit a UTF-8 Byte Order Mark (BOM) in the beginning of output files. */
+    // "newLine": "crlf",                                /* Set the newline character for emitting files. */
+    // "stripInternal": true,                            /* Disable emitting declarations that have '@internal' in their JSDoc comments. */
+    // "noEmitHelpers": true,                            /* Disable generating custom helper functions like '__extends' in compiled output. */
+    // "noEmitOnError": true,                            /* Disable emitting files if any type checking errors are reported. */
+    // "preserveConstEnums": true,                       /* Disable erasing 'const enum' declarations in generated code. */
+    // "declarationDir": "./",                           /* Specify the output directory for generated declaration files. */
+    // "preserveValueImports": true,                     /* Preserve unused imported values in the JavaScript output that would otherwise be removed. */
+
+    /* Interop Constraints */
+    // "isolatedModules": true,                          /* Ensure that each file can be safely transpiled without relying on other imports. */
+    // "allowSyntheticDefaultImports": true,             /* Allow 'import x from y' when a module doesn't have a default export. */
+    "esModuleInterop": true,                             /* Emit additional JavaScript to ease support for importing CommonJS modules. This enables 'allowSyntheticDefaultImports' for type compatibility. */
+    // "preserveSymlinks": true,                         /* Disable resolving symlinks to their realpath. This correlates to the same flag in node. */
+    "forceConsistentCasingInFileNames": true,            /* Ensure that casing is correct in imports. */
+
+    /* Type Checking */
+    "strict": true,                                      /* Enable all strict type-checking options. */
+    // "noImplicitAny": true,                            /* Enable error reporting for expressions and declarations with an implied 'any' type. */
+    // "strictNullChecks": true,                         /* When type checking, take into account 'null' and 'undefined'. */
+    // "strictFunctionTypes": true,                      /* When assigning functions, check to ensure parameters and the return values are subtype-compatible. */
+    // "strictBindCallApply": true,                      /* Check that the arguments for 'bind', 'call', and 'apply' methods match the original function. */
+    // "strictPropertyInitialization": true,             /* Check for class properties that are declared but not set in the constructor. */
+    // "noImplicitThis": true,                           /* Enable error reporting when 'this' is given the type 'any'. */
+    // "useUnknownInCatchVariables": true,               /* Default catch clause variables as 'unknown' instead of 'any'. */
+    // "alwaysStrict": true,                             /* Ensure 'use strict' is always emitted. */
+    // "noUnusedLocals": true,                           /* Enable error reporting when local variables aren't read. */
+    // "noUnusedParameters": true,                       /* Raise an error when a function parameter isn't read. */
+    // "exactOptionalPropertyTypes": true,               /* Interpret optional property types as written, rather than adding 'undefined'. */
+    // "noImplicitReturns": true,                        /* Enable error reporting for codepaths that do not explicitly return in a function. */
+    // "noFallthroughCasesInSwitch": true,               /* Enable error reporting for fallthrough cases in switch statements. */
+    // "noUncheckedIndexedAccess": true,                 /* Add 'undefined' to a type when accessed using an index. */
+    // "noImplicitOverride": true,                       /* Ensure overriding members in derived classes are marked with an override modifier. */
+    // "noPropertyAccessFromIndexSignature": true,       /* Enforces using indexed accessors for keys declared using an indexed type. */
+    // "allowUnusedLabels": true,                        /* Disable error reporting for unused labels. */
+    // "allowUnreachableCode": true,                     /* Disable error reporting for unreachable code. */
+
+    /* Completeness */
+    // "skipDefaultLibCheck": true,                      /* Skip type checking .d.ts files that are included with TypeScript. */
+    "skipLibCheck": true                                 /* Skip type checking all .d.ts files. */
+  },
+  "exclude": ["api", "react", "node_modules"]
+}