@multiplatform.one/keycloak

Keycloak authentication for the multiplatform.one ecosystem — a Better Auth–powered client with a useKeycloak() hook, session hooks, route guards, and a server config factory for One apps.

Install

pnpm add @multiplatform.one/keycloak

Peers: react, @multiplatform.one/logger, @multiplatform.one/platform.

What it owns

• KeycloakProvider — auth context (debug, disabled, iframeSso, loginRedirectUri, …); usually mounted for you by createApp({ keycloak: true }) from @multiplatform.one/core
• useKeycloak() — the Keycloak client (login/logout, tokens); returns null when auth is disabled
• useSession(), useAuthConfig(), useTokensFromQuery, useTokensFromState
• Authenticated / withAuthenticated — render children only when signed in
• Token helpers — isTokenExpired, validOrRefreshableToken, getKeycloakBearerToken, wallet-claim readers (getWalletsFromToken, getWalletAddresses, hasWallets)
• @multiplatform.one/keycloak/one — createAuth() Better Auth server factory (stateless JWE sessions, Keycloak OAuth, Expo support)

What it must not do

• No UI beyond the guard components — login screens belong to apps
• No Frappe logic besides bearer-token bridging (getKeycloakBearerToken)

Usage

import { Authenticated, useKeycloak } from "@multiplatform.one/keycloak";

export function AccountMenu() {
  const keycloak = useKeycloak();
  if (!keycloak) return null; // auth disabled
  return (
    <Authenticated>
      <button onClick={() => keycloak.logout()}>Sign out</button>
    </Authenticated>
  );
}

Uses the patched adapter from @multiplatform.one/keycloak-js under the hood.

License

Apache-2.0