{"version":3,"file":"keycloak.mjs","names":[],"sources":["../../../../src/plugins/generic-oauth/providers/keycloak.ts"],"sourcesContent":["import type { BaseOAuthProviderOptions, GenericOAuthConfig } from \"../index\";\n\nexport interface KeycloakOptions extends BaseOAuthProviderOptions {\n\t/**\n\t * Keycloak issuer URL (includes realm, e.g., https://my-domain/realms/MyRealm)\n\t * This will be used to construct the discovery URL.\n\t */\n\tissuer: string;\n}\n\n/**\n * Keycloak OAuth provider helper\n *\n * @example\n * ```ts\n * import { genericOAuth, keycloak } from \"better-auth/plugins/generic-oauth\";\n *\n * export const auth = betterAuth({\n *   plugins: [\n *     genericOAuth({\n *       config: [\n *         keycloak({\n *           clientId: process.env.KEYCLOAK_CLIENT_ID,\n *           clientSecret: process.env.KEYCLOAK_CLIENT_SECRET,\n *           issuer: process.env.KEYCLOAK_ISSUER,\n *         }),\n *       ],\n *     }),\n *   ],\n * });\n * ```\n */\nexport function keycloak(options: KeycloakOptions): GenericOAuthConfig {\n\tconst defaultScopes = [\"openid\", \"profile\", \"email\"];\n\n\t// Ensure issuer ends without trailing slash for proper discovery URL construction\n\tconst issuer = options.issuer.replace(/\\/$/, \"\");\n\tconst discoveryUrl = `${issuer}/.well-known/openid-configuration`;\n\n\treturn {\n\t\tproviderId: \"keycloak\",\n\t\tdiscoveryUrl,\n\t\tclientId: options.clientId,\n\t\tclientSecret: options.clientSecret,\n\t\tscopes: options.scopes ?? defaultScopes,\n\t\tredirectURI: options.redirectURI,\n\t\tpkce: options.pkce,\n\t\tdisableImplicitSignUp: options.disableImplicitSignUp,\n\t\tdisableSignUp: options.disableSignUp,\n\t\toverrideUserInfo: options.overrideUserInfo,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAgB,SAAS,SAA8C;AAOtE,QAAO;EACN,YAAY;EACZ,cAJoB,GADN,QAAQ,OAAO,QAAQ,OAAO,GAAG,CACjB;EAK9B,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,QAAQ,QAAQ,UAXK;GAAC;GAAU;GAAW;GAAQ;EAYnD,aAAa,QAAQ;EACrB,MAAM,QAAQ;EACd,uBAAuB,QAAQ;EAC/B,eAAe,QAAQ;EACvB,kBAAkB,QAAQ;EAC1B"}