Make Keycloak-JS a peer dependency

[gfrn]

I'm not using Keycloak JS, and some other projects only implement a basic OAuth2 Proxy ingress on top of their application

I've been trying to replace Toolpad in Evo with Sci-React-Ui since that's the way going forward (and also less buggy), but since we're working with Better Auth (as Evo includes a basic backend serving as a proxy to allow external users to use the API), Keycloak-JS becomes a bit unnecessary

I appreciate that AuthProvider is separate and this helps a lot already, but could we also have Keycloak-JS as a peer dependency, since basic/advanced use cases may not need it?

[akademy]

My thinking about this was that if you had SRU you wouldn't need to install Keycloak as there is no need to - you won't be calling it directly (as opposed to something like MUI or Icons which are used both locally and in SRU). I was hoping it would encourage everyone to use the SRU way to login too, but maybe that's wishful thinking.

I guess I don't mind it being a peer dependency. Maybe it's better like that anyway, given, as you say, it's already separate.

[akademy]

This also struck me as a question about the dependencies section - why not just have peerDependecies all the time?

[gfrn]

This also struck me as a question about the dependencies section - why not just have peerDependecies all the time?

I think this is what a lot of libs do to some extent - things like icons are fine because most of the times, they can be tree-shaken and they end up as SVGs, which don't take much space and the redundancy is worth it, other smaller libs (like apng-js or utif) are also worth having because they don't have many dependencies themselves, and they get dropped from the final build anyway

As for encouraging using SRU for login, that's true, I didn't think of that - I was thinking of SRU as a UI library first, and a compilation of utilities second (insofar that it could add some components which did some logical work to display things, like APNG/TIFF/plot viewers that could modify the image, but as a function of a UI element)

Looking at Evo's build, KeycloakJS does get dropped and it does not affect us that much, although the lockfile has a dependency that we don't use, which may result in some false positives (which is why I tagged this as low priority, it doesn't break anything for us, but since it might break other people's workflows, we can keep it if needed)