verifyFinal method

@override Future<void> verifyFinal({ required String? authId, required String? authMethod, required Map<String, Object?>? authExtra, })

Verifies authentication data returned by the router before session use.

Authentication methods without a mutual-authentication response can keep this default no-op implementation.

Implementation

@override
Future<void> verifyFinal({
  required String? authId,
  required String? authMethod,
  required Map<String, Object?>? authExtra,
}) async {
  final expected = _expectedServerSignature;
  try {
    if (expected == null ||
        authMethod != getName() ||
        authId != _expectedAuthId) {
      throw StateError('SCRAM server identity could not be verified');
    }
    final encodedVerifier = authExtra?['verifier'];
    if (encodedVerifier is! String) {
      throw StateError('SCRAM server verifier is missing');
    }
    Uint8List actual;
    try {
      actual = Uint8List.fromList(base64.decode(encodedVerifier));
    } on FormatException {
      throw StateError('SCRAM server verifier is invalid');
    }
    final valid = _constantTimeEquals(expected, actual);
    _clear(actual);
    if (!valid) throw StateError('SCRAM server verifier is invalid');
  } finally {
    _clearExpectedVerifier();
    if (!_reuseClientKey) _clearKeys();
  }
}