auth library
Classes
- Authenticated
- AuthProvider
- A public provider descriptor returned by CtrlAppAuth.listProviders.
- Cancelled
- ChallengeHasher
- CtrlAppAuth
- The public auth client.
- CtrlAppAuthConfig
- Disabled
- Expired
- FakeCtrlAppAuth
- Deterministic in-memory fake for tests. Never touches the network.
- Loading
- Offline
- Outage
- SecureStore
- Platform secure-storage interface — implement with flutter_secure_storage (which uses Keychain on iOS and EncryptedSharedPreferences on Android). Only opaque server-issued tokens are ever passed here (CSRF, session id hash). Access tokens and refresh tokens are NEVER stored via this API.
- SessionData
- SessionState
- Discriminated session state.
- SessionUser
- Unauthenticated
Enums
Functions
-
generateVerifier(
[Random? rng]) → String -
isSafeReturnTo(
String? candidate, Uri baseUrl) → bool - Same-origin / relative path validation. Public for tests.
-
s256Challenge(
String verifier) → String
Exceptions / Errors
- CtrlAppAuthError
- Typed error hierarchy — never leaks bearer tokens or codes.