signUp method

Future<AuthUser?> signUp(String email, String password, { String? name, required String source, String? challengeToken, })

Signs up after the source limit, the challenge and the breach check pass.

A sign-up that signs somebody in cannot hide that an address was free, so what the guard can do is make probing expensive: each sign-up that hits a taken address counts against the source that sent it, and a source over its budget is refused before the provider is asked. The count is never kept against the address, because a sign-in lockout that only taken addresses can trip would be the oracle again.

Implementation

Future<AuthUser?> signUp(
  String email,
  String password, {
  String? name,
  required String source,
  String? challengeToken,
}) async {
  final limited = await velocity.checkSource(source: source);
  if (limited != null) {
    DVObservability.log(
      'A source velocity limit tripped; the sign-up was not tried.',
      level: DVLogLevel.warn,
      code: limited.code,
    );
    throw limited;
  }
  final bots = botProtection;
  if (bots != null) {
    final verdict = await DVBotChallenge(bots, action: 'sign-up')
        .check(challengeToken, source: source);
    if (!verdict.human) {
      throw DVBotRefusal(verdict.reason ?? 'the challenge was not passed');
    }
  }
  await checkNewPassword(password);
  try {
    return await provider.signUp(email, password, name: name);
  } on AuthException catch (error) {
    if (error.failure == AuthFailure.accountExists) {
      await velocity.recordSourceFailure(source: source);
    }
    rethrow;
  }
}