DVOAuthEndpoints class

Handlers for the generated OAuth routes.

Properties

hashCode → int

The hash code for this object.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

Methods

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Properties

resolveUser ↔ Future<String?> Function(Request request)?

Who is signed in on request, answered by the application's own auth.

getter/setter pair

Static Methods

approve(Request request) → Future<Response>

POST /oauth/authorize: the signed-in person's answer, as a form with the authorization parameters and decision=approve or deny. Answers {"redirect_to": ...} for the consent screen to navigate to, because a script following a redirect to the partner's origin could not read it.

authorizationRequest(Request request) → Future<Response>

GET /oauth/authorize/request: the client and each scope with the words its declaration gave it, for the consent screen.

authorize(Request request) → Future<Response>

GET /oauth/authorize: a valid request is sent to the consent screen with its parameters; an unknown client or unregistered redirect URI is shown and never redirected; any other error goes back to the client.

introspect(Request request) → Future<Response>

POST /oauth/introspect (RFC 7662). The caller authenticates as a confidential client, or with an API key or access token whose scopes cover introspectAction. Tokens are answered for on the request's tenant only.

metadata(Request request, {required String apiBasePath}) → Future<Response>

GET /.well-known/oauth-authorization-server (RFC 8414).

otherMethod(Request request, {required String allow, bool crossOrigin = false}) → Response

Any method a route does not serve: a CORS preflight where the endpoint is crossOrigin, and 405 naming allow otherwise.

revoke(Request request) → Future<Response>

POST /oauth/revoke (RFC 7009). A token that is unknown or belongs to another client is answered like one that was revoked.

token(Request request) → Future<Response>

POST /oauth/token: authorization_code with PKCE, refresh_token and client_credentials, as a form.

Constants

authorizationRequestPath → const String

What the consent screen reads: the client and the scope wording.

authorizePath → const String

consentPath → const String

Where a valid authorization request is sent to be answered.

introspectAction → const String

The action a scope covers for its holder to introspect tokens. Defined by the framework, so a scope naming it needs no application policy.

introspectionPath → const String

maxBodyBytes → const int

The most a form body to these endpoints may be.

metadataPath → const String

revocationPath → const String

tokenPath → const String