DVSessions class

Issues, authenticates, rotates and revokes sessions.

Constructors

DVSessions({DVSessionStore? store, Duration idleTimeout = const Duration(days: 14), Duration absoluteTimeout = const Duration(days: 30), DateTime clock()?})

Properties

absoluteTimeout → Duration

A session older than this no longer authenticates, however recently it was used or rotated.

final

hashCode → int

The hash code for this object.

no setter, inherited

idleTimeout → Duration

A session unused for this long no longer authenticates.

final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

store → DVSessionStore

final

Methods

authenticate(String token) → Future<DVSession?>

The session token authenticates, or null.

check(String token, {String? tenant}) → Future<DVSessionCheck>

The session token authenticates, with why not when it does not.

completeMfa(String token) → Future<DVIssuedSession>

Rotates and records that a second factor was presented now.

create(String userId, {String? tenant, String? device, String? location, Map<String, Object?> claims = const <String, Object?>{}}) → Future<DVIssuedSession>

Signs userId in on a device: a new session and the token for it.

elevate(String token, {required Map<String, Object?> claims}) → Future<DVIssuedSession>

Rotates and merges claims over the session's own — a privilege change, which is the boundary fixation exploits.

list(String userId, {String? currentToken}) → Future<List<DVSession>>

Every live session of userId, newest sign-in first, with the one currentToken authenticates marked current.

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

requireMfa(String token, DVMfa policy) → Future<DVSession>

The session token authenticates, if it meets policy; otherwise DVMfaRequired when the second factor is missing or stale, and DVSessionInvalid when there is no live session at all.

revoke(String id) → Future<void>

Revokes one session by its listed id. Its next request fails.

revokeOthers(String currentToken) → Future<int>

Revokes every other live session of the person currentToken belongs to, and returns how many.

rotate(String token) → Future<DVIssuedSession>

Reissues the token for token's session. The old token stops authenticating in the same write.

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Constants

tokenPrefix → const String

Every session token starts with this, so a request's authentication stage can tell the application's own session from an API key (dvk_), an OAuth access token (dvat_) and any other bearer token the application uses, without asking the store about each.