DescopeSessionManager class

The DescopeSessionManager class is used to manage an authenticated user session for an application.

The session manager takes care of loading and saving the session as well as ensuring that it's refreshed when needed.

Once the user completes a sign in flow successfully you should set the DescopeSession object as the active session of the session manager.

final authResponse = await Descope.otp.verify(method: DeliverMethod.Email, loginId: '[e-mail]', code: '123456');
final session = DescopeSession.fromAuthenticationResponse(authResponse);
Descope.sessionManager.manageSession(session);

The session manager can then be used at any time to ensure the session is valid and to authenticate outgoing requests to your backend with a bearer token authorization header.

await request.setAuthorization(Descope.sessionManager);

If your backend uses a different authorization mechanism you can of course use the session JWT directly instead of the extension function. You can either add another extension function on http.Request such as the one above, or you can do the following.

await Descope.sessionManager.refreshSessionIfNeeded();
final session = Descope.sessionManager.session;
if (session != null) {
  request.headers['X-Auth-Token'] = session.sessionJwt;
} else {
  throw ServerError.unauthorized;
}

The same principals can be used in the various networking libraries available, if those are used in your application.

When the application is relaunched the DescopeSessionManager can load the existing session and you can check straight away if there's an authenticated user.

await Descope.sessionManager.loadSession();
final session = Descope.sessionManager.session;
if (session != null) {
  print('User is logged in: ${session.user}');
}
...

When the user wants to sign out of the application we revoke the active session and clear it from the session manager:

final refreshJwt = Descope.sessionManager.session?.refreshJwt;
if (refreshJwt != null) {
  Descope.auth.logout(refreshJwt);
  Descope.sessionManager.clearSession();
}

You can customize how the DescopeSessionManager behaves by using your own DescopeSessionStorage and DescopeSessionLifecycle` objects. See the documentation for the initializer below for more details.

Constructors

DescopeSessionManager(DescopeSessionStorage storage, DescopeSessionLifecycle lifecycle)

Creates a new DescopeSessionManager object.

Properties

hashCode → int

The hash code for this object.

no setter, inherited

lifecycle → DescopeSessionLifecycle

final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

session → DescopeSession?

The active DescopeSession managed by this object.

no setter

storage → DescopeSessionStorage

final

Methods

addListener(DescopeSessionManagerListener listener) → void

Adds a listener object to the session manager.

clearSession() → void

Clears any active DescopeSession from this manager.

loadSession() → Future<void>

Loads any saved DescopeSession from secure storage.

manageSession(DescopeSession session) → void

Set an active DescopeSession in this manager.

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

refreshSessionIfNeeded() → Future<void>

Ensures that the session is valid and refreshes it if needed.

removeListener(DescopeSessionManagerListener listener) → void

Removes a listener object that was previously added.

toString() → String

A string representation of this object.

inherited

updateTokens(RefreshResponse refreshResponse) → void

Updates the active session's underlying JWTs.

updateUser(DescopeUser user) → void

Updates the active session's user details.

Operators

operator ==(Object other) → bool

The equality operator.

inherited