flutter_mfa library

Classes

Accepted: The code matched.
AsyncMutex: A non-reentrant asynchronous lock that runs critical sections one at a time, in the order protect was called.
AtomicAttemptStore: An AttemptStore that can change one subject's state atomically (ADR-0014), so no failure is lost across processes sharing the store.
AttemptLimiter: Throttles verification attempts per subject (FR-VER-05, S1).
AttemptState: Persisted throttling state of one subject.
AttemptStore: Storage for AttemptState, keyed by subject (user or account id).
BackupCodec: Encrypts and decrypts backups in format v1: PBKDF2-HMAC-SHA256 and AES-256-GCM, with the header authenticated (FR-BAK-01, ADR-0007).
BackupEntry: One account and its secret, as stored in an encrypted backup.
Base32: Base32 codec (RFC 4648 §6) with the leniency authenticator apps need.
BiometricPrompt: Text for the system biometric prompt shown when reading an entry stored with ProtectionLevel.biometric or hardwareBound.
Clock: Source of the current time, injectable so tests and servers control it (FR-OTP-02 AC3).
DeviceIntegrityCheck: A device integrity check supplied by the app, for example one built on a root-detection or attestation package (FR-FAC-03).
Hotp: Counter-based one-time password generator (RFC 4226, FR-OTP-01).
HotpConfig: Parameters of an HOTP generator (RFC 4226).
HotpVerifier: Verifies HOTP codes with look-ahead, resynchronisation and optional attempt limiting (FR-VER-03/05/06).
ImportReport: The outcome of MfaClient.importEncrypted: account metadata only, never secrets (FR-BAK-03).
InMemoryAttemptStore: Process-local AttemptStore kept in memory.
IntegrityReport: The result of a DeviceIntegrityCheck: a verdict and short signal names such as 'root' or 'debugger', never device data or secrets.
LimiterPolicy: Throttling parameters for an AttemptLimiter (RFC 4226 §7.3).
MfaClient: The single entry point for apps: enrol accounts, list them and produce codes, with secrets kept in the platform vault (FR-FAC-01).
MfaClientOptions: Configuration of an MfaClient.
MfaLogger: Receives flutter_mfa's diagnostic messages (FR-FAC-04).
NoopIntegrityCheck: The default check: does nothing and reports IntegrityVerdict.unknown.
OtpAccount: Non-secret metadata of an enrolled account (03 §1.7).
OtpAuthUri: An otpauth://totp|hotp/<label>?… enrolment URI (Google Key URI format).
OtpCode: A one-time code ready to show the user.
OtpSecret: An OTP shared secret (seed), held as bytes.
PassphrasePolicy: The rules a backup passphrase must meet (FR-BAK-02).
Rejected: The code was not accepted.
RelyingPartyEnrollment: Everything a relying party (the service a user signs in to) needs to enrol a user in TOTP (FR-FAC-07). Create it with MfaClient.createEnrollment.
SilentMfaLogger: MfaLogger that discards everything (the default).
SystemClock: Clock backed by the system clock.
Totp: Time-based one-time password generator (RFC 6238, FR-OTP-02).
TotpConfig: Parameters of a TOTP generator (RFC 6238).
TotpVerifier: Verifies TOTP codes with a drift window, replay protection and optional attempt limiting (FR-VER-01/02/05/06).
VaultCapabilities: What the device's secure vault can provide (FR-VLT-05 AC1).
VerificationResult: Outcome of verifying a submitted code. Rejections are values, not exceptions; only rate limiting throws (02_ARCHITECTURE §6).

Enums

CompatibilityWarning: Ways an otpauth:// URI may not work in common authenticator apps.
DuplicateStrategy: What MfaClient.importEncrypted does with a backed-up account that is already on this device (FR-BAK-03).
HardwareUnavailableReason: Why a requested hardware-backed protection is not available.
IntegrityVerdict: How far a DeviceIntegrityCheck trusts the device (FR-FAC-03).
MfaLogLevel: Severity of a MfaLogger message.
OtpAlgorithm: HMAC hash function used to compute one-time passwords (FR-OTP-03).
OtpType: Kind of one-time password.
PassphraseCheck: Outcome of checking a backup passphrase against the policy (FR-BAK-02).
ProtectionLevel: How strongly an account's secret is protected in the vault (FR-VLT-05).
RejectReason: Why a code was rejected.
VaultUnavailableReason: Why the vault as a whole cannot be used.

Functions

allowAllIntegrity(IntegrityReport report) → Future<void>: The default policy: accept every report.

Typedefs

IntegrityPolicy = Future<void> Function(IntegrityReport report): What the app does with an IntegrityReport: return to continue, or throw to block (the exception reaches the caller of MfaClient.create or MfaClient.checkIntegrity).

Exceptions / Errors

BackupDecryptFailed: Wrong passphrase, or the backup was modified or truncated. The two cases are deliberately indistinguishable (FR-BAK-03).
BackupException: Encrypted backup export or import failed.
BackupUnsupportedVersion: The backup uses a format version (or KDF parameters) this reader does not accept.
BackupWeakPassphrase: The export passphrase does not satisfy the policy (FR-BAK-02).
MfaException: Root of every exception thrown by the flutter_mfa packages.
OtpAuthUriException: An otpauth:// URI could not be parsed.
OtpConfigException: An OTP parameter is invalid: digits, period, algorithm, counter, window or secret length.
VaultCorrupted: Stored data failed authentication or could not be decoded (tampering, truncation or a format bug). See S17.
VaultException: A secure-vault operation failed (FR-VLT-07).
VaultHardwareUnavailable: The requested protection level cannot be provided on this device.
VaultKeyInvalidated: The protecting key was permanently invalidated, typically because the biometric enrolment changed (FR-VLT-06 AC3).
VaultNotFound: No entry exists for the requested key.
VaultUnavailable: The vault cannot be used in the current environment.
VaultUnknown: A platform error with no specific mapping.
VaultUserCancelled: The user dismissed the biometric or device-credential prompt.
VerificationRateLimited: Verification was refused by the attempt limiter before any code was computed (FR-VER-05, S1).

flutter_mfa library

Classes

Enums

Functions

Typedefs

Exceptions / Errors

flutter_mfa package

flutter_mfa library