FFXAuth class
Auth surface (14 §6): email/password + guest sign-in and self-managing sessions.
Sessions persist by default and restore synchronously at
FlutterFlowCloud.initialize: currentUser is hydrated from the stored
snapshot immediately (no network), then reconciled against GET /v1/auth/me in the background. authStateChanges therefore reports a
restored session as signed-in from the very first event — boot code can
simply branch on currentUser == null.
Constructors
-
FFXAuth(HttpCore _http, FFXSessionStorage _storage, {Future<
void> onIdentityChanged()?, FFXRefreshLock? refreshLock})
Properties
- credentialEpoch → int
-
Monotonic identity generation; token rotation alone does not advance it.
Transports freeze this value to prevent retries across account changes.
no setter
- currentUser → FFXUser?
-
The signed-in user, or null when signed out.
no setter
- hashCode → int
-
The hash code for this object.
no setterinherited
- hasSession → bool
-
Whether a session (tokens) exists — true during the brief window where
tokens were restored but no user snapshot was available.
no setter
- realtimeIdentity → String
-
Internal principal and claims identity used to fence realtime snapshots.
no setter
- runtimeType → Type
-
A representation of the runtime type of the object.
no setterinherited
Methods
-
authStateChanges(
) → Stream< FFXUser?> - The current user, then every subsequent auth-state change. Emits null when signed out. The first event fires immediately on listen.
-
close(
) → void - Releases subscriptions without deleting persisted credentials.
-
completePasswordReset(
{required String oobCode, required String newPassword}) → Future< void> -
Sets a new password with the
oobCodefrom a reset link (06 §5.8). -
deleteAccount(
) → Future< void> -
Permanently deletes this account across every environment and revokes
all sessions. A retry after a transport failure, a timeout or a 5xx keeps
its original key. A refusal the server will repeat (such as
403 permissionDeniedfor drip's test account) leaves the session as it was, and the next call is a new deletion with a new key. A refresh already in flight lands first, so that session holds the refreshed tokens. -
getAccessToken(
) → Future< String?> -
me(
) → Future< FFXUser> - Fetches the current user from the server and updates currentUser and the persisted snapshot.
-
noSuchMethod(
Invocation invocation) → dynamic -
Invoked when a nonexistent method or property is accessed.
inherited
-
onTokenExpired(
) → Future< bool> -
reconcile(
) → Future< void> - Background reconcile after restore: refreshes the user snapshot when a session exists. Transient failures (offline, 5xx) keep the restored state; a definitive auth rejection signs out. Never throws.
-
refresh(
) → Future< bool> - Single-flight refresh; false when no session exists or the session is definitively dead.
-
restore(
) → Future< void> - Restores the persisted session; called by FlutterFlowCloud.initialize (no network). An identity adopted while the storage was read (a sign-in during startBorrowing) is kept.
-
sendPasswordResetEmail(
{required String email, String? turnstileToken}) → Future< void> -
Emails a password-reset link to the email/password account using
email(06 §5.8). -
setCustomClaim(
{required String endUserId, required String claim, required Object? value, int? expectedRevision, String? idempotencyKey}) → Future< FFXAppClaimResult> - Sets one claim under the current standalone policy (published or draft). Null revokes it; other claims are preserved.
-
signInAsGuest(
) → Future< FFXUser> - Signs in as a guest (anonymous) user, when the project's config enables the guest provider.
-
signInWithEmail(
{required String email, required String password, String? turnstileToken}) → Future< FFXUser> -
signInWithGoogle(
{required Uri redirectUri, required FFXGoogleSignInBrowser browser, Map< String, Object?> ? profile, Future<void> ? abort}) → Future<FFXUser> - Opens Google through a system browser and adopts an FFX session. Construct FFXSystemGoogleSignInBrowser before any await in a Flutter button handler; tests and non-Flutter hosts may supply their own port.
-
signOut(
{FFXSignOutScope scope = FFXSignOutScope.currentSession}) → Future< void> - Revokes the session server-side and clears local state. Local state is cleared even when the revoke call fails (e.g. offline).
-
signUpWithEmail(
{required String email, required String password, Map< String, Object?> ? profile, String? turnstileToken}) → Future<FFXUser> - Creates an email/password account and signs in.
-
startBorrowing(
) → void - Starts an instance App Preview connected on first read (FlutterFlowCloud.instance), off the caller's frame. The whole-app preview and every other screen share its persisted session, so it borrows that session instead of owning it: it never presents the refresh token, because a second instance rotating the same token trips the reuse tripwire and revokes the session for all of them (06 AUTH-R2). When the access token runs out it takes the session another instance stored since, or else signs in as a guest. It stores only a session it signed in itself, and clears the stored one only while it is still the session it holds.
-
toString(
) → String -
A string representation of this object.
inherited
-
updateProfile(
{required Map< String, Object?> patch}) → Future<FFXUser> - Updates owner-writable built-ins and config-declared profile fields. Absent fields are unchanged; an explicit null clears an optional field.
Operators
-
operator ==(
Object other) → bool -
The equality operator.
inherited