ensureFreshTokens method

Future<OneIdAuthResult> ensureFreshTokens()

Returns a token set guaranteed not to be within _refreshSkew of expiring, refreshing it first if needed.

Throws OneIdAuthException if nothing is stored (call login first) or if the token is expiring/expired with no refresh token to recover with.

Implementation

Future<OneIdAuthResult> ensureFreshTokens() async {
  final tokens = await _storage.read();
  if (tokens == null) {
    throw const OneIdAuthException('Not authenticated — call login() first.');
  }

  if (!tokens.isExpiringWithin(_refreshSkew)) {
    return tokens;
  }

  final refreshToken = tokens.refreshToken;
  if (refreshToken == null) {
    throw const OneIdAuthException(
      'Access token expired and no refresh token is available — call '
      'login() again.',
    );
  }

  final message = await guardPlatformCall(
    () => _hostApi.refresh(_toMessage(config), refreshToken),
  );
  final refreshed = _fromMessage(message);
  await _storage.save(refreshed);
  return refreshed;
}