AuthScimConnectionPlugin<TContext> class final

Plugin-first managed connection and credential administration.

This plugin is intentionally separate from ScimPlugin. Install it only when an application wants a session-authorized management surface, and add its matching client plugin only to clients that administer connections.

Implemented types

• AuthServerPlugin<TContext>
• AuthEndpointContributor<TContext>
• AuthClientOperationContributor
• AuthPersistenceContributor
• AuthRateLimitContributor
• AuthUserDeletionPlanContributor

Constructors

AuthScimConnectionPlugin({required AuthScimConnectionStore store, required AuthScimConnectionAuthorizer<TContext> authorize, String tokenPrefix = 'rscim', Duration defaultCredentialLifetime = const Duration(days: 90), Duration maximumCredentialLifetime = const Duration(days: 365), AuthScimConnectionTokenGenerator connectionIdGenerator = secureRandomToken, AuthScimConnectionTokenGenerator credentialIdGenerator = secureRandomToken, AuthScimConnectionTokenGenerator secretGenerator = secureRandomToken, DateTime clock()?})

Creates a plugin for managing SCIM connections and credentials.

Properties

authorize → AuthScimConnectionAuthorizer<TContext>

Authorizes each management operation for the current request.

final

clientOperations → Iterable<AuthClientOperationDescriptor>

Client operations declared by the plugin.

no setter, override

connectionIdGenerator → AuthScimConnectionTokenGenerator

Generates connection identifiers.

final

credentialIdGenerator → AuthScimConnectionTokenGenerator

Generates credential identifiers.

final

dataContract → AuthServerPluginDataContract

Declares data and destructive routes owned by this plugin.

no setter, override

defaultCredentialLifetime → Duration

Lifetime applied when a credential does not specify an expiry.

final

endpoints → Iterable<AuthEndpointDescriptor<TContext>>

Runtime endpoints contributed by the plugin.

no setter, override

hashCode → int

The hash code for this object.

no setter, inherited

id → String

Stable plugin identifier.

no setter, override

maximumCredentialLifetime → Duration

Maximum lifetime accepted for an issued credential.

final

persistenceSchemas → Iterable<AuthPersistenceSchema>

Persistence schemas declared by the plugin.

no setter, override

rateLimitOperations → Iterable<AuthRateLimitOperation>

Rate-limit operations declared by the plugin.

no setter, override

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

secretGenerator → AuthScimConnectionTokenGenerator

Generates the raw secret shown when a credential is issued.

final

store → AuthScimConnectionStore

Persistence boundary for connections, credentials, and replay receipts.

final

tokenPrefix → String

Prefix used for issued managed SCIM bearer tokens.

final

userDataNamespace → String

The namespace used for plugin-owned user data.

no setter, override

Methods

configure(AuthServerPluginContext<TContext> context) → void

Configures this plugin against the shared runtime context.

override

create({required AuthScimConnectionManagementPrincipal principal, required String name, required String provisioningDomainId, required Iterable<AuthScimScope> scopes, required String credentialName, required String idempotencyKey, DateTime? expiresAt}) → Future<AuthScimConnectionCreation>

Creates a connection and initial credential in one transaction.

createUserDeletionPlan(AuthUser user) → Future<AuthUserDeletionPlan>

Creates user deletion plan.

override

deleteTenant(String tenantId) → Future<void>

Trusted tenant lifecycle operation. This is deliberately not an endpoint.

disable({required AuthScimConnectionManagementPrincipal principal, required String connectionId}) → Future<AuthScimManagedConnection?>

Disables a connection and revokes its active credentials.

issueCredential({required AuthScimConnectionManagementPrincipal principal, required String connectionId, required String name, required Iterable<AuthScimScope> scopes, required String idempotencyKey, DateTime? expiresAt}) → Future<AuthScimCredentialIssuance>

Issues one credential and returns its raw secret once.

list({required AuthScimConnectionManagementPrincipal principal, int limit = 100, int offset = 0}) → Future<AuthScimConnectionPage>

Lists connections visible to principal.

listCredentials({required AuthScimConnectionManagementPrincipal principal, required String connectionId, int limit = 100, int offset = 0}) → Future<AuthScimCredentialPage>

Lists credentials belonging to a connection visible to principal.

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

revokeCredential({required AuthScimConnectionManagementPrincipal principal, required String connectionId, required String credentialId}) → Future<AuthScimCredential?>

Revokes one credential without issuing a replacement.

rotateCredential({required AuthScimConnectionManagementPrincipal principal, required String connectionId, required String credentialId, required String name, required Iterable<AuthScimScope> scopes, required String idempotencyKey, DateTime? expiresAt}) → Future<AuthScimCredentialIssuance?>

Revokes a credential and issues its replacement atomically.

toString() → String

A string representation of this object.

inherited

update({required AuthScimConnectionManagementPrincipal principal, required String connectionId, required DateTime expectedUpdatedAt, required String name, required String provisioningDomainId, required Iterable<AuthScimScope> scopes}) → Future<AuthScimManagedConnection?>

Updates connection metadata using optimistic concurrency control.

Operators

operator ==(Object other) → bool

The equality operator.

inherited