createAuthPluginRuntimeConformanceEngine function

Engine createAuthPluginRuntimeConformanceEngine({ bool includeTwoFactor = true, AuthPluginRuntimePhoneDeliveryRecorder? phoneDeliveryRecorder, })

Creates an engine containing deterministic, provider-free auth plugins.

The fixture is intended for host-adapter integration tests. It does not contact an email service, WebAuthn metadata service, or any other external provider. Set includeTwoFactor to false to verify that two-factor routes are absent when the plugin is not installed.

Implementation

Engine createAuthPluginRuntimeConformanceEngine({
  bool includeTwoFactor = true,
  AuthPluginRuntimePhoneDeliveryRecorder? phoneDeliveryRecorder,
}) {
  final store = InMemoryAuthStore();
  final phoneDeliveries =
      phoneDeliveryRecorder ?? AuthPluginRuntimePhoneDeliveryRecorder();
  final webAuthnProvider = WebAuthnProvider(
    getUserInfo: (_, _, _) => null,
    getRelyingParty: (_, _) => const WebAuthnRelyingParty(
      id: 'runtime.example',
      name: 'Routed runtime conformance',
      origin: 'https://runtime.example',
    ),
  );
  final plugins = <AuthServerPlugin<EngineContext>>[
    MagicLinkPlugin<EngineContext>(
      id: authPluginRuntimeConformanceMagicLinkProviderId,
      tokenGenerator: () => _authPluginRuntimeConformanceMagicLinkToken,
      sendMagicLink: (_) {},
    ),
    PhoneNumberPlugin<EngineContext>(
      sendCode: phoneDeliveries._record,
      codeHashKey: 'runtime-phone-code-hash-key-32-bytes',
      allowSignUp: true,
      generateCode: (_) => _authPluginRuntimeConformancePhoneCode,
    ),
    EmailOtpPlugin<EngineContext>(
      secret: 'runtime-email-otp-rate-limit-key',
      generateOtp: (_) => authPluginRuntimeConformanceOtpCode,
      sendCode: (_) {},
    ),
    UsernamePlugin<EngineContext>(),
    AuthApiKeyPlugin<EngineContext>(
      store: InMemoryAuthApiKeyStore(),
      sessionExchangeEnabled: true,
      keyIdGenerator: ({int length = 32}) => 'runtime-key-id',
      secretGenerator: ({int length = 32}) => 'runtime-key-secret',
    ),
    WebAuthnPlugin<EngineContext>(provider: webAuthnProvider),
    AnonymousPlugin<EngineContext>(),
    if (includeTwoFactor)
      TwoFactorPlugin<EngineContext>(
        backend: InMemoryAuthTwoFactorBackend(),
        secretProtector: const PlaintextAuthTwoFactorSecretProtector(),
        secretGenerator: (length) =>
            List<int>.generate(length, (index) => (index + 1) & 0xff),
      ),
  ];
  final manager = AuthManager(
    AuthOptions<EngineContext>(
      store: store,
      storeMode: AuthStoreMode.ephemeral,
      providers: <AuthProvider>[webAuthnProvider],
      plugins: plugins,
      passwordHasher: const _ConformancePasswordHasher(),
      cookiePolicy: AuthCookiePolicy.development,
    ),
  );
  final sessionKey = base64.encode(
    List<int>.generate(32, (index) => 255 - index),
  );
  final sessionConfig = SessionConfig.cookie(
    appKey: 'base64:$sessionKey',
    cookieName: authPluginRuntimeConformanceCookieName,
    options: SessionOptions(
      secure: false,
      httpOnly: true,
      sameSite: SameSite.lax,
    ),
  );
  final engine = Engine(
    config: EngineConfig(
      security: const EngineSecurityFeatures(csrfProtection: false),
    ),
    providers: [
      ...Engine.defaultProviders,
      RoutedSessionsProvider(sessionConfig),
    ],
  );
  engine.addGlobalMiddleware(sessionMiddleware());
  engine.addGlobalMiddleware(SessionAuth.sessionAuthMiddleware());
  AuthRoutes(manager).register(engine.defaultRouter);
  return engine;
}