createAuthRuntimeConformanceEngine function

Engine createAuthRuntimeConformanceEngine()

Creates the opinionated engine fixture used by verifyAuthRuntimeConformance.

The fixture enables credential sign-in, cookie-backed sessions, CSRF and browser-origin protection. Its credential callback also has a deliberate failure path used to confirm that transports sanitize internal errors.

Implementation

Engine createAuthRuntimeConformanceEngine() {
  final sessionKey = base64.encode(
    List<int>.generate(32, (index) => index + 1),
  );
  final manager = AuthManager(
    AuthOptions<EngineContext>(
      store: InMemoryAuthStore(),
      storeMode: AuthStoreMode.ephemeral,
      providers: [
        CredentialsProvider(
          authorize: (_, _, credentials) async {
            final identifier = credentials.email ?? credentials.username;
            if (identifier == '[e-mail]') {
              throw StateError(authRuntimeConformanceFailureMarker);
            }
            if (identifier != authRuntimeConformanceEmail ||
                credentials.password != authRuntimeConformancePassword) {
              return null;
            }
            return AuthUser(
              id: authRuntimeConformanceUserId,
              email: authRuntimeConformanceEmail,
              name: 'Runtime User',
            );
          },
        ),
      ],
      cookiePolicy: AuthCookiePolicy.development,
    ),
  );
  final sessionConfig = SessionConfig.cookie(
    appKey: 'base64:$sessionKey',
    cookieName: authRuntimeConformanceCookieName,
    options: SessionOptions(
      secure: false,
      httpOnly: true,
      sameSite: SameSite.lax,
    ),
  );
  final engine = Engine(
    config: EngineConfig(
      security: const EngineSecurityFeatures(csrfProtection: false),
    ),
    providers: [
      ...Engine.defaultProviders,
      RoutedSessionsProvider(sessionConfig),
    ],
  );
  engine.addGlobalMiddleware(sessionMiddleware());
  engine.addGlobalMiddleware(SessionAuth.sessionAuthMiddleware());
  AuthRoutes(manager).register(engine.defaultRouter);
  return engine;
}