testing library

Public test support for validating Routed auth host transports.

Classes

AdminPlugin<TContext>: Server plugin that exposes administrative user and session operations.
AnonymousPlugin<TContext>: Anonymous authenticated identities that can later be linked to a real sign-in method by the host integration.
AppleName: Apple user name structure.
AppleProfile: Apple user profile returned by the ID token.
AppleProviderOptions: Configuration for the Apple OAuth provider.
Argon2idPasswordHasher: Argon2id password hashing policy backed by PointyCastle.
AuthAccount: Provider account metadata linked to an AuthUser.
AuthAccountClient: Client for viewing, unlinking, and deleting linked provider accounts.
AuthAccountClientPlugin: Adds linked-account operations to an AuthClient.
AuthAccountDeletionConfirmed: Result of confirming account deletion.
AuthAccountDeletionDelivery<TContext>: Application delivery payload for account-deletion confirmation.
AuthAccountDeletionInitiated: Result of initiating account deletion.
AuthAccountDeletionRequest: Request for initiating account deletion.
AuthAccountLinked: Result of linking a provider account.
AuthAccountPolicy: Policy configuration for account states and authentication rules.
AuthAccountState: Account state information for policy enforcement.
AuthAccountStateStore: Persistence contract for account state.
AuthAccountStore: Persistence contract for external provider accounts.
AuthAccountUnlinked: Result of unlinking a provider account.
AuthAdminAccessControl: Role-based access control for administrative operations.
AuthAdminAuditRecord: Secret-free audit fact persisted with one administrative mutation.
AuthAdminClient: Typed client for the opt-in Admin plugin.
AuthAdminClientPlugin: Installs the typed administrative API on an AuthClient.
AuthAdminCreateUserDraft: Input draft for auth admin create user draft.
AuthAdminCreateUserMutation: Mutation describing auth admin create user mutation.
AuthAdminDeleteUserMutation: Mutation describing auth admin delete user mutation.
AuthAdminHookContext<TContext, T>: Context supplied to auth admin hook context.
AuthAdminHooks<TContext>: Authentication data for auth admin hooks.
AuthAdminImpersonationStartDecision: Authentication data for auth admin impersonation start decision.
AuthAdminImpersonationStopDecision: Authentication data for auth admin impersonation stop decision.
AuthAdminInternalFailure: Failure details for auth admin internal failure.
AuthAdminLifecycleEvent: Lifecycle event for auth admin lifecycle event.
AuthAdminMutation<T>: A typed mutation executed entirely by an AuthAdminStore.
AuthAdminMutationAuthorization: Immutable authorization policy carried into a backend-owned admin command.
AuthAdminMutationResult<T>: Result returned by auth admin mutation result.
AuthAdminOptions<TContext>: Configuration for administrative operations.
AuthAdminPermissionRequirement: One permission that must still be held when an admin mutation commits.
AuthAdminPermissionResult: Result returned by auth admin permission result.
AuthAdminPrepareImpersonationMutation: Mutation describing auth admin prepare impersonation mutation.
AuthAdminPrepareStopImpersonatingMutation: Mutation describing auth admin prepare stop impersonating mutation.
AuthAdminReplaceRolesMutation: Mutation describing auth admin replace roles mutation.
AuthAdminRevokeSessionMutation: Mutation describing auth admin revoke session mutation.
AuthAdminRevokeSessionsMutation: Mutation describing auth admin revoke sessions mutation.
AuthAdminSession: Authentication data for auth admin session.
AuthAdminSetAccountStateMutation: Mutation describing auth admin set account state mutation.
AuthAdminSetBanMutation: Mutation describing auth admin set ban mutation.
AuthAdminSetPasswordMutation: Mutation describing auth admin set password mutation.
AuthAdminStopImpersonatingResult: Result returned by auth admin stop impersonating result.
AuthAdminStore: Plugin-owned persistence contract for administrative user operations.
AuthAdminStoreCapabilities: Optional data-plane operations required by the Admin plugin.
AuthAdminTrustedReplaceRolesMutation: Trusted bootstrap-only role grant. This command is never route-contributed.
AuthAdminUpdateUserDraft: Input draft for auth admin update user draft.
AuthAdminUpdateUserMutation: Mutation describing auth admin update user mutation.
AuthAdminUser: Authentication data for auth admin user.
AuthAdminUserPage: A page of auth admin user page.
AuthAdminUserQuery: Query options for auth admin user query.
AuthAdminUserState: State information for auth admin user state.
AuthAdminWarning: Authentication data for auth admin warning.
AuthAnonymousAccountMutationStore: Optional persistence capability required by AnonymousPlugin.
AuthAnonymousClient: Client for creating and deleting anonymous accounts.
AuthAnonymousClientPlugin: Adds anonymous-account operations to an AuthClient.
AuthAnonymousCompleteUpgradeCommand: Finalizes an anonymous-to-authenticated account upgrade.
AuthAnonymousCreateAccountCommand: Creates one anonymous identity.
AuthAnonymousDeleteAccountCommand: Deletes an authenticated anonymous identity and all user-owned auth data.
AuthAnonymousMutationResult: Result returned by an anonymous-account mutation backend.
AuthAnonymousSignInResult: Result returned by auth anonymous sign in result.
AuthApiKey: Public API-key metadata. It never contains the secret or its hash.
AuthApiKeyAuthentication: Successful verification result returned to framework adapters.
AuthApiKeyClient: Client for issuing and managing API keys for the current user.
AuthApiKeyClientPlugin: Adds API-key management operations to an AuthClient.
AuthApiKeyDeployment<TContext>: Service deployment that retains its API-key plugin for middleware wiring.
AuthApiKeyIssued: The only response that contains a raw API key.
AuthApiKeyPlugin<TContext>: Complete API-key capability with lifecycle endpoints and client metadata.
AuthApiKeyPrimaryMutationStore: Optional exact transaction used when API keys count as primary methods.
AuthApiKeyPrimaryRevocationCommand: Complete input to an exact primary API-key revocation transaction.
AuthApiKeyRecord: The persisted representation of an API key.
AuthApiKeyRequest: Parsed API-key header state.
AuthApiKeyStore: Persistence contract for API keys.
AuthApiKeyUserAccessRevocationStore: Optional atomic capability for revoking all API keys owned by one user.
AuthAtomicOperationDescriptor: Describes one atomic persistence operation in a plugin schema.
AuthAuthenticationLifecycleContributor<TContext>: Optional plugin contributor notified only after host-owned lifecycle work has completed.
AuthAuthenticationLifecycleEvent<TContext>: Typed, in-memory host lifecycle event for optional authentication plugins.
AuthAuthenticationMethod: One usable way for a user to establish a new authenticated principal.
AuthAuthenticationMethodInventoryBinding: Backend affinity declared by authoritative inventory contributors.
AuthAuthenticationMethodInventoryContributor: Typed provider/plugin capability for enumerating usable login methods.
AuthAuthenticationMethodInventoryControl: Optional switch for contributors whose method status is configuration-led.
AuthAuthenticationMethodMutationStore: Root-store transaction required by destructive method mutations.
AuthAuthenticationMethodService: Composes provider and plugin inventories with the root-store transaction.
AuthAuthenticationMethodSnapshot: A contributor's bounded view of one user's usable authentication methods.
AuthAuthenticationMethodTopologyStore: Binds the immutable method topology to a durable mutation coordinator.
AuthAuthenticationPolicyContributor<TContext>: Optional plugin contribution consulted at every authentication boundary.
AuthAuthenticationPolicyRequest<TContext>: Context supplied to an authentication policy contributor.
AuthBreachedPasswordCheckRequest<TContext>: Typed input passed to an application-owned breached-password lookup.
AuthBreachedPasswordCheckResult: Typed result returned by an application-owned breached-password lookup.
AuthBreachedPasswordLookup<TContext>: Application-owned boundary for a breached-password lookup.
AuthBreachedPasswordPluginConfig: Typed limits and operation selection for breached-password checks.
AuthBrowserProtectionOptions: Typed browser-request protections shared by framework adapters.
AuthBrowserProtectionValidator: Comprehensive browser-request validator for auth routes.
AuthCallbackProviderOutcome: Framework-agnostic normalized outcome for callback-provider results.
AuthCallbackRouteDecision: Concrete callback routing decision used by framework adapters.
AuthCallbacks<TContext>: Container for auth callbacks.
AuthCaptchaClient: Typed credential operations protected by one captcha token per request.
AuthCaptchaClientPlugin: Installs captcha-aware credential operations on an AuthClient.
AuthCaptchaPluginConfig: Typed limits for the captcha provider boundary.
AuthCaptchaVerificationRequest<TContext>: Typed input passed to an application-owned captcha verifier.
AuthCaptchaVerificationResult: Typed result returned by an application-owned captcha verifier.
AuthCaptchaVerifier<TContext>: Application-owned captcha vendor boundary.
AuthClient: Typed host for the framework-independent auth client contract.
AuthClientApiKey: Public API-key metadata returned by the auth API.
AuthClientAuthResult: The result of an auth callback that may return a session or redirect.
AuthClientCookie: A cookie received from an auth response.
AuthClientCookieStore: Stores cookies for an AuthClient instance.
AuthClientDeviceAccessToken: Access-token response returned after a device has been approved.
AuthClientDeviceAuthorization: Device-code response returned by the RFC 8628 authorization endpoint.
AuthClientIssuedApiKey: The one-time API-key response returned after create or rotate.
AuthClientOperationContributor: Contributes client operations owned by a server plugin.
AuthClientOperationDescriptor: Describes one client-visible operation exposed by an auth plugin.
AuthClientPlugin<TApi extends Object>: A typed, opt-in client API.
AuthClientPluginContext: Context supplied when an optional client plugin is installed.
AuthClientPluginRegistry: Registry of the client plugins selected for one AuthClient.
AuthClientProvider: Public provider metadata returned by /auth/providers.
AuthClientResponse: Raw successful response returned by AuthClientTransport.
AuthClientSession: A server-side session returned by the session-management API.
AuthClientTransport: Shared HTTP transport for core and plugin-specific auth clients.
AuthClientTwoFactorEnrollment: TOTP enrollment data returned by a two-factor plugin.
AuthClientTwoFactorRecoveryCodes: Recovery codes returned after two-factor activation or regeneration.
AuthClientTwoFactorStatus: Public two-factor status returned by the auth server.
AuthClientTwoFactorStepUp: Result of completing a recent step-up verification.
AuthClientVerificationSent: A successful email sign-in request.
AuthClientWebAuthnAuthenticationOptions: Authentication options returned by the WebAuthn ceremony-start endpoint.
AuthClientWebAuthnAuthenticationResult: Result returned after a passkey assertion is verified.
AuthClientWebAuthnCredential: Public metadata for a registered passkey.
AuthClientWebAuthnRegistrationOptions: Registration options returned by the WebAuthn ceremony-start endpoint.
AuthConfig: Normalized, typed authentication configuration consumed by framework adapters.
AuthCookiePolicy: Typed cookie security configuration for auth cookies.
AuthCreateUserEvent: Event emitted when a new user is created.
AuthCredentialPolicyContributor<TContext>: Optional policy consulted immediately before a credential provider runs.
AuthCredentialPolicyRequest<TContext>: Non-password input supplied to credential policy contributors.
AuthCredentials: Credential input for username/password flows.
AuthCredentialsClient: Client for registering and signing in with credentials.
AuthCredentialsClientPlugin: Adds username-and-password operations to an AuthClient.
AuthCredentialStore: Persistence contract for credential authentication.
AuthCredentialUserLookupStore: Optional credential-store capability for resolving a user's password credential without assuming that their login identifier is an email.
AuthDeployment<TContext>: A typed auth deployment assembled from framework-neutral runtime options.
AuthDeploymentPresets: Focused, typed presets for common auth deployment shapes.
AuthDeviceAccessToken: A token response produced by the application's access-token issuer.
AuthDeviceAuthorization: A persisted device authorization request.
AuthDeviceAuthorizationClient: Client for starting, polling, approving, and denying device authorization.
AuthDeviceAuthorizationClientPlugin: Adds RFC 8628 device-authorization operations to an AuthClient.
AuthDeviceAuthorizationIssuanceLease: One secret-free, bounded claim on an approved authorization.
AuthDeviceAuthorizationIssuanceLeaseResult: Result of attempting to acquire an issuance lease.
AuthDeviceAuthorizationPollingContext: State supplied before each wait in an automatic device-token poll.
AuthDeviceAuthorizationPollingController: Allows a caller to interrupt an automatic device-authorization poll.
AuthDeviceAuthorizationPollingOptions: Controls a high-level RFC 8628 device-token polling operation.
AuthDeviceAuthorizationPollResult: Result of atomically polling a device authorization request.
AuthDeviceAuthorizationRequest: Raw values returned once when a device starts authorization.
AuthDeviceAuthorizationStore: Persistence boundary for RFC 8628 device authorization transactions.
AuthDeviceAuthorizationTokenIssuanceRequest<TContext>: Immutable input to an application-owned idempotent token issuer.
AuthDeviceAuthorizationTokenIssuer<TContext>: Application-owned, authorization-ID-idempotent device token issuer.
AuthDurableSamlReplayStore: Marker implemented only by adapters with durable transactional guarantees.
AuthE164PhoneNumberPolicy: Strict E.164 policy without locale-dependent guessing.
AuthEmailBackendFaultInjector: One-shot fault injector for InMemoryAuthStore email transactions. Schedules one-shot failures for in-memory email transaction tests.
AuthEmailChangeConfirmed: Result returned after a pending email change is confirmed.
AuthEmailChangeInitiated: Result returned by the framework-neutral email-change initiation helper.
AuthEmailChangeRequest<TContext>: Delivery payload for an email-change confirmation.
AuthEmailChangeToken: One-time confirmation token for changing a user's email address.
AuthEmailChangeTokenConditionalDeleteStore: Optional compare-and-delete capability for failed email-change delivery.
AuthEmailChangeTokenStore: Persistence contract for one-time email-change confirmations.
AuthEmailOtp: A persisted email OTP transaction.
AuthEmailOtpBackend: Required transaction boundary for the email OTP plugin.
AuthEmailOtpClient: Typed client for the optional email OTP server plugin.
AuthEmailOtpClientPlugin: Installs the email OTP API on an AuthClient.
AuthEmailOtpDelivery<TContext>: Transient delivery payload for an email OTP.
AuthEmailOtpIssueCommand: Persists a digest-only email OTP, replacing the active purpose-specific record for its canonical email.
AuthEmailOtpSignInCommand: Atomically consumes a sign-in OTP and resolves its verified local user.
AuthEmailOtpSignInResult: Result of consuming an email OTP for sign-in.
AuthEmailOtpStore: Typed persistence boundary for email OTP records.
AuthEmailOtpUserTransitionResult: Result of an OTP-backed user transition.
AuthEmailOtpVerificationResult: Result of an OTP verification attempt.
AuthEmailOtpVerifyCommand: Atomically compares, counts, and consumes one OTP attempt.
AuthEmailOtpVerifyUserCommand: Atomically consumes an email-verification OTP bound to the current user and their current email address.
AuthEmailRequest: Email verification payload shared with provider callbacks.
AuthEmailUserResolution: Result of resolving an email sign-in user.
AuthEmailVerificationPayload: Prepared payload for email verification sign-in flows.
AuthEmailVerificationSignInResolution: Result of resolving an email verification callback into sign-in payloads.
AuthEndpointAuthenticationIntent: A successful plugin authentication that must be completed by the host.
AuthEndpointContractDescriptor: Optional typed request/response contracts exposed by an auth endpoint.
AuthEndpointContributor<TContext>: Contributes runtime routes owned by a server plugin.
AuthEndpointDescriptor<TContext>: Describes and invokes one framework-neutral auth endpoint.
AuthEndpointHttpResponse: An explicit HTTP response returned by a portable plugin endpoint.
AuthEndpointPublicErrorResponseDescriptor: Optional protocol-specific public errors for failures owned by the host.
AuthEndpointRateLimitIdentifierDescriptor: Optional endpoint contribution used to derive a private rate-limit key.
AuthEndpointRedirect: A framework-neutral redirect returned by an auth plugin endpoint.
AuthEndpointRequest: Namespaced request data supplied to a portable auth endpoint.
AuthEndpointResponseContract: One explicit HTTP response advertised by a portable plugin operation.
AuthEndpointResponseContractDescriptor: Optional complete HTTP response contract for an endpoint.
AuthEndpointSecurityDescriptor: Optional security metadata for endpoints that remove or rotate a login method.
AuthEntityDescriptor: Describes one persisted entity in an auth plugin schema.
AuthEventContext: An immutable, bounded request-metadata projection for authentication events.
AuthFieldDescriptor: Describes one persisted field in an auth plugin schema.
AuthFrameworkSessionHooks<TContext>: Lifecycle hooks for a framework-owned session surrounding sign-out.
AuthGateEvaluation<TContext>: Result payload emitted after a gate evaluation.
AuthGateEvaluationContext<TContext>: Context provided during gate evaluation.
AuthGateRegistry<TContext>: Registry for gate callbacks keyed by ability.
AuthGateService<TContext>: Framework-agnostic gate evaluation service.
AuthGuardRegistry<TContext, TResponse>: Registry for guard callbacks keyed by name.
AuthGuardService<TContext, TResponse>: Framework-agnostic guard evaluation service.
AuthHistoricalUserDeletionNamespaceCoordinator: Optional coordinator capability for deployments that removed a plugin.
AuthHostEndpointContributor<TContext>: Public endpoint contracts implemented by the framework host.
AuthInMemoryCompositeDeletionOperation: Composes multiple typed in-memory operations owned by one plugin.
AuthInMemoryDeletionState: Reversible state owned by an in-memory persistence store.
AuthInMemoryStoreDeletionOperation: Adapts one typed in-memory store into an immutable plan operation.
AuthInMemoryUserDeletionBackend: Core in-memory persistence owned by one deletion coordinator.
AuthInMemoryUserDeletionCoordinator: In-memory coordinator for atomic hard deletion of user data.
AuthInMemoryUserDeletionDomain: The domain owned by InMemoryAuthStore.
AuthInMemoryUserDeletionOperation: A typed reversible operation used by the in-memory coordinator.
AuthInMemoryUserDeletionPlan: Immutable, in-memory deletion plan.
AuthInMemoryUserDeletionStore: A user-scoped in-memory store operation used to build a deletion plan.
AuthIssuedJwtToken: Result of issuing a JWT token and corresponding auth cookie.
AuthJwtCallbackContext<TContext>: Context passed to JWT callbacks.
AuthJwtConfig: JWT verification settings for adapter-managed bearer authentication.
AuthJwtSessionIssue: Result of issuing a JWT session with callbacks.
AuthJwtVersionStore: Persistence contract for per-user JWT session versions.
AuthLastAuthenticationMethodBrowserStore<TContext>: Minimal host adapter used by the portable plugin to own one browser cookie.
AuthLastAuthenticationMethodClient: Typed client for the optional server plugin.
AuthLastAuthenticationMethodClientPlugin: Installs only the typed last-authentication-method read API.
AuthLastAuthenticationMethodCookie: Host-owned browser cookie instructions produced by the plugin.
AuthLastAuthenticationMethodId: A bounded, stable identifier for one authentication method.
AuthLastAuthenticationMethodPlugin<TContext>: Opt-in server plugin that records only a signed, bounded method ID.
AuthLastAuthenticationMethodPolicy: Explicit policy for the last-method browser state.
AuthLastAuthenticationMethodReadResult: Public, typed result returned by the server and client read APIs.
AuthLifecycleDelivery<TContext>: Application-owned delivery behavior for account lifecycle operations.
AuthLinkAccountEvent: Event emitted when a provider account is linked.
AuthLinkedAccountInfo: Information about a linked provider account.
AuthMagicLinkBackend: Required transaction boundary for email magic-link authentication.
AuthMagicLinkClient: Typed client for email magic-link authentication.
AuthMagicLinkClientPlugin: Installs the email magic-link API on an AuthClient.
AuthMagicLinkConsumeCommand: Atomically consumes a magic link and resolves its verified local user.
AuthMagicLinkConsumeResult: Result of an atomic magic-link consume operation.
AuthMagicLinkDelivery<TContext>: The only public boundary that receives a raw magic-link token.
AuthMagicLinkIssueCommand: Replaces every prior active magic link for one canonical email.
AuthMagicLinkProvider: Portable provider surface used by magic-link route decisions and helpers.
AuthMagicLinkRecord: Digest-only magic-link record owned by an authentication backend.
AuthManager: High-level auth coordinator for routed.
AuthMutationOperationSemantics: A state-changing endpoint with explicit persistence and replay behavior.
AuthMutationPersistence: Typed persistence semantics for a state-changing auth operation.
AuthNoopUserDeletionPlan: Domain-bound namespace marker for plugins whose user state is stored wholly inside core persistence and therefore needs no additional mutation.
AuthOAuthAccountMutationStore: Backend-owned exact OAuth unlink transaction.
AuthOAuthAuthorizationResolution: Result of preparing OAuth authorization and persisted session values.
AuthOAuthAuthorizationServerMetadata: RFC 8414 authorization-server metadata advertised to MCP clients.
AuthOAuthAuthorizationStart: Prepared OAuth authorization start payload.
AuthOAuthCallbackSessionValues: OAuth callback session values loaded for a provider.
AuthOAuthCallbackSignInResolution: Result of resolving an OAuth callback into sign-in payloads and callback redirect metadata.
AuthOAuthChallenge: The short-lived values required to finish one OAuth authorization attempt.
AuthOAuthChallengeStore: Persistence boundary for one-time OAuth authorization challenges.
AuthOAuthClient: Client for starting and completing OAuth authorization flows.
AuthOAuthClientPlugin: Adds OAuth authorization-code operations to an AuthClient.
AuthOAuthClientRegistration: The application-owned result of registering an OAuth client.
AuthOAuthClientRegistrationRequest: A validated dynamic-client-registration request.
AuthOAuthProtectedResourceMetadata: RFC 9728 protected-resource metadata for an MCP HTTP server.
AuthOAuthSignInResolution: Result of resolving provider OAuth callback data into auth sign-in payloads.
AuthOAuthTokenEndpointHost<TContext>: Host for grant handlers sharing a single OAuth token endpoint.
AuthOAuthUserResolution: Result of resolving an OAuth-mapped user against persisted identities.
AuthOperationCodec<T>: Encodes and decodes one side of a typed auth operation.
AuthOperationContract: Serialization contract for one side of an auth operation.
AuthOperationInvocation<TContext>: Host context and authenticated state passed to a typed endpoint handler.
AuthOperationSemantics: Whether an auth endpoint observes state or changes it.
AuthOptions<TContext>: Framework-agnostic auth runtime options.
AuthOrganization: Authentication data for auth organization.
AuthOrganizationAccessControl: Static and organization-specific role resolver.
AuthOrganizationAtomicMutationStore: Required capability for organization mutations whose authorization and invariants must be checked in the same durable transaction as the write.
AuthOrganizationAuthorizationContext<TContext>: Explicit tenant authorization context. Organization roles stay separate from global principal roles.
AuthOrganizationClient: Typed client for the opt-in organization plugin.
AuthOrganizationClientPlugin: Installs the typed organization API on an AuthClient.
AuthOrganizationCreateInvitationCommand: Command describing auth organization create invitation command.
AuthOrganizationCreateStoredResult: Result returned by auth organization create stored result.
AuthOrganizationCreateTransaction: Authentication data for auth organization create transaction.
AuthOrganizationDetails: Authentication data for auth organization details.
AuthOrganizationHookContext<TContext, T>: Context supplied to auth organization hook context.
AuthOrganizationHooks<TContext>: Authentication data for auth organization hooks.
AuthOrganizationIdempotency: A bounded, non-secret retry key bound to one organization mutation.
AuthOrganizationInternalFailure: Failure details for auth organization internal failure.
AuthOrganizationInvitation: Authentication data for auth organization invitation.
AuthOrganizationInvitationAcceptance: Authentication data for auth organization invitation acceptance.
AuthOrganizationInvitationAcceptanceResult: Result returned by auth organization invitation acceptance result.
AuthOrganizationInvitationDelivery<TContext>: Authentication data for auth organization invitation delivery.
AuthOrganizationLifecycleEvent: Lifecycle event for auth organization lifecycle event.
AuthOrganizationMember: Authentication data for auth organization member.
AuthOrganizationMembershipMutation: One authorization-checked organization membership mutation.
AuthOrganizationMembershipMutationStore: Required capability for ownership-bearing membership writes.
AuthOrganizationMutationResult<T>: Result returned by auth organization mutation result.
AuthOrganizationOptions<TContext>: Configuration for organization, membership, invitation, and team operations.
AuthOrganizationPage<T>: A page of auth organization page.
AuthOrganizationPermission: Permission data for auth organization permission.
AuthOrganizationPermissionDecision: Authentication data for auth organization permission decision.
AuthOrganizationPermissionResult: Result returned by auth organization permission result.
AuthOrganizationRole: Authentication data for auth organization role.
AuthOrganizationRoleMutationCommand: Command describing auth organization role mutation command.
AuthOrganizationStore: Plugin-owned persistence contract. Implementations must preserve the documented atomicity of every mutating method.
AuthOrganizationStoreCommand<TResult>: A typed organization-store transaction command.
AuthOrganizationStoreMutationResult<T>: Result returned by auth organization store mutation result.
AuthOrganizationTeam: Authentication data for auth organization team.
AuthOrganizationTeamMember: Authentication data for auth organization team member.
AuthOrganizationTeamMemberMutationCommand: Command describing auth organization team member mutation command.
AuthOrganizationTeamMutationCommand: Command describing auth organization team mutation command.
AuthOrganizationTeamsOptions: Configuration for organization team behavior.
AuthOrganizationTransitionInvitationCommand: Command describing auth organization transition invitation command.
AuthOrganizationUserDeletionStore: Optional organization namespace support for atomic administrative deletion.
AuthOrganizationWarning: Authentication data for auth organization warning.
AuthPasswordChangeResult: Result of successfully changing a user's password.
AuthPasswordClient: Client for changing passwords and confirming email changes.
AuthPasswordClientPlugin: Adds password-management operations to an AuthClient.
AuthPasswordCredential: Persisted password credential record.
AuthPasswordPolicyContributor<TContext>: Optional policy consulted before a new password is accepted.
AuthPasswordPolicyRequest<TContext>: Request passed to password policy contributors.
AuthPasswordResetRequest<TContext>: Request passed to an application-owned password-reset delivery callback.
AuthPasswordResetResult: Result of successfully replacing a password with a reset token.
AuthPasswordResetToken: Persisted password-reset challenge metadata.
AuthPasswordResetTokenStore: Persistence boundary for single-use password-reset tokens.
AuthPersistenceContributor: Contributes persistence schemas owned by a server plugin.
AuthPersistenceOperationReference: A reference to public plugin persistence metadata.
AuthPersistenceSchema: Describes the persistence topology owned by an auth plugin.
AuthPhoneNumberBackend: Required backend-owned command capability for phone authentication.
AuthPhoneNumberClient: Typed client for an explicitly installed phone-number server plugin.
AuthPhoneNumberClientCodeIssued: Client result returned after a verification code is sent.
AuthPhoneNumberClientPlugin: Installs only the phone-number API on an AuthClient.
AuthPhoneNumberClientSignIn: Client result returned after phone authentication succeeds.
AuthPhoneNumberCodeDelivery<TContext>: The one boundary where the raw verification code is exposed.
AuthPhoneNumberCodeIssued: Result returned after a phone verification code is issued.
AuthPhoneNumberIdentity: A verified E.164 phone number linked to one auth user.
AuthPhoneNumberIssueCodeCommand: Atomically installs one digest-only phone challenge.
AuthPhoneNumberIssueResult: Store result returned by an atomic phone-code issue command.
AuthPhoneNumberMutationStore: Optional exact transaction for removing a verified phone identity safely.
AuthPhoneNumberPolicy: Normalizes application input into a canonical phone number or rejects it.
AuthPhoneNumberRemovalCommand: Complete input to an atomic phone-identity removal.
AuthPhoneNumberSendCodeRequest: JSON request for sending a phone verification code.
AuthPhoneNumberSendCodeResponse: JSON response returned after sending a phone verification code.
AuthPhoneNumberSignInResult: Result returned after a phone verification code authenticates a user.
AuthPhoneNumberVerification: A persisted phone verification challenge.
AuthPhoneNumberVerifyCodeCommand: Atomically verifies and consumes a phone challenge.
AuthPhoneNumberVerifyRequest: JSON request for verifying a phone verification code.
AuthPhoneNumberVerifyResponse: JSON response returned after successful phone verification.
AuthPhoneNumberVerifyResult: Store result returned by an atomic phone-code verification command.
AuthPluginRuntimePhoneDelivery: A copy of one provider-owned phone-code delivery.
AuthPluginRuntimePhoneDeliveryRecorder: Records the provider boundary used by the cross-host phone flow.
AuthPortableSamlXmlDsigVerifier: Pure-Dart, application-selectable verifier for the bounded SAML XMLDSig profile documented by AuthSamlXmlDsigPolicy.
AuthPrincipal: Represents an authenticated user or entity.
AuthProductionBoundary: Browser and network boundary required by production auth options.
AuthProductionPostureContributor: Optional plugin check executed whenever auth boots in production posture.
AuthProvider: Base metadata for a server auth provider.
AuthProviderClient: Client for discovering providers exposed by the auth server.
AuthProviderClientPlugin: Adds the provider-discovery API to an AuthClient.
AuthProxyPolicy: Explicit policy for forwarded client-address headers at an auth boundary.
AuthRateLimitContributor: Contributes rate-limit operation metadata owned by a server plugin.
AuthRateLimitDecision: Result returned by an AuthRateLimiter.
AuthRateLimiter<TContext>: Application-owned policy for throttling authentication operations.
AuthRateLimitOperation: Stable namespaced identifier for a rate-limited auth operation.
AuthRateLimitRequest<TContext>: The non-secret context supplied to an auth rate limiter.
AuthReadOnlyOperationSemantics: A state-observing endpoint.
AuthRedirectCallbackContext<TContext>: Context passed to redirect callbacks.
AuthRegisterRouteDecision: Concrete register routing decision used by framework adapters.
AuthRelationshipDescriptor: Describes a relationship between two persisted plugin entities.
AuthResolvedJwtSession: Resolved JWT session payload after optional refresh processing.
AuthResolvedSignInResult: Result of resolving a sign-in response for a session strategy.
AuthResult: Result returned by sign-in flows.
AuthRouteParameterKey: A declared key for one dynamic auth route segment.
AuthRoutePath: A framework-neutral auth route using canonical {parameter} segments.
AuthRoutes: Auth HTTP routes for routed.
AuthRuntime<TContext>: Composed authentication runtime for one application.
AuthRuntimeConformanceRequest: A framework-neutral HTTP request issued by the auth runtime conformance test.
AuthRuntimeConformanceResponse: A framework-neutral response returned by a host transport adapter.
AuthSamlAccountIdentity: Stable external account key. Email attributes never participate in it.
AuthSamlAssertionVerifier: Verifies parsed SAML responses against an application-owned trust policy.
AuthSamlAuthenticationAttempt: Persisted state for one service-provider-initiated SAML request.
AuthSamlClient: Client operations exposed by the SAML server plugin.
AuthSamlClientPlugin: Adds the opt-in SAML client operations to an AuthClient.
AuthSamlConnection: Immutable application-owned SAML trust configuration.
AuthSamlConnectionCatalog: Typed, application-owned catalog for immutable SAML connections.
AuthSamlConnectionSelector: Selects one lookup key for a SAML connection.
AuthSamlConsumptionResult: Result of atomically consuming SAML request and replay state.
AuthSamlIdentityInput<TContext>: Inputs supplied to an application-owned SAML identity resolver.
AuthSamlIdentityResolver<TContext>: Application policy seam shared by SAML sign-in and future SCIM mapping.
AuthSamlIdpInitiatedDisabled: Policy value that disables IdP-initiated SAML responses.
AuthSamlIdpInitiatedFixedCallback: Policy value that sends IdP-initiated responses to one callback.
AuthSamlIdpInitiatedPolicy: Policy controlling whether IdP-initiated SAML responses are accepted.
AuthSamlLimits: Resource and parsing limits applied to SAML messages and metadata.
AuthSamlOptions: Runtime policy for SAML request lifetime, redirects, and storage.
AuthSamlOrganizationSelector: A connection selector containing an organization slug.
AuthSamlPlugin<TContext>: Optional SAML 2.0 SSO server plugin.
AuthSamlProviderSelector: A connection selector containing a provider identifier.
AuthSamlRedirectPolicy: Allow-list policy for SAML callback URIs.
AuthSamlReplayStore: Atomic multi-instance persistence boundary for SAML request and replay state.
AuthSamlSignatureProof: Proof returned by an application-owned XMLDSig implementation.
AuthSamlSignInForm: Browser-submittable HTTP-POST AuthnRequest returned by the server plugin.
AuthSamlSignInRequest: Selects a SAML connection for a sign-in request.
AuthSamlVerificationInput: Inputs supplied to an application-owned SAML assertion verifier.
AuthSamlVerifiedDomainSelector: A connection selector containing a verified domain.
AuthSamlXmlDsigPolicy: Explicit algorithm and structural policy for the portable XMLDSig verifier.
AuthScimApplicationProjectionCommand: Idempotent, version-bound application projection command.
AuthScimApplicationProjectionDrift: Describes a difference between authoritative and projected subject state.
AuthScimApplicationProjectionDriftPage: A page of drift findings for one projection scope.
AuthScimApplicationProjectionDriftQuery: Snapshot-bound, bounded drift query.
AuthScimApplicationProjectionPage: A page of projection records for one scope.
AuthScimApplicationProjectionQuery: Bounded query over one exact application projection scope.
AuthScimApplicationProjectionRecord: Durable application-owned projection record.
AuthScimApplicationProjectionResult: Result of applying one projection command.
AuthScimApplicationProjectionScope: Immutable application projection boundary for one SCIM connection.
AuthScimApplicationProjectionScopeDeletionCommand: Final, idempotent cleanup command for one retired SCIM connection scope.
AuthScimApplicationProjectionScopeDeletionResult: Result of deleting and fencing one projection scope.
AuthScimApplicationProjectionSnapshot: Versioned, digest-bound directory state safe for application projection.
AuthScimApplicationProjectionStore: Application-owned SCIM identity projection and reconciliation capability.
AuthScimApplicationProjectionStoreOptions: Bounded retention settings for the reference in-memory projection store.
AuthScimApplicationProjectionSubject: Stable directory subject key used by application-owned projection state.
AuthScimApplicationReconciliationCommand: Full, bounded application projection reconciliation command.
AuthScimApplicationReconciliationResult: Result of applying a complete projection reconciliation.
AuthScimBearerTokenRequest<TContext>: One transient bearer verification request.
AuthScimBearerTokenResolver<TContext>: Application-owned, atomic bearer-token resolution boundary.
AuthScimConnectionAuthorizationRequest<TContext>: Authorization input for a managed SCIM operation.
AuthScimConnectionBinding: Exact tenancy boundary used by managed SCIM connection operations.
AuthScimConnectionCatalogQuery: Bounded connection query. Adapters must enforce the exact binding.
AuthScimConnectionClient: Typed client for the opt-in managed SCIM connection plugin.
AuthScimConnectionClientPlugin: Installs only the managed-SCIM connection API selected by the application.
AuthScimConnectionCreation: Result of creating a connection and its initial credential atomically.
AuthScimConnectionIdentity: Immutable connection identity resolved atomically from one bearer token.
AuthScimConnectionManagementPrincipal: Exact principal and tenancy binding selected by application policy.
AuthScimConnectionPage: Bounded connection catalog page.
AuthScimConnectionPlugin<TContext>: Plugin-first managed connection and credential administration.
AuthScimConnectionStore: Complete atomic persistence boundary for managed SCIM connections.
AuthScimCreateConnectionTransaction: Atomic connection + initial credential creation command.
AuthScimCredential: Safe credential metadata returned by management APIs.
AuthScimCredentialCatalogQuery: Bounded credential query. Adapters must enforce connection ownership.
AuthScimCredentialIssuance: Result of one digest-only credential issuance transaction.
AuthScimCredentialPage: Bounded credential catalog page.
AuthScimCredentialRecord: Persisted credential record. The raw bearer secret is never represented.
AuthScimGroup: Connection-bound SCIM Group resource returned by an application store.
AuthScimGroupData: Strict application-owned data accepted for SCIM Group provisioning.
AuthScimGroupFilter: A bounded equality filter for Group listing.
AuthScimGroupMember: One direct, stable SCIM resource reference in a Group.
AuthScimGroupMembershipMutation: Atomic direct-membership mutation requested from an application store.
AuthScimGroupPage: A page of SCIM Group resources returned by a connection-bound query.
AuthScimGroupPatchDocument: Strict, bounded SCIM Group PatchOp document.
AuthScimGroupPatchOperation: One validated SCIM Group patch operation.
AuthScimGroupResourceType: Typed ResourceType response for the supported SCIM Group resource.
AuthScimGroupSchemaDefinition: Typed Schema response for bounded core Group attributes.
AuthScimIdempotencyBinding: Required replay binding for an issuance transaction.
AuthScimInternalFailure: Sanitized operation context supplied to an optional internal reporter.
AuthScimIssueCredentialTransaction: Atomic credential issuance command.
AuthScimListGroupsQuery: Bounded query supplied to AuthScimProvisioningStore.listGroups.
AuthScimListUsersQuery: Bounded query supplied to AuthScimProvisioningStore.listUsers.
AuthScimManagedBearerTokenResolver<TContext>: Resolver that connects ScimPlugin to a managed digest-only store.
AuthScimManagedConnection: Safe, public metadata for one managed directory connection.
AuthScimOptions: Bounded SCIM server settings.
AuthScimPatchDocument: Strict, bounded SCIM PatchOp document.
AuthScimPatchOperation: One validated SCIM user patch operation.
AuthScimProvisioningContext: Connection-scoped application store context for one SCIM request.
AuthScimProvisioningStore: Application-owned provisioning persistence boundary.
AuthScimResourceMeta: SCIM resource metadata supplied by the application provisioning store.
AuthScimResourceType: Typed ResourceType response for the supported SCIM User resource.
AuthScimRotateCredentialTransaction: Atomic revoke-old/create-new rotation command.
AuthScimServiceProviderConfig: Typed ServiceProviderConfig response.
AuthScimStoredConnectionCreation: Stored result of connection creation.
AuthScimStoredCredentialIssuance: Stored result of a one-time credential transaction.
AuthScimUpdateConnectionTransaction: Atomic connection update command.
AuthScimUser: Connection-bound SCIM User resource returned by an application store.
AuthScimUserData: Strict application-owned data accepted for SCIM User provisioning.
AuthScimUserEmail: Typed SCIM user email value.
AuthScimUserFilter: A bounded SCIM equality filter.
AuthScimUserName: Typed SCIM user name.
AuthScimUserPage: Tenant-bound page returned by an application provisioning store.
AuthScimUserSchemaDefinition: Typed Schema response for the bounded core User attributes.
AuthServerPlugin<TContext>: Contract implemented by every server plugin.
AuthServerPluginContext<TContext>: Context supplied while configuring a server plugin.
AuthServerPluginDataContract: Declares the persistent data and destructive routes owned by one server plugin.
AuthServerPluginRegistry<TContext>: Registry that composes, freezes, and exposes server plugin topology.
AuthServerPluginSessionControl: Host-owned session operations available to portable plugin endpoints.
AuthServerPluginTopologyAware<TContext>: Optional second-pass composition after every plugin has been registered.
AuthServiceProvider: Service provider that boots routed auth infrastructure.
AuthSession: Session data returned by auth endpoints.
AuthSessionCallbackContext<TContext>: Context passed to session callbacks.
AuthSessionClient: Client for reading and mutating the current user's sessions.
AuthSessionClientPlugin: Adds session-management operations to an AuthClient.
AuthSessionConfig: Session authentication strategy and lifetime settings.
AuthSessionEvent: Event emitted when a session payload is produced.
AuthSessionInfo: Safe public projection of a persisted server-side session.
AuthSessionRecord: Persisted server-side session metadata.
AuthSessionResolution: Result of resolving an auth session for a selected strategy.
AuthSessionRuntimeAdapter<TContext>: Adapter used by RememberSessionAuthRuntime to read/write framework state.
AuthSessionStore: Persistence contract for server-side sessions.
AuthSessionUpdateResolution: Result of updating an auth session for a selected strategy.
AuthSignInCallbackContext<TContext>: Context passed to sign-in callbacks.
AuthSignInEvent: Event emitted after a successful sign-in.
AuthSignInResult: Result of a sign-in callback decision.
AuthSignInRouteDecision: Concrete sign-in routing decision used by framework adapters.
AuthSignOutEvent: Event emitted after a sign-out flow completes.
AuthSignOutResolution: Result of resolving sign-out behavior for a selected strategy.
AuthStore: Authoritative persistence boundary for authentication plugins.
AuthTwoFactorAttemptPolicy: Attempt and lockout policy evaluated inside an atomic command.
AuthTwoFactorBackend: Required persistence boundary for the optional two-factor plugin.
AuthTwoFactorBeginChallengeCommand: Atomically accepts a trusted device or creates a pending sign-in challenge.
AuthTwoFactorBeginEnrollmentCommand: Atomically starts or replaces an unverified enrollment.
AuthTwoFactorChallengeAttempt: Atomic result of a pending-challenge verification attempt.
AuthTwoFactorChallengeRecord: Persisted state for a pending two-factor sign-in.
AuthTwoFactorChallengeStore: Typed persistence contract for pending two-factor sign-ins.
AuthTwoFactorClient: Client for enrolling, verifying, and disabling two-factor authentication.
AuthTwoFactorClientPlugin: Adds two-factor authentication operations to an AuthClient.
AuthTwoFactorCommandResult: Result returned by every two-factor atomic command.
AuthTwoFactorCompleteChallengeCommand: Atomically completes a pending TOTP challenge and optionally trusts a device.
AuthTwoFactorCompleteRecoveryChallengeCommand: Atomically consumes recovery material and completes a pending challenge.
AuthTwoFactorDisableCommand: Atomically verifies TOTP and removes all two-factor state for a user.
AuthTwoFactorEnrollment: Data returned when a user starts TOTP enrollment.
AuthTwoFactorFaultInjector: Deterministic, one-shot fault injection for the in-memory backend.
AuthTwoFactorIssueTrustedDeviceCommand: Atomically verifies TOTP and creates a trusted-device record.
AuthTwoFactorRecord: Persisted two-factor state for one user.
AuthTwoFactorRecoveryCodes: Recovery codes returned after verified enrollment or explicit regeneration.
AuthTwoFactorRegenerateRecoveryCodesCommand: Atomically verifies TOTP and replaces every recovery-code digest.
AuthTwoFactorRevokeStepUpCommand: Command that revokes step-up proofs for one session binding.
AuthTwoFactorRevokeTrustedDevicesCommand: Command that revokes every trusted device for a user.
AuthTwoFactorSecretProtector: Protects TOTP secrets before they cross a persistence boundary.
AuthTwoFactorSignInChallenge: A short-lived pending sign-in challenge returned to a client.
AuthTwoFactorSignInCompletion: Result of completing a pending sign-in challenge.
AuthTwoFactorStatus: Public two-factor status that never exposes the secret or code digests.
AuthTwoFactorStepUpRecord: Persisted state for a recent step-up proof.
AuthTwoFactorStepUpStore: Persistence contract for short-lived step-up proofs.
AuthTwoFactorStepUpToken: A short-lived proof that a user recently completed TOTP verification.
AuthTwoFactorStore: Typed persistence contract owned by the two-factor plugin.
AuthTwoFactorTrustedDeviceRecord: Persisted state for one trusted device.
AuthTwoFactorTrustedDeviceStore: Persistence contract for expiring trusted two-factor devices.
AuthTwoFactorTrustedDeviceToken: A short-lived trusted-device token returned only after TOTP verification.
AuthTwoFactorUseRecoveryCodeCommand: Atomically consumes a recovery code or records the failed attempt.
AuthTwoFactorVerifyEnrollmentCommand: Atomically activates an enrollment or records its failed TOTP attempt.
AuthTwoFactorVerifyStepUpCommand: Atomically verifies TOTP and creates a session-bound recent proof.
AuthTwoFactorVerifyTotpCommand: Atomically verifies TOTP and updates the account attempt state.
AuthUpdateUserEvent: Event emitted when a user is updated.
AuthUser: Authenticated user profile used by auth flows and sessions.
AuthUserAccessRevocationContributor: Plugin-owned credentials or tokens that must be revoked when a user is made unavailable without deleting their data.
AuthUserCreateResult: Result of an atomic user create-or-find operation.
AuthUserDeletionCoordinator: Backend-owned coordinator for hard user deletion.
AuthUserDeletionCoordinatorHost: A store that owns a deletion domain and coordinates its configured plans.
AuthUserDeletionDomain: Opaque identity for one persistence/transaction domain.
AuthUserDeletionPlan: An immutable description of one plugin-owned user-data deletion.
AuthUserDeletionPlanContributor: A contributor that creates exactly one immutable plan for its namespace.
AuthUserDeletionPlanFactory: Backend-specific plugin store that can build its own immutable plan.
AuthUserDeletionPreflight: Shared validation for backend coordinators.
AuthUsernameAuthenticationResponse: Endpoint response returned after username authentication.
AuthUsernameAuthenticationResult: Internal result returned after username authentication.
AuthUsernameChangeCommand: Complete input to an atomic username change.
AuthUsernameChangeRequest: JSON request for changing a username credential.
AuthUsernameChangeResult: JSON response describing a username change.
AuthUsernameClient: Typed client for an explicitly installed username server plugin.
AuthUsernameClientAuthentication: Client result returned after username authentication succeeds.
AuthUsernameClientChange: Client result returned after a username change.
AuthUsernameClientPlugin: Installs only the username-first API on an AuthClient.
AuthUsernameIdentifier: One unambiguous, canonical login identifier.
AuthUsernameIdentifierPolicy: Strict policy for username canonicalization and email intent resolution.
AuthUsernameMutationResult: Store-confirmed result of a username transaction.
AuthUsernameRegistrationCommand: Complete input to an atomic username registration.
AuthUsernameRegistrationRequest: JSON request for registering a username credential.
AuthUsernameRemovalCommand: Complete input to an atomic username removal.
AuthUsernameSignInRequest: JSON request for signing in with a username credential.
AuthUsernameStore: Root-store capability required by the opt-in username plugin.
AuthUserStore: Persistence contract for user records.
AuthVerificationToken: Verification token for email sign-in.
AuthVerificationTokenConditionalDeleteStore: Optional compare-and-delete capability for failed token delivery cleanup.
AuthVerificationTokenStore: Storage interface used by email magic-link verification flows.
AuthVerifiedJwtSession: Verified JWT session payload for auth session resolution.
AuthWebAuthnAuthenticationOptions: Public authentication options returned to a WebAuthn client.
AuthWebAuthnAuthenticationResult: Result of a verified passkey assertion.
AuthWebAuthnAuthenticatorMutationStore: Optional exact transaction for removing a passkey safely.
AuthWebAuthnAuthenticatorStore: Persistence boundary for registered passkeys.
AuthWebAuthnChallenge: A persisted, one-time WebAuthn challenge.
AuthWebAuthnChallengeStore: Persistence boundary for one-time WebAuthn challenges.
AuthWebAuthnClient: Client for registering and authenticating with passkeys.
AuthWebAuthnClientPlugin: Adds WebAuthn passkey operations to an AuthClient.
AuthWebAuthnCredentialRemovalCommand: Complete input to an exact passkey-removal transaction.
AuthWebAuthnRegistrationOptions: Public registration options returned to a WebAuthn client.
AuthWebAuthnStoreCapabilities: Optional persistence capability required by the WebAuthn plugin.
AuthWebAuthnUserDeletionPlanFactory: Optional backend-owned hard-deletion plan for both WebAuthn stores.
BreachedPasswordPlugin<TContext>: Opt-in protection for newly created or replacement passwords.
BrowserValidationResult: Comprehensive browser-request validation result.
CallbackAuthStore: Callback-backed auth store for focused tests and compatibility adapters.
CallbackResult: Result from a custom callback provider's handleCallback method.
CaptchaPlugin<TContext>: Opt-in captcha protection for credential registration and sign-in.
CredentialsProvider: Credentials provider configuration.
DefaultJsonWebKeySetLoader: A JsonWebKeySetLoader that uses http.Client to make http requests.
DeviceAuthorizationPlugin<TContext>: RFC 8628 device authorization flow.
DiscordProfile: Discord user profile returned by the userinfo endpoint.
DiscordProviderOptions: Configuration for the Discord OAuth provider.
DropboxProfile: Dropbox user profile returned by the /2/users/get_current_account endpoint.
DropboxProviderOptions: Configuration for the Dropbox OAuth provider.
EmailOtpPlugin<TContext>: Typed email OTP plugin modeled on the common sign-in, verification, and password-recovery OTP flows.
FacebookPicture: Facebook profile picture data.
FacebookProfile: Facebook user profile returned by the Graph API.
FacebookProviderOptions: Configuration for the Facebook OAuth provider.
FidoMetadataAttestationPathVerificationInput: Input to an optional verifier for an attestation path whose metadata root is omitted from the client-supplied WebAuthn certificate path.
FidoMetadataBlob: A verified and time-valid MDS3 compact JWT payload.
FidoMetadataBlobLoader: Parses a caller-supplied compact MDS3 JWT after an explicit JWS check.
FidoMetadataCertificate: A certificate trust anchor from a metadata statement.
FidoMetadataCertificateRevocationInput: One certificate and its issuer after local path and signature validation.
FidoMetadataDownloader: Opt-in downloader for authenticated FIDO Metadata Service blobs.
FidoMetadataDownloadPolicy: Security and resource bounds for remote MDS refreshes.
FidoMetadataEntry: One MetadataBLOBPayloadEntry from an authenticated MDS blob.
FidoMetadataEvaluation: Typed result returned by FidoMetadataWebAuthnTrustEvaluator.
FidoMetadataHttpRequest: A bounded, single-hop HTTP GET request used by the MDS downloader.
FidoMetadataHttpResponse: A bounded response returned by FidoMetadataHttpTransport.
FidoMetadataHttpTransport: Injectable one-hop transport for deterministic tests and custom runtimes.
FidoMetadataJwsPkixVerifier: Built-in ES256/RS256 JWS verifier with a strict, pinned PKIX path.
FidoMetadataJwsVerificationInput: Immutable input to an application's offline MDS JWS verifier.
FidoMetadataJwsVerificationResult: Result of the application-supplied MDS JWS verifier.
FidoMetadataLimits: Resource bounds applied before any MDS payload is materialized.
FidoMetadataPkixTrust: Pinned trust and revocation dependencies for the built-in MDS verifier.
FidoMetadataProvenance: Safe provenance for a WebAuthn metadata decision.
FidoMetadataRefreshResult: Result of a remote metadata refresh.
FidoMetadataStatement: The metadata statement fields used by WebAuthn trust evaluation.
FidoMetadataStatusReport: One status report attached to a metadata entry.
FidoMetadataVerifiedCertificate: Public certificate information supplied to a revocation checker.
FidoMetadataWebAuthnTrustEvaluator: Maps verified WebAuthn attestation provenance to an authenticated MDS entry.
GateDefaults: Default HTTP response details for a denied gate.
GateDefinition: Declarative definition of a named authorization gate.
GitHubEmail: GitHub email payload returned by /user/emails.
GitHubPlan: GitHub user plan information.
GitHubProfile: GitHub user profile returned by GET /user.
GitHubProviderOptions: Configuration for the GitHub OAuth provider.
GitLabProfile: GitLab user profile.
GitLabProviderOptions: Configuration for the GitLab OAuth provider.
GoogleProfile: Google user profile returned by the userinfo endpoint.
GoogleProviderOptions: Configuration for the Google OAuth provider.
GuardDefinition: Declarative definition of a named authentication guard.
GuardResult<TResponse>: Result for a guard evaluation.
Haigate: Static authorization facade for Routed request contexts.
HaigateConfig: Haigate authorization settings.
InMemoryAuthAccountStateStore: In-memory account state store for tests and development.
InMemoryAuthAdminStore: Serialized admin store for tests and local development.
InMemoryAuthApiKeyStore: Bounded in-memory API-key store for tests and local development.
InMemoryAuthClientCookieStore: A process-local cookie store for tests and short-lived clients.
InMemoryAuthDeviceAuthorizationStore: In-memory device authorization store for tests and local development.
InMemoryAuthEmailChangeTokenStore: Bounded in-memory email-change token store for tests and local development.
InMemoryAuthEmailOtpStore: In-memory OTP store for tests and local development.
InMemoryAuthJwtVersionStore: In-memory JWT version store for tests and local development.
InMemoryAuthOAuthChallengeStore: In-memory OAuth challenge store for tests and local development.
InMemoryAuthOrganizationStore: Serialized, process-local organization store for tests and development.
InMemoryAuthPasswordResetTokenStore: In-memory password-reset token store for tests and local development.
InMemoryAuthSamlReplayStore: Bounded local store for deterministic tests only.
InMemoryAuthScimApplicationProjectionStore: Transactional reference implementation of application-owned SCIM state.
InMemoryAuthScimConnectionStore: Bounded transactional in-memory implementation for tests and development.
InMemoryAuthStore: In-memory store for tests, examples, and local development.
InMemoryAuthTwoFactorBackend: Transactional in-memory backend for tests and local applications.
InMemoryAuthTwoFactorChallengeStore: In-memory pending-challenge store for tests and local examples.
InMemoryAuthTwoFactorStepUpStore: In-memory step-up store for tests and local examples.
InMemoryAuthTwoFactorStore: In-memory two-factor store for tests and local examples.
InMemoryAuthTwoFactorTrustedDeviceStore: In-memory trusted-device store for tests and local examples.
InMemoryAuthVerificationTokenStore: In-memory token store for development and tests.
InMemoryAuthWebAuthnAuthenticatorStore: In-memory registered-passkey store for tests and local development.
InMemoryAuthWebAuthnChallengeStore: In-memory WebAuthn stores for tests and local development.
InMemoryOAuthAccessTokenStore: In-memory access token store for tests and development.
InMemoryOAuthAuthorizationCodeExchangeStore: In-memory atomic authorization-code exchange store.
InMemoryOAuthAuthorizationCodeStore: In-memory authorization code store for tests and development.
InMemoryOAuthClientStore: In-memory OAuth client store for tests and development.
InMemoryRememberTokenStore: Bounded, process-local storage for remember-me tokens.
JoseHeader: Contains the JSON Object Signing and Encryption header parameters for JsonWebSignature and JsonWebEncryption
JoseObject: Base class for JsonWebSignature and JsonWebEncryption.
JoseObjectBuilder<T extends JoseObject>: Base class for JsonWebSignatureBuilder and JsonWebEncryptionBuilder
JosePayload: The payload of a JsonWebSignature or JsonWebEncryption
JoseRecipient: Per-recipient content of a JoseObject
JsonWebAlgorithm
JsonWebEncryption: JSON Web Encryption (JWE) represents encrypted content using JSON-based data structures
JsonWebEncryptionBuilder: Builder for JsonWebSignature
JsonWebKey: JSON Web Key (JWK) represents a cryptographic key
JsonWebKeySet: Represents a set of JsonWebKeys
JsonWebKeySetLoader: Used for loading JSON Web Key sets from an url
JsonWebKeyStore: A key store to lookup JsonWebKeys
JsonWebSignature: JSON Web Signature (JWS) represents content secured with digital signatures or Message Authentication Codes (MACs) using JSON-based data structures.
JsonWebSignatureBuilder: Builder for JsonWebSignature
JsonWebToken: Represents a JWT
JsonWebTokenClaims: The set of claims conveyed by the JsonWebToken
JwtBearerVerificationResult: Result of resolving and verifying a JWT bearer token from a header.
JwtIssuer: A JWT issuer that produces signed tokens for auth sessions.
JwtOptions: Configuration options for JWT verification.
JwtPayload: The payload of a verified JWT, including its claims and headers.
JwtSessionOptions: Configuration for JWT-based auth session issuance.
JwtVerifier: A JWT verifier that validates tokens against configured keys and claims.
LinkedInProfile: LinkedIn user profile (OIDC).
LinkedInProviderOptions: Configuration for the LinkedIn OAuth provider.
MagicLinkPlugin<TContext>: Opt-in email magic-link server plugin.
McpAuthPlugin<TContext>: Publishes MCP protected-resource and OAuth authorization-server metadata.
MicrosoftEntraProfile: Microsoft Entra ID (Azure AD) user profile.
MicrosoftEntraProviderOptions: Configuration for the Microsoft Entra ID OAuth provider.
OAuth2Client: Generic OAuth2 client for token exchange and userinfo requests.
OAuth2TokenIntrospector: Reusable RFC 7662 token introspection runtime with in-memory caching.
OAuthAccessToken: Represents an issued access token.
OAuthAccessTokenStore: Persistence contract for access tokens.
OAuthAuthorizationCode: Represents an authorization code issued to a client.
OAuthAuthorizationCodeExchangeRequest: Bindings presented during an authorization-code exchange.
OAuthAuthorizationCodeExchangeResult: Atomic authorization-code exchange result.
OAuthAuthorizationCodeExchangeStore: Authoritative persistence capability for authorization-code grants.
OAuthAuthorizationCodePreparation: Result of preparing an authorization-code exchange.
OAuthAuthorizationCodeStore: Persistence contract for authorization codes.
OAuthBearerValidationResult: Result of validating a bearer authorization header via introspection.
OAuthClient: Represents an OAuth client registered with this application.
OAuthClientStore: Persistence contract for OAuth clients.
OAuthIntrospectionConfig: OAuth 2.0 token-introspection settings.
OAuthIntrospectionOptions: Options for RFC 7662 token introspection.
OAuthIntrospectionResult: Parsed response from an RFC 7662 token introspection endpoint.
OAuthOidcConfiguration: OpenID Connect issuer and asymmetric signing configuration.
OAuthProvider<TProfile extends Object>: OAuth 2.0 provider configuration.
OAuthProviderModeOptions: Options for the OAuth provider mode.
OAuthProviderModePlugin<TContext>: Plugin that enables the application to act as an OAuth/OIDC provider.
OAuthProviderPersistenceTopology: Identifies OAuth provider persistence that is authoritative when durable.
OAuthTokenResponse: Represents the response from an OAuth2 token endpoint.
OrganizationPlugin<TContext>: Complete organization capability with storage-independent behavior.
PasswordHasher: Contract for password hashing and verification policies.
PasswordPolicy: Password acceptance policy for the built-in credentials flow.
PasswordVerification: Result of verifying a password against a stored password hash.
PhoneNumberPlugin<TContext>: Phone-number OTP authentication as an opt-in server plugin.
PlaintextAuthTwoFactorSecretProtector: A deliberately explicit protector for tests and ephemeral examples.
Policy<T extends Object>: Resource policy contract.
PolicyBinding<T extends Object>: Binds a policy to an ability prefix.
PolicyOptions: Policy registration options.
RbacAbility: Role-based ability definition.
RbacOptions: RBAC configuration options.
RememberSessionAuthRuntime<TContext>: Framework-agnostic remember-me and session-principal runtime.
RememberTokenStore: Persistence contract for long-lived "remember me" tokens.
RoutedAuthLastAuthenticationMethodBrowserStore: Routed host adapter for the server plugin's Secure, HttpOnly cookie.
ScimPlugin<TContext>: Typed, server-only SCIM 2.0 provisioning plugin.
SessionAuth: Process-global facade for the configured SessionAuthService.
SessionAuthService: Routed adapter for session and remember-me authentication.
SessionRememberMeConfig: Remember-me cookie settings for session authentication.
SlackProfile: Slack user profile (OIDC).
SlackProviderOptions: Configuration for the Slack OAuth provider.
SpotifyFollowers: Spotify followers object.
SpotifyImage: Spotify image object.
SpotifyProfile: Spotify user profile.
SpotifyProviderOptions: Configuration for the Spotify OAuth provider.
TelegramProfile: Telegram user profile returned by the Login Widget.
TelegramProvider: Telegram Login Widget provider.
TelegramProviderOptions: Configuration for the Telegram Login Widget provider.
TwitchProfile: Twitch user profile (OIDC).
TwitchProviderOptions: Configuration for the Twitch OAuth provider.
TwitterProfile: Twitter/X user profile returned by the API.
TwitterProviderOptions: Configuration for the Twitter/X OAuth provider.
TwoFactorPlugin<TContext>: Optional TOTP and recovery-code authentication plugin.
TypedAuthEndpointDescriptor<TContext, TRequest, TResponse>: Typed endpoint descriptor that owns request decoding and response encoding.
UsernamePlugin<TContext>: Opt-in username-first password authentication.
WebAuthnAttestationCertificate: One certificate in a format-validated WebAuthn attestation trust path.
WebAuthnAttestationMetadata: Safe output from WebAuthn attestation statement verification.
WebAuthnAttestationTrustPolicy: Explicit relying-party policy for WebAuthn attestation trust.
WebAuthnAuthenticationOptions: Options for WebAuthn authentication ceremonies.
WebAuthnAuthenticator: Authenticator device stored for a user.
WebAuthnAuthenticatorSelection: Authenticator selection criteria for registration.
WebAuthnFormField: Form field configuration for WebAuthn sign-in forms.
WebAuthnPlugin<TContext>: Typed WebAuthn/passkey plugin for server_auth runtimes.
WebAuthnProvider: WebAuthn (Passkey) provider configuration.
WebAuthnRegistrationOptions: Options for WebAuthn registration ceremonies.
WebAuthnRelyingParty: Relying party configuration for WebAuthn.
WebAuthnUserInfo: User info returned by WebAuthn getUserInfo callback.

Enums

AuthAdminAccountStateAction: Authentication data for auth admin account state action.
AuthAdminInMemoryFaultPoint: Stable fault points exposed only by the in-memory test adapter.
AuthAdminUserSortField: Authentication data for auth admin user sort field.
AuthAnonymousInMemoryFaultPoint: Fault points exposed by the process-local implementation for rollback tests.
AuthAnonymousMutationStatus: Outcome of one backend-owned anonymous-account mutation.
AuthAuthenticationLifecycleEventType: Lifecycle phase emitted by the host after it completes an authentication transition or clears one.
AuthAuthenticationMethodKind: Built-in kinds understood by the account-safety inventory.
AuthAuthenticationMethodMutationResult: Result of an atomic authentication-method removal attempt.
AuthAuthenticationPolicyPhase: Authentication boundary at which a policy is evaluated.
AuthCallbackRouteKind: Callback route branch selected for a request.
AuthCaptchaTokenUsePolicy: Controls whether the application-owned verifier or this plugin owns token replay prevention.
AuthCredentialPolicyOperation: Credential operation at which an application-owned credential policy runs.
AuthDeviceAuthorizationIssuanceLeaseStatus: Outcome of trying to acquire the bounded token-issuance lease.
AuthDeviceAuthorizationPollingStopReason: Why automatic device-authorization polling stopped locally.
AuthDeviceAuthorizationPollStatus: Result of atomically polling a device authorization request.
AuthDeviceAuthorizationStatus: State of an RFC 8628 device authorization transaction.
AuthEmailBackendFaultPoint: Fault locations supported by the deterministic in-memory rollback test injector.
AuthEmailOtpType: Supported one-time-password purposes.
AuthEmailOtpUserTransitionStatus: Outcome of a user transition coupled to OTP consumption.
AuthEmailOtpVerificationStatus: Outcome of comparing an OTP digest with a stored record.
AuthEndpointMount: Where a portable auth endpoint is mounted by a framework host.
AuthEndpointPublicErrorKind: Host-level failure that happened outside a plugin handler.
AuthLastAuthenticationMethodBrowserPersistence: Persistence modes for the browser cookie that stores the last method.
AuthLastAuthenticationMethodSameSite: SameSite modes supported by the last-method cookie.
AuthMagicLinkConsumeStatus: Outcome of consuming a magic-link record.
AuthMutationAtomicity: Whether a mutation is committed as one indivisible persistence operation.
AuthMutationPersistenceKind: The persistence boundary that owns a mutation.
AuthMutationReplaySafety: What a caller can expect when the same mutation is submitted again.
AuthOperationAuthentication: Authentication boundary enforced for a portable auth plugin operation.
AuthOperationCsrfPolicy: CSRF policy applied before a portable endpoint is invoked.
AuthOperationMethod: HTTP method exposed by a portable auth plugin operation.
AuthOperationOriginPolicy: Origin policy applied before a portable endpoint is invoked.
AuthOrganizationInvitationStatus: Authentication data for auth organization invitation status.
AuthOrganizationMembershipMutationKind: The ownership-bearing membership change performed by an organization store.
AuthOrganizationRoleMutationKind: Authentication data for auth organization role mutation kind.
AuthOrganizationTeamMemberMutationKind: Authentication data for auth organization team member mutation kind.
AuthOrganizationTeamMutationKind: Authentication data for auth organization team mutation kind.
AuthPasswordPolicyOperation: Password mutation protected by an application-owned password policy.
AuthPhoneNumberInMemoryFaultPoint: Deterministic fault points exposed by the process-local backend.
AuthPhoneNumberIssueStatus: Outcomes of an atomic phone-code issue command.
AuthPhoneNumberVerifyStatus: Outcomes of an atomic phone-code verification command.
AuthProviderType: Base metadata for a server auth provider.
AuthRateLimitAction: The externally reachable authentication operation being rate limited.
AuthRegisterRouteKind: Register route branch selected for a request.
AuthRuntimeMode: Declares whether auth is running with production guarantees or an explicitly relaxed local-development posture.
AuthSamlConsumptionFailure: Reasons why a SAML response cannot consume its authentication attempt.
AuthSamlNameIdFormat: NameID formats accepted by the SAML connection policy.
AuthSamlXmlDsigDigestAlgorithm: Digest methods implemented by AuthPortableSamlXmlDsigVerifier.
AuthSamlXmlDsigSignatureAlgorithm: Signature methods implemented by AuthPortableSamlXmlDsigVerifier.
AuthScimApplicationProjectionDriftKind: Difference between authoritative source state and projected state.
AuthScimApplicationProjectionFaultPoint: Deterministic fault points exposed by the in-memory reference adapter.
AuthScimApplicationProjectionMutation: Explicit application projection mutation.
AuthScimApplicationProjectionScopeDeletionStatus: Outcome statuses returned after deleting and fencing a projection scope.
AuthScimApplicationProjectionState: Application-visible lifecycle derived from directory provisioning.
AuthScimApplicationProjectionStatus: Outcome statuses returned after applying one projection command.
AuthScimApplicationReconciliationStatus: Outcome statuses returned after applying a complete reconciliation.
AuthScimApplicationSubjectKind: Directory resource kind represented by an application projection.
AuthScimConnectionManagementOperation: Management permission checked by the application-owned authorizer.
AuthScimConnectionState: Lifecycle of one managed SCIM directory connection.
AuthScimConnectionStoreFailure: Stable failure codes returned by managed SCIM persistence adapters.
AuthScimDirectoryGroupState: Explicit internal lifecycle of a connection-owned directory group.
AuthScimDirectoryUserState: Explicit internal lifecycle of a connection-owned directory user.
AuthScimGroupFilterAttribute: Attribute supported by the bounded Group filter parser.
AuthScimGroupMembershipMutationKind: Semantics of a direct Group membership mutation.
AuthScimGroupMemberType: Kind of SCIM resource referenced directly by a Group member.
AuthScimGroupPatchPath: Group attributes supported by the typed patch implementation.
AuthScimPatchOperationKind: SCIM patch operation kind.
AuthScimScope: Operation scope granted to one authenticated SCIM credential.
AuthScimUserFilterAttribute: Attribute supported by the bounded first-slice SCIM filter parser.
AuthScimUserPatchPath: User property supported by the bounded typed patch implementation.
AuthSessionRefreshAction: Session refresh action derived from issued-at metadata.
AuthSessionStrategy: Session storage strategy for auth.
AuthSignInRouteKind: Sign-in route branch selected for a request.
AuthStoreMode: Declares whether an auth store is durable across process restarts.
AuthTwoFactorAtomicFaultPoint: In-memory fault locations used to prove rollback behavior.
AuthTwoFactorCommandStatus: Outcome of a backend-owned two-factor atomic command.
AuthUserDeletionFaultPoint: A conformance-friendly fault point for coordinator implementations.
AuthUsernameCaseCanonicalization: Username case-handling strategies.
AuthUsernameFaultPoint: Deterministic fault points exposed by the in-memory adapter for conformance.
AuthUsernameIdentifierKind: Namespaces supported by username identifier resolution.
AuthUsernameMutationStatus: Outcome of a store-owned username registration or change transaction.
AuthWebAuthnCeremony: The WebAuthn ceremony for which a challenge was issued.
FidoMetadataAuthenticatorStatus: The status values currently defined by FIDO Metadata Service 3.1.1.
FidoMetadataCertificateRevocationStatus: Outcome required from an application-owned certificate revocation check.
FidoMetadataEvaluationReason: The reason attached to a typed metadata evaluation.
FidoMetadataMatchKind: How a WebAuthn attestation was matched to an MDS entry.
FidoMetadataNextUpdatePolicy: How the deprecated MDS nextUpdate field affects blob acceptance.
GateType: Kind of gate applied to a request.
GuardType: Kind of response-producing authentication guard.
InMemoryOAuthCodeExchangeFaultPoint: Fault points exposed by the in-memory adapter for rollback tests.
MicrosoftEntraTenantType: Tenant type for Microsoft Entra ID.
OAuthAuthorizationCodeExchangeStatus: Result of the backend-owned code-consumption and token-persistence commit.
OAuthAuthorizationCodePreparationStatus: Result of checking exchange bindings without consuming a valid code.
PolicyAction: Available policy actions.
WebAuthnAttestationKind: The provenance model established by attestation statement verification.
WebAuthnAttestationTrustDecision: A relying-party decision about a cryptographically valid attestation.
WebAuthnUnprovenAttestationDecision: A relying-party decision for none or self attestation.

Mixins

CallbackProvider: Mixin for auth providers that handle custom callback flows.

Extensions

RoutedAuthDeploymentBinding on AuthDeployment<EngineContext>: Routed-specific binding helpers for a typed AuthDeployment.

Constants

apiKeyCreateRateLimitOperation → const AuthRateLimitOperation: Default rate-limit operation for API-key creation.
apiKeyExchangeRateLimitOperation → const AuthRateLimitOperation: Default rate-limit operation for API-key session exchange.
apiKeyListRateLimitOperation → const AuthRateLimitOperation: Default rate-limit operation for API-key listing.
apiKeyRevokeRateLimitOperation → const AuthRateLimitOperation: Default rate-limit operation for API-key revocation.
apiKeyRotateRateLimitOperation → const AuthRateLimitOperation: Default rate-limit operation for API-key rotation.
authAdminPluginId → const String: The stable plugin identifier for auth admin plugin.
authAnonymousPluginId → const String: The stable plugin identifier for auth anonymous plugin.
authApiKeyAuthenticationAttribute → const String: Request attribute containing the verified API-key metadata.
authApiKeyPluginId → const String: Stable identifier for the API-key plugin.
authBreachedPasswordPluginId → const String: Stable ID for the opt-in breached-password policy plugin.
authBreachedPasswordRejectedErrorCode → const String: Generic public error used for a breached password and for every lookup failure. This prevents provider health and vendor-specific details from becoming an authentication oracle.
authCallbackProviderRoute → const AuthRoutePath: Route template for completing a provider callback.
authCaptchaFailedErrorCode → const String: Generic public error returned for every captcha rejection, malformed token, provider exception, and provider timeout.
authCaptchaPluginId → const String: Stable ID for the opt-in captcha policy plugin.
authDeviceAuthorizationPluginId → const String: Registry identifier for the RFC 8628 device-authorization plugin.
authEmailIdentifierMaximumLength → const int: Maximum accepted length for an email authentication identifier.
authEmailOtpDigestKeyMinimumLength → const int: Minimum UTF-8 key size for digesting low-entropy email OTP values.
authEmailOtpMaximumLength → const int: Maximum raw OTP input accepted before digesting.
authEmailOtpPluginId → const String: Stable identifier for the optional email OTP plugin.
authExternalProviderRuntimeCallbackProviderId → const String: Custom callback provider ID used by the external-provider fixture.
authExternalProviderRuntimeCookieName → const String: Host session cookie used by the external-provider conformance fixture.
authExternalProviderRuntimeFailureMarker → const String: Sensitive marker that deterministic provider failures must never expose.
authExternalProviderRuntimeOidcProviderId → const String: OIDC provider ID used by the external-provider conformance fixture.
authJwtAuthenticationTimeClaim → const String: OIDC authentication-time claim preserved across JWT refreshes.
authJwtVersionClaim → const String: Claim carrying the per-user JWT session version.
authLastAuthenticationMethodPluginId → const String: Stable plugin identifier for the last-authentication-method feature.
authMagicLinkSendRateLimitOperation → const AuthRateLimitOperation: Rate-limit operation for requesting magic links.
authMagicLinkVerifyRateLimitOperation → const AuthRateLimitOperation: Rate-limit operation for consuming magic links.
authMcpPluginId → const String: Stable identifier for McpAuthPlugin.
authOAuthProviderModePluginId → const String: Stable identifier for OAuthProviderModePlugin.
authOrganizationPluginId → const String: The stable plugin identifier for auth organization plugin.
authPhoneNumberAuthenticationMethod → const String: Authentication-method identifier recorded for verified phone sign-ins.
authPhoneNumberPluginId → const String: Stable identifier for the phone-number plugin.
authPhoneNumberRemovalRateLimitOperation → const AuthRateLimitOperation: Rate-limit operation for removing a verified phone identity.
authPhoneNumberSendRateLimitOperation → const AuthRateLimitOperation: Rate-limit operation for sending phone verification codes.
authPhoneNumberVerifyRateLimitOperation → const AuthRateLimitOperation: Rate-limit operation for verifying phone verification codes.
authPluginRuntimeConformanceCookieName → const String: Session cookie used by createAuthPluginRuntimeConformanceEngine.
authPluginRuntimeConformanceMagicLinkEmail → const String: Email used by the magic-link client/runtime conformance flow.
authPluginRuntimeConformanceMagicLinkProviderId → const String: Provider ID resolved through the typed magic-link route placeholder.
authPluginRuntimeConformanceOtpCode → const String: One-time code delivered by the email-OTP conformance fixture.
authPluginRuntimeConformanceOtpEmail → const String: Email used by the email-OTP conformance flow.
authPluginRuntimeConformancePassword → const String: Password accepted by the username conformance fixture.
authPluginRuntimeConformancePhoneNumber → const String: Canonical number used by the phone-number client/runtime conformance flow.
authPluginRuntimeConformanceUsername → const String: Username registered by the plugin conformance flow.
authPluginRuntimeConformanceUsernameEmail → const String: Email registered by the username conformance flow.
authPrincipalAttribute → const String: Attribute key used to store the authenticated principal in request context.
authProviderRouteParameter → const AuthRouteParameterKey: Typed key for the provider parameter used by built-in provider routes.
authRateLimitIdentifierMaximumLength → const int: Maximum UTF-16 code-unit length accepted for a limiter identifier.
authRegisterProviderRoute → const AuthRoutePath: Route template for starting provider registration.
authRuntimeConformanceCookieName → const String: Session cookie used by createAuthRuntimeConformanceEngine.
authRuntimeConformanceEmail → const String: Email accepted by the conformance credentials provider.
authRuntimeConformanceFailureMarker → const String: Sensitive marker used to verify that host errors do not leak details.
authRuntimeConformancePassword → const String: Password accepted by the conformance credentials provider.
authRuntimeConformanceUserId → const String: User identifier returned by the conformance credentials provider.
authSamlPluginId → const String: Stable identifier for the SAML server plugin and persistence schema.
authSamlProviderIdRouteParameter → const AuthRouteParameterKey: Route parameter used by SAML metadata and assertion-consumer endpoints.
authScimConnectionPluginId → const String: Stable server-plugin identifier for managed SCIM connections.
authScimErrorJsonSchema → const Map<String, Object?>: JSON Schema contract for generic, non-secret SCIM errors.
authScimErrorSchema → const String: SCIM 2.0 error response schema identifier.
authScimGroupInputJsonSchema → const Map<String, Object?>: JSON Schema contract for strict SCIM Group mutation input.
authScimGroupListResponseJsonSchema → const Map<String, Object?>: JSON Schema contract for a SCIM ListResponse containing groups.
authScimGroupPatchDocumentJsonSchema → const Map<String, Object?>: Strict JSON Schema contract for a SCIM Group PatchOp document.
authScimGroupResponseJsonSchema → const Map<String, Object?>: JSON Schema contract for SCIM Group responses.
authScimGroupSchema → const String: SCIM 2.0 core Group schema identifier.
authScimListResponseSchema → const String: SCIM 2.0 list response schema identifier.
authScimMaximumProjectionPageSize → const int: Maximum projection or drift records returned by one page.
authScimMaximumReconciliationSubjects → const int: Maximum authoritative subjects accepted by one full reconciliation.
authScimMediaType → const String: Media type used by SCIM 2.0 request and response documents.
authScimPatchDocumentJsonSchema → const Map<String, Object?>: Strict JSON Schema contract for a SCIM PatchOp document.
authScimPatchOperationSchema → const String: SCIM 2.0 patch request schema identifier.
authScimPluginId → const String: Stable server-plugin identifier for the SCIM 2.0 provisioning capability.
authScimResourceIdRouteParameter → const AuthRouteParameterKey: Route parameter used by SCIM User and Group resource endpoints.
authScimResourceTypeSchema → const String: SCIM 2.0 resource-type schema identifier.
authScimSchemaSchema → const String: SCIM 2.0 schema-resource schema identifier.
authScimServiceProviderConfigSchema → const String: SCIM 2.0 service-provider configuration schema identifier.
authScimUserInputJsonSchema → const Map<String, Object?>: JSON Schema contract for strict SCIM User mutation input.
authScimUserListResponseJsonSchema → const Map<String, Object?>: JSON Schema contract for a SCIM ListResponse containing users.
authScimUserResponseJsonSchema → const Map<String, Object?>: JSON Schema contract for SCIM User responses.
authScimUserSchema → const String: SCIM 2.0 core User schema identifier.
authSessionIssuedAtKey → const String: Session key used to store auth session issued-at timestamps.
authSignInProviderRoute → const AuthRoutePath: Route template for starting provider sign-in.
authTwoFactorPluginId → const String: Stable ID for the built-in two-factor plugin.
authUsernameAuthenticationMethod → const String: Authentication-method identifier recorded for username sign-ins.
authUsernameChangeRateLimitOperation → const AuthRateLimitOperation: Rate-limit operation for username changes.
authUsernamePluginId → const String: Stable identifier for the username plugin.
authUsernameRegistrationRateLimitOperation → const AuthRateLimitOperation: Rate-limit operation for username registration.
authUsernameRemovalRateLimitOperation → const AuthRateLimitOperation: Rate-limit operation for username removal.
authUsernameSignInRateLimitOperation → const AuthRateLimitOperation: Rate-limit operation for username sign-in.
authWebAuthnPluginId → const String: Stable ID for the opt-in WebAuthn plugin.
jwtClaimsAttribute → const String: Attribute key for JWT claims in framework request context stores.
jwtHeadersAttribute → const String: Attribute key for JWT headers in framework request context stores.
jwtSubjectAttribute → const String: Attribute key for the JWT subject in framework request context stores.
maxOAuthResponseCharacters → const int: Maximum response size accepted from OAuth token and user-info endpoints.
oauthClaimsAttribute → const String: Attribute key used to store OAuth2 claims.
oauthScopeAttribute → const String: Attribute key used to store OAuth2 scope values.
oauthTokenAttribute → const String: Attribute key used to store the OAuth2 access token.

Properties

authScimEmptyApplicationProjectionSnapshotId → String: Snapshot identifier for an empty projection scope.
final
gateRegistry → AuthGateRegistry<EngineContext>: Global gate registry used by Haigate.
final
guardRegistry → AuthGuardRegistry<EngineContext, Response>: Global guard registry used by guardMiddleware.
final

Functions

apiKeyAuthentication({required AuthApiKeyPlugin<EngineContext> plugin, required AuthUserStore userStore, String headerName = 'x-api-key', FutureOr<void> onVerified(EngineContext context, AuthApiKeyAuthentication authentication, AuthUser user)?}) → Middleware: Authenticates requests carrying an API key.
appleProvider(AppleProviderOptions options) → OAuthProvider<AppleProfile>: Apple Sign In OAuth provider.
authEmailCallbackSessionKey(String callbackKey) → String: Session key for email callback URL.
authenticatedGate<TContext>() → AuthGateCallback<TContext>: Creates a gate callback that allows only authenticated principals.
authErrorStatusCode(String code) → int: Resolves the HTTP status code for a canonical auth error code.
authJwtClaimsForUser(AuthUser user) → Map<String, dynamic>: Converts user into default JWT auth claims.
authorizeCredentialsRegistration({required AuthStore store, required PasswordHasher passwordHasher, required CredentialsProvider provider, required AuthContext context, required AuthCredentials credentials, PasswordPolicy passwordPolicy = const PasswordPolicy()}) → Future<AuthUser?>: Resolves credential registration via provider callback or password records.
authorizeCredentialsSignIn({required AuthStore store, required PasswordHasher passwordHasher, required CredentialsProvider provider, required AuthContext context, required AuthCredentials credentials, PasswordPolicy passwordPolicy = const PasswordPolicy()}) → Future<AuthUser?>: Resolves credential sign-in via provider callback or password records.
authProviderCallbackSessionKey(String callbackKey, String providerId) → String: Session key for provider callback URL.
authProviderNonceSessionKey(String nonceKey, String providerId) → String: Session key for the OIDC nonce associated with a provider flow.
authProviderPkceSessionKey(String pkceKey, String providerId) → String: Session key for provider PKCE verifier.
authProviderStateSessionKey(String stateKey, String providerId) → String: Session key for provider OAuth state.
authProviderSummaries(Iterable<AuthProvider> providers) → List<Map<String, dynamic>>: Builds JSON-friendly provider summaries for /auth/providers responses.
authScimApplicationSourceSnapshotId(AuthScimApplicationProjectionScope scope, Iterable<AuthScimApplicationProjectionSnapshot> authoritative) → String: Computes the canonical digest for a complete authoritative source snapshot.
authScimParseScopes(Object? value) → Set<AuthScimScope>: Parses and validates a SCIM scope collection.
authScimScopeFingerprint(Iterable<AuthScimScope> scopes) → String: Returns a stable sorted fingerprint for scopes.
authScimScopesAllow(Iterable<AuthScimScope> granted, Iterable<AuthScimScope> requested) → bool: Whether granted permits every exact scope in requested.
authSessionRefreshAction({required String? issuedAtValue, required Duration updateAge, DateTime? now}) → AuthSessionRefreshAction: Decides how auth session issued-at metadata should be updated.
authUserEmailIsVerified(AuthUser user) → bool: Returns whether user has an explicitly verified email address.
authUserFromJwtClaims(Map<String, dynamic> claims) → AuthUser: Creates an AuthUser from default JWT auth claims.
authUserIsDisabled(AuthUser user) → bool: Returns whether user is unavailable for authentication.
authUsersDiffer(AuthUser left, AuthUser right) → bool: Returns true when left and right differ by auth-relevant fields.
base64UrlNoPadding(List<int> bytes) → String: Encodes bytes as URL-safe base64 with all = padding removed.
baseUrlFromUri(Uri uri, {String defaultScheme = 'http', String defaultHost = 'localhost'}) → String: Builds a base URL (scheme://host[:port]) from uri.
buildAuthPasswordResetToken({required String userId, required String token, required Duration ttl, DateTime? now}) → AuthPasswordResetToken: Builds persistable password-reset metadata from a raw delivery token.
buildBearerAuthenticateHeader({String? realm, String? error, String? errorDescription}) → String: Builds a WWW-Authenticate header value for a Bearer challenge.
buildExpiredJwtTokenCookie(String cookieName, {String path = '/', bool secure = true, SameSite sameSite = SameSite.lax}) → Cookie: Builds an expired JWT cookie for sign-out flows.
buildExpiredRememberTokenCookie(String cookieName, {String path = '/', String? domain, bool secure = false, SameSite? sameSite, bool httpOnly = true}) → Cookie: Builds an expired remember-token cookie for logout or invalidation.
buildJwtTokenCookie(String cookieName, String token, {DateTime? expires, String path = '/', bool httpOnly = true, bool secure = true, SameSite sameSite = SameSite.lax}) → Cookie: Builds an HTTP-only JWT cookie.
buildOAuthAuthAccount({required String providerId, required String providerAccountId, required String userId, required OAuthTokenResponse token, required Map<String, dynamic> metadata, DateTime? expiresAt}) → AuthAccount: Builds an AuthAccount from OAuth token/profile payloads.
buildOAuthAuthorizationParameters<TProfile extends Object>(OAuthProvider<TProfile> provider, {required String state, String? codeChallenge, String? nonce, String? callbackUrl}) → Map<String, String>: Builds OAuth authorization query parameters for provider.
buildRememberTokenCookie(String cookieName, String token, {required DateTime expiresAt, String path = '/', String? domain, bool secure = false, SameSite? sameSite, bool httpOnly = true}) → Cookie: Builds a remember-token cookie with the supplied lifetime and attributes.
canUnlinkProvider({required AuthStore store, required AuthAuthenticationMethodService authenticationMethods, required String userId, required String providerId, required String providerAccountId}) → Future<bool>: Safety check: determines if a provider account can be unlinked.
changeAuthPasswordForUser({required AuthStore store, required PasswordHasher passwordHasher, required String userId, required String identifier, required String currentPassword, required String newPassword, AuthTwoFactorTrustedDeviceStore? trustedDeviceStore, PasswordPolicy passwordPolicy = const PasswordPolicy(), DateTime? now, FutureOr<void> beforeCommit(AuthUser user)?}) → Future<AuthPasswordChangeResult>: Reauthenticates a user, replaces their password, and revokes all sessions.
clearAuthVerificationTokens({required AuthStore store, required String identifier, AuthVerificationTokenStore? tokenStore}) → Future<void>: Deletes existing verification tokens from the configured typed store.
confirmAccountDeletion({required AuthStore store, required String userId, required String token, DateTime? now}) → Future<AuthAccountDeletionConfirmed>: Confirms and executes account deletion.
confirmAccountDeletionFlow({required AuthStore store, required String userId, required String token}) → Future<AuthAccountDeletionConfirmed>: Confirms an account deletion flow.
confirmAuthEmailChange({required AuthStore store, required String userId, required String token, String? expectedNewEmail}) → Future<AuthUser>: Confirms a one-time email change and returns the updated user.
confirmEmailChange({required AuthStore store, required String tokenIdentifier, required String token, required String newEmail, DateTime? now}) → Future<AuthEmailChangeConfirmed>: Confirms a bound pending-email token and revokes existing access.
confirmEmailChangeFlow({required AuthStore store, required String tokenIdentifier, required String token, required String newEmail}) → Future<AuthEmailChangeConfirmed>: Confirms an email change flow.
constantTimeEqualsBytes(List<int> a, List<int> b) → bool: Compares two byte sequences in constant time when their lengths match.
constantTimeStringEquals(String left, String right) → bool: Compares secret-shaped strings without returning early on their content or length. Hashing first keeps the comparison loop fixed-width.
consumeAuthPasswordResetToken({required AuthPasswordResetTokenStore store, required String token}) → Future<AuthPasswordResetToken?>: Consumes a raw password-reset token from the configured typed store.
consumeAuthVerificationToken({required AuthStore store, required String identifier, required String token, AuthVerificationTokenStore? tokenStore}) → Future<AuthVerificationToken?>: Consumes an email verification token from the configured typed store.
createAuthExternalProviderRuntimeConformanceEngine({AuthSessionStrategy sessionStrategy = AuthSessionStrategy.session}) → Engine: Creates an auth engine backed only by deterministic external providers.
createAuthPluginRuntimeConformanceEngine({bool includeTwoFactor = true, AuthPluginRuntimePhoneDeliveryRecorder? phoneDeliveryRecorder}) → Engine: Creates an engine containing deterministic, provider-free auth plugins.
createAuthRuntimeConformanceEngine() → Engine: Creates the opinionated engine fixture used by verifyAuthRuntimeConformance.
currentApiKey(EngineContext context) → AuthApiKeyAuthentication?: Returns the API-key authentication for the current request, if present.
decodeAuthBase32(String value) → List<int>?: Decodes unpadded RFC 4648 base32, returning null for malformed input.
digestAuthEmailOtpCode({required String code, required String secret}) → String: Produces the keyed digest persisted for a low-entropy email OTP.
discordProvider(DiscordProviderOptions options) → OAuthProvider<DiscordProfile>: Discord OAuth provider.
dropboxProvider(DropboxProviderOptions options) → OAuthProvider<DropboxProfile>: Dropbox OAuth provider.
encodeAuthBase32(List<int> bytes) → String: Encodes bytes in RFC 4648 base32 without padding.
enforceAccountPolicy({required AuthAccountStateStore accountStateStore, required AuthAccountPolicy policy, required String userId, DateTime? now}) → Future<void>: Validates that an account can authenticate under the current policy.
enforceAuthRateLimit<TContext>({required AuthRateLimiter<TContext>? limiter, required AuthRateLimitRequest<TContext> request}) → Future<void>: Applies an optional auth rate limiter and raises a stable flow error when the operation is blocked.
ensureOAuthStateMatches({required String? expectedState, required String? receivedState}) → void: Ensures OAuth callback receivedState matches expectedState.
ensureRoutedAuthProviderRegistered([ProviderRegistry? registry]) → void: Ensures the Routed auth provider ID is available in registry.
exchangeOAuthAuthorizationCode<TProfile extends Object>(OAuthProvider<TProfile> provider, {required String code, String? codeVerifier, Client? httpClient}) → Future<OAuthTokenResponse>: Exchanges an authorization code for provider tokens.
extractBearerToken(String? headerValue, {String prefix = 'Bearer ', bool caseSensitive = true}) → String?: Extracts a bearer token from an authorization header value.
facebookProvider(FacebookProviderOptions options) → OAuthProvider<FacebookProfile>: Facebook OAuth provider.
findAuthCredentialForUser(AuthStore store, String userId) → Future<AuthPasswordCredential?>: Resolves the password credential owned by userId.
generateAuthPasswordResetToken({int length = 32}) → String: Generates a raw password-reset token for delivery to the user.
generateAuthTotpCode(String base32Secret, {int? timestampSeconds, int period = 30, int digits = 6}) → String: Generates an RFC 6238 TOTP code using the maintained hashlib OTP core.
githubProvider(GitHubProviderOptions options) → OAuthProvider<GitHubProfile>: GitHub OAuth provider.
gitlabProvider(GitLabProviderOptions options) → OAuthProvider<GitLabProfile>: GitLab OAuth provider.
googleProvider(GoogleProviderOptions options) → OAuthProvider<GoogleProfile>: Google OAuth provider.
guardMiddleware(List<String> guardNames, {AuthGuardRegistry<EngineContext, Response>? registry}) → Middleware: Creates middleware that evaluates registered guards in order.
guestGate<TContext>() → AuthGateCallback<TContext>: Creates a gate callback that allows only guests.
hashAuthDeviceAuthorizationCode(String code) → String: Builds the opaque digest stored for a raw device or user code.
hashAuthDeviceAuthorizationIssuanceLease(String lease) → String: Builds a digest for a process-local random issuance lease identity.
hashOpaqueToken(String token) → String: Hashes an opaque authentication token for safe persistence.
hexFromBytes(List<int> bytes) → String: Encodes bytes as a lowercase hexadecimal string.
hmacSha256(List<int> key, List<int> message) → Uint8List: Computes an HMAC-SHA-256 authentication tag for message using key.
initiateAccountDeletion({required AuthStore store, required PasswordHasher passwordHasher, required String userId, required String password, Duration ttl = const Duration(hours: 24), String generateToken()?, DateTime? now}) → Future<AuthAccountDeletionInitiated>: Initiates account deletion with reauthentication.
initiateAccountDeletionFlow({required AuthStore store, required PasswordHasher passwordHasher, required String userId, required String password}) → Future<AuthAccountDeletionInitiated>: Initiates an account deletion flow.
initiateEmailChange({required AuthStore store, required PasswordHasher passwordHasher, required String userId, required String currentPassword, required String newEmail, Duration ttl = const Duration(hours: 24), String generateToken()?, DateTime? now}) → Future<AuthEmailChangeInitiated>: Compatibility flow that reauthenticates and creates a bound pending-email token.
initiateEmailChangeFlow({required AuthStore store, required PasswordHasher passwordHasher, required String userId, required String currentPassword, required String newEmail}) → Future<AuthEmailChangeInitiated>: Initiates an email change flow.
issueAuthEmailChangeTokenForUser({required AuthStore store, required String userId, required String newEmail, required Duration ttl, String generateToken()?, DateTime? now}) → Future<String>: Creates a one-time email-change token after checking ownership and normalized email uniqueness.
issueAuthJwtSessionWithCallbacks<TContext>({required AuthCallbacks<TContext> callbacks, required TContext context, required JwtSessionOptions options, required AuthUser user, AuthSessionStrategy strategy = AuthSessionStrategy.jwt, AuthProvider? provider, AuthAccount? account, Map<String, dynamic>? profile, bool isNewUser = false, Map<String, dynamic>? token, Map<String, dynamic>? protectedClaims}) → Future<AuthJwtSessionIssue>: Issues a JWT-backed auth session using callback-driven claims resolution.
issueAuthJwtToken({required JwtSessionOptions options, required Map<String, dynamic> claims}) → AuthIssuedJwtToken: Issues a JWT token and builds the corresponding auth cookie.
issueAuthPasswordResetTokenForUser({required AuthStore store, required String userId, required Duration ttl, String generateToken()?, DateTime? now}) → Future<String?>: Issues a one-time password-reset token for an existing user.
isZeroFidoAaguid(String aaguid) → bool: Returns whether aaguid is the WebAuthn all-zero placeholder.
jwtAuthentication(JwtOptions options, {AuthJwtVerifiedCallback<EngineContext>? onVerified, Client? httpClient}) → Middleware: Creates a JWT authentication Middleware with the given options.
jwtAuthenticationTimeUtc(Map<String, dynamic> claims) → DateTime?: Resolves the original authentication time for a JWT session.
jwtIssuedAtUtc(Object? value) → DateTime?: Parses a JWT iat claim value into a UTC timestamp.
jwtSecretKey(String secret) → JsonWebKey: Builds a symmetric JsonWebKey from a plain-text secret.
linkedInProvider(LinkedInProviderOptions options) → OAuthProvider<LinkedInProfile>: LinkedIn OAuth provider (OIDC).
linkOAuthAccountOrThrow({required AuthStore store, required AuthAccount account}) → Future<AuthAccount>: Atomically links an OAuth account and rejects a canonical link owned by a different user.
linkProviderAccount({required AuthStore store, required String userId, required String providerId, required String providerAccountId, String? accessToken, String? refreshToken, DateTime? expiresAt, Map<String, dynamic>? metadata, DateTime? now}) → Future<AuthAccountLinked>: Links a provider account to a user.
linkProviderAccountFlow({required AuthStore store, required String userId, required String providerId, required String providerAccountId, String? accessToken, String? refreshToken, DateTime? expiresAt, Map<String, dynamic>? metadata}) → Future<AuthAccountLinked>: Links a provider account flow.
listAuthSessionsForUser({required AuthStore store, required String userId, String? currentSessionId, DateTime? now}) → Future<List<AuthSessionInfo>>: Lists active sessions for a user, placing the current session first.
listLinkedAccounts({required AuthStore store, required List<AuthProvider> providers, required String userId}) → Future<List<AuthLinkedAccountInfo>>: Lists all linked provider accounts for a user.
listLinkedAccountsFlow({required AuthStore store, required List<AuthProvider> providers, required String userId}) → Future<List<AuthLinkedAccountInfo>>: Lists linked accounts flow.
loadOAuthProfile<TProfile extends Object>(OAuthProvider<TProfile> provider, {required OAuthTokenResponse token, required Client httpClient, String? oidcNonce}) → Future<Map<String, dynamic>>: Loads a provider profile from userinfo or an ID token payload.
materializeJwtVerifier({required bool enabled, String? issuer, Iterable<String> audience = const <String>[], Iterable<String> requiredClaims = const <String>['exp'], Uri? jwksUri, Iterable<Map<String, dynamic>> inlineKeys = const <Map<String, dynamic>>[], Iterable<String> algorithms = const <String>['RS256'], Duration clockSkew = const Duration(seconds: 60), Duration jwksCacheTtl = const Duration(minutes: 5), Duration requestTimeout = const Duration(seconds: 10), String header = 'Authorization', String bearerPrefix = 'Bearer ', Client? httpClient, JwtClaimsValidator? validateClaims}) → JwtVerifier?: Materializes a JwtVerifier from config-like fields.
materializeJwtVerifierOptions({required bool enabled, String? issuer, Iterable<String> audience = const <String>[], Iterable<String> requiredClaims = const <String>['exp'], Uri? jwksUri, Iterable<Map<String, dynamic>> inlineKeys = const <Map<String, dynamic>>[], Iterable<String> algorithms = const <String>['RS256'], Duration clockSkew = const Duration(seconds: 60), Duration jwksCacheTtl = const Duration(minutes: 5), Duration requestTimeout = const Duration(seconds: 10), String header = 'Authorization', String bearerPrefix = 'Bearer '}) → JwtOptions?: Materializes JWT verifier options from config-like fields.
materializeOAuthIntrospectionOptions({required bool enabled, required Uri? endpoint, String? clientId, String? clientSecret, String? tokenTypeHint, Duration cacheTtl = Duration.zero, int maxCacheEntries = 1024, Duration clockSkew = const Duration(seconds: 60), Duration requestTimeout = const Duration(seconds: 10), String? requiredAudience, Map<String, String> additionalParameters = const <String, String>{}}) → OAuthIntrospectionOptions?: Materializes OAuth introspection options from typed provider fields.
md5Digest(List<int> bytes) → Uint8List: Computes the MD5 digest of bytes.
mergeAuthProvidersById(Iterable<AuthProvider> base, Iterable<AuthProvider> additional) → List<AuthProvider>: Merges additional providers into base by unique provider id.
mergeAuthUser(AuthUser existing, AuthUser incoming) → AuthUser: Merges incoming user data into existing using auth manager semantics.
microsoftEntraProvider(MicrosoftEntraProviderOptions options) → OAuthProvider<MicrosoftEntraProfile>: Microsoft Entra ID (Azure AD) OAuth provider.
normalizeAuthAdminRoles(Iterable<String> roles) → List<String>: Normalizes auth admin roles.
normalizeAuthAnonymousDisplayName(String? value) → String?: Normalizes an optional generated display name before persistence.
normalizeAuthCallbackProviderResult(CallbackResult result, {String fallbackErrorCode = 'callback_failed'}) → AuthCallbackProviderOutcome: Normalizes callback-provider result into a stable success/failure shape.
normalizeAuthEmail(String email) → String: Normalizes an email identifier used by built-in auth flows.
normalizeAuthEmailOtpEmail(String email) → String: Normalizes an OTP storage key without full email-address validation.
normalizeAuthOneTimeEmail(String value) → String: Normalizes and validates an email used by one-time email credentials.
normalizeAuthOrganizationPermissions(Map<String, Iterable<String>> permissions) → Map<String, List<String>>: Normalizes auth organization permissions.
normalizeAuthOrganizationRoles(Iterable<String> roles) → List<String>: Normalizes auth organization roles.
normalizeAuthOrigin(Uri origin, {required bool requireHttps}) → String: Normalizes an HTTP or HTTPS origin for boundary comparisons.
normalizeAuthRateLimitIdentifier(String? value) → String?: Applies the common safety boundary for endpoint-derived limiter keys.
normalizeAuthSamlDomain(String value) → String: Normalizes and validates a SAML verified domain.
normalizeFidoAaguid(String value) → String: Normalizes the two AAGUID spellings found in deployed MDS data.
oauth2Introspection(OAuthIntrospectionOptions options, {AuthOAuthValidatedCallback<EngineContext>? onValidated, Client? httpClient}) → Middleware: Creates a middleware for OAuth2 token introspection.
oauthClientForProvider<TProfile extends Object>(OAuthProvider<TProfile> provider, {Client? httpClient}) → OAuth2Client: Builds an OAuth2Client from provider metadata.
oauthTokenExpiryFromSeconds(int? expiresIn, {DateTime? now}) → DateTime?: Resolves token expiration from OAuth expires_in seconds.
parseApiKeyRequest(EngineContext ctx, {String headerName = 'x-api-key'}) → AuthApiKeyRequest: Parses API-key headers while distinguishing a missing credential from a malformed recognized authorization scheme.
parseAuthSessionIssuedAt(String? value) → DateTime?: Parses an ISO-8601 session issued-at timestamp into UTC.
persistAuthVerificationToken({required AuthStore store, required AuthVerificationToken verification, AuthVerificationTokenStore? tokenStore}) → Future<void>: Persists a verification token in the configured typed store.
pkceS256CodeChallenge(String verifier) → String: Computes an OAuth PKCE S256 code challenge for verifier.
policyGate<TContext, T extends Object>(Policy<T> policy, PolicyAction action) → AuthGateCallback<TContext>: Builds a gate callback for a specific policy action.
prepareAuthEmailVerificationPayload({required AuthMagicLinkProvider provider, required String email, required String callbackUrl, required AuthSessionStrategy sessionStrategy, String generateToken()?, DateTime? now}) → AuthEmailVerificationPayload: Prepares token, request, and pending session payloads for email sign-in.
prepareOAuthAuthorizationStart<TProfile extends Object>(OAuthProvider<TProfile> provider, {String? callbackUrl}) → AuthOAuthAuthorizationStart: Prepares OAuth state, PKCE values, and authorization parameters.
rbacGate<TContext>(RbacAbility ability) → AuthGateCallback<TContext>: Builds a gate callback for an RBAC ability.
readApiKeyFromRequest(EngineContext ctx, {String headerName = 'x-api-key'}) → String?: Reads an API key from the configured header or the standard authorization scheme without accepting request-body values.
recordFailedLoginAttempt({required AuthAccountStateStore accountStateStore, required AuthAccountPolicy policy, required String userId, DateTime? now}) → Future<AuthAccountState>: Records a failed login attempt and potentially locks the account.
recordSuccessfulLogin({required AuthAccountStateStore accountStateStore, required String userId, DateTime? now}) → Future<AuthAccountState>: Records a successful login and resets failure counters.
refreshAuthJwtTokenIfNeeded({required JwtSessionOptions options, required Map<String, dynamic> claims, required Duration? updateAge, required FutureOr<Map<String, dynamic>> resolveClaims(Map<String, dynamic> claims), DateTime? now}) → Future<AuthIssuedJwtToken?>: Reissues JWT token/cookie only when claims indicate refresh is required.
registerGateCallbacksSafely<TContext>(AuthGateRegistry<TContext> registry, Map<String, AuthGateCallback<TContext>> entries, {Set<String> managed = const <String>{}}) → Set<String>: Registers gate callbacks without overriding unmanaged existing entries.
registerPoliciesWithHaigate(List<PolicyBinding<Object>> bindings) → Set<String>: Registers policy bindings into gateRegistry with stable ability tracking.
registerPolicyBindings<TContext>(AuthGateRegistry<TContext> registry, List<PolicyBinding<Object>> bindings) → Set<String>: Registers policy abilities into registry.
registerPolicyBindingsSafely<TContext>(AuthGateRegistry<TContext> registry, List<PolicyBinding<Object>> bindings, {Set<String> managed = const <String>{}}) → Set<String>: Registers policy abilities without overriding unmanaged entries.
registerRbacAbilities<TContext>(AuthGateRegistry<TContext> registry, Map<String, RbacAbility> abilities) → Set<String>: Registers RBAC abilities into registry.
registerRbacAbilitiesSafely<TContext>(AuthGateRegistry<TContext> registry, Map<String, RbacAbility> abilities, {Set<String> managed = const <String>{}}) → Set<String>: Registers RBAC abilities without overriding unmanaged entries.
registerRoutedAuthProviders([ProviderRegistry? registry]) → void: Alias for ensureRoutedAuthProviderRegistered.
requireAuthenticated({String realm = 'Restricted', SessionAuthService? sessionAuth}) → AuthGuard<EngineContext, Response>: Creates a guard that requires a principal for the selected service.
requireAuthenticatedGuard<TContext, TResponse>({required AuthPrincipalResolver<TContext> principalResolver, GuardDeniedFactory<TContext, TResponse>? onDenied}) → AuthGuard<TContext, TResponse>: Returns a guard that requires a principal to be present.
requireAuthorizedCredentialsRegistration({required AuthStore store, required PasswordHasher passwordHasher, required CredentialsProvider provider, required AuthContext context, required AuthCredentials credentials, PasswordPolicy passwordPolicy = const PasswordPolicy(), String invalidCode = 'registration_failed'}) → Future<AuthUser>: Resolves credential registration and throws AuthFlowException when registration fails.
requireAuthorizedCredentialsSignIn({required AuthStore store, required PasswordHasher passwordHasher, required CredentialsProvider provider, required AuthContext context, required AuthCredentials credentials, PasswordPolicy passwordPolicy = const PasswordPolicy(), String invalidCode = 'invalid_credentials'}) → Future<AuthUser>: Resolves credential sign-in and throws AuthFlowException when rejected.
requireAuthPasswordForUser({required AuthStore store, required PasswordHasher passwordHasher, required PasswordPolicy passwordPolicy, required String userId, required String identifier, required String password}) → Future<void>: Reauthenticates a password credential without changing it.
requireRoles(List<String> roles, {SessionAuthService? sessionAuth, bool any = false}) → AuthGuard<EngineContext, Response>: Creates a guard that checks roles on the selected service's principal.
requireRolesGuard<TContext, TResponse>(Iterable<String> roles, {required AuthPrincipalResolver<TContext> principalResolver, bool any = false, GuardDeniedFactory<TContext, TResponse>? onUnauthenticated, GuardDeniedFactory<TContext, TResponse>? onForbidden}) → AuthGuard<TContext, TResponse>: Returns a guard that validates roles against the resolved principal.
resetAuthPasswordWithToken({required AuthStore store, required PasswordHasher passwordHasher, required String token, required String newPassword, AuthTwoFactorTrustedDeviceStore? trustedDeviceStore, PasswordPolicy passwordPolicy = const PasswordPolicy(), DateTime? now}) → Future<AuthPasswordResetResult>: Consumes a reset token, replaces the user's password, and revokes sessions.
resolveAndSanitizeRedirectCandidate(Map<String, dynamic> payload, Map<String, String> queryParameters, {required Uri requestUri, String? fallbackHost, String? fallbackScheme, String payloadCallbackKey = 'callbackUrl', String payloadRedirectKey = 'redirect', String queryCallbackKey = 'callbackUrl'}) → String?: Resolves then sanitizes a redirect candidate using callback precedence.
resolveAndSanitizeRedirectWithResolver(Map<String, dynamic> payload, Map<String, String> queryParameters, {required Uri requestUri, required FutureOr<String?> resolveRedirect(String? candidate), String? fallbackHost, String? fallbackScheme, String payloadCallbackKey = 'callbackUrl', String payloadRedirectKey = 'redirect', String queryCallbackKey = 'callbackUrl'}) → Future<String?>: Resolves and sanitizes redirect values using callback precedence plus an optional external resolver.
resolveAuthAccountId(Map<String, dynamic> profile, AuthUser user, {required String fallbackId(), bool emailVerified = false}) → String: Resolves a provider account id from profile/user fields.
resolveAuthCallbackRouteDecision({required String? providerId, required AuthProvider? provider, required Map<String, dynamic> query}) → AuthCallbackRouteDecision: Resolves callback branching decisions used by auth route handlers.
resolveAuthEmailVerificationSignIn({required AuthMagicLinkBackend backend, required String providerId, required String email, required String token, String generateUserId()?, DateTime? now, String? callbackKey, String? readSession(String key)?, String? expectedBrowserToken, bool requireBrowserToken = false}) → Future<AuthEmailVerificationSignInResolution?>: Resolves an email verification callback token into sign-in user data.
resolveAuthJwtClaims<TContext>({required AuthJwtCallback<TContext>? callback, required AuthJwtCallbackContext<TContext> context}) → Future<Map<String, dynamic>>: Evaluates JWT callback behavior with pass-through defaults.
resolveAuthJwtClaimsWithCallbacks<TContext>({required AuthCallbacks<TContext> callbacks, required TContext context, required AuthUser user, required AuthSessionStrategy strategy, AuthProvider? provider, AuthAccount? account, Map<String, dynamic>? profile, bool isNewUser = false, Map<String, dynamic>? token, Map<String, dynamic>? protectedClaims}) → Future<Map<String, dynamic>>: Resolves JWT claims through AuthCallbacks.jwt using standard auth context.
resolveAuthJwtSessionWithRefresh({required String? token, required JwtSessionOptions options, required Duration? updateAge, FutureOr<Map<String, dynamic>> resolveClaims(Map<String, dynamic> claims, AuthUser user)?, FutureOr<bool> validateClaims(Map<String, dynamic> claims, AuthUser user)?, Client? httpClient, DateTime? now}) → Future<AuthResolvedJwtSession?>: Verifies a JWT session token and optionally refreshes it when iat exceeds updateAge.
resolveAuthOptions<TContext>({required AuthOptions<TContext> options, Iterable<AuthProvider> configuredProviders = const <AuthProvider>[], AuthStore? store, Client? httpClient, AuthSessionStrategy? sessionStrategy, Duration? sessionMaxAge, Duration? sessionUpdateAge}) → AuthOptions<TContext>: Resolves final options by merging framework overrides into options.
resolveAuthProviderById(Iterable<AuthProvider> providers, String id) → AuthProvider?: Resolves an auth provider by id from providers.
resolveAuthProviderByOptionalId(Iterable<AuthProvider> providers, String? id) → AuthProvider?: Resolves an auth provider by optional id, returning null when absent.
resolveAuthRedirectTarget<TContext>({required AuthRedirectCallback<TContext>? callback, required AuthRedirectCallbackContext<TContext> context}) → Future<String?>: Evaluates redirect callback behavior.
resolveAuthRedirectTargetWithFallback<TContext>({required AuthRedirectCallback<TContext>? callback, required AuthRedirectCallbackContext<TContext> context, String? fallbackUrl}) → Future<String?>: Evaluates redirect callback behavior with fallback pass-through semantics.
resolveAuthRedirectWithCallbacks<TContext>({required AuthCallbacks<TContext> callbacks, required TContext context, required String? url, required String baseUrl, AuthProvider? provider}) → Future<String?>: Resolves redirect URL through AuthCallbacks.redirect with pass-through fallback behavior.
resolveAuthRegisterRouteDecision({required String? providerId, required AuthProvider? provider, required bool csrfValid}) → AuthRegisterRouteDecision: Resolves register branching decisions used by auth route handlers.
resolveAuthSessionExpiry({Duration? sessionMaxAge, int? sessionOptionsMaxAgeSeconds, DateTime? now}) → DateTime?: Resolves an auth session expiry from explicit or cookie max-age settings.
resolveAuthSessionForStrategyWithCallbacks<TContext>({required AuthSessionStrategy strategy, required AuthCallbacks<TContext> callbacks, required TContext context, required JwtSessionOptions jwtOptions, required Duration? sessionUpdateAge, AuthPrincipal? readSessionPrincipal()?, void applySessionMaxAge()?, String? readSessionIssuedAt()?, void writeSessionIssuedAt(DateTime issuedAtUtc)?, void touchSession()?, DateTime? resolveSessionExpiry()?, String? readJwtToken()?, FutureOr<bool> validateJwtClaims(Map<String, dynamic> claims, AuthUser user)?, void writeJwtAttribute(String key, Object? value)?, Map<String, dynamic>? protectedJwtClaims, Client? httpClient, DateTime? now}) → Future<AuthSessionResolution>: Resolves resolveSession behavior for an auth session strategy.
resolveAuthSessionMaxAgeSeconds(Duration? sessionMaxAge) → int?: Returns positive whole seconds represented by sessionMaxAge.
resolveAuthSessionPayload<TContext>({required AuthSessionCallback<TContext>? callback, required AuthSessionCallbackContext<TContext> context}) → Future<Map<String, dynamic>>: Evaluates session callback behavior with pass-through defaults.
resolveAuthSessionPayloadWithCallbacks<TContext>({required AuthCallbacks<TContext> callbacks, required TContext context, required AuthSession session, required AuthSessionStrategy strategy, AuthProvider? provider, Map<String, dynamic>? payload}) → Future<Map<String, dynamic>>: Resolves session payload through AuthCallbacks.session using standard auth session callback context.
resolveAuthSessionUpdateForStrategyWithCallbacks<TContext>({required AuthSessionStrategy strategy, required AuthCallbacks<TContext> callbacks, required TContext context, required AuthPrincipal principal, required JwtSessionOptions jwtOptions, FutureOr<void> persistSessionPrincipal(AuthPrincipal principal)?, void applySessionMaxAge()?, void writeSessionIssuedAt(DateTime issuedAtUtc)?, DateTime? resolveSessionExpiry()?, Map<String, dynamic>? protectedJwtClaims, DateTime? now}) → Future<AuthSessionUpdateResolution>: Resolves updateSession behavior for an auth session strategy.
resolveAuthSignInDecision<TContext>({required AuthSignInCallback<TContext>? callback, required AuthSignInCallbackContext<TContext> context}) → Future<AuthSignInResult>: Evaluates sign-in callback behavior with built-in allow-by-default logic.
resolveAuthSignInRedirectOrThrow<TContext>({required AuthSignInCallback<TContext>? callback, required AuthSignInCallbackContext<TContext> context, String blockedCode = 'sign_in_blocked'}) → Future<String?>: Resolves sign-in decision and returns redirect when allowed.
resolveAuthSignInRedirectTarget<TContext>({required AuthCallbacks<TContext> callbacks, required TContext context, required AuthUser user, required AuthSessionStrategy strategy, required FutureOr<String?> resolveRedirect(String? candidate), AuthProvider? provider, AuthAccount? account, Map<String, dynamic>? profile, AuthCredentials? credentials, bool isNewUser = false, String? callbackUrl, String blockedCode = 'sign_in_blocked'}) → Future<String?>: Resolves the final sign-in redirect by combining sign-in callback decision and adapter-specific redirect resolution.
resolveAuthSignInRedirectWithCallbacks<TContext>({required AuthCallbacks<TContext> callbacks, required TContext context, required AuthUser user, required AuthSessionStrategy strategy, AuthProvider? provider, AuthAccount? account, Map<String, dynamic>? profile, AuthCredentials? credentials, bool isNewUser = false, String? callbackUrl, String blockedCode = 'sign_in_blocked'}) → Future<String?>: Resolves sign-in callback using AuthCallbacks.signIn, returning redirect when allowed and throwing AuthFlowException when denied.
resolveAuthSignInResultForStrategyWithCallbacks<TContext>({required AuthCallbacks<TContext> callbacks, required TContext context, required AuthSessionStrategy strategy, required AuthUser user, required String? redirectUrl, required JwtSessionOptions jwtOptions, DateTime? sessionExpiresAt, AuthProvider? provider, AuthAccount? account, Map<String, dynamic>? profile, bool isNewUser = false, Map<String, dynamic>? token, Map<String, dynamic>? protectedClaims}) → Future<AuthResolvedSignInResult>: Resolves a sign-in AuthResult for the selected strategy.
resolveAuthSignInRouteDecision({required String? providerId, required AuthProvider? provider, required String method, required Map<String, dynamic> payload, required bool csrfValid}) → AuthSignInRouteDecision: Resolves sign-in branching decisions used by auth route handlers.
resolveAuthSignOutForStrategy({required AuthSessionStrategy strategy, required String jwtCookieName, FutureOr<void> logoutSession()?, String jwtCookiePath = '/', bool jwtCookieSecure = true, SameSite jwtCookieSameSite = SameSite.lax}) → Future<AuthSignOutResolution>: Resolves sign-out behavior for an auth session strategy.
resolveAuthUserByEmailOrCreate({required AuthStore store, required String email}) → Future<AuthEmailUserResolution>: Loads an existing user by email or creates a new record.
resolveBearerOrCookieToken({required String? authorizationHeader, required String bearerPrefix, required String cookieName, required Iterable<MapEntry<String, String>> cookies, bool caseSensitive = true}) → String?: Resolves a token from the bearer header before cookie entries by name.
resolveConfiguredGateCallback<TContext>(GateDefinition definition) → AuthGateCallback<TContext>?: Resolves a generic auth gate callback from definition.
resolveConfiguredGuard<TContext, TResponse>({required GuardDefinition definition, required AuthGuard<TContext, TResponse> authenticatedGuard(String realm), required AuthGuard<TContext, TResponse> rolesGuard(List<String> roles, bool any)}) → AuthGuard<TContext, TResponse>?: Resolves a generic auth guard from definition.
resolveCsrfToken({required String? existingToken, required String generateToken()}) → String: Returns an existing CSRF token or generates one when missing.
resolveOAuthAuthorizationStart<TContext, TProfile extends Object>({required TContext context, required OAuthProvider<TProfile> provider, required String stateKey, required String pkceKey, required String callbackKey, required void writeSession(String key, String value), String nonceKey = '_auth.nonce', AuthOAuthChallengeStore? challengeStore, Duration challengeTtl = const Duration(minutes: 10), String? callbackUrl}) → Future<AuthOAuthAuthorizationResolution>: Prepares and persists OAuth authorization state for framework adapters.
resolveOAuthCallbackSessionValues({required String providerId, required String stateKey, required String pkceKey, required String callbackKey, required String? readSession(String key), String nonceKey = '_auth.nonce'}) → AuthOAuthCallbackSessionValues: Loads OAuth callback state/verifier/callback URL values from session.
resolveOAuthCallbackSignInForProvider<TContext, TProfile extends Object>({required AuthStore store, required TContext context, required OAuthProvider<TProfile> provider, required String code, required String? receivedState, required String stateKey, required String pkceKey, required String callbackKey, required String? readSession(String key), required Client httpClient, String nonceKey = '_auth.nonce', void removeSession(String key)?, FutureOr<AuthOAuthChallenge?> consumeChallenge(String providerId, String state)?, String? expectedBrowserState, bool requireBrowserState = false, String fallbackAccountId()?}) → Future<AuthOAuthCallbackSignInResolution>: Resolves a full OAuth callback flow including state validation and account linking.
resolveOAuthSignInForProvider<TContext, TProfile extends Object>({required AuthStore store, required TContext context, required OAuthProvider<TProfile> provider, required String code, required Client httpClient, String? codeVerifier, String? oidcNonce, String fallbackAccountId()?}) → Future<AuthOAuthSignInResolution>: Resolves OAuth callback payloads into user/account/profile sign-in data.
resolveOAuthUserForAccount({required AuthStore store, required String providerId, required String accountId, required AuthUser mappedUser, bool emailVerified = false}) → Future<AuthOAuthUserResolution>: Resolves OAuth-mapped users against existing account/email records.
resolveRedirectCandidate(Map<String, dynamic> payload, Map<String, String> queryParameters, {String payloadCallbackKey = 'callbackUrl', String payloadRedirectKey = 'redirect', String queryCallbackKey = 'callbackUrl'}) → String?: Resolves a redirect candidate using auth callback precedence: payload callback key -> payload redirect key -> query callback key.
respondWithSanitizedAuthRedirectOrSession<TResponse>({required AuthResult result, required Uri requestUri, required FutureOr<TResponse> onRedirect(String redirectUrl), required FutureOr<TResponse> onSession(AuthSession session), String? fallbackHost, String? fallbackScheme}) → Future<TResponse>: Resolves a response by preferring a sanitized redirect URL when present, otherwise falling back to session payload handling.
rolesGate<TContext>(Iterable<String> requiredRoles, {bool any = false, bool allowGuest = false}) → AuthGateCallback<TContext>: Creates a roles gate callback.
sanitizeAuthAdminAttributes(Map<String, dynamic>? value) → Map<String, dynamic>: Sanitizes auth admin attributes.
sanitizeAuthErrorCode(String? code, {String fallback = 'auth_error'}) → String: Returns a bounded, identifier-shaped error code for HTTP responses.
sanitizeAuthPublicAttributes(Map<String, dynamic> value) → Map<String, dynamic>: Removes credential-like keys recursively from a public attribute map.
sanitizeRedirectUrl(String? value, {required Uri requestUri, String? fallbackHost, String? fallbackScheme}) → String?: Sanitizes callback/redirect URLs to same-origin or rooted-relative values.
secureRandomToken({int length = 32}) → String: Generates a cryptographically secure random token.
serializeAuthSessionIssuedAt(DateTime issuedAt) → String: Serializes issued-at timestamps for auth session metadata.
sha1Digest(List<int> bytes) → Uint8List: Computes the SHA-1 digest of bytes.
sha256Digest(List<int> bytes) → Uint8List: Computes the SHA-256 digest of bytes.
shouldRefreshAuthSession(DateTime issuedAt, Duration updateAge, {DateTime? now}) → bool: Returns whether a session has reached its refresh threshold.
shouldRefreshJwtByIssuedAt(Object? issuedAtClaim, Duration updateAge, {DateTime? now}) → bool: Returns true when a JWT should be refreshed based on its iat claim.
shouldRefreshJwtClaims(Map<String, dynamic> claims, Duration? updateAge, {DateTime? now}) → bool: Returns true when JWT claims indicate refresh should occur.
slackProvider(SlackProviderOptions options) → OAuthProvider<SlackProfile>: Slack OAuth provider (OIDC).
spotifyProvider(SpotifyProviderOptions options) → OAuthProvider<SpotifyProfile>: Spotify OAuth provider.
startAuthEmailSignIn<TContext>({required AuthMagicLinkBackend backend, required AuthMagicLinkProvider provider, required TContext context, required String email, required String callbackUrl, required AuthSessionStrategy sessionStrategy, String generateToken()?, void writeSession(String key, String value)?, String? callbackKey, DateTime? now}) → Future<AuthEmailVerificationPayload>: Starts an email verification sign-in flow and dispatches the provider verification request.
syncAuthSessionRefresh({required String? issuedAtValue, required Duration? updateAge, required void writeIssuedAt(DateTime issuedAtUtc), DateTime? now, void touchSession()?}) → void: Applies issued-at refresh semantics through write and touch callbacks.
syncManagedGateAbilities<TContext>(AuthGateRegistry<TContext> registry, {required Set<String> managed, required Set<String> nextManaged}) → void: Synchronizes managed with nextManaged, unregistering stale abilities.
syncManagedGateDefinitions<TContext, TDefinition extends Object>(AuthGateRegistry<TContext> registry, Map<String, TDefinition> definitions, {required AuthGateCallback<TContext>? buildGate(String ability, TDefinition definition), required Set<String> managed}) → Set<String>: Builds and synchronizes managed gate registrations from definitions.
syncManagedGuardDefinitions<TContext, TResponse, TDefinition extends Object>(AuthGuardRegistry<TContext, TResponse> registry, Map<String, TDefinition> definitions, {required AuthGuard<TContext, TResponse>? buildGuard(String name, TDefinition definition), required Set<String> managed, Set<String> preserve = const <String>{}}) → Set<String>: Builds and synchronizes managed guard registrations from definitions.
syncManagedGuards<TContext, TResponse>(AuthGuardRegistry<TContext, TResponse> registry, {required Set<String> managed, required Set<String> nextManaged, Set<String> preserve = const <String>{}}) → void: Synchronizes managed with nextManaged, unregistering stale guard names.
syncManagedPolicyBindings<TContext>(AuthGateRegistry<TContext> registry, List<PolicyBinding<Object>> bindings, {required Set<String> managed}) → Set<String>: Registers policy abilities and synchronizes the managed ability set.
syncManagedRbacAbilities<TContext>(AuthGateRegistry<TContext> registry, Map<String, RbacAbility> abilities, {required Set<String> managed}) → Set<String>: Registers RBAC abilities and synchronizes the managed ability set.
telegramProvider(TelegramProviderOptions options) → TelegramProvider: Creates a Telegram Login Widget provider.
twitchProvider(TwitchProviderOptions options) → OAuthProvider<TwitchProfile>: Twitch OAuth provider (OIDC).
twitterProvider(TwitterProviderOptions options) → OAuthProvider<TwitterProfile>: Twitter/X OAuth provider.
unlinkProviderAccount({required AuthStore store, required AuthAuthenticationMethodService authenticationMethods, required String userId, required String providerId, required String providerAccountId, DateTime? now}) → Future<AuthAccountUnlinked>: Unlinks a provider account from a user.
unlinkProviderAccountFlow({required AuthStore store, required AuthAuthenticationMethodService authenticationMethods, required String userId, required String providerId, required String providerAccountId}) → Future<AuthAccountUnlinked>: Unlinks a provider account flow.
validateAuthAccountForLink(AuthAccount account) → void: Validates an external account before it is linked to a local user.
validateAuthAnonymousOperationId(String value) → String: Validates auth anonymous operation id.
validateAuthAnonymousUser(AuthUser user) → void: Validates auth anonymous user.
validateAuthAnonymousUserId(String value) → String: Validates auth anonymous user id.
validateAuthCanonicalPhoneNumber(String value) → String: Validates and returns a canonical E.164 phone number.
validateAuthEmailSecretDigest(String value, String name) → String: Validates a digest before it crosses an email-auth persistence boundary.
validateAuthPhoneNumberCandidateUser(AuthUser user) → void: Validates a candidate user before phone sign-up can create it.
validateAuthPhoneNumberVerification(AuthPhoneNumberVerification verification) → void: Validates a challenge before a backend stores it.
validateAuthProviderConfiguration(Iterable<AuthProvider> providers) → void: Validates the provider identities used by auth routes and persistence.
validateAuthSessionForPersistence(AuthSessionRecord session) → void: Validates a session record before it is persisted.
validateAuthUserForPersistence(AuthUser user) → void: Validates a user before it crosses a persistence boundary.
validateCsrfToken({required String? expectedToken, String? headerToken, String? formToken, bool enforce = true}) → bool: Validates a CSRF token from header and form values.
validateOAuthBearerAuthorization({required String? authorizationHeader, required OAuth2TokenIntrospector introspector, String bearerPrefix = 'Bearer '}) → Future<OAuthBearerValidationResult>: Validates a bearer authorization header using OAuth2TokenIntrospector.
validateOAuthBearerAuthorizationAndWriteAttributes<TContext>({required String? authorizationHeader, required OAuth2TokenIntrospector introspector, required void setAttribute(String key, Object? value), required TContext context, AuthOAuthValidatedCallback<TContext>? onValidated, String bearerPrefix = 'Bearer '}) → Future<OAuthBearerValidationResult>: Validates a bearer token, writes attributes, and runs validation callback.
validateRoutedAuthBrowserRequest(EngineContext context, AuthBrowserProtectionOptions options) → String?: Checks browser-origin and Fetch Metadata headers for state-changing auth requests.
verifyAuthExternalProviderRuntimeConformance({required Uri origin, required AuthRuntimeConformanceSend send, required bool expectJwt}) → Future<void>: Verifies deterministic external-provider behavior through one host adapter.
verifyAuthJwtSessionToken({required String? token, required JwtSessionOptions options, Client? httpClient}) → Future<AuthVerifiedJwtSession?>: Verifies a JWT session token and returns auth user/session material.
verifyAuthPluginRuntimeConformance({required Uri origin, required AuthRuntimeConformanceSend send, required AuthRuntimeConformanceSend sendWithoutTwoFactor, required AuthPluginRuntimePhoneDeliveryRecorder phoneDeliveryRecorder}) → Future<void>: Verifies representative plugin flows through an arbitrary host transport.
verifyAuthRuntimeConformance({required Uri origin, required AuthRuntimeConformanceSend send, bool sendValidOriginHeader = true}) → Future<void>: Verifies auth behavior through an arbitrary HTTP host transport.
verifyAuthWebAuthnBrowserRuntimeConformance({required Uri transportOrigin, required AuthRuntimeConformanceSend send, required String sessionCookie, required String sessionCookieName, required String csrfToken, required String expectedUserEmail}) → Future<void>: Verifies a successful browser-shaped passkey ceremony through one host.
verifyAuthWebAuthnPluginRuntimeConformance({required Uri origin, required AuthRuntimeConformanceSend send}) → Future<void>: Verifies only the browser-shaped WebAuthn/passkey plugin flow.
verifyJwtBearerAuthorization({required String? authorizationHeader, required JwtVerifier verifier, String? bearerPrefix}) → Future<JwtBearerVerificationResult>: Extracts and verifies a bearer JWT token from an authorization header.
verifyJwtBearerAuthorizationAndWriteAttributes<TContext>({required String? authorizationHeader, required JwtVerifier verifier, required void setAttribute(String key, Object? value), required TContext context, AuthJwtVerifiedCallback<TContext>? onVerified, String? bearerPrefix}) → Future<JwtBearerVerificationResult>: Verifies a bearer JWT token, writes payload attributes, and runs callback.
verifyOAuthProviderAccount({required AuthProvider provider, required String accessToken, required String expectedProviderAccountId, required String userId, required Object context, required Client httpClient}) → Future<AuthAccount>: Verifies ownership of a provider account using a provider-issued access token before it is linked to the current local user.
writeJwtPayloadAttributes(JwtPayload payload, {required void setAttribute(String key, Object? value)}) → void: Writes verified JWT payload attributes into a context attribute store.
writeOAuthValidationAttributes(OAuthBearerValidationResult validation, {required void setAttribute(String key, Object? value)}) → void: Writes OAuth validation attributes into a context attribute store.

Typedefs

AuthAccountDeletionSender<TContext> = FutureOr<void> Function(AuthAccountDeletionDelivery<TContext> delivery): Callback that sends auth account deletion sender.
AuthAdminAfterHook<TContext, T> = FutureOr<void> Function(AuthAdminHookContext<TContext, T> event): Callback that handles auth admin after hook.
AuthAdminBeforeHook<TContext, T> = FutureOr<T> Function(AuthAdminHookContext<TContext, T> event): Callback that handles auth admin before hook.
AuthAdminDeletionGuard = FutureOr<void> Function(String userId): Callback that guards auth admin deletion guard.
AuthAdminEventSink = FutureOr<void> Function(AuthAdminLifecycleEvent event): Callback that receives auth admin event sink.
AuthAdminFailureReporter = FutureOr<void> Function(AuthAdminInternalFailure failure): Callback that reports auth admin failure reporter.
AuthAdminInMemoryFaultInjector = FutureOr<void> Function(AuthAdminInMemoryFaultPoint point, AuthAdminMutation mutation): Callback that injects auth admin in memory fault injector.
AuthAdminPermissionSet = Map<String, Iterable<String>>: Resource/action permissions assigned to one administrative role.
AuthAnonymousInMemoryFaultInjector = FutureOr<void> Function(AuthAnonymousInMemoryFaultPoint point): Callback that injects auth anonymous in memory fault injector.
AuthAnonymousNameGenerator<TContext> = FutureOr<String?> Function(TContext context): Callback that generates auth anonymous name generator.
AuthApiKeyTokenGenerator = String Function({int length}): Generates a token component with the requested length.
AuthAuthenticationMethodInventoryLoader = FutureOr<AuthAuthenticationMethodSnapshot> Function(): Loads the current authentication-method inventory for a user.
AuthAuthenticationMethodMutation = FutureOr<bool> Function(): Applies a previously checked authentication-method mutation.
AuthContext = dynamic: Framework-specific auth callback context.
AuthDeviceAuthorizationClientValidator<TContext> = FutureOr<bool> Function(TContext context, String clientId, List<String> scopes): Validates a device-flow client and its requested scopes.
AuthDeviceAuthorizationClock = DateTime Function(): Supplies the current UTC time to device-authorization polling.
AuthDeviceAuthorizationDelay = Future<void> Function(Duration delay): Waits before the next device-token request.
AuthDeviceAuthorizationShouldContinue = FutureOr<bool> Function(AuthDeviceAuthorizationPollingContext context): Decides whether an automatic device-authorization poll should continue.
AuthEmailChangeSender<TContext> = FutureOr<void> Function(AuthEmailChangeRequest<TContext> request): Application-owned delivery callback for email-change confirmations. Sends a transient email-change confirmation payload.
AuthEmailOtpSender<TContext> = FutureOr<void> Function(AuthEmailOtpDelivery<TContext> delivery): Delivers a transient raw OTP after its digest is committed.
AuthEndpointAuthenticationProjector = FutureOr<Object?> Function(Map<String, dynamic> sessionPayload): Projects a resolved session payload into an endpoint-specific response.
AuthEndpointPublicErrorResponseFactory = AuthEndpointHttpResponse Function(AuthEndpointPublicErrorKind kind): Creates a public HTTP response for a host-owned endpoint error.
AuthEndpointRateLimitIdentifierResolver<TRequest> = String? Function(TRequest request): Derives a private limiter key from a successfully decoded endpoint request.
AuthFrameworkSessionHook<TContext> = FutureOr<void> Function(TContext context): A framework adapter hook invoked during authentication sign-out.
AuthGateCallback<TContext> = FutureOr<bool> Function(AuthGateEvaluationContext<TContext> context): Generic gate callback contract.
AuthGateObserver<TContext> = void Function(AuthGateEvaluation<TContext> evaluation): Observer callback for gate evaluation results.
AuthGatePayloadResolver<TContext> = Object? Function(TContext context, String ability): Resolves payloads for gate ability checks.
AuthGuard<TContext, TResponse> = FutureOr<GuardResult<TResponse>> Function(TContext ctx): Guard callback contract.
AuthInMemoryUserDeletionMutationSerializer = Future<T> Function<T>(Future<T> operation()): Coordinator implementation for process-local in-memory stores.
AuthJwtCallback<TContext> = FutureOr<Map<String, dynamic>?> Function(AuthJwtCallbackContext<TContext> context): Callback invoked to customize JWT claims.
AuthJwtVerifiedCallback<TContext> = FutureOr<void> Function(JwtPayload payload, TContext context): Callback invoked after a JWT has been successfully verified.
AuthMagicLinkSender<TContext> = FutureOr<void> Function(AuthMagicLinkDelivery<TContext> delivery): Delivers a transient raw magic-link token after persistence commits.
AuthOAuthClientRegistrar<TContext> = FutureOr<AuthOAuthClientRegistration> Function(TContext context, AuthOAuthClientRegistrationRequest request): Application-owned dynamic client registration boundary.
AuthOAuthTokenGrantHandler<TContext> = FutureOr<Object?> Function(AuthOperationInvocation<TContext> invocation, Map<String, dynamic> request): Handles one OAuth token grant for a host-owned token endpoint.
AuthOAuthValidatedCallback<TContext> = FutureOr<void> Function(OAuthIntrospectionResult result, TContext context): Callback invoked after token introspection has validated a request.
AuthOrganizationAfterHook<TContext, T> = FutureOr<void> Function(AuthOrganizationHookContext<TContext, T> event): Callback that handles auth organization after hook.
AuthOrganizationBeforeHook<TContext, T> = FutureOr<T> Function(AuthOrganizationHookContext<TContext, T> event): Callback that handles auth organization before hook.
AuthOrganizationCreationPolicy = FutureOr<bool> Function(AuthUser user): Policy describing auth organization creation policy.
AuthOrganizationEventSink = FutureOr<void> Function(AuthOrganizationLifecycleEvent event): Callback that receives auth organization event sink.
AuthOrganizationFailureReporter = FutureOr<void> Function(AuthOrganizationInternalFailure failure): Callback that reports auth organization failure reporter.
AuthOrganizationInvitationIdGenerator = String Function(): Callback that generates auth organization invitation id generator.
AuthOrganizationInvitationSender<TContext> = FutureOr<void> Function(AuthOrganizationInvitationDelivery<TContext> delivery): Callback that sends auth organization invitation sender.
AuthOrganizationPermissionSet = Map<String, Iterable<String>>: Permissions assigned to auth organization permission set.
AuthPasswordResetSender<TContext> = FutureOr<void> Function(AuthPasswordResetRequest<TContext> request): Application-owned delivery callback for password-reset messages.
AuthPhoneNumberCodeSender<TContext> = FutureOr<void> Function(AuthPhoneNumberCodeDelivery<TContext> delivery): Delivers a newly generated phone verification code.
AuthPhoneNumberInMemoryFaultInjector = FutureOr<void> Function(AuthPhoneNumberInMemoryFaultPoint point): Callback used by the in-memory backend to inject deterministic failures.
AuthPhoneNumberUserFactory<TContext> = FutureOr<AuthUser> Function(TContext context, String phoneNumber, String? name): Builds candidate user data for backend-owned sign-up.
AuthPhoneNumberVerifiedCallback<TContext> = FutureOr<void> Function(TContext context, String phoneNumber, AuthUser user): Notifies the application after a phone identity is committed.
AuthPrincipalResolver<TContext> = AuthPrincipal? Function(TContext context): Resolves the authenticated principal from a context.
AuthProfileMapper<TProfile extends Object> = AuthUser Function(TProfile profile): Maps a provider profile payload to an AuthUser.
AuthRedirectCallback<TContext> = FutureOr<String?> Function(AuthRedirectCallbackContext<TContext> context): Callback invoked to resolve redirect targets.
AuthRuntimeConformanceSend = Future<AuthRuntimeConformanceResponse> Function(AuthRuntimeConformanceRequest request): Sends one request through the host transport under test.
AuthSamlBrowserBindingResolver<TContext> = FutureOr<String> Function(TContext context): Resolves a stable, request-bound browser value for SAML replay protection.
AuthScimApplicationProjectionFaultInjector = FutureOr<void> Function(AuthScimApplicationProjectionFaultPoint point): Injects a deterministic failure at a reference-store point.
AuthScimConnectionAuthorizer<TContext> = FutureOr<AuthScimConnectionManagementPrincipal?> Function(AuthScimConnectionAuthorizationRequest<TContext> request): Application-owned authorization boundary for connection administration.
AuthScimConnectionStoreFaultInjector = FutureOr<void> Function(String operation): Injects a named failure point into adapter and rollback tests.
AuthScimConnectionTokenGenerator = String Function({int length}): Generates bounded identifiers and secrets for managed SCIM records.
AuthScimFailureReporter = FutureOr<void> Function(AuthScimInternalFailure failure): Reports sanitized internal failures raised while handling SCIM operations.
AuthSessionCallback<TContext> = FutureOr<Map<String, dynamic>?> Function(AuthSessionCallbackContext<TContext> context): Callback invoked to customize session payloads.
AuthSignInCallback<TContext> = FutureOr<AuthSignInResult> Function(AuthSignInCallbackContext<TContext> context): Callback invoked before completing a sign-in flow.
AuthUserDeletionFaultInjector = FutureOr<void> Function(AuthUserDeletionFaultPoint point): Callback that injects auth user deletion fault injector.
AuthUsernameFaultInjector = FutureOr<void> Function(AuthUsernameFaultPoint point): Callback used by the in-memory username store to inject failures.
CredentialsAuthorize = FutureOr<AuthUser?> Function(AuthContext context, CredentialsProvider provider, AuthCredentials credentials): Authorizes credential-based sign-in.
CredentialsRegister = FutureOr<AuthUser?> Function(AuthContext context, CredentialsProvider provider, AuthCredentials credentials): Registers a new user from credential input.
FidoMetadataAttestationPathVerifier = FutureOr<bool> Function(FidoMetadataAttestationPathVerificationInput input): Verifies a WebAuthn certificate path to one of the MDS metadata roots.
FidoMetadataCertificateRevocationChecker = FutureOr<FidoMetadataCertificateRevocationStatus> Function(FidoMetadataCertificateRevocationInput input): Checks one verified certificate against application-owned revocation data.
FidoMetadataClock = DateTime Function(): Supplies the current time to metadata download and trust verification.
FidoMetadataJwsVerifier = FutureOr<FidoMetadataJwsVerificationResult> Function(FidoMetadataJwsVerificationInput input): The only cryptographic operation the package delegates to applications.
GateDeniedHandler = FutureOr<Response?> Function(AuthGateViolation<EngineContext> violation, EngineContext ctx): A handler function that is called when a gate denies access.
GatePayloadProvider = Object? Function(EngineContext ctx, String ability): A function that provides a payload for a specific ability in the given EngineContext.
GateViolation = AuthGateViolation<EngineContext>: Backward-compatible alias for denied authorization exceptions.
GuardDeniedFactory<TContext, TResponse> = TResponse Function(TContext context): Builds a denied response value for a guard result.
InMemoryOAuthCodeExchangeFaultInjector = FutureOr<void> Function(InMemoryOAuthCodeExchangeFaultPoint point): Callback used to inject a one-shot exchange failure in tests.
JwtClaimsValidator = FutureOr<bool> Function(Map<String, dynamic> claims): Validates application-specific claims after a JWT signature and standard claims have been verified.
OAuthProfileCallback<TProfile extends Object> = FutureOr<AuthUser?> Function(AuthContext context, OAuthProvider<TProfile> provider, TProfile profile): Called after the OAuth profile is loaded.
OAuthProfileParser<TProfile extends Object> = TProfile Function(Map<String, dynamic> profile): Parses a raw OAuth profile payload into a typed profile.
OAuthProfileRequest<TProfile extends Object> = FutureOr<TProfile> Function(AuthContext context, OAuthProvider<TProfile> provider, OAuthTokenResponse token, Client httpClient, TProfile profile): Called to enrich or replace the OAuth profile data.
OAuthProfileSerializer<TProfile extends Object> = Map<String, dynamic> Function(TProfile profile): Serializes a typed profile into a JSON-friendly map.
OAuthStateCallback<TProfile extends Object> = FutureOr<void> Function(AuthContext context, OAuthProvider<TProfile> provider, String state): Called after OAuth state is generated.
OAuthUserInfoRequest = FutureOr<Map<String, dynamic>> Function(OAuthTokenResponse token, Client httpClient, Uri endpoint): Custom userinfo request callback for providers that require non-standard userinfo fetching (e.g., POST instead of GET, custom headers, etc.).
WebAuthnCertificateAttestationTrustEvaluator = FutureOr<WebAuthnAttestationTrustDecision> Function(WebAuthnAttestationMetadata metadata): Evaluates a certificate-backed attestation after format verification.
WebAuthnGetRelyingParty = WebAuthnRelyingParty Function(AuthContext context, WebAuthnProvider provider): Callback to get the relying party configuration.
WebAuthnGetUserInfo = FutureOr<WebAuthnUserInfo?> Function(AuthContext context, WebAuthnProvider provider, Map<String, dynamic> request): Callback to retrieve user info for WebAuthn registration/authentication.

Exceptions / Errors

AuthClientException: An error returned by an auth endpoint.
AuthClientTwoFactorRequiredException: Indicates that credentials were valid but a TOTP challenge is required.
AuthDeviceAuthorizationPollingStoppedException: Indicates that automatic polling stopped before receiving a token.
AuthEmailBackendInjectedFault: Exception raised when a configured email-transaction fault is triggered.
AuthFlowException: Exception used for framework-agnostic auth flow failures.
AuthGateRegistrationException: Exception thrown when there is an error during gate registration.
AuthGateViolation<TContext>: Exception thrown when a gate denies access to a specific ability.
AuthRateLimitException: Raised when an auth operation is rejected by AuthRateLimiter.
AuthRuntimeConformanceFailure: A failed auth runtime conformance assertion.
AuthSamlXmlDsigVerificationException: A stable, non-diagnostic failure from portable SAML XMLDSig verification.
AuthScimBearerResolutionException: Secret-safe marker reported when application bearer resolution throws.
AuthScimConflictException: Signals a persistence uniqueness conflict without exposing store details.
AuthScimConnectionStoreException: Sanitized managed-SCIM persistence failure.
AuthTwoFactorInjectedFault: Exception raised when an in-memory atomic fault is injected.
AuthTwoFactorRequiredException: Exception used by an adapter to return a pending sign-in response.
AuthUserDeletionPreflightException: Thrown when a deletion plan set cannot describe one complete transaction.
FidoMetadataException: Generic public failure for malformed or untrusted metadata.
JoseException
JwtAuthException: An exception thrown when JWT authentication fails.
OAuth2Exception: Represents an exception that occurs during OAuth2 operations.
TelegramAuthException: Exception thrown when Telegram authentication fails.

testing library

Classes

Enums

Mixins

Extensions

Constants

Properties

Functions

Typedefs

Exceptions / Errors

routed_auth package

testing library