enforceAccountPolicy function

Future<void> enforceAccountPolicy({ required AuthAccountStateStore accountStateStore, required AuthAccountPolicy policy, required String userId, DateTime? now, })

Validates that an account can authenticate under the current policy.

Throws AuthFlowException if authentication is not allowed.

Implementation

Future<void> enforceAccountPolicy({
  required AuthAccountStateStore accountStateStore,
  required AuthAccountPolicy policy,
  required String userId,
  DateTime? now,
}) async {
  final state = await accountStateStore.find(userId);
  if (state == null) {
    // No state means fresh account, allow
    return;
  }

  if (state.disabled) {
    throw AuthFlowException('account_disabled');
  }

  if (state.isLocked(now: now)) {
    throw AuthFlowException('account_locked');
  }

  if (policy.requireEmailVerification && !state.emailVerified) {
    if (!policy.allowUnverifiedSignIn) {
      throw AuthFlowException('email_not_verified');
    }
  }
}