issueToken method

@nonVirtual Future<AuthSuccess> issueToken(Session session, { required UuidValue authUserId, required String method, Set<Scope>? scopes, Transaction? transaction, })

Issues an authentication token for authUserId and delivers it according to the request.

An authenticated caller may only re-issue a token for themself; issuing for a different user throws a SignInWhileAuthenticatedException (switching users requires a sign-out first). To mint a token on behalf of another user (e.g. an admin flow), call createToken directly.

On a cookie-mode web request the issued secrets are set as HttpOnly cookies and hidden from the response body: a refresh token moves to the refresh cookie, otherwise a non-empty token moves to the auth cookie.

Returns an AuthSuccess containing the token and user information.

Implementation

@nonVirtual
Future<AuthSuccess> issueToken(
  final Session session, {
  required final UuidValue authUserId,
  required final String method,
  final Set<Scope>? scopes,
  final Transaction? transaction,
}) async {
  final callerIdentifier = session.authenticated?.userIdentifier;
  if (callerIdentifier != null && callerIdentifier != authUserId.toString()) {
    throw SignInWhileAuthenticatedException();
  }

  final authSuccess = await createToken(
    session,
    authUserId: authUserId,
    method: method,
    scopes: scopes,
    transaction: transaction,
  );
  if (!session.isWebAuthCookieRequest) return authSuccess;

  final refreshToken = authSuccess.refreshToken;
  if (refreshToken != null && refreshToken.isNotEmpty) {
    session.writeWebAuthRefreshCookie(
      refreshToken,
      maxAgeSeconds: _maxAgeSeconds(refreshTokenExpiresAt()),
      path: refreshCookiePath(session),
    );
    return CookieAuthSuccess(authSuccess, maskRefreshToken: true);
  }
  if (authSuccess.token.isNotEmpty) {
    session.writeWebAuthCookie(
      authSuccess.token,
      maxAgeSeconds: _maxAgeSeconds(authSuccess.tokenExpiresAt),
    );
    return CookieAuthSuccess(authSuccess, maskToken: true);
  }
  return authSuccess;
}