ab_ecosystem_sso 0.1.0

Flutter SDK for AB Ecosystem SSO — drop-in sign-in and sign-up widgets, 2FA, multi-account switching, captcha and secure session storage.

Changelog

0.1.0

First release.

Authentication, account settings, team administration and billing for Flutter apps against AB Ecosystem SSO, ported from the ab-ecosystem-sso web SDK.

Added

• SsoClient — sign-in, 2FA verification, signup, forgot-password, reset-password, verify-email, change-password and logout, plus GET /me profile and account-context reads.
• Sealed LoginResult covering the three login outcomes (signed in, 2FA required, account selection required) and SignupResult covering the two signup outcomes, so every branch is handled at compile time.
• Multi-account support: selectAccount, switchAccount, listAccounts, and invitation lookup and acceptance.
• Session state as a ValueListenable<SsoSession>, with A403 reported as SsoAccountAccessLost rather than a sign-out.
• SsoScope, which provides the client and re-checks the session when the app returns to the foreground.
• Widgets: SsoAuthFlow, SsoLoginForm, SsoSignupForm, SsoTwoFactorForm, SsoForgotPasswordForm and SsoAccountPicker, themed from Theme.of(context) and translatable through SsoStrings.
• Captcha support via WebViewCaptchaSolver, which builds the provider's page from the site key in GET /auth-config and needs nothing deployed, with WebViewCaptchaSolver.hosted for a page you serve yourself and a CaptchaSolver interface for your own implementation.
• Token persistence in the platform keychain or keystore (SecureTokenStore), with an in-memory fallback so storage failures never crash the app, plus MemoryTokenStore to opt out.
• AuthHttpClient for attaching the session token to your own API calls, with a mandatory origin allowlist and 401 / A403 dispatch.
• jwtExpiry and isJwtExpired, used to discard an already-expired token without a round trip.
• Account settings: SsoAccountSettings (and showSsoAccountSettings) with nine panes that hide themselves when they don't apply, plus each pane standalone — SsoProfileForm, SsoChangePasswordForm, SsoTwoFactorSetup, SsoWhatsAppSetup, SsoWalletSection, SsoPlansSection, SsoCreditsSection, SsoMembersSection, SsoRolesSection and SsoInvitationsSection, and SsoLogoutButton. Copy lives in SsoSettingsStrings.
• Profile editing (PUT /profile) with ProfileUpdate, which can be seeded from a profile so a one-field edit doesn't blank the rest.
• 2FA enrolment — beginTwoFactor, confirmTwoFactor, disableTwoFactor, twoFactorEnabled — against both backend endpoint families, which stay reachable from one client: SsoConfig.twoFactorFamily sets the default and every call (and SsoTwoFactorSetup) takes a family of its own.
• WhatsApp as a second factor: whatsAppStatus, enableWhatsApp, verifyWhatsApp, with splitDialCode for the dial-code the verify endpoint wants separately.
• Team administration: the permission catalogue (permissions, cached) with expandPermissions and indexActions, roles CRUD, memberships with three-state Patch updates, the member-side team list, and invitations. SsoPermissionMatrix and SsoDataScopeControl render the editor, showing implied permissions ticked and locked.
• Billing: plans, subscribe, subscription, wallets, walletLogs, rechargeLinks, creditWallets, creditWalletLogs and rechargeCreditWallet, with mapping for both wallet-log wire shapes.

Known limits

Email links are not received or parsed (the endpoints are there once you hold a token), external URLs need an onLaunchUrl callback, plan descriptions are shown as written rather than rendered as markdown, and dates and amounts are formatted without intl. See the README.