forui_firebase_ui_auth 0.1.0

Pre-built widgets library that are integrated with the variety of the Firebase Auth providers.

0.1.0

Note: This release has breaking changes.

• BREAKING REFACTOR: host OAuthProvider, button styles, and OAuthProviderButtonBase in auth so oauth depends only on auth (no publish cycle).

• REFACTOR: upgrade project to remove warnings from Flutter 3.7 (#10344). (c9364bb6)

• FIX(ui_auth): allow to pass EmailFormStyle via property (#98). (88c31a33)

• FIX(firebase_ui_auth): sendPasswordResetEmail should not be executed when isLoading=true (#315). (955e5c28)

• FIX(ui): bump dependencies (#9756). (9fde266e)

• FIX(ui_oauth_apple): set default scope to 'email' and add a way to provide custom scopes (#9784). (cec68582)

• FIX: bump FlutterFire dependencies & fix CI (#552). (0e6d85bf)

• FIX: analyser issues from later Flutter version (#551). (62cc4be7)

• FIX(ui_auth): fix docs typo (#9925). (0405b6e9)

• FIX(firebase_ui_auth): Add padding between avatar and display name form (#524). (2747c1ae)

• FIX(firebase_ui_auth): Avoid redundant confirmation on account deletion (#494). (e2626d24)

• FIX(ui_auth): fix docs typo for EmailAuthProvider. (#9927). (0412a9db)

• FIX: bump FF dependencies to latest (#526). (9f355bfc)

• FIX: bump FF dependencies to latest (#520). (ac4f1fdd)

• FIX: replace deprecated API and bump FlutterFire dependencies (#453). (530be48a)

• FIX(auth): remove listener on dispose and only call setState when mounted (#419). (91c982b5)

• FIX(auth): ensure previous display name is provided to callback (#431). (662717d7)

• FIX(ui_auth): upgrade dependency to fix platform support for firebase_ui_auth (#9924). (13004220)

• FIX(ui_auth): fix confirmation dialog for unlink account button in profile screen (#373). (0e3a7c49)

• FIX(auth): using theme color instead of hardcoded value (#416). (d183d87e)

• FIX(ui_auth): make light text on _EmailVerificationBadge legible (#196). (72530e52)

• FIX(ui_auth): fix confirmation dialog for delete account button (#346). (4fd041d1)

• FIX(auth): ForgotPasswordScreen display email within input box (#336). (ad666666)

• FIX(ui_auth): widen app_links constraint to allow 7.x (#676). (235b4071)

• FIX(ui_oauth): initialize auth and auth listener in standalone OAuth buttons (#9926). (d52d58b8)

• FIX(ui_auth): Fixed a momentary form display after signing in with EmailLinkAuth. (#318). (3e37d143)

• FIX(firebase_ui_localizations): expose all Firebase UI localizations for overriding (#309). (e4567478)

• FIX(firebase_ui_auth): Catch sms code validation (#482). (687a9bad)

• FIX(ui_auth): correctly handle phone auth in showReauthenticateDialog (#209). (c0612cfd)

• FIX(ui_auth): deprecate email enumeration protection affected APIs (#210). (eed65674)

• FIX(ui_auth): correctly position phone input screen footer (#183). (d5e2338d)

• FIX(ui_auth): make maxWidth configurable on all screens (#178). (c5e77c27)

• FIX(ui_auth): documentation - fix material misspelling in universal_text_form_field.dart (#11151). (f44b9ff3)

• FIX(ui_auth): deprecate screens and widgets that use fetchSignInMethodsForEmail (#153). (84ce5fb7)

• FIX(ui_auth): use capitalized cancel label on dialogs (#134). (78c1ba9b)

• FIX(ui_localizations): localize weak password error (#138). (bcfa2be6)

• FIX(ui_auth): add showPasswordVisibilityToggle to the SignInScreen (#114). (77ed75d3)

• FIX(ui_auth,ui_localizations): add invalid verification SMS code error label (#102). (8adc39b9)

• FIX(ui_auth): automatically upgrade anonymous accounts (#10071). (eb205bf8)

• FIX(ui_localizations,ui_auth): add missing labels (#87). (be2b0c33)

• FIX(ui_auth): Pass correct AuthAction to the footerBuilder (#70). (1e091cc5)

• FIX(ui_auth): fix LoadingIndicator layout on EmailVerificationScreen (#11169). (07739ebd)

• FIX(ui_auth): pass breakpoint to LoginScreen (#10607). (147b9545)

• FIX(firebase_ui_auth): clear the error on ForgotPasswordScreen after submitting a valid email (#9992). (b176f572)

• FIX: allow to unlink providers only in edit mode (#10649). (aa217855)

• FIX(ui_auth): fix OAuth providers on RegisterScreen (#10026). (d29aed25)

• FIX(ui_auth): fix reauthenticate dialog overflow (#9734). (a85d4b2b)

• FIX: add support for AGP 8.0 (#10901). (81a1bf47)

• FIX(ui_auth): emit UserCreated state when signed in user is new (#10225). (a461bad6)

• FIX(firebase_ui_oauth): fix OAuth provider buttons paddings (#9991). (34aae12a)

• FIX: Unfocus to dismiss keyboard when submitting email form (#10208). (310b1f6d)

• FIX(ui_auth): fix material 3 button styling (#10253). (90377b06)

• FIX(ui): allow null countryCode for phone input (#9937). (227e27c4)

• FIX(firebase_ui_auth): Error added in ProfileScreen in firebase_ui_auth 1.4.0 (#10957). (e00550f7)

• FIX(auth,web): currentUser is now populated right at the start of the application without needing to wait for authStateChange (#10028). (4d41880e)

• FIX(ui_auth): fix ProfileScreen ignoring parent rebuilds (#11160). (f8232be6)

• FIX(ui_auth_google): bump google_sign_in version (#10531). (b9059c25)

• FIX(ui_auth): fix ResponsivePage layout causing unexpected overflows (#10533). (9314edd7)

• FIX(ui_auth): fix PhoneInputScreen layout (#10227). (f4ecfb25)

• FIX(ui_auth): fix default SMSCodeInputScreen breakpoint (#10226). (eb8d6936)

• FIX(ui_auth): allow to pass actions to the RegisterScreen (#10025). (5cd84e32)

• FIX(firebase_ui_auth): preserve UI form state when device rotates (#9993). (08e0eff2)

• FEAT(auth): move to Pigeon for Platform channels (#10802). (651ed52b)

• FEAT(ui_auth): Add "Go Back" button to EmailLinkSignInView (#63). (326fd27d)

• FEAT(ui_auth): allow passing custom user avatar widget (#11161). (1a4c004c)

• FEAT(ui_auth): allow to toggle password visibility (#104). (6e3735d9)

• FEAT(ui_auth): show confirmation dialog when trying to unlink a provider (#116). (8757037b)

• FEAT: update dependency constraints to sdk: '>=2.18.0 <4.0.0' flutter: '>=3.3.0' (#10946). (9c2906d5)

• FEAT: update librairies to be compatible with Flutter 3.10.0 (#10944). (6a6b02b1)

• FEAT(ui_auth): add a way to customize ErrorText message (#119). (a36884d7)

• FEAT(core): add support for Windows via Firebase C++ desktop SDK (#10496). (9ce686c6)

• FEAT(ui_auth): add more account actions (#172). (518a6c7b)

• FEAT: upgrade to dart 3 compatible dependencies (#10890). (857070d2)

• FEAT: [firebase_ui_auth] [firebase_ui_oauth] Allow for custom labels to be used for custom OAuth providers (#9858). (6badaf8e)

• FEAT(ui_auth): confirm account deletion (#187). (053a96ee)

• FEAT(ui): add firebase_ui_auth and oauth providers (#9343). (2d2db74d)

• FEAT(ui_auth): export localizedErrorText (#189). (ab89f5cf)

• FEAT(ui_shared): pass platform-specific icons and colors explicitly (#10655). (c7ac28a5)

• FEAT: bump dart sdk constraint to 2.18 (#10618). (882d9205)

• FEAT(ui_shared): extract common widgets to a shared library (#10620). (79f76d3a)

• FEAT(ui_auth): add a way to get an AuthController for AuthState (#207). (0816bfd4)

• FEAT(firebase_ui_localizations): support for sendVerificationEmailLabel() label (#280). (95be915d)

• FEAT(firebase_ui_auth): add showPasswordVisibilityToggle to RegisterScreen (#297). (6ec3ec1e)

• FEAT(firebase_ui_auth): add autofocus property to PhoneInput widget (#334). (eb9e2bd1)

• FEAT: bump FlutterFire dependencies 2024-09-30 (#407). (d72ce8e3)

• FEAT(firebase_ui_auth): Use icon from OAuth provider as a fallback in ProfileScreen (#474). (55f04ebb)

• FEAT(firebase_ui_auth): Override the default deletion modal. (#493). (97210905)

• FEAT(auth): upgrade flutter_facebook_auth dependency and use limited/classic login depending on ATT status (#553). (c3acdba7)

• FEAT: update FlutterFire dependencies to the latest (#580). (acef6d3c)

• FEAT: upgrade all packages min SDK to Dart 3.5 (#615). (aefa711a)

• FEAT: upgrade all packages min SDK to Dart 3.5 (#616). (1535fac4)

• FEAT: Require Dart 3.9 (#618). (80a27122)

• FEAT: migrate to Swift Package Manager and drop the Firestore fork (#699). (73b2c453)

• FEAT(ui_auth): add a way to customize PlatformException text (#171). (cbe75ca4)

• FEAT(ui_auth): use google_sign_in on macOS (#255). (72571a0d)

• DOCS(ui_auth): fix typo RegisterScren -> RegisterScreen (#10488). (385f55ef)

• DOCS: Fixed typo on phone.md (#10196). (8922419d)

• DOCS(ui_auth): Removed extra header and fixed typos (#10248). (b881a04e)

• DOCS(ui_auth): fix typo in "platform (#10247). (8254549a)

• DOCS(ui_auth): add a font requirement (#10293). (deef5210)

• DOCS(firebase_ui_auth): fix return type of example main function (#10342). (8bfb084f)

• DOCS(ui_auth): Fixed typo 'EmaiAuthProvider' to 'EmailAuthProvider' (#10654). (85e8256e)

• DOCS(firebase_ui_auth): fix an error in the documentation (#10797). (111dee9f)

• DOCS(firebase_ui_auth): fix phone provider's widget example (#10917). (0c5672eb)

• DOCS(ui_auth): improve phone.md (#9774). (a0a0e0ba)

• DOCS: Added superkey to example widget (#326). (dd5507e1)

• DOCS(firebase_ui_auth): Handle UserCreated event in README example (#422). (bd1d5ecf)

• DOCS(ui_auth): update platform support matrix (#9764). (a0a0f374)

• DOCS(ui_auth): add docs links to the package README (#10104). (3509c322)

• BREAKING FEAT(auth): Remove Dynamic Links, replace with app-links. (#522). (b32ec609)

• BREAKING FEAT: bump FlutterFire dependencies & remove deprecated API (#529). (7650921e)

• BREAKING FEAT(ui_oauth_twitter): replace twitter_login with signInWithProvider (#697). (6290de49)

  • feat(ui_oauth_twitter)!: replace twitter_login with signInWithProvider

  twitter_login has not published since July 2023 and ships an Android build.gradle with no namespace that pins AGP 4.1.0, which capped this repo at AGP 8.7.3 and blocked #693 from using flutter_web_auth_2.

  TwitterProvider now signs in through auth.signInWithProvider on Android and iOS, mirroring AppleProvider, so Firebase performs the OAuth dance and the Twitter API key and secret move out of the app binary into the Firebase console. macOS and Windows keep the vendored OAuth 1.0a flow, which is why apiKey and apiSecretKey survive as optional parameters rather than being removed.

  macOS stays on the desktop flow because signInWithProvider is not available to it: FLTFirebaseAuthPlugin.swift carves out Apple and Game Center, then fails every other provider under #if os(macOS) with unsupported-platform. Android has no equivalent restriction.

  • AuthAction.none throws UnsupportedError on Android and iOS, since signInWithProvider cannot return a credential without also creating a session.
  • Anonymous users are upgraded with linkWithProvider so the anonymous uid survives sign in.
  • A debug-only diagnostic warns once when apiKey or apiSecretKey are passed on a platform that now ignores them.
  • Restores compileSdk to flutter.compileSdkVersion and bumps AGP to 8.9.1, now that nothing pins it.
  • fix(ui_oauth_twitter): report an error when linking without a signed in user

  AuthAction.link with no FirebaseAuth.currentUser null-shorted the linkWithProvider call, so the flow neither completed nor reported an error and the UI stayed in its loading state. The credential path this replaced raised through auth.currentUser!, so a null user was at least surfaced.

  Reports a FirebaseAuthException instead, which reaches AuthFailed rather than escaping as an unhandled Error the way a StateError would.

  • ci(e2e): correct stale version comment on the setup-gradle pin

  The pin comment claimed v6 while the pinned SHA is v6.2.0, and upstream has since moved the v6 tag to v6.3.0. zizmor flagged the mismatch as a medium severity finding, which blocks the workflow check.

  Corrects the comment rather than moving the pin, so the action version CI runs is unchanged.

  • docs(ui_oauth_twitter): document the signInWithProvider setup

  Rewrites the Twitter section around the flow Firebase now performs on Android and iOS: enable the provider in the console, point the X app callback URL at the Firebase auth handler, then add the encoded app ID URL scheme on iOS and the SHA-1 on Android. The twitter_login install step is gone, and the API key and secret move into their own macOS and Windows section, since those are the only platforms that still need them.

  Adds the encoded app ID scheme to the firebase_ui_auth example and drops the ffire:// redirect it passed for twitter_login, which no longer takes part in either flow.

  • fix(tests): bump the Gradle wrapper to 8.11.1 for AGP 8.9.1

  AGP 8.9.1 requires Gradle 8.11.1 or later, and the tests app wrapper was on 8.10, so assembleDebug failed with a version-check error as soon as the AGP pin moved.

  Only the tests app is affected. The example apps keep their own lower AGP versions and wrappers.

  • chore(ui_oauth): format the twitter example button call

  • fix(ui_oauth_twitter): report auth failures instead of throwing Errors

  Independent review found that three of the new failure paths raised Error subtypes into the auth listener. defaultOnAuthError rethrows anything that is not a FirebaseAuthException, and both AuthFlow.onError and the button's handler catch only Exception, so those Errors escaped and left the flow in its loading state permanently.

  • AuthAction.none now reports a FirebaseAuthException rather than throwing UnsupportedError out of the tap handler.
  • Missing OAuth 1.0a credentials are checked in desktopSignIn, before the base flow reads desktopSignInArgs synchronously, so the ArgumentError is no longer reachable from the UI.
  • Empty strings count as missing credentials, since String.fromEnvironment yields an empty string and that is the documented way to supply them. The debug diagnostic no longer fires on them either.
  • User cancellation is mapped back to a flow reset. The native SDKs report dismissal as a FirebaseAuthException, which was being rendered as a sign in failure where the previous flow reset silently.
  • The linked credential is no longer force unwrapped, since it is nullable on every platform.

  Also makes the anonymous upgrade test pass AuthAction.signIn explicitly. The flow resolves to AuthAction.link whenever currentUser is non-null, so the test was passing without the shouldUpgradeAnonymous branch being consulted.

  • fix(ui_oauth_twitter): correct the diagnostic callback URL and two stale comments

  The debug diagnostic told developers to set their Twitter app callback URL to redirectUri when one was supplied, but the native flow on Android and iOS ignores redirectUri and always completes through the Firebase auth handler, so the advice guaranteed failure for exactly the consumers migrating from the custom scheme twitter_login needed. It now names the handler. The desktop flow still honours redirectUri, so its own use of it is unchanged.

  Also corrects the class doc, which listed Game Center alongside Apple as exempt from the macOS restriction. Game Center is rejected on every platform, for its own reason, so Apple is the only exception. And removes a comment in the example that lost its subject when the twitter_login dependency was deleted.

  • fix(ui_auth): navigate to the profile after a sign in that returns no email

  The example's sign in handler matched only emailVerified users and unverified users that have an email, so a user with neither matched no case and the screen stayed put after signing in successfully. Twitter only returns an email when the app asks for it, and such a user is never emailVerified, so Twitter sign in landed in that gap.

  The app's own initialRoute already treats those users as signed in via its catch all, so this brings the in flow navigation in line with what a relaunch does.

  • fix(ui_auth): stop EmailVerificationController crashing on resume when signed out

  reload() read auth.currentUser! and runs on every app resume, so resuming with no signed in user threw an unhandled TypeError rather than an Exception, which escapes the flow's error handling entirely.

  Cancelling an OAuth sign in is the easiest way to hit it: the provider takes the app to the background, cancelling brings it back, and currentUser is still null because the sign in never completed. Any app switch while signed out does the same, so this is not specific to a provider.

  The constructor already guards currentUser for null, so this brings reload() in line with the rest of the class rather than changing its contract.

  • chore(ui_oauth_twitter): wrap the diagnostic guard condition

  • docs(ui_oauth_twitter): expand the 2.x upgrade note with what testing found

  Device testing surfaced three things the original note could not have covered, because none of them is visible from the source.

  • Registering the Android SHA-1 is not sufficient on its own. The certificate hash is embedded in google-services.json at download time, so the file has to be re-downloaded afterwards. The note now carries the error string Firebase shows when either step is missed, since that is what consumers will actually search for.
  • Firebase occasionally opens the full browser rather than a Chrome Custom Tab, and abandoning the flow there leaves the operation pending until the app restarts. Recorded as a known limitation, since nothing in the Dart layer can resolve a future the SDK never completes.
  • Cancelling returns silently, which is worth stating because it is indistinguishable from nothing having happened.

  Also documents that redirectUri is ignored on Android and iOS, which was missing, and splits the section into what you must change, what behaviour changed, and the known limitation.

• BREAKING FEAT(ui_oauth_google): migrate to google_sign_in 7 (#700). (7fd741c9)

  • feat(ui_oauth_google)!: migrate to google_sign_in 7

  Migrates GoogleProvider to the google_sign_in 7 API, which adopts the UIScene lifecycle on iOS (google_sign_in_ios 6.3.0) and Swift Package Manager (6.3.3). Fixes the deprecated application lifecycle warning tracked in #673.

  • GoogleSignIn is now the shared instance and is initialized once before the first sign-in.
  • Authentication and authorization are separate steps. The provider reuses an existing authorization for the requested scopes and prompts for consent when one is not available, so the credential still carries an access token when scopes are requested.
  • A cancelled sign-in surfaces as AuthCancelledException, matching the previous flow reset behaviour.
  • Adds an optional serverClientId parameter to GoogleProvider, GoogleSignInButton and GoogleSignInIconButton for Android apps that do not use google-services.json.
  • Updates the integration test mocks to the new API.

  integration steps: GIDClientID in Info.plist on iOS, and on Android a web OAuth client entry in google-services.json or an explicit serverClientId. When no scopes are requested the credential now contains only an ID token.

  • refactor(ui_oauth_google): simplify init and isolate it in tests

  Chain the retry-reset catchError directly onto initialize() instead of threading an intermediate local, and add a @visibleForTesting debugReset() that clears the static one-time-init future so each test starts from a clean state with its freshly injected mock.

  Addresses review feedback on #689.

  • chore(ui_oauth_google): format provider.dart

  • fix(ui_oauth_google): preserve stack trace on init retry

  Use Error.throwWithStackTrace in the initialize() catchError so a failed initialization keeps its original stack trace instead of resetting it with a bare throw.

• BREAKING FEAT(ui_auth): complete email link sign in after cold start and on other devices (#710). (57b353e5)

0.1.0

• Initial release of forui_firebase_ui_auth: Forui port of the original Firebase UI Auth package. Screens and form widgets use Forui (FScaffold, FTextFormField, FOtpField, FAvatar, FDialog, Lucide icons). Apps must wrap UI in an FTheme ancestor. Requires Dart ^3.13.0 / Flutter 3.47+.