secure_session_manager 1.2.0

A lightweight, secure, and highly scalable session management package for Flutter with zero performance overhead, automatic token refresh, and built-in interceptors for Dio and http.

1.2.0

🚀 New Features

• Infinite Loop Prevention: Added smart retry markers to both Dio and HTTP interceptors to prevent infinite refresh loops when server continuously returns 401
• Rich Event System: Added TokenRefreshStartedEvent and TokenRefreshFailedEvent for comprehensive event tracking
• Refreshing Auth State: Added AuthState.refreshing state to track when token refresh is in progress
• IdleListener Widget: New convenience widget for easy idle detection setup without manual wiring
• Cache Invalidation: Added invalidateCache() method and invalidateCache parameter to getSession() for multi-isolate scenarios
• Reset Method: Added reset() method to completely reset and reinitialize SessionManager
• Exceptions: Added comprehensive exception types: SessionException and TokenRefreshException
• New Getters: Added isRefreshing, failedRefreshAttempts, and hasCachedToken getters

🛡️ Security Improvements

• Automatic Logout on Refresh Failure: Now automatically logs out when token refresh fails instead of silently failing
• Strong Warnings: Added prominent warnings about SharedPreferencesProvider security risks
• Safe Multipart Replay: Improved multipart request handling to prevent stream consumption issues

🐛 Bug Fixes

• Deadlock Prevention: Fixed potential deadlock in refresh failure handling
• Private Field Access: Fixed issue with accessing private _cachedToken field
• Dispose Safety: Improved dispose() method to handle edge cases properly
• Re-initialization: Allow re-initializing SessionManager after disposal

📚 Documentation

• Comprehensive README: Updated with all new features, quick start guide, and security best practices
• Migration Guide: Added migration guide from 1.1.0 to 1.2.0
• More Examples: Added code examples for all new features

🎯 Other Improvements

• Backward Compatible: No breaking changes - fully compatible with 1.1.0
• Wider SDK Support: Lowered minimum SDK from 3.6.0 to 3.0.0
• More Topics: Added additional pub.dev topics for better discoverability
• Documentation Link: Added explicit documentation field in pubspec.yaml
• All Tests Pass: Maintained 100% test coverage

1.1.0

• Added Dio and http interceptors for automatic token injection and 401 handling.
• Introduced JwtDecoder for automatic expiry detection from JWT payloads.
• Added SharedPreferencesProvider for broad device compatibility (fallback for non-secure storage needs).
• Added revokeToken method to SessionManager for explicit server-side revocation.
• Improved test coverage and reliability.

1.0.2

• Expanded SDK compatibility: Now supports Dart SDK ">=3.6.0 <4.0.0".
• Updated environment constraints to support a wider range of development environments.

1.0.1

• Added explicit platform support for Android, iOS, Web, Windows, macOS, and Linux.
• Included relevant topics for better discoverability.
• Improved documentation with detailed idle detection and global listener guides.
• Enhanced example app with real-time activity logs.
• Cleaned up analysis warnings and improved strict typing.

1.0.0

• Initial release of secure_session_manager.
• Secure token storage with flutter_secure_storage.
• Atomic token refresh with request queueing.
• Optional, event-driven idle detection.
• App lifecycle session validation.
• Unit-testable architecture.