vestibule_auth 2.0.2

Multi-tenant OTP authentication client for Vestibule

Changelog

2.0.2 - 2026-08-09

Proactive token refresh for long-lived mobile sessions (app left open for days).

Changed

• Default refreshBuffer is now 24 hours (was 5 minutes).
• getValidJWT({bool forceRefresh = false}) — pass forceRefresh: true before long-lived connections (e.g. voice WebSocket).
• On app resume (foreground), always runs getValidJWT so multi-day suspends renew access tokens instead of waiting for a 7-day timer that may never fire.
• Hydrates in-memory tokens from secure storage when returning a stored JWT.

2.0.1 - 2026-05-19

Drop the vestigial Flutter plugin scaffold. v1 was created with flutter create --template=plugin but the plugin classes were never used (no MethodChannel calls anywhere in Dart). Becoming a pure Flutter package eliminates the "plugin X does not support Swift Package Manager" warning consumers were seeing on Flutter 3.35+.

Removed

• ios/, android/ plugin scaffolds.
• flutter.plugin block in pubspec.yaml.

No API changes.

2.0.0 - 2026-05-19

Breaking — full rewrite as a REST client. Connect RPC and protobuf-generated code removed.

Migration from 1.x

• Constructor: VestibuleClient({ required serverUrl, required tenantId, http.Client? httpClient, ... }). The transport: Transport parameter is gone.
• Method names: prefer requestOtp / verifyOtp / signInWithGoogle / signInWithApple / refreshToken(token) over their *_OTP variants. The old names remain as @Deprecated aliases.
• Response fields: previously empty strings on absent values, now nullable. if (result.jwt != null && result.jwt!.isNotEmpty) rather than if (result.hasJwt()).
• Errors: server failures now throw VestibuleException(statusCode, code, message) instead of ConnectException. Codes: INVALID_ARGUMENT, NOT_FOUND, UNAUTHENTICATED, PERMISSION_DENIED, FAILED_PRECONDITION, INTERNAL.
• getProfile() / updateSmsOptIn(bool) / deleteUser() no longer take a jwt parameter. Call setAuthTokens(...) first (or rely on autoSaveTokens: true).
• getPublicKey() is now getJwks() and returns a raw JWKS map { "keys": [...] }.
• DeliveryMethod enum: DeliveryMethod.email / .sms (was DELIVERY_METHOD_EMAIL / DELIVERY_METHOD_SMS — wire format unchanged).
• tenantId field removed from request bodies: it's derived from the URL path now.
• database_url / database_token removed: per-user database routing is not part of the v2 surface.
• Import path: import 'package:vestibule_auth/client.dart' → import 'package:vestibule_auth/vestibule_auth.dart' (matches pub.dev convention of naming the main library after the package).

Removed

• protobuf, protoc_plugin, connectrpc dependencies.
• lib/gen/ generated code.

Added

• http, meta dependencies.
• Hand-written request/response model classes in lib/src/models/.
• VestibuleException with structured error codes.

0.0.1-beta.3

• Update flutter_fgbg to ^0.7.1 for compatibility

0.0.1-beta.2

• Add automatic JWT token refresh
  • getValidJWT() method that auto-refreshes if token is expired/expiring
  • Background refresh timer that refreshes tokens before expiry
  • Configurable refreshBuffer (default 5 minutes before expiry)
• Add foreground-only refresh with flutter_fgbg
  • Token refresh only runs when app is in foreground
  • Automatically refreshes when returning from background if needed
• Add JWT expiry utilities
  • isJwtExpired(), getJwtExpiry(), willExpireSoon()
• Add callbacks for token events
  • onTokenRefresh callback when tokens are refreshed
  • onTokenRefreshError callback when refresh fails

0.0.1-beta.1

• Initial beta release
• Email OTP authentication
• SMS OTP authentication
• Multi-factor authentication support
• Google Sign-In integration
• Apple Sign-In integration
• Secure token storage with flutter_secure_storage
• Optional automatic token management (autoSaveTokens parameter)
• Token refresh functionality
• FlutterFlow integration helpers with UID extraction
• Device fingerprinting
• Multi-tenant support