AuthScimConnectionPlugin<TContext> class final

Plugin-first managed connection and credential administration.

This plugin is intentionally separate from ScimPlugin. Install it only when an application wants a session-authorized management surface, and add its matching client plugin only to clients that administer connections.

Implemented types

Constructors

AuthScimConnectionPlugin({required AuthScimConnectionStore store, required AuthScimConnectionAuthorizer<TContext> authorize, String tokenPrefix = 'rscim', Duration defaultCredentialLifetime = const Duration(days: 90), Duration maximumCredentialLifetime = const Duration(days: 365), AuthScimConnectionTokenGenerator connectionIdGenerator = secureRandomToken, AuthScimConnectionTokenGenerator credentialIdGenerator = secureRandomToken, AuthScimConnectionTokenGenerator secretGenerator = secureRandomToken, DateTime clock()?})
Creates a plugin for managing SCIM connections and credentials.

Properties

authorize → AuthScimConnectionAuthorizer<TContext>
Authorizes each management operation for the current request.
final
clientOperations → Iterable<AuthClientOperationDescriptor>
Client operations declared by the plugin.
no setteroverride
connectionIdGenerator → AuthScimConnectionTokenGenerator
Generates connection identifiers.
final
credentialIdGenerator → AuthScimConnectionTokenGenerator
Generates credential identifiers.
final
dataContract → AuthServerPluginDataContract
Declares data and destructive routes owned by this plugin.
no setteroverride
defaultCredentialLifetime → Duration
Lifetime applied when a credential does not specify an expiry.
final
endpoints → Iterable<AuthEndpointDescriptor<TContext>>
Runtime endpoints contributed by the plugin.
no setteroverride
hashCode → int
The hash code for this object.
no setterinherited
id → String
Stable plugin identifier.
no setteroverride
maximumCredentialLifetime → Duration
Maximum lifetime accepted for an issued credential.
final
persistenceSchemas → Iterable<AuthPersistenceSchema>
Persistence schemas declared by the plugin.
no setteroverride
rateLimitOperations → Iterable<AuthRateLimitOperation>
Rate-limit operations declared by the plugin.
no setteroverride
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
secretGenerator → AuthScimConnectionTokenGenerator
Generates the raw secret shown when a credential is issued.
final
store → AuthScimConnectionStore
Persistence boundary for connections, credentials, and replay receipts.
final
tokenPrefix → String
Prefix used for issued managed SCIM bearer tokens.
final
userDataNamespace → String
The namespace used for plugin-owned user data.
no setteroverride

Methods

configure(AuthServerPluginContext<TContext> context) → void
Configures this plugin against the shared runtime context.
override
create({required AuthScimConnectionManagementPrincipal principal, required String name, required String provisioningDomainId, required Iterable<AuthScimScope> scopes, required String credentialName, required String idempotencyKey, DateTime? expiresAt}) → Future<AuthScimConnectionCreation>
Creates a connection and initial credential in one transaction.
createUserDeletionPlan(AuthUser user) → Future<AuthUserDeletionPlan>
Creates user deletion plan.
override
deleteTenant(String tenantId) → Future<void>
Trusted tenant lifecycle operation. This is deliberately not an endpoint.
disable({required AuthScimConnectionManagementPrincipal principal, required String connectionId}) → Future<AuthScimManagedConnection?>
Disables a connection and revokes its active credentials.
issueCredential({required AuthScimConnectionManagementPrincipal principal, required String connectionId, required String name, required Iterable<AuthScimScope> scopes, required String idempotencyKey, DateTime? expiresAt}) → Future<AuthScimCredentialIssuance>
Issues one credential and returns its raw secret once.
list({required AuthScimConnectionManagementPrincipal principal, int limit = 100, int offset = 0}) → Future<AuthScimConnectionPage>
Lists connections visible to principal.
listCredentials({required AuthScimConnectionManagementPrincipal principal, required String connectionId, int limit = 100, int offset = 0}) → Future<AuthScimCredentialPage>
Lists credentials belonging to a connection visible to principal.
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
revokeCredential({required AuthScimConnectionManagementPrincipal principal, required String connectionId, required String credentialId}) → Future<AuthScimCredential?>
Revokes one credential without issuing a replacement.
rotateCredential({required AuthScimConnectionManagementPrincipal principal, required String connectionId, required String credentialId, required String name, required Iterable<AuthScimScope> scopes, required String idempotencyKey, DateTime? expiresAt}) → Future<AuthScimCredentialIssuance?>
Revokes a credential and issues its replacement atomically.
toString() → String
A string representation of this object.
inherited
update({required AuthScimConnectionManagementPrincipal principal, required String connectionId, required DateTime expectedUpdatedAt, required String name, required String provisioningDomainId, required Iterable<AuthScimScope> scopes}) → Future<AuthScimManagedConnection?>
Updates connection metadata using optimistic concurrency control.

Operators

operator ==(Object other) → bool
The equality operator.
inherited