AuthManager class

High-level auth coordinator for routed.

Constructors

AuthManager(AuthOptions<EngineContext> options, {SessionAuthService? sessionAuth, AuthRuntime<EngineContext>? runtime, DateTime clock()?})
Creates an authentication coordinator from options.

Properties

admin → AdminPlugin<EngineContext>?
The configured Admin plugin, if enabled for this runtime.
no setter
anonymous → AnonymousPlugin<EngineContext>?
The configured anonymous-account plugin, if enabled.
no setter
apiKeys → AuthApiKeyPlugin<EngineContext>?
The configured API-key plugin, if enabled for this runtime.
no setter
callbacks → AuthCallbacks<EngineContext>
The callback collection configured for this coordinator.
no setter
hashCode → int
The hash code for this object.
no setterinherited
httpClient → Client
The HTTP client used by authentication flows that call external services.
no setter
options → AuthOptions<EngineContext>
The authentication options used by this coordinator.
final
organization → OrganizationPlugin<EngineContext>?
The configured organization plugin, if enabled for this runtime.
no setter
phoneNumbers → PhoneNumberPlugin<EngineContext>?
The configured phone-number authentication plugin, if enabled.
no setter
runtime → AuthRuntime<EngineContext>
The plugin and policy runtime used by this coordinator.
final
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
sessionAuth → SessionAuthService
The framework session service used to store the authenticated principal.
no setter
store → AuthStore
The persistent store configured for this coordinator.
no setter
twoFactor → TwoFactorPlugin<EngineContext>?
The configured two-factor plugin, if enabled for this runtime.
no setter
webAuthn → WebAuthnPlugin<EngineContext>?
The configured WebAuthn/passkey plugin, if enabled for this runtime.
no setter

Methods

beginOAuth<TProfile extends Object>(EngineContext ctx, OAuthProvider<TProfile> provider, {String? callbackUrl}) → Future<Uri>
Creates an OAuth authorization URI for provider.
buildSessionPayload(EngineContext ctx, AuthSession session, {AuthProvider? provider}) → Future<Map<String, dynamic>>
Builds the callback-adjusted payload returned for session.
changePassword(EngineContext ctx, {required String identifier, required String currentPassword, required String newPassword}) → Future<AuthPasswordChangeResult>
Reauthenticates the current user, changes their password, and revokes every server-side session or JWT version for that user.
completeCustomCallback(EngineContext ctx, AuthProvider provider, AuthUser user, {String? redirectUrl, Map<String, dynamic>? profile}) → Future<AuthResult>
Completes authentication for a custom callback provider.
completePluginAuthentication(EngineContext ctx, AuthEndpointAuthenticationIntent intent) → Future<AuthResult>
Completes a portable plugin authentication through the host policy.
completeTwoFactorRecoverySignIn(EngineContext ctx, {required String challengeToken, required String recoveryCode}) → Future<AuthResult>
Completes a pending credential sign-in after recovery-code verification.
completeTwoFactorSignIn(EngineContext ctx, {required String challengeToken, required String code, bool trustDevice = false}) → Future<AuthResult>
Completes a pending credential sign-in after TOTP verification.
confirmCurrentAccountDeletion(EngineContext ctx, {required String token}) → Future<AuthAccountDeletionConfirmed>
Confirms a deletion token and runs the canonical tombstoning lifecycle.
confirmEmailChange(EngineContext ctx, {required String token}) → Future<AuthUser>
Consumes an email-change confirmation and revokes previous sessions.
confirmPasswordReset(EngineContext ctx, {required String token, required String newPassword}) → Future<AuthPasswordResetResult>
Consumes a password-reset token and revokes the user's sessions.
csrfToken(EngineContext ctx) → String
Returns the request CSRF token, creating and storing one when necessary.
currentStoredSessionId(EngineContext ctx) → Future<String?>
Returns the persisted server-side session identifier for ctx, if any.
deleteCurrentUser(EngineContext ctx, {required String currentPassword}) → Future<void>
Reauthenticates and tombstones the current account.
enforceRateLimit(EngineContext ctx, AuthProvider provider, {required AuthRateLimitAction action, String? identifier}) → Future<void>
Enforces the configured limiter for an adapter-specific auth boundary.
enforceRateLimitForProviderId(EngineContext ctx, String providerId, {required AuthRateLimitAction action, String? identifier}) → Future<void>
Enforces a limiter for a boundary without a configured auth provider.
enforceRateLimitOperation(EngineContext ctx, {required AuthRateLimitOperation operation, String? identifier}) → Future<void>
Enforces a namespaced plugin rate-limit operation.
exchangeApiKeyForSession(EngineContext ctx) → Future<AuthResult>
Exchanges an enabled API key for a normal server-side session.
finishOAuth<TProfile extends Object>(EngineContext ctx, OAuthProvider<TProfile> provider, String code, String? state) → Future<AuthResult>
Completes an OAuth sign-in from an authorization code and state.
hasValidTwoFactorStepUp(EngineContext ctx) → Future<bool>
Returns whether the current request carries a valid step-up proof.
linkAccount(EngineContext ctx, {required String providerId, required String providerAccountId, required String accessToken}) → Future<AuthAccountLinked>
Verifies provider ownership with a provider-issued token before linking.
listLinkedAccounts(EngineContext ctx) → Future<List<AuthAccount>>
Lists the current user's linked external identities without provider access or refresh tokens.
listSessions(EngineContext ctx) → Future<List<AuthSessionInfo>>
Lists active server-side sessions belonging to the current user.
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
reauthenticateWithPassword(EngineContext ctx, {required String currentPassword, String? identifier}) → Future<void>
Verifies the current user's password and records a short-lived, session-bound proof for sensitive actions.
registerWithCredentials(EngineContext ctx, CredentialsProvider provider, AuthCredentials credentials, {String? captchaToken}) → Future<AuthResult>
Registers credentials through provider and signs the user in.
requestAccountDeletion(EngineContext ctx, {required String currentPassword}) → Future<void>
Reauthenticates and delivers a one-time account-deletion token.
requestEmailChange(EngineContext ctx, {required String newEmail, required String currentPassword, String? identifier}) → Future<void>
Reauthenticates the current user and sends an email-change confirmation.
requestPasswordReset(EngineContext ctx, String email) → Future<void>
Delivers a password-reset token through the application-owned sender.
requireRecentAuthentication(EngineContext ctx) → Future<void>
Requires a fresh authentication proof for a sensitive plugin operation.
requireTwoFactorStepUp(EngineContext ctx) → Future<void>
Requires a recent step-up proof for the current request.
resolveRedirect(EngineContext ctx, String? url, {AuthProvider? provider}) → Future<String?>
Resolves url against the current request and configured auth callbacks.
resolveSession(EngineContext ctx) → Future<AuthSession?>
Resolves and validates the current authentication session for ctx.
revokeOtherSessions(EngineContext ctx) → Future<int>
Revokes every other active server-side session for the current user.
revokeSession(EngineContext ctx, String sessionId) → Future<void>
Revokes one server-side session belonging to the current user.
revokeTwoFactorStepUp(EngineContext ctx) → Future<void>
Revokes the current session's step-up proofs and expires its cookie.
revokeTwoFactorTrustedDevices(EngineContext ctx) → Future<void>
Revokes all trusted devices for the current user and expires the cookie.
signInWithCredentials(EngineContext ctx, CredentialsProvider provider, AuthCredentials credentials, {String? captchaToken}) → Future<AuthResult>
Signs in with credentials through provider.
signInWithEmail(EngineContext ctx, AuthMagicLinkProvider provider, String email, String callbackUrl) → Future<AuthResult>
Starts a magic-link sign-in for email.
signOut(EngineContext ctx, {bool destroyFrameworkSession = false}) → Future<AuthSession?>
Signs out the current authentication session.
toString() → String
A string representation of this object.
inherited
unlinkAccount(EngineContext ctx, {required String providerId, required String providerAccountId, String? currentPassword}) → Future<void>
Removes one linked identity after explicit recent-auth/step-up policy.
updateSession(EngineContext ctx, AuthPrincipal principal) → Future<AuthSession>
Updates the current auth session with the given principal.
validateBrowserRequest(EngineContext ctx) → String?
Returns an auth error code when browser request protections reject ctx.
validateCsrf(EngineContext ctx, Map<String, dynamic> payload) → bool
Validates the request CSRF token against payload and request headers.
verifyEmail(EngineContext ctx, AuthMagicLinkProvider provider, String email, String token) → Future<AuthResult>
Completes a magic-link sign-in using email and token.
verifyTwoFactorStepUp(EngineContext ctx, {required String code}) → Future<AuthTwoFactorStepUpToken>
Verifies TOTP for a sensitive action and sets a short-lived proof cookie.

Operators

operator ==(Object other) → bool
The equality operator.
inherited