89 lines
3.0 KiB
Dart
89 lines
3.0 KiB
Dart
import 'package:dio/dio.dart';
|
|
import 'package:flutter_secure_storage/flutter_secure_storage.dart';
|
|
|
|
import '../../errors/auth_exception.dart';
|
|
|
|
/// `first_unlock` accessibility so the token can be read during background
|
|
/// requests (telemetry heartbeat, push-triggered syncs) after the first device
|
|
/// unlock following a reboot. The keychain default (`whenUnlocked`) throws
|
|
/// `-25308 errSecInteractionNotAllowed` when the device is locked.
|
|
const IOSOptions _mcIosOptions = IOSOptions(
|
|
accessibility: KeychainAccessibility.first_unlock,
|
|
);
|
|
|
|
/// Persists the Marianum-Connect bearer token in the platform keystore. Kept
|
|
/// separate from `SessionManager` because the username/password live on (Nextcloud
|
|
/// + MHSL still need them) while the MC token is short-lived and per-endpoint.
|
|
class MarianumConnectTokenStorage {
|
|
static const _tokenKey = 'mc_bearer_token';
|
|
static const _tokenIdKey = 'mc_token_id';
|
|
static const _expiresAtKey = 'mc_token_expires_at';
|
|
|
|
final FlutterSecureStorage _storage;
|
|
|
|
const MarianumConnectTokenStorage([
|
|
this._storage = const FlutterSecureStorage(iOptions: _mcIosOptions),
|
|
]);
|
|
|
|
Future<String?> readToken() => _storage.read(key: _tokenKey);
|
|
|
|
/// Request options carrying the stored token, for probes that bypass the
|
|
/// auth interceptor. Throws [AuthException] when no token is stored.
|
|
Future<Options> requireBearerOptions(String caller) async {
|
|
final token = await readToken();
|
|
if (token == null || token.isEmpty) {
|
|
throw AuthException.unauthorized(
|
|
technicalDetails: '$caller: no bearer token in storage',
|
|
);
|
|
}
|
|
return Options(headers: {'Authorization': 'Bearer $token'});
|
|
}
|
|
|
|
Future<String?> readTokenId() => _storage.read(key: _tokenIdKey);
|
|
|
|
Future<DateTime?> readExpiresAt() async {
|
|
final raw = await _storage.read(key: _expiresAtKey);
|
|
if (raw == null || raw.isEmpty) return null;
|
|
return DateTime.tryParse(raw);
|
|
}
|
|
|
|
Future<void> write({
|
|
required String token,
|
|
required String tokenId,
|
|
required DateTime? expiresAt,
|
|
}) async {
|
|
await _storage.write(key: _tokenKey, value: token);
|
|
await _storage.write(key: _tokenIdKey, value: tokenId);
|
|
await _storage.write(
|
|
key: _expiresAtKey,
|
|
value: expiresAt?.toIso8601String() ?? '',
|
|
);
|
|
}
|
|
|
|
static const bearerKey = _tokenKey;
|
|
static const fieldKeys = [_tokenKey, _tokenIdKey, _expiresAtKey];
|
|
|
|
/// Raw stored fields, for parking the token of an inactive account.
|
|
Future<Map<String, String>> readAll() async => {
|
|
for (final key in fieldKeys) key: ?await _storage.read(key: key),
|
|
};
|
|
|
|
/// Restores fields from [readAll]; missing ones are deleted.
|
|
Future<void> writeAll(Map<String, String> fields) async {
|
|
for (final key in fieldKeys) {
|
|
final value = fields[key];
|
|
if (value == null) {
|
|
await _storage.delete(key: key);
|
|
} else {
|
|
await _storage.write(key: key, value: value);
|
|
}
|
|
}
|
|
}
|
|
|
|
Future<void> clear() async {
|
|
await _storage.delete(key: _tokenKey);
|
|
await _storage.delete(key: _tokenIdKey);
|
|
await _storage.delete(key: _expiresAtKey);
|
|
}
|
|
}
|