halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions 1

feat(oidc): halkyon_oidc_flutter, the device's half of signing in with OpenID Connect (ADR 0023)

Browse source 
OidcBrowser opens the page of an attempt the server began (OidcStart),
waits until the browser comes back by an OidcReturn (the app's scheme,
a verified https address, or the loopback) and returns the provider's
code (OidcCode), its refusal (OidcDenied), or nothing when the person
closed the browser. It checks the returned state against the attempt's,
as the server never compares it; a wrong state, neither one code nor
one refusal, no browser or a failed way back are OidcCallbackExceptions.

halkyon_app's LoopbackWebAuth moves in with its tests, relicensed from
AGPL v3 to BSD-3-Clause by its author, the developer; GitHub's sign-in
keeps using it from there until it ends. The package is BSD-3-Clause,
publish_to: none, as the module (ADR 0023, D2, D3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-23 23:46:52 +02:00
commit 3cb2000927
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
3 changed files with 706 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

1
packages/halkyon_app/lib/halkyon_app.dart
View file

@ -35,7 +35,6 @@ export 'src/auth/bloc/session_bloc.dart';
export 'src/auth/bloc/sign_in_ways_cubit.dart';
export 'src/auth/data/auth_gateway.dart';
export 'src/auth/data/auth_repository.dart';
export 'src/auth/data/loopback_web_auth.dart';
export 'src/auth/data/serverpod_auth_gateway.dart';
export 'src/auth/data/sign_in_addresses.dart';
export 'src/auth/data/signed_out_mark.dart';

149
packages/halkyon_app/lib/src/auth/data/loopback_web_auth.dart
View file

@ -1,149 +0,0 @@
import 'dart:async';
import 'dart:convert';
import 'dart:developer';
import 'dart:io';
import 'package:flutter/services.dart';
import 'package:flutter_web_auth_2_platform_interface/flutter_web_auth_2_platform_interface.dart';
import 'package:url_launcher/url_launcher.dart';
import 'package:window_to_front/window_to_front.dart';
/// The browser half of signing in with GitHub on Linux and Windows: opens
/// GitHub's page in the system browser and waits on a loopback address until
/// the browser comes back (RFC 8252, section 7.3).
///
/// It takes the place of flutter_web_auth_2's own implementation, which the
/// package's front ends whenever the app is resumed. That suits mobile, where
/// coming back to the app without finishing means giving up, but on the
/// desktop the app's window regaining focus resumes it, and the browser came
/// back to a closed port. Remove this class once the package no longer ends
/// the sign-in on Linux and Windows then.
///
/// The wait ends when the browser comes back, on [cancel], when another
/// sign-in starts, or after [_timeout].
class LoopbackWebAuth({
/// The app's name, as the browser's page says to go back to it.
final String appName = 'Halkyon',
final Future<bool> Function(Uri url) _launch = launchUrl,
final Future<void> Function() _bringToFront = WindowToFront.activate,
final Duration _timeout = const Duration(minutes: 5),
}) extends FlutterWebAuth2Platform {
HttpServer? _server;
Completer<String>? _pending;
/// Opens [url] in the browser and returns the URL the browser comes back
/// to. [callbackUrlScheme] is the whole redirect URI, on 127.0.0.1 with a
/// port; only its path ends the wait. [options] are the package's and
/// don't apply.
@override
Future<String> authenticate({
required String url,
required String callbackUrlScheme,
required Map<String, dynamic> options,
}) async {
final callback = Uri.parse(callbackUrlScheme);
if (callback.scheme != 'http' ||
callback.host != InternetAddress.loopbackIPv4.address ||
!callback.hasPort ||
callback.path.isEmpty) {
throw ArgumentError.value(
callbackUrlScheme,
'callbackUrlScheme',
'must be a path on http://127.0.0.1 with a port',
);
}
await cancel();
// The loopback address only: nothing but this device can answer.
final server = _server = await HttpServer.bind(
InternetAddress.loopbackIPv4,
callback.port,
);
final pending = _pending = Completer<String>()..future.ignore();
server.listen((request) => _answer(request, callback.path, pending));
try {
if (!await _launch(Uri.parse(url))) {
throw PlatformException(
code: 'FAILED',
message: "Couldn't open the browser.",
);
}
final result = await pending.future.timeout(_timeout);
try {
await _bringToFront();
} on Exception catch (error, st) {
// The sign-in worked; the person switches back by themselves.
log(
"Couldn't bring the window to the front",
name: 'Auth',
error: error,
stackTrace: st,
);
}
return result;
} finally {
await server.close();
if (identical(_server, server)) {
_server = null;
_pending = null;
}
}
}
/// Does nothing: the package's front calls it whenever the app is resumed,
/// which on the desktop includes the window regaining focus. [cancel] ends
/// a sign-in instead.
@override
Future<void> clearAllDanglingCalls() async {}
/// Stops waiting: the sign-in in progress ends as cancelled, the way the
/// package reports it. Does nothing when none is in progress.
Future<void> cancel() async {
final pending = _pending;
final server = _server;
_pending = null;
_server = null;
if (pending != null && !pending.isCompleted) {
pending.completeError(
PlatformException(code: 'CANCELED', message: 'User canceled login'),
);
}
await server?.close(force: true);
}
/// Answers the browser: the first request for the callback's path ends the
/// wait, anything else is not found.
Future<void> _answer(
HttpRequest request,
String callbackPath,
Completer<String> pending,
) async {
final response = request.response;
if (request.uri.path == callbackPath && !pending.isCompleted) {
pending.complete(request.requestedUri.toString());
response
..headers.contentType = ContentType.html
..write(_landingPage(appName));
} else {
response.statusCode = HttpStatus.notFound;
}
try {
await response.close();
} on IOException {
// The browser went away before the answer; nothing is left to tell it.
}
}
}
/// What the browser shows once it has come back to [app].
String _landingPage(String app) {
final name = const HtmlEscape().convert(app);
return '''
<!DOCTYPE html>
<html lang="en">
<meta charset="utf-8">
<title>$name</title>
<p>You can close this tab and return to $name.</p>
</html>
''';
}

3
packages/halkyon_app/lib/src/auth/data/serverpod_auth_gateway.dart
View file

@ -4,7 +4,6 @@ import 'dart:io';
import 'package:flutter_web_auth_2_platform_interface/flutter_web_auth_2_platform_interface.dart';
import 'package:halkyon_app/src/auth/data/auth_gateway.dart';
import 'package:halkyon_app/src/auth/data/loopback_web_auth.dart';
import 'package:halkyon_app/src/auth/model/auth_status.dart';
import 'package:halkyon_app/src/auth/model/github_link_outcome.dart';
import 'package:halkyon_app/src/auth/model/github_sign_in.dart';
@ -14,6 +13,8 @@ import 'package:halkyon_app/src/base/base_client.dart';
import 'package:halkyon_base_client/halkyon_base_client.dart'
show GitHubSignInRefusal, GitHubSignInRefusedException;
import 'package:halkyon_base_client/halkyon_base_client.dart' as base_client;
import 'package:halkyon_oidc_flutter/halkyon_oidc_flutter.dart'
show LoopbackWebAuth;
import 'package:http/http.dart' as http;
import 'package:serverpod_auth_idp_flutter/serverpod_auth_idp_flutter.dart';