azakaw_kyc_flutter

Releases

1. ▸▾1.0.022 Sept 2026

   First release with full parity against the Azakaw web SDK (@azakawcompliance/azakaw-web-sdk 1.1.x). Breaking.

   First release with full parity against the Azakaw web SDK (@azakawcompliance/azakaw-web-sdk 1.1.x). Breaking.

   Migration

   // 0.0.9
   AzakawKyc.start(
     context: context,
     config: AzakawKycConfig(
       sessionId: id,
       environment: Environment.sandbox,
     ),
     onComplete: () {},
     onCancel: () {},
   );
   
   // 1.0.0
   final result = await AzakawKyc.start(
     context: context,
     config: AzakawKycConfig(
       sessionId: id,
       region: AzakawRegion.uae,
       environment: AzakawEnvironment.sandbox,
     ),
   );
   

   • Environment is replaced by AzakawEnvironment (sandbox, production) plus the new AzakawRegion (uae, ksa, qatar, kuwait).
   • AzakawKycConfig.baseUrl is gone. Use resolveAzakawUrls(...) if you need the resolved hosts.
   • AzakawKyc.start now returns Future<AzakawKycResult>. onComplete and onCancel still exist but take an AzakawKycResult.
   • AzakawKycDialog is replaced by AzakawKycView.
   • isFullscreen now defaults to true.

   Fixed

   • The sandbox environment pointed at qa-uaica2-metal.azakaw.com, an internal QA host, instead of sandbox.azakaw.com.
   • onComplete never fired. The SDK loaded the portal without a hostOrigin, and the portal gates all outbound messaging on it (isSdkEnabled = !!thirdPartyOrigin), so it never emitted OnboardingCompleted. The SDK now reports an origin and bridges the portal's postMessage protocol into Dart.
   • The SDK loaded /onboarding, which is not a registered route. The portal registers onboarding/:submissionId; a bare /onboarding falls through to its not-found page on any path where the startup navigation does not run. The SDK now loads the portal root, as the web SDK does.
   • The portal fell back to its login screen instead of the onboarding dashboard. The portal waits for IframeParametersResponse with takeWhile(e => hostOrigin !== e.origin, true) — a stream that completes on the first message whose origin equals hostOrigin. That is written for the iframe case, where hostOrigin is the parent page. Because a WebView has no parent, this SDK reports the portal's own origin, so the portal's own outbound IframeParametersRequest came straight back to its own listener, completed the stream before any reply could arrive, and made it abandon the session-token exchange. The bridge now intercepts window.postMessage and routes portal → host events to Dart without re-delivering them into the page; only the reply is delivered.
   • Camera capture failed on Android. Nothing handled the WebView's permission request, so the portal's getUserMedia call was denied. permission_handler was a declared dependency that was imported and never called, despite the README advertising "built-in camera permission handling".
   • The Android system back button dismissed the flow without firing onCancel, and without the close confirmation.
   • sessionId was interpolated into the URL unescaped; a value containing &, # or a space corrupted the query. An empty sessionId now throws instead of sending the string undefined.
   • Debug print() calls shipped to consumers.
   • pubspec.yaml used default_package — the federated-endorsement key — pointing the package at itself, so the native plugin was never registered or built on either platform.
   • The Android module was not a valid AGP 8 library: no com.android.library plugin and no namespace.
   • The podspec carried version 0.0.1 and unedited template metadata (A new Flutter plugin project, example.com, Your Company), and never bundled its privacy manifest.
   • The example app's Android manifest declared no permissions at all, and pinned a machine-specific org.gradle.java.home.

   Added

   • AzakawRegion — uae (azakaw.com), ksa (azakawksa.com), qatar (azakawqatar.com) matching the web SDK's SdkRegion, plus kuwait (kuwait.azakaw.com / kuwait-stg.azakaw.com), which the web SDK does not yet have.
   • Subdomains are now resolved per region/environment pair (AzakawRegion.subdomainFor) rather than from the environment alone. Kuwait shares the azakaw.com domain with UAE and is separated by subdomain, so the old app/sandbox assumption does not hold for it.
   • AzakawRegion.hasSandbox reports whether a region has a sandbox at all.
   • hideSidebar and hideOnboardingSections, answered over the portal's IframeParametersRequest handshake.
   • language — preselects en or ar, including RTL. The web SDK has no equivalent.
   • TenantBaseUrl support: the portal can move the session to a tenant-specific host mid-flow. Previously the SDK sent no sdkVersion, so the portal defaulted it to 1.0.0, failed its own semver.gt(sdkVersion, '1.0.2') gate and never sent the event at all — tenants on their own domain silently stayed on the generic host with the generic theme.
   • resolveTenantHost (default on): reads the baseUrl claim from the session token before the first load and opens the WebView on the tenant's domain directly, so themed tenants never render the generic host. Falls back to the TenantBaseUrl redirect on any failure.
   • AzakawKycResult / AzakawKycStatus / AzakawKycException, and an onError callback.
   • AzakawKycView for embedding the flow in your own layout.
   • A loading indicator and a retry-able error state.
   • The plugin's own manifest now declares INTERNET and CAMERA, with android.hardware.camera marked not required.
   • Real unit tests: the full region × environment matrix, URL construction, the event protocol, and the close confirmation.
   • Integration tests under example/integration_test/ that drive the live portal and assert the postMessage handshake round-trips, and that an invalid certificate is rejected. Verified on Android and iOS.

   iOS

   • Minimum iOS raised from the template's 12.0 to 14.3 — WKWebView gained getUserMedia there, so document capture cannot work below it. The permission callback the SDK uses is iOS 15+; on 14.3–14.x WKWebView prompts on its own via NSCameraUsageDescription.
   • iOS reports the WKMediaCaptureType the page asked for as a single resource, so a video-only getUserMedia arrives as CAMERA and CAMERA_AND_MICROPHONE only appears when a page asks for the microphone too. The portal captures with audio: false, so only CAMERA is granted and a combined request is refused — this flow never needs the microphone.
   • TLS handling is platform-aware. Android reports sslError only on a real failure, but iOS routes every HTTPS connection through the same hook and reports unspecified — which means success. Treating that as a failure would have blocked every valid server on iOS.
   • A cancelled navigation (NSURLErrorCancelled) is routine on iOS and is no longer surfaced as an error.

   Changed

   • WebView moved from webview_flutter to flutter_inappwebview, which is what makes the camera grant and the document-start bridge possible.
   • Minimum Flutter 3.24 / Dart 3.5.