bapp_auth

Releases

1. ▸▾0.2.123 Mar 2026

   Updated bapp_api_client dependency from ^0.4.4 to ^0.5.0

   • Updated bapp_api_client dependency from ^0.4.4 to ^0.5.0

   Open source →
2. ▸▾0.2.023 Mar 2026

   BREAKING: Replaced built-in API client with `bapp_api_client` package

   • BREAKING: Replaced built-in API client with bapp_api_client package
     • Removed BappApiClient, ApiError, RetryConfig classes
     • Added dependency on bapp_api_client ^0.4.4
     • Re-exports BappApiClient and PagedList for convenience
   • New BappAuth orchestrator class
     • Single entry point for auth lifecycle: initialize → login → refresh → logout
     • Pre-configured BappApiClient with automatic bearer token injection
     • Reactive authStateStream for driving UI (initial, loading, authenticated, unauthenticated)
     • Configurable BAPP API host per project, fixed Keycloak hostname (id.bapp.ro)
   • New BappAuthConfig configuration
     • host: BAPP API base URL (configurable per project)
     • ssoAutoLogin: silent SSO login on initialize using prompt=none
     • sessionId: user-scoped token storage for shared devices (kiosk/POS)
   • Silent SSO with prompt=none
     • Non-interactive SSO passes prompt=none to Keycloak for instant response
     • No login form shown — if session exists, authenticates silently
     • Minimal browser flash on all platforms
   • Shared device support
     • sessionId scopes token storage per user (key: bapp_auth_token_{clientId}_{sessionId})
     • switchSession() method for switching users at runtime
     • Multiple users on same device never overwrite each other's tokens
   • AuthenticatedHttpClient
     • Transparent bearer token injection on all requests
     • Proactive refresh when token expiring within 30 seconds
     • Automatic retry on 498 (Token Expired) responses
     • Concurrent refresh prevention with lock
   • Android compatibility fix for flutter_web_auth_2 v5
     • Forces preferEphemeral: true on Android to trigger CustomTabsIntent fallback
     • Ensures compatibility with all Chrome versions (including Chrome 56+ on Android 7)
   • Bug fix: TokenResponse.fromJson now restores issuedAt
     • Previously, deserialized tokens always had issuedAt = DateTime.now(), making expired tokens appear valid
   • Updated dependencies: http ^1.6.0, flutter_web_auth_2 ^5.0.1, url_launcher ^6.3.2, crypto ^3.0.7
   • Integration tests: Cross-platform tests for macOS, iOS, Android (automated + interactive SSO)
   • 45 unit tests, 7 integration tests