• [iOS][macOS] improved SPM (Swift Package Manager) compatibility

• Removed assertion around tied to idTokenHint and postLogoutRedirectUrl parameters passed to the EndSessionRequest constructor. This was done as both are optional according to the OIDC RP-initiated logout specification

• Breaking change updated minimum supported SDK version to Flutter 3.38.1/Dart 3.10. Consequently the minimum OS requirements for each platform has been updated as well
  • [Android] minimum Android version is now 7.0 (API level 24)
  • [iOS] minimum iOS version is now 13
  • [macOS] minimum macOS version is now 10.15
• Plugin and example app now adopt UISceneDelegate. Note that whilst migration required Flutter 3.38.0 as a minimum, I have set the minimum supported Flutter SDK version to 3.38.1. This was done as the Dart 3.10 SDK bundled with Flutter 3.38.0 was technically still a beta. The Dart 3.10 SDK bundled with Flutter 3.38.1 is considered stable

• Breaking change updated minimum supported SDK version to Flutter 3.38.1/Dart 3.10. Consequently the minimum OS requirements for each platform has been updated as well
  • [Android] minimum Android version is now 7.0 (API level 24)
  • [iOS] minimum iOS version is now 13
  • [macOS] minimum macOS version is now 10.15
• Plugin and example app now adopt UISceneDelegate. Note that whilst migration required Flutter 3.38.0 as a minimum, I have set the minimum supported Flutter SDK version to 3.38.1. This was done as the Dart 3.10 SDK bundled with Flutter 3.38.0 was technically still a beta. The Dart 3.10 SDK bundled with Flutter 3.38.1 is considered stable

• Added Prompt class that exposes standard prompt string values as defined in the OIDC specification. Thanks to the PR from Valentin Michalak
• Potentiallu breaking change [Android] plugin will now throw a PlatformException with a null_activity error code when plugin runs into a scenario where the bound Flutter activity has been detached/disposed. Thanks to the PR from Sam Costa

• Breaking change updated minimum supported SDK version to Flutter 3.29/Dart 3.7
• Bumped flutter_lints dev dependency
• [Android] Breaking changes updated compileSdkVersion to 35 and AGP to 8.6.0
• Updated Android setup section in readme with instructions for apps using Kotlin DSL. Thanks to the PR from LennartMart

• [iOS][macOS] bumped AppAuth iOS dependency to 2.0.0

• Breaking change updated minimum supported SDK version to Flutter 3.19/Dart 3.3
• [Android] Breaking changes updated compileSdkVersion to 33 and AGP to 8.0.1 to align with what's used by the AppAuth Android SDK
• [iOS][macOS] added Swift Package Manager support
• [iOS][macOS] Breaking changes a number of Objective-C headers that were public are now no longer public. This means that classes were defined on the native side of the plugin may now no longer visible. These changes likely don't affect users of the plugin as this is to do with APIs that can be accessed via Objective-C or Swift. These changes were done to add Swift Package Manager support
• Migrated Android side of example to use plugin DSL
• Bumped flutter_lints dev dependency
• Fixed typo in the code snippet shown in the End session section of the readme. Thanks to the PR from barryguvenkaya
• Updated readme to add a table of contents
• Updated links to tutorials associated with identity providers. The Auth0 one has been removed as their tutorial has changed to use a different SDK. A disclaimer has been added to warn that the content is managed by external parties and may also be out of date

• [iOS][macOS] bumped AppAuth iOS dependency to 1.7.6
• [iOS][macOS] BAD added Swift Package Manager support but "local" testing didn't uncover. This has been reverted by 8.0.3

• Fixed issue 568 where compilation could fail with a 'OIDExternalUserAgent.h' file not found error

• Breaking change Replaced the preferEphemeralSession property in the AuthorizationRequest, AuthorizationTokenRequest and EndSessionRequest classes with externalUserAgent. Thanks to the PR from john-slow. externalUserAgent is presented by the newly ExternalUserAgent enum that has the following values
  • asWebAuthenticationSession: uses the ASWebAuthenticationSession APIs where possible. This is the default value and was the default behaviour behaviour that aligns with what the AppAuth iOS SDK would do in choosing the best available user-agent
  • ephemeralAsWebAuthenticationSession: uses an ephemeral session via the ASWebAuthenticationSession APIs. Applications that previously used preferEphemeralSession and specified to be true can migrate by specifying this enum value
  • sfSafariViewController: uses the SFSafariViewController APIs
• Updated iOS plugin details to indicate it needs a minimum iOS version of 11.0. This aligns with the minimum best supported version for Flutter 3.13.0
• Updated macOS plugin details to indicate it needs a minimum iOS version of 10.14. This aligns with the minimum best supported version for Flutter 3.13.0
• [Android] some refactoring around code related to allowInsecureConnections has been done in response to issue 554
• [Android] added logic to help with issues like 205 where an app tries to refresh a token but the instances of AuthorizationService have been disposed
• [macOS] added privacy manifest file

7.0.1

• [iOS] correctly bumped AppAuth iOS dependency to 1.7.5. The 7.0.0 release mistakenly only bumped the dependency for macOS

7.0.0

• Breaking change Bumped minimum Flutter and Dart SDK constraints to 3.13.0 and 3.1.0 respectively
• Breaking change all methods have now been made to return non-nullable types
• [macOS] bumped AppAuth iOS dependency to 1.7.5
• Updated error handling to expose more details for each platform. Plugin will now throw FlutterAppAuthUserCancelledException when an authorization request has been cancelled as a result of the user closing the browser. For other scenarios the plugin will throw FlutterAppAuthPlatformException. See the API docs for both classes for more details on the available details. Both exception classes inherit from PlatformException so the changes should be backwards compatible
• Updated readme with more details on essential knowledge and links to OAuth 2.0 specifications

6.0.7

• [Android] updated plugin to specify Theme.AppCompat.Translucent.NoTitleBar as the theme for the RedirectUriReceiverActivity from the AppAuth Android SDK. This is to fix a crash raised with issues #362 and #515

6.0.6

• [iOS][macOS] bumped AppAuth iOS dependency to 1.7.4

6.0.5

• [iOS] bumped AppAuth iOS dependency to 1.7.2

6.0.4

• [Android] when no suitable browser is found when calling either authorize() or authorizeAndExchange(), rather than crashing the plugin will now throw a PlatformException with an error code of no_browser_available. Thanks to the PR from NikHomann
• Removed duplicate asterisk from the 6.0.3 changelog entry around how the example app got updated

6.0.3

• [Android] community has reported that there seem to be instances where the plugin encounters a null intent on some devices upon processing a end session request. This resulted in a crash before but will now throw a PlatformException. Thanks to the PR from John
• Updated example app so that the Android side specifies the minimum SDK version version that aligns with what's specified by the Flutter SDK

6.0.2+1

• [iOS] added privacy manifest

6.0.2

• [macOS] fixed deprecation warning around using init and to use initWithPresentingWindow via the AppAuth iOS/macOS SDK instead. Thanks to the PR from Ivan Tivonenko

6.0.1

• [iOS] updated plugin so it supports apps that leverage the multiple window capability that Apple added to iOS 13. Thanks to the PR from Jerold Albertson
• Added a link to the tutorials section of the readme that walks through how to use this plugin with Asgardeo. Thanks to the PR from Achintha Isuru

6.0.0

• Potentially breaking change [iOS][macOS] bumped AppAuth dependency to 1.6.2 where fixes were done to allow SDK to compile in Xcode 14 by bumping the minimum OS versions
• Bumped maximum Dart SDK constraint
• Recreated iOS and macOS side of example app so it would work with new Flutter 3.10 stable release

• Updated 8.0.0 as it was missing mention of the privacy manifest file to the macOS implementation of the plugin

• Breaking change Bumped minimum Flutter SDK version to 3.0.0 and Dart SDK version to 2.17
• [Android] removed references to v1 embedding
• [Android] updated compileSdkVersion to 31 (Android 12)
• [Android] bumped AGP (Android Gradle plugin) to 7.4.2
• [Android] conditionally adds a namespace for compatibility with AGP 8.0
  • Note: it's quite likely that the AppAuth Android SDK itself requires this change going forward but this change will ensure that the flutter_appauth plugin has done this change ahead of time
• Applied following updates to the example app on the Android side
  • Bumped AGP to 7.4.2 and Gradle 7.5
  • Used namespace instead of package identifier since the latter has been deprecated (reference: https://developer.android.com/build/releases/past-releases/agp-7-3-0-release-notes#package-deprecated). Note that as of this writing, using the flutter run command on the stable channel (i.e. Flutter version 3.7.1) to debug/run the app will in an error that says "package identifier or launch activity not found". However, an APK or app bundle can still be built and will run on a device. The Flutter team have already addressed this issue on the master channel that is currently on version 3.10.0-17.0.pre.21 so would expect the next stable release to contain the fix. Alternatively developers can manually restore the package identifier though this change was done to avoid issues from happening in the future

• Added comments to example app to explain how code challenge takes place per PKCE. Thanks to PR from Davide Ravasi
• Updated code for API docs to avoid lines longer than 80 characters

• [iOS][macOS] bumped AppAuth dependency to 1.6.0

• Added preferEphemeralSession to EndSessionRequest Thanks to the PR from Daniel Ziegler

• Added missing credit to 4.1.0 changelog entry
• Updated readme to remove Android setup step for setting queries in AndroidManifest.xml as that is now handled directly with the AppAuth Android SDK

• Added ability to specify the nonce as part of requests. Thanks to the PR from Tiernan

• Bumped AppAuth iOS dependency. Thanks to PR from Didier Prophete

• Added support for macOS. Thanks to the PR from Jordy Langen

• [iOS] fix nonce not being returned correctly on iOS

• Breaking change AuthorizationResponse's constructor now includes nonce and has changed to take positional parameters
• nonce can now be specified for TokenRequest class. This is especially useful on Android as the AppAuth Android SKD had turned on ID token validation that results in nonce mismatch errors. These errors should no longer appear when using the nonce value returned by the AuthorizationResponse object after calling authorize() and passing the value to the TokenRequest when calling the token() method
• Bumped AppAuth Android SDK to 0.11.1 where the SDK reports that it has fixed an issue where rotating device could lead to the SDK reporting that the user cancelled login flow

• Added const constructor to FlutterAppAuth

• Example app has been updated to point to the new demo IdentityServer instance

• [iOS] fixed issue with scopes not being sent correctly as they should've been space-delimited instead of comma-delimited. Thanks to the PR from Angle Wang

• Added scopes property to TokenResponse class and AuthorizationTokenResponse class that inherits from it. Thanks to PR from leoshusar
• [Android] applied fix to a scenario where skipping https check on the issuer wasn't done for refreshing tokens. Thanks to the PR from Javier Puerto

• [Android] claims can now be passed as part of the additionalParameters included with requests without triggering an exception by the AppAuth Android SDK. Thanks to the PR from Garry Jeromson

• [Android] updated error handling so more details are returned. Thanks to Andreas Kägi for originally starting on the PR

• Fix grammar in 2.1.0 changelog entry

• [Android] ui_locales can now be passed as part of the additionalParameters included with requests without triggering an exception by the AppAuth Android SDK. Thanks to the PR from dimitristoz

• Breaking change AuthorizationServiceConfiguration constructor has changed to take named parameters
• Added endSession() method, EndSessionRequest and EndSessionResponse classes to support end session requests
• [Android] skips https issuer check if allowInsecureConnections is true. Thanks to the PR from Roman Fürst
• Bumped AppAuth Android and iOS SDK dependencies
• Added FAQs section to readme to describe a common iOS issue with Azure B2C and Azure AD