zuraffa_auth_macos 1.1.0
zuraffa_auth_macos: ^1.1.0 copied to clipboard
macOS adapter for zuraffa_auth — local-authorization provider and data-protection Keychain store with partition-scoped writes.
zuraffa_auth_macos #
macOS adapter for zuraffa_auth — local-authorization sign-in (LocalAuthentication-shaped) and data-protection Keychain session persistence over one injected channel seam.
Pure Dart: the native embedder is a documented method/error protocol, not a dependency.
final channel = MacosAuthChannel(invoke: myTransport.invoke);
final auth = AuthService(
providers: [
MacosCredentialAuthProvider(
channel: channel,
context: MacosAuthContext(bundleId: 'com.example.app', teamId: 'T34M'),
),
],
sessions: MacosKeychainSessionStore(channel: channel, context: context),
);
// or:
registerMacosAuthDependencies(getIt, channel: channel);
Channel protocol #
| Method | Args | Result | Errors |
|---|---|---|---|
authorize |
identifier, secret, extras, bundleId, teamId, dataProtection |
token payload + subject, displayName?, email? |
see below |
refreshCredential |
token fields + context + flavor | token payload | see below |
revokeCredential |
accessToken + context + flavor |
any (best-effort) | swallowed |
secureWrite |
key, value (JSON), dataProtection, partitions |
any | typed |
secureRead |
key, dataProtection |
{value: String?} |
typed |
secureKeys |
prefix, dataProtection |
{keys: [String]} |
typed |
secureDelete |
key, dataProtection |
{deleted: bool} |
typed |
Errors arrive as {'error': {'code', 'message'}} payloads (or thrown
transport failures → channel_error). Taxonomy: no_credentials → typed
invalid_credentials; user_cancelled / interaction_not_allowed /
timeout → recoverable; keychain_unavailable / entitlement_missing and
unknown codes → non-recoverable, preserved verbatim.
Keychain flavor #
Every call carries the declared dataProtection flag (default true — the
modern data-protection keychain, not the legacy file-based one) and every
write is partition-scoped to the context's bundleId.