Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 12 additions & 9 deletions auth0_flutter/lib/auth0_flutter_web.dart
Original file line number Diff line number Diff line change
Expand Up @@ -278,15 +278,15 @@ class Auth0Web {
/// RFC 8693 Token Exchange.
///
/// This method implements the OAuth 2.0 Token Exchange flow, allowing you to
/// exchange a token from an external provider for Auth0 tokens. This is useful
/// when integrating with external identity providers or custom authentication
/// systems.
/// exchange a token from an external provider for Auth0 tokens.
/// This is useful when integrating with external identity providers or
/// custom authentication systems.
///
/// **Parameters:**
///
/// * [subjectToken] (required) - The token being exchanged from the external
/// provider. For example, this might be a JWT from your custom authentication
/// system or another identity provider.
/// provider. For example, this might be a JWT from your
/// custom authentication system or another identity provider.
///
/// * [subjectTokenType] (required) - A URI identifying the type of the
/// subject token according to RFC 8693. Must be a namespaced URI under your
Expand All @@ -301,7 +301,8 @@ class Auth0Web {
///
/// * [audience] - Optional API identifier for which you want to receive an
/// access token. Must match exactly with an API identifier configured in
/// your Auth0 tenant. If not provided, falls back to the client's default audience.
/// your Auth0 tenant. If not provided, falls back to the client's default
/// audience.
///
/// * [scopes] - Optional set of scopes to request.
/// These scopes determine what permissions the resulting tokens will have.
Expand All @@ -316,13 +317,15 @@ class Auth0Web {
/// * `idToken` - The Auth0 ID token with user information
/// * `expiresAt` - When the access token expires
/// * `scopes` - The granted scopes
/// * `refreshToken` - Optional refresh token (if offline_access scope was requested)
/// * `refreshToken` - Optional refresh token
///
/// **Requirements:**
///
/// 1. Configure a Token Exchange profile in your Auth0 Dashboard
/// 2. Implement validation logic in an Auth0 Action to verify the external token
/// 3. Grant your Auth0 application the `urn:auth0:oauth2:grant-type:token-exchange` permission
/// 2. Implement validation logic in an Auth0 Action to verify the external
/// token
/// 3. Grant your Auth0 application the
/// `urn:auth0:oauth2:grant-type:token-exchange` permission
///
/// **Example:**
///
Expand Down
10 changes: 5 additions & 5 deletions auth0_flutter/lib/src/mobile/authentication_api.dart
Original file line number Diff line number Diff line change
Expand Up @@ -349,20 +349,20 @@ class AuthenticationApi {
scopes: scopes,
parameters: parameters)));

/// Performs a custom token exchange to obtain Auth0 credentials using an
/// Performs a custom token exchange to obtain Auth0 credentials using an
/// existing identity provider token.
///
/// This method allows you to exchange tokens from external identity providers
/// for Auth0 tokens, enabling seamless integration with existing authentication
/// systems.
/// for Auth0 tokens, enabling seamless integration with existing
/// authentication systems.
///
/// ## Endpoint
/// https://auth0.com/docs/api/authentication#token-exchange
///
/// ## Notes
///
/// * [subjectToken] is the token obtained from the external identity provider.
/// * [subjectTokenType] specifies the format of the subject token (e.g.,
/// * [subjectToken] the token obtained from the external identity provider.
Copy link

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The documentation for subjectToken is inconsistent with other parameter descriptions in this file. Other parameters use "- The" or similar prefix (e.g., "- The API identifier", "- Optional API identifier"), but this line uses just "the token". Consider changing to "- The token obtained from the external identity provider" for consistency.

Suggested change
/// * [subjectToken] the token obtained from the external identity provider.
/// * [subjectToken] The token obtained from the external identity provider.

Copilot uses AI. Check for mistakes.
/// * [subjectTokenType] specifies the format of the subject token (e.g.,
/// 'http://acme.com/legacy-token').
/// * [audience] relates to the API Identifier you want to reference in your
/// access tokens. See [API settings](https://auth0.com/docs/get-started/apis/api-settings)
Expand Down
3 changes: 2 additions & 1 deletion auth0_flutter/test/mobile/web_authentication_test.dart
Original file line number Diff line number Diff line change
Expand Up @@ -329,7 +329,8 @@ void main() {
expect(verificationResult.options.useHTTPS, true);
expect(verificationResult.options.returnTo, 'https://example.com/logout');
expect(verificationResult.options.federated, true);
expect(verificationResult.options.allowedBrowsers, ['com.android.chrome']);
expect(verificationResult.options.allowedBrowsers,
['com.android.chrome']);
});
});

Expand Down
3 changes: 2 additions & 1 deletion auth0_flutter/test/web/auth0_flutter_web_test.dart
Original file line number Diff line number Diff line change
Expand Up @@ -497,7 +497,8 @@ void main() {

for (final errorCase in errorCases) {
when(mockClientProxy.exchangeToken(any))
.thenThrow(createJsException(errorCase['code']!, errorCase['message']!));
.thenThrow(createJsException(errorCase['code']!,
errorCase['message']!));
Copy link

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The closing parenthesis on line 501 is not properly indented. It should align with the opening of the createJsException call on line 500, consistent with Dart formatting conventions.

Suggested change
errorCase['message']!));
errorCase['message']!));

Copilot uses AI. Check for mistakes.

await expectLater(
auth0.customTokenExchange(
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,9 @@ abstract class Auth0FlutterWebPlatform extends PlatformInterface {
}

Future<Credentials> customTokenExchange(final ExchangeTokenOptions options) {
throw UnimplementedError('web.customTokenExchange has not been implemented');
throw UnimplementedError(
'web.customTokenExchange has not been implemented'
);
Comment on lines +44 to +46
Copy link

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The closing parenthesis and semicolon for the UnimplementedError should be on the same line as the string message, consistent with the formatting of other UnimplementedError calls in the same file (see lines 21, 28, 32, 36, 40, and 56). The current formatting places them on a separate line without proper indentation.

Suggested change
throw UnimplementedError(
'web.customTokenExchange has not been implemented'
);
throw UnimplementedError('web.customTokenExchange has not been implemented');

Copilot uses AI. Check for mistakes.
}

Future<bool> hasValidCredentials() {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,11 @@
///
/// * [subjectToken] - The external token to be exchanged (required)
/// * [subjectTokenType] - A URI that indicates the type of the subject token,
Copy link

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The documentation for the subjectTokenType parameter is incomplete. Line 9 ends with a comma but doesn't provide a description of what this parameter represents, unlike the other parameters which have complete descriptions.

Suggested change
/// * [subjectTokenType] - A URI that indicates the type of the subject token,
/// * [subjectTokenType] - A URI that indicates the type of the subject token (required)

Copilot uses AI. Check for mistakes.
/// * [audience] - The API identifier for which the access token is requested (optional)
/// * [audience] - The API identifier for which the access token is
/// requested (optional)
/// * [scopes] - Set of OAuth scopes to request (optional)
/// * [organizationId] - organization ID or name of the organization to authenticate with (optional)
/// * [organizationId] - organization ID or name of the organization to
/// authenticate with (optional)
class ExchangeTokenOptions {
final String subjectToken;
final String subjectTokenType;
Expand Down
Loading