Finding out if a user is signed in *without* authenticating them if they're not. about simple_auth

[Clancey]

I totally understand what your'e saying. The main thing with simple auth is to hide the authentication. The authenticate method isn't even really needed. If you make api calls it will present the UI only if needed. Presenting UI is a last resort. If you ever get a user from loadAccount then the UI should never show again. It is possible, but shouldn't happen if the services does proper OAuth. I really think at this point it complicates things by optimizing for an edge case that is super rare.

Also, I wish I could use private methods. What I really need is protected methods. With dart, if you make it private subclasses cannot call them. This means there is more surface area than I would like since I need to keep the internals public.

[C-Alexander]

I totally understand what your'e saying. The main thing with simple auth is to hide the authentication. The authenticate method isn't even really needed. If you make api calls it will present the UI only if needed. Presenting UI is a last resort. If you ever get a user from loadAccount then the UI should never show again. It is possible, but shouldn't happen if the services does proper OAuth. I really think at this point it complicates things by optimizing for an edge case that is super rare.

Also, I wish I could use private methods. What I really need is protected methods. With dart, if you make it private subclasses cannot call them. This means there is more surface area than I would like since I need to keep the internals public.

Fair enough. 👍

You should consider getting active on the gitter if you haven't, people are pretty eager to help if you bump into something like that. E.g. you can definitely use private methods, they're "package private" by default in the sense of allowing anything in the file to access them, but also anything that is "part" of the file.

This "part" system is very generous, you use it right now for the api definitions, but it can also be used to extend and override even flutter itself. In the long run they'd like to replace it with something slightly more restricted, but it should help you code more C#-like I reckon.

[Clancey]

So By design, the UI only shows if needed. How I gave traditionally handled this in my app, was a save a user preference for if they have signed in, set that to true on first login.

Now, Simple Auth can tell you if the user has logged in, and it can be exposed. For most OAuth API's you will never need to show the UI again. Unless something catastrophic happens.

If you call the following method, it will return a user account. If there is an account, then the user has logged in before. It is what the underlying API does as show here. If needed this can be exposed in a better manner.

[C-Alexander]

Yeah I noticed that method, but noticed that it was commented not to call it.

Right now things are very interwoven - if you want to know if you have a valid token after you have to call .valid which works fine, but it seems you can't for example refresh it/confirm it still works without also potentially prompting the user to login.

I've worked around it for now, but just putting in my two cents there -- I feel like decoupling the specific methods to private methods and then moving the base usecase (do or login) methods together with optional parameters or more advanced methods hidden deeper in might make SimpleAuth more simple (by hiding the complexity completely) and also enable more specific/custom flows.

But I can definitely be wrong in that, and probably am... Just my view looking at the experience I remember from other apps

Edit: Thanks a ton for responding by the way, I think it's really nice you made this library and bother to respond as well!