jpmschweitzer/tatlock-ui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

chore: release v1.0.5
Build and Push / release (push) Successful in 3s
Details
Build and Push / build (push) Successful in 3m0s
Details

Browse Source 
Web authentication now uses OIDC Authorization Code flow with PKCE
instead of NPM forward auth. Added callback route and web utilities.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Jeroen Schweitzer
2026-01-04 12:01:42 +01:00
co-authored by Claude Opus 4.5
parent 45de2591a7
commit 9c41a8805d
10 changed files with 502 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/routing/app_router.dart
+148 -30
View File
@@ -1,4 +1,3 @@
import 'package:flutter/foundation.dart' show kIsWeb;
import 'package:flutter/material.dart';
import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:go_router/go_router.dart';
@@ -18,6 +17,7 @@ abstract class AppRoutes {
static const parlor = '/parlor';
static const settings = '/settings';
static const login = '/login';
static const callback = '/callback';
}
/// Provides the GoRouter instance.
@@ -47,6 +47,11 @@ GoRouter appRouter(Ref ref) {
return AppRoutes.frontHall;
}
// Allow callback route through without auth check
if (state.matchedLocation == AppRoutes.callback) {
return null;
}
return null;
},
routes: [
@@ -56,6 +61,17 @@ GoRouter appRouter(Ref ref) {
name: 'login',
builder: (context, state) => const _LoginPage(),
),
// OIDC callback route (handles auth code exchange)
GoRoute(
path: AppRoutes.callback,
name: 'callback',
builder: (context, state) => _OidcCallbackPage(
code: state.uri.queryParameters['code'],
callbackState: state.uri.queryParameters['state'],
error: state.uri.queryParameters['error'],
errorDescription: state.uri.queryParameters['error_description'],
),
),
// Main app routes (inside shell with app scaffold)
ShellRoute(
builder: (context, state, child) => AppScaffold(child: child),
@@ -185,32 +201,7 @@ class _LoginPage extends ConsumerWidget {
}
Widget _buildSignInContent(BuildContext context, WidgetRef ref) {
if (kIsWeb) {
// Web: User needs to access via authenticated proxy
return Column(
children: [
Text(
'Please access Tatlock via the authenticated URL.\n'
'If you see this page, the proxy authentication may not be configured.',
style: Theme.of(context).textTheme.bodyMedium?.copyWith(
color: Theme.of(context).colorScheme.onSurfaceVariant,
),
textAlign: TextAlign.center,
),
const SizedBox(height: 16),
OutlinedButton.icon(
onPressed: () => ref.read(authProvider.notifier).signIn(),
icon: const Icon(Icons.refresh),
label: const Text('Retry'),
style: OutlinedButton.styleFrom(
minimumSize: const Size(double.infinity, 48),
),
),
],
);
}
// Mobile: Show sign in button
// Same sign in button for both web and mobile
return FilledButton.icon(
onPressed: () => ref.read(authProvider.notifier).signIn(),
icon: const Icon(Icons.login),
@@ -266,9 +257,136 @@ class _LoginPage extends ConsumerWidget {
if (message.contains('network')) {
return 'Network error. Please check your connection.';
}
if (message.contains('authenticated URL')) {
return 'Not authenticated - please access via the authenticated URL';
}
return 'Authentication failed. Please try again.';
}
}
/// OIDC callback page that handles the authorization code exchange.
class _OidcCallbackPage extends ConsumerStatefulWidget {
const _OidcCallbackPage({
this.code,
this.callbackState,
this.error,
this.errorDescription,
});
final String? code;
final String? callbackState;
final String? error;
final String? errorDescription;
@override
ConsumerState<_OidcCallbackPage> createState() => _OidcCallbackPageState();
}
class _OidcCallbackPageState extends ConsumerState<_OidcCallbackPage> {
bool _isProcessing = true;
String? _error;
@override
void initState() {
super.initState();
_processCallback();
}
Future<void> _processCallback() async {
// Check for error from Authentik
if (widget.error != null) {
setState(() {
_isProcessing = false;
_error = widget.errorDescription ?? widget.error;
});
return;
}
// Check for required parameters
if (widget.code == null || widget.callbackState == null) {
setState(() {
_isProcessing = false;
_error = 'Invalid callback - missing code or state parameter';
});
return;
}
// Exchange code for tokens
try {
await ref.read(authProvider.notifier).handleOidcCallback(
widget.code!,
widget.callbackState!,
);
// Navigate to home on success
if (mounted) {
context.go(AppRoutes.frontHall);
}
} catch (e) {
if (mounted) {
setState(() {
_isProcessing = false;
_error = e.toString();
});
}
}
}
@override
Widget build(BuildContext context) {
final colorScheme = Theme.of(context).colorScheme;
return Scaffold(
body: Center(
child: ConstrainedBox(
constraints: const BoxConstraints(maxWidth: 400),
child: Card(
child: Padding(
padding: const EdgeInsets.all(32),
child: Column(
mainAxisSize: MainAxisSize.min,
children: [
Icon(
_error != null ? Icons.error_outline : Icons.home_work_outlined,
size: 64,
color: _error != null ? colorScheme.error : colorScheme.primary,
),
const SizedBox(height: 24),
Text(
_error != null ? 'Authentication Failed' : 'Signing in...',
style: Theme.of(context).textTheme.headlineMedium?.copyWith(
fontWeight: FontWeight.w600,
),
),
const SizedBox(height: 16),
if (_isProcessing)
const CircularProgressIndicator()
else if (_error != null) ...[
Container(
padding: const EdgeInsets.all(12),
decoration: BoxDecoration(
color: colorScheme.errorContainer,
borderRadius: BorderRadius.circular(8),
),
child: Text(
_error!,
style: TextStyle(color: colorScheme.onErrorContainer),
textAlign: TextAlign.center,
),
),
const SizedBox(height: 16),
OutlinedButton.icon(
onPressed: () => context.go(AppRoutes.login),
icon: const Icon(Icons.arrow_back),
label: const Text('Back to Login'),
style: OutlinedButton.styleFrom(
minimumSize: const Size(double.infinity, 48),
),
),
],
],
),
),
),
),
),
);
}
}