From f0b32ff68b796f72e6c6b1e761c5afeffebc8a98 Mon Sep 17 00:00:00 2001 From: Jeroen Schweitzer Date: Sun, 4 Jan 2026 15:01:33 +0100 Subject: [PATCH] fix(auth): skip Flutter OIDC on web, rely on NPM forward auth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On web, NPM forward auth handles authentication at the proxy level. By the time the Flutter app loads, the user is already authenticated. Skip the redundant Flutter OIDC flow that was causing Riverpod "Ref disposed" errors from conflicting auth state updates. Mobile still uses Flutter's OIDC flow as before. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- CHANGELOG.md | 15 ++++++++------- lib/shared/layouts/app_scaffold.dart | 9 +++++++++ pubspec.yaml | 2 +- 3 files changed, 18 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 25cad49..06e5ea5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] -## [1.1.1] - 2026-01-04 +## [1.1.2] - 2026-01-04 + +### Changed +- **Web auth simplified**: Skip Flutter OIDC on web - NPM forward auth handles it + - NPM authenticates at proxy level before app loads + - No more redundant OIDC redirect after NPM auth completes + - Fixes "Cannot use Ref after disposed" error from conflicting auth flows + - Mobile still uses Flutter OIDC flow ### Added - Logout now redirects to Authentik to end SSO session @@ -15,12 +22,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Uses OIDC end_session_endpoint from discovery document - Redirects back to app after Authentik logout completes -### Fixed -- Fixed Riverpod lifecycle error in OIDC callback page - - "Cannot use the Ref of authProvider after it has been disposed" - - Store notifier reference before async gap to prevent disposed ref access - - Add mounted check at start of callback processing - ## [1.1.0] - 2026-01-04 ### Changed diff --git a/lib/shared/layouts/app_scaffold.dart b/lib/shared/layouts/app_scaffold.dart index ae4bd91..09f781f 100644 --- a/lib/shared/layouts/app_scaffold.dart +++ b/lib/shared/layouts/app_scaffold.dart @@ -1,3 +1,4 @@ +import 'package:flutter/foundation.dart' show kIsWeb; import 'package:flutter/material.dart'; import 'package:flutter_riverpod/flutter_riverpod.dart'; import 'package:go_router/go_router.dart'; @@ -45,6 +46,14 @@ class _AppScaffoldState extends ConsumerState { return _buildScaffold(context); } + // On web, NPM forward auth handles authentication at the proxy level. + // If we reach this point, the user is already authenticated by NPM. + // No need for Flutter's OIDC flow - just show the app. + if (kIsWeb) { + return _buildScaffold(context); + } + + // Mobile: Use Flutter's OIDC flow final authAsync = ref.watch(authProvider); return authAsync.when( diff --git a/pubspec.yaml b/pubspec.yaml index 4eb66a9..9f54dc3 100644 --- a/pubspec.yaml +++ b/pubspec.yaml @@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html # In Windows, build-name is used as the major, minor, and patch parts # of the product and file versions while build-number is used as the build suffix. -version: 1.1.1+1 +version: 1.1.2+1 environment: sdk: ^3.10.4