[google_sign_in] Redesign API for current identity SDKs #9267
+1,504
−1,173
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| # Migrating from `google_sign_in` 6.x to 7.x | ||
|
|
||
| The API of `google_sign_in` 6.x and earlier was designed for the Google Sign-In | ||
| SDK, which has been deprecated on both Android and Web, and replaced with new | ||
| SDKs that have significantly different structures. As a result, the | ||
| `google_sign_in` API surface has changed significantly. Notable differences | ||
| include: | ||
| * `GoogleSignIn` is now a singleton, which is obtained via | ||
| `GoogleSignIn.instance`. In practice, creating multiple `GoogleSignIn` | ||
| instances in 6.x would not work correctly, so this just enforces an existing | ||
| restriction. | ||
| * There is now an explicit `initialize` step that must be called exactly once, | ||
| before any other methods. On some platforms the future will complete almost | ||
| immediately, but on others (for example, web) it may take some time. | ||
| * The plugin no longer tracks a single "current" signed in user. Instead, | ||
| applications that assume a single signed in user should track this at the | ||
| application level using the `authenticationEvents` stream. | ||
| * Authentication (signing in) and authorization (allowing access to user data | ||
| in the form of scopes) are now separate steps. Recommended practice is to | ||
| authenticate as soon as it makes sense for a user to potentially be signed in, | ||
| but to delay authorization until the point where the data will actually be | ||
| used. | ||
| * In applications where these steps should happen at the same time, you can | ||
| pass a `scopeHint` during the authentication step. On platforms that support | ||
| it this allows for a combined authentication and authorization UI flow. | ||
| Not all platforms allow combining these flows, so your application should be | ||
| prepared to trigger a separate authorization prompt if necessary. | ||
| * Authorization is further separated into client and server authorization. | ||
| Applications that need a `serverAuthCode` must now call a separate method, | ||
| `authorizeServer`, to obtain that code. | ||
| * Client authorization is handled via two new methods: | ||
| * `authorizationForScopes`, which returns an access token if the requested | ||
| scopes are already authorized, or null if not, and | ||
| * `authorizeScopes`, which requests that the user authorize the scopes, and | ||
| is expected to show UI. | ||
|
|
||
| Clients should generally attempt to get tokens via `authorizationForScopes`, | ||
| and if they are unable to do so, show some UI to request authoriaztion that | ||
| calls `authorizeScopes`. This is similar to the previously web-only flow | ||
| of calling `canAccessScopes` and then calling `addScopes` if necessary. | ||
| * `signInSilently` has been replaced with `attemptLightweightAuthentication`. | ||
| The intended usage is essentially the same, but the change reflects that it | ||
| is no longer guaranteed to be silent. For example, as of the publishing of | ||
| 7.0, on web this may show a floating sign-in card, and on Android it may show | ||
| an account selection sheet. | ||
| * This new method is no longer guaranteed to return a future. This allows | ||
| clients to distinguish, at runtime: | ||
| * platforms where a definitive "signed in" or "not signed in" response | ||
| can be returned quickly, and thus `await`-ing completion is reasonable, | ||
| in which case a `Future` is returned, and | ||
| * platforms (such as web) where it could take an arbitrary amount of time, | ||
| in which case no `Future` is returned, and clients should assume a | ||
| non-signed-in state until/unless a sign-in event is eventually posted to | ||
| the `authenticationEvents` stream. | ||
| * `authenticate` replaces the authentication portion of `signIn` on platforms | ||
| that support it (see below). | ||
| * The new `supportsAuthenticate` method allows clients to determine at runtime | ||
| whether the `authenticate` method is supported, as some platforms do not allow | ||
| custom UI to trigger explicit authentication. These platforms instead provide | ||
| some other platform-specific way of triggering authentication. As of | ||
| publishing, the only platform that does not support `authenticate` is web, | ||
| where `google_sign_in_web`'s `renderButton` is used to create a sign-in | ||
| button. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -12,21 +12,22 @@ import 'package:flutter/material.dart'; | ||
| import 'package:google_sign_in/google_sign_in.dart'; | ||
| import 'package:http/http.dart' as http; | ||
|
|
||
| import 'src/web_wrapper.dart' as web; | ||
|
|
||
| /// To run this example, replace this value with your client ID, and/or | ||
| /// update the relevant configuration files, as described in the README. | ||
| String? clientId; | ||
|
|
||
| /// To run this example, replace this value with your server client ID, and/or | ||
| /// update the relevant configuration files, as described in the README. | ||
| String? serverClientId; | ||
|
|
||
| /// The scopes required by this application. | ||
| // #docregion CheckAuthorization | ||
| const List<String> scopes = <String>[ | ||
| 'https://www.googleapis.com/auth/contacts.readonly', | ||
| ]; | ||
| // #enddocregion CheckAuthorization | ||
|
|
||
| void main() { | ||
| runApp( | ||
| @@ -50,58 +51,102 @@ class _SignInDemoState extends State<SignInDemo> { | ||
| GoogleSignInAccount? _currentUser; | ||
| bool _isAuthorized = false; // has granted permissions? | ||
| String _contactText = ''; | ||
| String _errorMessage = ''; | ||
| String _serverAuthCode = ''; | ||
|
|
||
| @override | ||
| void initState() { | ||
| super.initState(); | ||
|
|
||
| // #docregion Setup | ||
| final GoogleSignIn signIn = GoogleSignIn.instance; | ||
|
There was a problem hiding this comment. Hmm this reminds me of flutter/flutter#168100, if the user connects / disconnects a mouse / keyboard on Android the activity will restart and that would result in the element tree being re-inflated anew. I guess that does not break the new flow (from reading the docs There was a problem hiding this comment. Or when the activity restarts, the lightweight authentication path will be taken and the flow will typically be invisible to user / require no additional user interactions? EDIT: Just read the design doc and it mentioned "Fully silent sign in is no longer available" There was a problem hiding this comment.
That's up to whether the app developer chooses to include auth state in their state restoration.
That's up to the app developer too. There was a problem hiding this comment.
Oh I thought the developer would have to restore GoogleSignIn, and state restoration only supports value types. If the dart part of GoogleSignIn doesn't keep any secret state itself then that makes sense. |
||
| unawaited(signIn | ||
| .initialize(clientId: clientId, serverClientId: serverClientId) | ||
| .then((_) { | ||
| signIn.authenticationEvents | ||
| .listen(_handleAuthenticationEvent) | ||
| .onError(_handleAuthenticationError); | ||
|
|
||
| /// This example always uses the stream-based approach to determining | ||
| /// which UI state to show, rather than using the future returned here, | ||
| /// if any, to conditionally skip directly to the signed-in state. | ||
| signIn.attemptLightweightAuthentication(); | ||
| })); | ||
| // #enddocregion Setup | ||
| } | ||
|
|
||
| Future<void> _handleAuthenticationEvent( | ||
| GoogleSignInAuthenticationEvent event) async { | ||
| // #docregion CheckAuthorization | ||
| final GoogleSignInAccount? user = // ... | ||
| // #enddocregion CheckAuthorization | ||
| switch (event) { | ||
| GoogleSignInAuthenticationEventSignIn() => event.user, | ||
| GoogleSignInAuthenticationEventSignOut() => null, | ||
| }; | ||
|
|
||
| // Check for existing authorization. | ||
| // #docregion CheckAuthorization | ||
| final GoogleSignInClientAuthorization? authorization = | ||
| await user?.authorizationClient.authorizationForScopes(scopes); | ||
| // #enddocregion CheckAuthorization | ||
|
|
||
| setState(() { | ||
| _currentUser = user; | ||
| _isAuthorized = authorization != null; | ||
| _errorMessage = ''; | ||
| }); | ||
|
|
||
| // If the user has already granted access to the required scopes, call the | ||
| // REST API. | ||
| if (user != null && authorization != null) { | ||
| unawaited(_handleGetContact(user)); | ||
| } | ||
| } | ||
|
|
||
| Future<void> _handleAuthenticationError(Object e) async { | ||
| setState(() { | ||
| _currentUser = null; | ||
| _isAuthorized = false; | ||
| _errorMessage = e is GoogleSignInException | ||
| ? 'GoogleSignInException ${e.code}: ${e.description}' | ||
| : 'Unknown error: $e'; | ||
| }); | ||
| } | ||
|
|
||
| // Calls the People API REST endpoint for the signed-in user to retrieve information. | ||
| Future<void> _handleGetContact(GoogleSignInAccount user) async { | ||
| setState(() { | ||
| _contactText = 'Loading contact info...'; | ||
| }); | ||
| final Map<String, String>? headers = | ||
| await user.authorizationClient.authorizationHeaders(scopes); | ||
| if (headers == null) { | ||
| setState(() { | ||
| _contactText = ''; | ||
| _errorMessage = 'Failed to construct authorization headers.'; | ||
| }); | ||
| return; | ||
| } | ||
| final http.Response response = await http.get( | ||
| Uri.parse('https://people.googleapis.com/v1/people/me/connections' | ||
| '?requestMask.includeField=person.names'), | ||
| headers: headers, | ||
| ); | ||
| if (response.statusCode != 200) { | ||
| if (response.statusCode == 401 || response.statusCode == 403) { | ||
| setState(() { | ||
| _isAuthorized = false; | ||
| _errorMessage = 'People API gave a ${response.statusCode} response. ' | ||
| 'Please re-authorize access.'; | ||
| }); | ||
| } else { | ||
| print('People API ${response.statusCode} response: ${response.body}'); | ||
| setState(() { | ||
| _contactText = 'People API gave a ${response.statusCode} ' | ||
| 'response. Check logs for details.'; | ||
| }); | ||
| } | ||
| return; | ||
| } | ||
| final Map<String, dynamic> data = | ||
| @@ -136,94 +181,147 @@ class _SignInDemoState extends State<SignInDemo> { | ||
| return null; | ||
| } | ||
|
|
||
| // Prompts the user to authorize `scopes`. | ||
| // | ||
| // If authorizationRequiresUserInteraction() is true, this must be called from | ||
| // a user interaction (button click). In this example app, a button is used | ||
| // regardless, so authorizationRequiresUserInteraction() is not checked. | ||
| Future<void> _handleAuthorizeScopes(GoogleSignInAccount user) async { | ||
| try { | ||
| // #docregion RequestScopes | ||
| final GoogleSignInClientAuthorization authorization = | ||
| await user.authorizationClient.authorizeScopes(scopes); | ||
| // #enddocregion RequestScopes | ||
|
|
||
| // The returned tokens are ignored since _handleGetContact uses the | ||
| // authorizationHeaders method to re-read the token cached by | ||
| // authorizeScopes. The code above is used as a README excerpt, so shows | ||
| // the simpler pattern of getting the authorization for immediate use. | ||
| // That results in an unused variable, which this statement suppresses | ||
| // (without adding an ignore: directive to the README excerpt). | ||
| // ignore: unnecessary_statements | ||
| authorization; | ||
|
|
||
| setState(() { | ||
| _isAuthorized = true; | ||
| _errorMessage = ''; | ||
| }); | ||
| unawaited(_handleGetContact(_currentUser!)); | ||
| } on GoogleSignInException catch (e) { | ||
| _errorMessage = 'GoogleSignInException ${e.code}: ${e.description}'; | ||
| } | ||
| } | ||
|
|
||
| // Requests a server auth code for the authorized scopes. | ||
| // | ||
| // If authorizationRequiresUserInteraction() is true, this must be called from | ||
| // a user interaction (button click). In this example app, a button is used | ||
| // regardless, so authorizationRequiresUserInteraction() is not checked. | ||
| Future<void> _handleGetAuthCode(GoogleSignInAccount user) async { | ||
| try { | ||
| // #docregion RequestServerAuth | ||
| final GoogleSignInServerAuthorization? serverAuth = | ||
| await user.authorizationClient.authorizeServer(scopes); | ||
| // #enddocregion RequestServerAuth | ||
|
|
||
| setState(() { | ||
| _serverAuthCode = serverAuth == null ? '' : serverAuth.serverAuthCode; | ||
| }); | ||
| } on GoogleSignInException catch (e) { | ||
| _errorMessage = 'GoogleSignInException ${e.code}: ${e.description}'; | ||
| } | ||
| } | ||
|
|
||
| Future<void> _handleSignOut() async { | ||
| // Disconnect instead of just signing out, to reset the example state as | ||
| // much as possible. | ||
| await GoogleSignIn.instance.disconnect(); | ||
| } | ||
|
|
||
| Widget _buildBody() { | ||
| final GoogleSignInAccount? user = _currentUser; | ||
| return Column( | ||
| mainAxisAlignment: MainAxisAlignment.spaceAround, | ||
| children: <Widget>[ | ||
| if (user != null) | ||
| ..._buildAuthenticatedWidgets(user) | ||
| else | ||
| ..._buildUnauthenticatedWidgets(), | ||
| if (_errorMessage.isNotEmpty) Text(_errorMessage), | ||
| ], | ||
| ); | ||
| } | ||
|
|
||
| /// Returns the list of widgets to include if the user is authenticated. | ||
| List<Widget> _buildAuthenticatedWidgets(GoogleSignInAccount user) { | ||
| return <Widget>[ | ||
| // The user is Authenticated. | ||
| ListTile( | ||
| leading: GoogleUserCircleAvatar( | ||
| identity: user, | ||
| ), | ||
| title: Text(user.displayName ?? ''), | ||
| subtitle: Text(user.email), | ||
| ), | ||
| const Text('Signed in successfully.'), | ||
| if (_isAuthorized) ...<Widget>[ | ||
| // The user has Authorized all required scopes. | ||
| if (_contactText.isNotEmpty) Text(_contactText), | ||
| ElevatedButton( | ||
| child: const Text('REFRESH'), | ||
| onPressed: () => _handleGetContact(user), | ||
| ), | ||
| if (_serverAuthCode.isEmpty) | ||
| ElevatedButton( | ||
| child: const Text('REQUEST SERVER CODE'), | ||
| onPressed: () => _handleGetAuthCode(user), | ||
| ) | ||
| else | ||
| Text('Server auth code:\n$_serverAuthCode'), | ||
| ] else ...<Widget>[ | ||
| // The user has NOT Authorized all required scopes. | ||
| const Text('Authorization needed to read your contacts.'), | ||
| ElevatedButton( | ||
| onPressed: () => _handleAuthorizeScopes(user), | ||
| child: const Text('REQUEST PERMISSIONS'), | ||
| ), | ||
| ], | ||
| ElevatedButton( | ||
| onPressed: _handleSignOut, | ||
| child: const Text('SIGN OUT'), | ||
| ), | ||
| ]; | ||
| } | ||
|
|
||
| /// Returns the list of widgets to include if the user is not authenticated. | ||
| List<Widget> _buildUnauthenticatedWidgets() { | ||
| return <Widget>[ | ||
| const Text('You are not currently signed in.'), | ||
| // #docregion ExplicitSignIn | ||
| if (GoogleSignIn.instance.supportsAuthenticate()) | ||
| ElevatedButton( | ||
| onPressed: () async { | ||
| try { | ||
| await GoogleSignIn.instance.authenticate(); | ||
| } catch (e) { | ||
| // #enddocregion ExplicitSignIn | ||
| _errorMessage = e.toString(); | ||
| // #docregion ExplicitSignIn | ||
| } | ||
| }, | ||
| child: const Text('SIGN IN'), | ||
| ) | ||
| else ...<Widget>[ | ||
| if (kIsWeb) | ||
| web.renderButton() | ||
| // #enddocregion ExplicitSignIn | ||
| else | ||
| const Text( | ||
| 'This platform does not have a known authentication method') | ||
|
Comment on lines
+319
to
+320
There was a problem hiding this comment. This exposes the biggest flaw in the |
||
| // #docregion ExplicitSignIn | ||
| ] | ||
| // #enddocregion ExplicitSignIn | ||
| ]; | ||
| } | ||
|
|
||
| @override | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| // Copyright 2013 The Flutter Authors. All rights reserved. | ||
| // Use of this source code is governed by a BSD-style license that can be | ||
| // found in the LICENSE file. | ||
|
|
||
| export 'package:google_sign_in_web/web_only.dart'; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| // Copyright 2013 The Flutter Authors. All rights reserved. | ||
| // Use of this source code is governed by a BSD-style license that can be | ||
| // found in the LICENSE file. | ||
|
|
||
| import 'package:flutter/foundation.dart'; | ||
|
|
||
| import '../google_sign_in.dart'; | ||
|
|
||
| export 'package:google_sign_in_platform_interface/google_sign_in_platform_interface.dart' | ||
| show GoogleSignInException; | ||
|
|
||
| /// A base class for authentication event streams. | ||
| @immutable | ||
| sealed class GoogleSignInAuthenticationEvent { | ||
|
There was a problem hiding this comment. Are these classes needed? It seems the sealed type is a glorified There was a problem hiding this comment. Originally there were three subclasses, but exceptions moved into It would make things less self-documenting though. It's non-obvious that getting There was a problem hiding this comment. I was thinking maybe we can avoid introducing new classes by using typedef or extension types. I played with that idea but found the resulting code harder to read (the user code would still be the same though). So never mind. |
||
| const GoogleSignInAuthenticationEvent(); | ||
| } | ||
|
|
||
| /// A sign-in event, corresponding to an authentication flow completing | ||
| /// successfully. | ||
| @immutable | ||
| class GoogleSignInAuthenticationEventSignIn | ||
| extends GoogleSignInAuthenticationEvent { | ||
| /// Creates an event for a successful sign in. | ||
| const GoogleSignInAuthenticationEventSignIn({required this.user}); | ||
|
|
||
| /// The user that was authenticated. | ||
| final GoogleSignInAccount user; | ||
| } | ||
|
|
||
| /// A sign-out event, corresponding to a user having been signed out. | ||
| /// | ||
| /// Implicit sign-outs (for example, due to server-side authentication | ||
| /// revocation, or timeouts) are not guaranteed to send events. | ||
| @immutable | ||
| class GoogleSignInAuthenticationEventSignOut | ||
| extends GoogleSignInAuthenticationEvent {} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| // Copyright 2013 The Flutter Authors. All rights reserved. | ||
| // Use of this source code is governed by a BSD-style license that can be | ||
| // found in the LICENSE file. | ||
|
|
||
| import 'package:flutter/foundation.dart'; | ||
|
|
||
| /// Holds authentication tokens. | ||
| /// | ||
| /// Currently there is only an idToken, but this wrapper class allows for the | ||
| /// posibility of adding additional information in the future without breaking | ||
| /// changes. | ||
| @immutable | ||
| class GoogleSignInAuthentication { | ||
| /// Creates a new token container with the given tokens. | ||
| const GoogleSignInAuthentication({required this.idToken}); | ||
|
|
||
| /// An OpenID Connect ID token that identifies the user. | ||
| final String? idToken; | ||
|
|
||
| @override | ||
| String toString() => 'GoogleSignInAuthentication: $idToken'; | ||
| } | ||
|
|
||
| /// Holds client authorization tokens. | ||
| /// | ||
| /// Currently there is only an accessToken, but this wrapper class allows for | ||
| /// the posibility of adding additional information in the future without | ||
| /// breaking changes. | ||
| @immutable | ||
| class GoogleSignInClientAuthorization { | ||
| /// Creates a new token container with the given tokens. | ||
| const GoogleSignInClientAuthorization({required this.accessToken}); | ||
|
|
||
| /// The OAuth2 access token to access Google services. | ||
| final String accessToken; | ||
|
|
||
| @override | ||
| String toString() => 'GoogleSignInClientAuthorization: $accessToken'; | ||
| } | ||
|
|
||
| /// Holds server authorization tokens. | ||
| /// | ||
| /// Currently there is only a serverAuthCode, but this wrapper class allows for | ||
| /// the posibility of adding additional information in the future without | ||
| /// breaking changes. | ||
| @immutable | ||
| class GoogleSignInServerAuthorization { | ||
| /// Creates a new token container with the given tokens. | ||
| const GoogleSignInServerAuthorization({required this.serverAuthCode}); | ||
|
|
||
| /// Auth code to provide to a backend server to exchange for access or | ||
| /// refresh tokens. | ||
| final String serverAuthCode; | ||
|
|
||
| @override | ||
| String toString() => 'GoogleSignInServerAuthorization: $serverAuthCode'; | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Upon re-reading this... is this paragraph is a little bit incomplete? IIRC The authentication token (idToken) is also not refreshed, so both authorization and authentication end up expiring, right?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks that way. I can adjust the README accordingly, but maybe you just didn't mention it because normally (IIUC) clients don't need to keep using ID tokens they way they do access tokens.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added a similar note in the authentication section, but pointing out that for authentication generally you should only need to use
idTokenwhen it's first received.