feat: app Flutter GameManager (OIDC pocket-id, contrôle serveurs, MOTD live, auto-update) + CI APK signée

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-13 09:13:55 +02:00
parent 2c5476b1db
commit 3286640b37
14 changed files with 969 additions and 0 deletions
@@ -0,0 +1,70 @@
+import 'package:flutter_appauth/flutter_appauth.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
+import '../config.dart';
+
+/// Authentification OIDC pocket-id (Authorization Code + PKCE, client public).
+/// Le jeton d'identité (JWT) est stocké de façon sécurisée et envoyé à l'API.
+class AuthService {
+  final _appAuth = const FlutterAppAuth();
+  final _storage = const FlutterSecureStorage();
+
+  static const _kIdToken = 'id_token';
+  static const _kRefresh = 'refresh_token';
+  static const _kExpiry = 'access_expiry';
+
+  Future<String?> get idToken => _storage.read(key: _kIdToken);
+
+  Future<bool> isLoggedIn() async => (await idToken) != null;
+
+  Future<bool> login() async {
+    final result = await _appAuth.authorizeAndExchangeCode(
+      AuthorizationTokenRequest(
+        Config.oidcClientId,
+        Config.oidcRedirect,
+        issuer: Config.oidcIssuer,
+        scopes: Config.oidcScopes,
+        promptValues: ['login'],
+      ),
+    );
+    if (result.idToken == null) return false;
+    await _storage.write(key: _kIdToken, value: result.idToken);
+    await _storage.write(key: _kRefresh, value: result.refreshToken);
+    await _storage.write(
+      key: _kExpiry,
+      value: result.accessTokenExpirationDateTime?.toIso8601String(),
+    );
+    return true;
+  }
+
+  /// Rafraîchit le jeton si expiré (via refresh_token), renvoie l'id_token courant.
+  Future<String?> validToken() async {
+    final expiry = await _storage.read(key: _kExpiry);
+    final refresh = await _storage.read(key: _kRefresh);
+    if (expiry != null && refresh != null) {
+      final exp = DateTime.tryParse(expiry);
+      if (exp != null && exp.isBefore(DateTime.now().add(const Duration(seconds: 30)))) {
+        try {
+          final r = await _appAuth.token(TokenRequest(
+            Config.oidcClientId,
+            Config.oidcRedirect,
+            issuer: Config.oidcIssuer,
+            refreshToken: refresh,
+            scopes: Config.oidcScopes,
+          ));
+          if (r.idToken != null) {
+            await _storage.write(key: _kIdToken, value: r.idToken);
+            await _storage.write(key: _kRefresh, value: r.refreshToken ?? refresh);
+            await _storage.write(
+              key: _kExpiry,
+              value: r.accessTokenExpirationDateTime?.toIso8601String(),
+            );
+          }
+        } catch (_) {/* on garde l'ancien token, l'API renverra 401 si mort */}
+      }
+    }
+    return idToken;
+  }
+
+  Future<void> logout() async => _storage.deleteAll();
+}