kuhyx/utils
1
0
Fork 0
mirror of https://github.com/kuhyx/utils.git synced 2026-11-10 20:07:18 +01:00
Code Issues Actions 16 Packages Projects Releases Wiki Activity
1fb04ce59d
utils/google_account_token/README.md
Krzysztof kuhy Rudnicki db70ba204d Add google_account_token plugin 
Android AccountManager ID token for Firebase signInWithIdp, extracted from todo so the sync apps stop copying the Kotlin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WzxdWY1k4muZfdVJfb7YGJ
2026-11-02 10:32:58 +01:00

2.1 KiB
Raw Blame History

google_account_token

Android one-tap Google ID token via AccountManager, owned once for every sync app. The system account chooser, then getAuthToken(account, "audience:server:client_id:<WEB client id>"). The result is a Google ID token for Firebase signInWithIdp: one dialog, no browser, no google_sign_in, no Play Services SDK in the APK. Verified on a Pixel: aud = the Web client, Firebase accepted it.

Other platforms (web, Linux desktop, iOS) return null, so the caller falls back to its password path.

Install

dependencies:
  google_account_token:
    git:
      url: https://github.com/kuhyx/utils
      ref: google_account_token-v0.1.0
      path: google_account_token

Android plugins auto-register: the app's MainActivity needs no code.

API

import 'package:google_account_token/google_account_token.dart';

if (googleAccountTokenSupported) {
  final idToken = await googleIdToken(serverClientId: kWebClientId);
  // null = cancelled / unsupported / failed (logged); use the password path
}
  • googleIdToken({required String serverClientId, String? accountHint}) returns the ID token or null. serverClientId must be the Web OAuth client id (an Android client id gives audience mismatch at Firebase). accountHint (an email) only preselects a row; the chooser always shows.
  • googleAccountTokenSupported is true only on Android.
  • There is no sign-out: the plugin holds no session. Each call is a fresh chooser plus getAuthToken; forgetting the account is the app's own stored credentials.

Failures are logged (level 900) and returned as null; a misconfigured client id looks the same as "user cancelled" except in the log.

Development

flutter test --coverage && scripts/check_coverage.sh coverage/lcov.info 100
flutter analyze

The Kotlin side (android/.../GoogleAccountTokenPlugin.kt) has no JVM unit test: utils has no Kotlin test convention and Android unit tests hit the MockableJarTransform / android-36 / JDK 21 breakage. It was compile-checked through a throwaway app (:google_account_token:compileDebugKotlin).