Av/711 migrate to latest OIDC

lib/src/auth/solid_oidc_config.dart

@@ -178,7 +178,7 @@ class SolidOidcConfig {
   ///
   /// [frontChannelLogoutUri] must be set for this to work.
   final OidcFrontChannelRequestListeningOptions
-      frontChannelRequestListeningOptions;
+  frontChannelRequestListeningOptions;
 
   /// How early the token gets refreshed.
   ///
@@ -210,12 +210,12 @@ class SolidOidcConfig {
   /// Customized hooks to modify the user manager behavior.
   final OidcUserManagerHooks? hooks;
 
-  /// whether JWTs are strictly verified.
+  /// Legacy no-op, retained only for source compatibility.
   ///
-  /// If set to true, the library will throw an exception if a JWT is invalid.
-  ///
-  /// **Security Note**: This defaults to `true` for security. Only set to `false`
-  /// for development/testing or when working with non-compliant OIDC providers.
+  /// `package:oidc` 1.0+ removed the fail-open opt-out this used to control.
+  /// ID token signature verification is now unconditionally strict regardless
+  /// of this value. Kept as a field so existing call sites setting it don't
+  /// fail to compile; it is no longer read by [SolidOidcManagerFactory].
   final bool strictJwtVerification;
 
   /// overrides a token's expires_in value.

lib/src/auth/solid_oidc_manager_factory.dart

@@ -67,11 +67,7 @@ abstract class SolidOidcManagerFactory {
   ///
   /// [metadata] is optional — pass it if you have already fetched the
   /// discovery document to avoid an extra network round-trip.
-  static Future<
-      ({
-        OidcUserManager manager,
-        DpopKeyManager keyManager,
-      })> create({
+  static Future<({OidcUserManager manager, DpopKeyManager keyManager})> create({
     required String issuerUri,
     required SolidOidcConfig config,
     SolidProviderMetadata? metadata,
@@ -125,16 +121,26 @@ abstract class SolidOidcManagerFactory {
     // dpopTokenHook.
     hooks.token = OidcHookGroup(
       hooks: [if (hooks.token != null) hooks.token!, dpopTokenHook],
-      executionHook: (hooks.token is OidcExecutionHookMixin<
-              OidcTokenHookRequest, OidcTokenResponse>)
+      executionHook:
+          (hooks.token
+              is OidcExecutionHookMixin<
+                OidcTokenHookRequest,
+                OidcTokenResponse
+              >)
           ? hooks.token
-              as OidcExecutionHookMixin<OidcTokenHookRequest, OidcTokenResponse>
+                as OidcExecutionHookMixin<
+                  OidcTokenHookRequest,
+                  OidcTokenResponse
+                >
           : dpopTokenHook,
     );
 
     // Wire the hook into OidcUserManagerSettings.
     final settings = OidcUserManagerSettings(
-      strictJwtVerification: config.strictJwtVerification,
+      // config.strictJwtVerification is intentionally not forwarded: oidc_core
+      // 1.0+ removed the corresponding fail-open opt-out entirely, so ID token
+      // signature verification is now unconditionally strict. See
+      // [SolidOidcConfig.strictJwtVerification] for the retained legacy field.
       scope: scopes,
       frontChannelLogoutUri: config.frontChannelLogoutUri,
       redirectUri: config.redirectUri,
@@ -160,6 +166,13 @@ abstract class SolidOidcManagerFactory {
       getIdToken: config.getIdToken,
       supportOfflineAuth: config.supportOfflineAuth,
       userInfoSettings: config.userInfoSettings,
+      // oidc_core 2.0+ defaults init() to OidcInitMode.cacheFirst, which
+      // returns a possibly-stale cached token immediately and refreshes in
+      // the background (a second, later userChanges emission). solid_auth's
+      // tryRestoreSession() reads currentAuthData synchronously right after
+      // init() resolves, so it needs the pre-2.0 guarantee that init() has
+      // already refreshed an expired token by the time it returns.
+      initMode: OidcInitMode.blockingValidate,
     );
 
     final clientAuth = config.clientSecret != null
@@ -193,10 +206,7 @@ abstract class SolidOidcManagerFactory {
           );
 
     // Return OIDC manager and custom key manager
-    return (
-      manager: manager,
-      keyManager: keyManager,
-    );
+    return (manager: manager, keyManager: keyManager);
   }
 
   // Check if the current scope contains webid.

pubspec.yaml

@@ -5,18 +5,18 @@ homepage: https://github.com/anusii/solid_auth
 repository: https://github.com/anusii/solid_auth
 
 environment:
-  sdk: '>=3.0.0 <4.0.0'
-  flutter: '>=3.10.0'
+  sdk: '>=3.11.0 <4.0.0'
+  flutter: '>=3.41.0'
 
 dependencies:
 
   # Crypto package
   crypto: ^3.0.7
 
   # Core OIDC package (OpenID certified) replacing the forked openid_client
-  oidc: ^0.14.0
-  oidc_core: ^0.16.0
-  oidc_default_store: ^0.6.0
+  oidc: ^4.0.0
+  oidc_core: ^3.0.0
+  oidc_default_store: ^1.0.0
 
   # JWT handling — kept for DPoP proof generation
   dart_jsonwebtoken: ^3.2.0