Authentication
Source: pharmanet/lib/features/auth/
Pages
| Page |
File |
Description |
AuthPage |
features/auth/presentation/pages/auth_page.dart |
Login with email/password, OTP, or OAuth |
RootPage |
features/auth/presentation/pages/root_page.dart |
Role-based routing (customer vs seller view) |
AuthForm |
features/auth/presentation/widgets/auth_form.dart |
Reusable auth form widget |
Providers
| Provider |
Type |
File |
authStateProvider |
StreamProvider<AuthState> |
core/providers/auth_provider.dart |
currentUserProvider |
Provider<User?> |
core/providers/auth_provider.dart |
userRoleProvider |
NotifierProvider<UserRole> |
core/providers/user_provider.dart |
API Methods
Source: pharmanet/lib/core/api/auth_api.dart
| Method |
Description |
sendOtp(email) |
Send OTP verification email |
verifyOtp(email, otp) |
Verify OTP code |
signInWithGoogle() |
Google OAuth sign-in |
signInWithApple() |
Apple OAuth sign-in (iOS) |
registerUser(email, name, role) |
Create user profile |
signInWithEmailPassword(email, password) |
Email/password sign-in |
signUpWithEmailPassword(email, password) |
Email/password sign-up |
signOut() |
Sign out |
currentUser |
Getter for current Supabase user |
getUserRole() |
Get role from user metadata |
hasProfile() |
Check if user has a profile record |
Auth Flow
sequenceDiagram
participant U as User
participant A as AuthPage
participant P as AuthProvider
participant S as Supabase Auth
participant DB as Profiles Table
U->>A: Enter email/password
A->>P: signIn()
P->>S: supabase.auth.signIn()
S-->>P: Session + User
P->>DB: Fetch profile (role)
DB-->>P: Profile data
P-->>A: Success + Role
A->>U: Navigate to home/dashboard
Role Routing
On login, RootPage determines the view:
| Role |
View |
customer |
Customer home (PublicHomePage) |
seller |
Pharmacist dashboard (PharmacistDashboard) |
admin |
(Web only — mobile blocks admin login) |
Security
- OTP-based email verification for new accounts
- Google OAuth available for quick sign-in
- Session persistence via
SecureStorageService
- FCM token saved to profile on every login
- Profile verification (hasProfile check) before granting access