Re: [PATCH dart-api-client v3 2/2] fix #4281: access: add OpenID Connect auth-url/login helpers

["Shan Shaji" <s.shaji@proxmox.com>]

Hi Azharul,

Thanks for factoring out the block. IMHO, we could separate the addition
of helper and openID functions into two patches.

1. Factor out the helper.
2. Add the OpenID specific functions.

On Fri Aug 21, 2026 at 5:41 AM CEST, Azharul Haque wrote:
> Add openIdAuthUrl() and openIdLogin(), mirroring the existing
> authenticate()/accessDomains() functions used by the login form
> before an authenticated ProxmoxApiClient exists.
>
> openIdAuthUrl() requests the provider's authorization URL for a
> realm from /access/openid/auth-url. openIdLogin() exchanges the
> state/code obtained from the provider's redirect for a PVE ticket
> via /access/openid/login, the same way authenticate() does for
> password realms.
>
> The OpenID login response carries the authenticated username in its
> body rather than it being known upfront by the caller, so
> handleOpenIdLoginResponse() is added alongside the existing
> handleAccessTicketResponse() to build Credentials from it. Its ticket
> regex only matches PVE tickets (not PMG), since OpenID login is only
> ever performed against a PVE realm; because the two regexes therefore
> differ, the regex match stays in each handler while the shared tail
> (deriving the expiration time and detecting an accompanying TFA
> challenge) is factored into a common helper used by both.
>
> Suggested-by: Shan Shaji <s.shaji@proxmox.com>
> Signed-off-by: Azharul Haque <haque@azharul.com>
> ---

[snip]

>  Future<List<PveAccessDomainModel?>> accessDomains(
>    Uri apiBaseUrl,
>    bool validateSSL, {
> diff --git a/lib/src/handle_ticket_response.dart b/lib/src/handle_ticket_response.dart
> index ba2128f..f4bffde 100644
> --- a/lib/src/handle_ticket_response.dart
> +++ b/lib/src/handle_ticket_response.dart
> @@ -5,6 +5,29 @@ import 'package:proxmox_dart_api_client/src/credentials.dart';
>  import 'package:proxmox_dart_api_client/src/extentions.dart';
>  import 'package:proxmox_dart_api_client/src/tfa_challenge.dart';
>
> +/// Shared tail of parsing a ticket response: derives the ticket's
> +/// expiration time from its embedded timestamp, and determines whether a
> +/// TFA challenge accompanies it (either encoded in the ticket itself, or
> +/// flagged via the legacy `NeedTFA` field).
> +({DateTime expiration, TfaChallenge? tfa}) _parseTicketExpirationAndTfa(
> +  RegExpMatch ticketMatch,
> +  String ticket,
> +  Map<String, dynamic> bodyJson,
> +) {
> +  final expiration = DateTime.fromMillisecondsSinceEpoch(
> +      int.parse(ticketMatch.group(3)!, radix: 16) * 1000);
> +
> +  TfaChallenge? tfa;
> +  if (ticket.startsWith('PVE:!tfa!')) {
> +    tfa = TfaChallenge.fromJson(
> +        jsonDecode(Uri.decodeComponent(ticket.substring(9).split(':')[0])));
> +  } else if (bodyJson['NeedTFA'] != null && bodyJson['NeedTFA'] == 1) {
> +    tfa = TfaChallenge.legacy();
> +  }
> +
> +  return (expiration: expiration, tfa: tfa);
> +}
> +
>  Credentials handleAccessTicketResponse(
>      http.Response response, Credentials unauthenticatedCredentials) {
>    response.validate(false);
> @@ -15,27 +38,46 @@ Credentials handleAccessTicketResponse(
>
>    final csrfToken = bodyJson['CSRFPreventionToken'];
>
> -  final ticketRegex = RegExp(r'(PVE|PMG)(?:QUAR)?:(?:(\S+):)?([A-Z0-9]{8})::')
> -      .firstMatch(bodyJson['ticket'])!;
> +  final ticketMatch = RegExp(r'(PVE|PMG)(?:QUAR)?:(?:(\S+):)?([A-Z0-9]{8})::')
> +      .firstMatch(ticket)!;
>
> -  final time = DateTime.fromMillisecondsSinceEpoch(
> -      int.parse(ticketRegex.group(3)!, radix: 16) * 1000);
> -
> -  TfaChallenge? tfa;
> -  if (ticket.startsWith('PVE:!tfa!')) {
> -    tfa = TfaChallenge.fromJson(
> -        jsonDecode(Uri.decodeComponent(ticket.substring(9).split(':')[0])));
> -  } else if (bodyJson['NeedTFA'] != null && bodyJson['NeedTFA'] == 1) {
> -    tfa = TfaChallenge.legacy();
> -  }
> +  final parsed = _parseTicketExpirationAndTfa(ticketMatch, ticket, bodyJson);
>
>    return Credentials(
>      unauthenticatedCredentials.apiBaseUrl,
>      unauthenticatedCredentials.username,
>      ticket: ticket,
>      csrfToken: csrfToken,
> -    expiration: time,
> -    tfa: tfa,
> +    expiration: parsed.expiration,
> +    tfa: parsed.tfa,
> +  );
> +}
> +

Above changes could itself be another preparatory patch.

[snip]