# Auth widgets

Canonical page: https://docs.ovok.com/flutter-sdk/auth-widgets

`ovok_flutter` provides Material widgets for the authentication methods in
`ovok_sdk`. The widgets call the existing `ovok.auth` and FHIR APIs; apps still
own navigation, success handling and the app theme.

## Sign in [#sign-in]

Use `SignIn` for password sign-in, MFA and optional Google sign-in. The app
chooses the profile type and can move to registration or password reset from
the callbacks.

```dart
SignIn(
  ovok: ovok,
  profileType: ProfileType.patient,
  googleInternalId: 'your-client-application-id',
  googleClientId: 'your-google-oauth-client-id',
  googleServerClientId: 'your-google-server-client-id',
  onSuccess: (session) async => openHome(session),
  onRegister: openRegistration,
  onResetPassword: openPasswordReset,
)
```

Google sign-in is optional. On Android and iOS, complete the native
`google_sign_in` setup for each app target. On web, provide `googleClientId` and
authorize the app origin in the Google OAuth client. The widget displays the
Google-rendered sign-in button on web and exchanges its ID token through
`ovok.auth.socialLogin`.

## Register and reset a password [#register-and-reset-a-password]

`Register` collects first and last name, email, password and confirmation. It
calls `ovok.auth.register`; `onSuccess` receives the stored session, while
`onInvite` handles a clinician invitation response.

`ResetPassword` requests a reset link for a patient or practitioner. Its success
message does not reveal whether the address is registered.

```dart
Register(
  ovok: ovok,
  onSuccess: (session) async => openHome(session),
  onSignIn: openSignIn,
)

ResetPassword(ovok: ovok, onBack: openSignIn)
```

## Profile and sessions [#profile-and-sessions]

`ProfileForm` loads the signed-in Patient through `auth.me()` and patches the
configured fields. Field paths use JSON Pointer syntax and must point to values
already present in the Patient resource.

```dart
ProfileForm(
  ovok: ovok,
  fields: const [
    ProfileFormField(path: '/name/0/given/0', label: 'First name'),
    ProfileFormField(path: '/name/0/family', label: 'Last name'),
  ],
)
```

`SessionList` shows active sessions and can revoke all other sessions. Use
`LogoutButton` to end the current session and clear it from the secure store.

## Delete an account [#delete-an-account]

`DeleteAccountButton` asks for confirmation and schedules deletion after 30 days.
It does not request a health-data wipe.

## Labels [#labels]

Widgets use `defaultAuthTranslations`. Pass `AuthTranslations` with translated
overrides for another language; keys not supplied fall back to the English
defaults.

## Run the sandbox example [#run-the-sandbox-example]

From `packages/ovok_flutter/example`, run:

```bash
flutter run -d chrome --web-hostname localhost --web-port 7357 \
  --dart-define=OVOK_TENANT_CODE=your-sandbox-tenant \
  --dart-define=OVOK_CLIENT_ID=your-client-application-id \
  --dart-define=GOOGLE_INTERNAL_ID=your-client-application-id \
  --dart-define=GOOGLE_CLIENT_ID=your-google-oauth-client-id
```

`OVOK_CLIENT_ID` is used by Ovok password resets and social login. The Google
OAuth client ID is a separate value. Add the local origin to the OAuth client's
authorized JavaScript origins. The app stores sessions with
`flutter_secure_storage`.