[juicycleff]

Optional features can now ship as client plugins, the same way they ship as server plugins. You add the client half to your provider and the server half with authsome.WithPlugin, and core knows nothing about either.

This is the second of three PRs, after #167. The next one builds the subscription plugin on top of this.

Using a plugin

<AuthProvider baseURL={url} plugins={[subscription()]}>
  <App />
</AuthProvider>

const billing = usePlugin(subscription);

AuthConfig(baseUrl: url, plugins: [SubscriptionPlugin()]);
final billing = context.auth.plugin<SubscriptionApi>();

A plugin is a name (the server plugin's Name()) and a setup function. Setup gets a small context: an authenticated request, the auth state, the client config, whether the server has the plugin installed, the active organization, and signedIn, signedOut, sessionRefreshed and orgChanged events. We kept it small on purpose, because once plugins version on their own every member is a promise to all of them.

Active organization

Core now knows which organization the session is in:

• GET /v1/me reports active_org_id, so a reload gets it back.
• useActiveOrg() in React, and activeOrgId / switchOrg on AuthManager and AuthNotifier.
• switchOrg keeps the new token a JWT app hands back, runs in turn with token refreshes so it can't undo one, and won't bring back a session that signed out while it waited.
• Both OrgSwitchers work with no props now: they show the session's organization and switch it. Pass activeOrgId and onOrgChange to keep managing it yourself.

Breaking: <Protect>

role and permission used to render their children for everyone. role now checks the roles /v1/me returns. permission can't be checked in the browser, so without a condition it shows the fallback and warns once. The React guide has a migration note.

Also

• AuthNotifier rebuilt its config field by field and would have dropped plugins. Fixed.
• Signing in as someone else without signing out first now fires signedOut then signedIn, so the previous user's organization and plugin caches don't carry over.
• The Flutter OrgSwitcher's "Create organization" row no longer overflows with a long label.
• New docs page: Client Plugins, plus active-org sections in the React and Flutter guides. The page uses @authsome/plugin-subscription as its example, which lands in the next PR.

Not in here

• Dart events are delivered synchronously, so a listener that changes auth state from inside the callback loses the inner event. Nothing does that today.
• In TS a server outage moves the state to unknown and fires signedOut, while Dart keeps the session and fires nothing. Both are defensible; the docs should say so.
• Core doesn't ship a fake PluginContext for plugin authors' tests yet.

Checked

GOWORK=off go test ./... passes. In ui, every package builds, type-checks and lints, and the tests pass (core 173, react 25, components 102, nextjs 32). Flutter: authsome_core 67, authsome_flutter 8, authsome_flutter_ui 86, all passing, and dart analyze is clean apart from one existing info in the generated client. Regenerating the clients shows no drift.

[codecov]

Codecov Report

❌ Patch coverage is 78.72340% with 10 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
sdkgen/cmd/main.go	0.00%	10 Missing ⚠️

📢 Thoughts on this report? Let us know!