1.1 Secure Token Storage Foundation

Sprint Key: 1-1-secure-token-storage-foundation Epic: 1 PRD: mobile-oidc

---

Story 1.1: Secure Token Storage Foundation

Status: ready-for-dev

Story

As a mobile app, I want a secure token storage abstraction backed by the platform keystore, so that authentication tokens are encrypted at rest and the auth stack is fully testable without platform dependencies.

Acceptance Criteria

1. AC1 - Dependencies added: flutter_secure_storage, flutter_appauth, flutter_riverpod, and app_links are added to pubspec.yaml and all packages resolve successfully with flutter pub get. shared_preferences and crypto remain in pubspec.yaml (removed later in Epic 6).

2. AC2 - SecureTokenStorage saves tokens as JSON blob: SecureTokenStorage.saveTokens() called with accessToken, idToken, refreshToken, and expiresIn stores all values as a single JSON blob under one key (auth_tokens) in the platform keystore. expiresIn is stored as the calculated absolute expiration date (DateTime.now().add(Duration(seconds: expiresIn))).

3. AC3 - SecureTokenStorage reads individual tokens: getAccessToken(), getIdToken(), getRefreshToken(), and getAccessTokenExpiration() each return the corresponding value from the stored JSON blob.

4. AC4 - deleteAll removes stored tokens: deleteAll() removes the auth_tokens key from the platform keystore.

5. AC5 - InMemoryTokenStorage mirrors SecureTokenStorage: InMemoryTokenStorage provides identical behavior to SecureTokenStorage but without platform dependencies. All unit tests pass without requiring a device emulator.

6. AC6 - deleteAll silently handles keystore failure: If deleteAll() fails due to keystore unavailability, the error is caught and does not propagate.