feat: add credentialsManager.clearAll() for full credential and key wipe

[utkrishtsahu]

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

📋 Changes

Adds a new clearAll() method to the credentials manager for a full wipe of stored credentials and the underlying encryption keys, across Android and iOS/macOS. This exposes Auth0.Android v4's SecureCredentialsManager.clearAll() and Auth0.swift v3's CredentialsManager.clearAll() through the Flutter API. Additive change — existing APIs are unaffected.

Public API (auth0_flutter)

• Adds Future<void> clearAll() to the CredentialsManager interface and DefaultCredentialsManager.

// Removes all credentials, all cached API credentials, and the encryption keys.
await auth0.credentialsManager.clearAll();

Platform interface (auth0_flutter_platform_interface)

• Adds clearAll() to CredentialsManagerPlatform.
• Adds the credentialsManager#clearAll method-channel constant and its MethodChannelCredentialsManager implementation (returns void; no throw on null).

Android native

• New ClearAllRequestHandler routes credentialsManager#clearAll to SecureCredentialsManager.clearAll(); registered in Auth0FlutterPlugin.

iOS/macOS native

• New CredentialsManagerClearAllMethodHandler routes to CredentialsManager.clearAll(); registered in CredentialsManagerHandler (Method enum + provider).

clearAll() vs clearCredentials() — these are intentionally distinct on both platforms (verified against the native SDK sources):

• clearCredentials() removes only the stored credential entries (plus biometric session).
• clearAll() additionally removes the encryption keys — on Android the crypto key pair and the DPoP key; on iOS/macOS every entry in the credentials store plus the DPoP key pair.

Because clearAll() deletes all entries in the underlying store, consumers are advised not to share that store (custom sharedPreferencesName on Android, or storeKey/accessGroup on iOS/macOS) with unrelated app data.

Docs

• EXAMPLES.md: new "Clear all credentials and encryption keys" section documenting usage and the difference from clearCredentials().
• V3_MIGRATION_GUIDE.md: additive note describing clearAll() and the distinction.

🎯 Testing

Unit tests added

• auth0_flutter_platform_interface — method-channel contract tests for clearAll (method_channel_credentials_manager_test.dart): dispatches credentialsManager#clearAll, maps account/userAgent, and throws CredentialsManagerException on a PlatformException.
• auth0_flutter — credentials_manager_test.dart: DefaultCredentialsManager.clearAll() forwards to the platform. Mockito mocks regenerated for this test only.
• Android — ClearAllRequestHandlerTest.kt: verifies SecureCredentialsManager.clearAll() is called and the handler returns success(null).
• iOS/macOS — CredentialsManagerClearAllMethodHandlerTests.swift: verifies the SDK full-wipe is invoked (deleteAllEntries), produces nil on success and a FlutterError on failure. SpyCredentialsStorage gained a deleteAllEntries() implementation (the protocol's default just asserts).

Verified locally

• flutter test (VM): auth0_flutter 153/153 pass; auth0_flutter_platform_interface pass except the pre-existing environment-dependent UTC-timezone test in credentials_test.dart (passes in CI).
• flutter analyze: auth0_flutter_platform_interface clean; auth0_flutter has no new issues.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (3)

• main
• beta-release/.*
• release/.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 806df2d5-2697-48f3-b507-bdd651608be2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[NandanPrabhu]

@utkrishtsahu clearAll underhood calls keychain for swift it can fail is it the same case for android? can keystore fail?

[utkrishtsahu]

Good catch — yes, on Android clearAll() can throw: it only swallows DPoPException internally, while crypto.deleteAllKeys() / storage.removeAll() can still throw (keystore errors). I've wrapped the call in try/catch and report the failure via result.error(...), matching the iOS handler, and added a test for the failure path.

[NandanPrabhu]

minor test build optimization. lets make it final class

[utkrishtsahu]

Done

[NandanPrabhu]

Let's mention clearApiCredentials as well here?

[utkrishtsahu]

Added a bullet for clearApiCredentials in the comparison.