title: Clean Architecture and authentication. Correct way?
body: <p>I'm working on an Android app based on Clean Architecture pattern and I have doubts how to implement user authentication in a clean way. Is the following solution clean in terms of clean architecture?</p>
  <p>I would create use cases like below (executed from presentation layer):</p>
  <ul>
  <li><code>LoginUseCase</code> (for provided login and password fetches api token via remote service and saves in local token source)</li>
  <li><code>LogoutUseCase</code> (clears token from <code>LocalTokenSource</code>)</li>
  </ul>
  <p>(<code>LocalTokenSource</code> interface would be stored in domain layer and its implementation in data layer - kind of repository)</p>
  <p>And in order to perform token refresh at each app launch (it's not a use case from the user perspective, right?) I would create <code>SessionManager</code> component in domain layer. <code>SessionManager</code> would be responsible for refreshing token and saving it in <code>LocalTokenSource</code>. Each time activity is started, from its presenter I would execute <code>refreshToken()</code> on injected <code>SessionManager.</code> What do you think about the solution?</p>
  <p>If it's clean, then how to handle passing token to the remote service to execute other API methods which require token? Lets say I have <code>PostsRepository</code> which fetches posts data from remote service. Should I pass token from a use case to the repository method like <code>repo.getPosts(token)</code>? Or inject <code>LocalTokenSource</code> to the repository, so it could read the token on its own? Wouldn't the second option violate Clean Architecture rules, because <code>LocalTokenSource</code> would be used in 2 layers?</p>