supabase / supabase-flutter / 27603730747

85%

push

github

fix(gotrue): support asymmetric JWTs in getClaims (#1410)

## What

`getClaims` built the JWT verification key by passing the JWK JSON to a
DER parser (`RSAPublicKey.bytes`), which threw
`UnsupportedASN1TagException` for asymmetric signing keys. It now uses
`JWTKey.fromJWK`, which builds the key from the JWK parameters and
supports both RSA and EC keys.

## Why

Projects using asymmetric JWT signing keys (RS256/ES256, the default for
new Supabase projects) could not use `getClaims` for local verification.
The previous symmetric (HS256) setups masked the bug because those
tokens fall back to `getUser` and never reach the asymmetric path.

## Changes

- Replace the `JWK.rsaPublicKey` getter with a `JWK.publicKey` getter
backed by `JWTKey.fromJWK` (supports RSA and EC).
- Bump `dart_jsonwebtoken` to `^3.1.0`, the first version that provides
`JWTKey.fromJWK`.
- Add `jwk_test.dart` covering RSA and EC key construction.

## Notes

This was surfaced while migrating the test suite to the Supabase CLI
(which signs tokens asymmetrically by default). That migration is a
separate follow-up PR stacked on this one.

25 of 27 new or added lines in 2 files covered. (92.59%)

4066 of 4744 relevant lines covered (85.71%)

3.48 hits per line