supabase / supabase-flutter / 27945964004

85%

Build Type

push

github

Committed by web-flow

Commit Message

fix: correctness fixes across gotrue, postgrest, storage, supabase and supabase_flutter (#1445)

## Summary

A batch of correctness fixes found during a code review sweep. Each fix
is in its own per-package commit and ships with a regression test that
was verified to fail on the current `main` and pass with the fix.

### gotrue
- `verifyOTP` sent the captcha token under `captchaToken` inside
`gotrue_meta_security`, but the server reads `captcha_token`, so the
token was silently dropped. Now uses `captcha_token` like every other
call.
- `resend` checked `containsKey(['message_id'])` with a list argument
(always false), so `ResendResponse.messageId` was never populated. Now
uses the string key.

### postgrest
- `.maybeSingle().count()` with zero matching rows and no converter
returned `null as T` where `T` is the non-nullable `PostgrestResponse`,
throwing a `TypeError`. Now returns a response with null data and
`count: 0`.

### storage_client
- A single `MultipartFile` instance was reused across retry attempts, so
a retry re-finalized an already finalized file and threw a `StateError`
instead of retrying. The request factory now builds a fresh
`MultipartFile` per attempt.
- Binary signed url uploads derived the content type from the full url
including the `?token=` query string, defeating mime lookup and falling
back to `application/octet-stream`. Now uses the url path.
- `_removeEmptyFolders` used JavaScript regex literals (`/.../g`) that
never matched, making it a no-op. Now uses valid Dart patterns so signed
url paths are normalized.

### supabase
- The `headers` setter rebuilt the realtime client headers from the
client headers only, dropping the `apikey` entry present at
construction. Now includes the `apikey`. Also removes a redundant
self-spread when merging rest headers before an `rpc`.

### supabase_flutter
- When initialized with a custom `accessToken`,
`_restoreSessionCancellableOperation` was never assigned, so `dispose()`
threw a `LateIniti... (continued)

Coverage Stats

15 of 16 new or added lines in 7 files covered. (93.75%)

1 existing line in 1 file now uncovered.

4086 of 4793 relevant lines covered (85.25%)

3.58 hits per line