supabase / supabase-flutter / 27963702382

85%

push

github

fix(gotrue): don't throw in verifyOTP when secure email/phone change returns no session (#1448)

## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

Closes #981.

When secure email change is enabled, the email-change OTP flow is
two-step: the server accepts the **first** OTP and returns a `200` with
no session (`{msg: "Confirmation link accepted. Please proceed to
confirm link sent to the other email"}`), only issuing a session once
the **second** OTP is verified.

`verifyOTP` assumed every successful verification returns a session and
threw `AuthException('An error occurred on token verification.')`
whenever `session == null`, breaking the legitimate intermediate step.

## What is the new behavior?

`verifyOTP` now only saves the session and notifies subscribers when a
session is actually present, and returns the intermediate response
otherwise. This matches the `auth-js` client, which does not throw on a
null session.

## Additional context

- No API surface change: the signature and `AuthResponse` return type
are unchanged. Genuine server errors are still surfaced earlier by the
fetch layer (non-2xx responses), so this only affects the
previously-broken intermediate success case. Not a breaking change.
- The secondary report in the issue (a
`500`/`AuthRetryableFetchException` when supplying a *wrong* OTP) stems
from a runtime panic in the Go `auth` server's `/verify` handler, not
the Flutter client, so it is out of scope here.
- Updated the existing `response with null session` test to verify the
intermediate response is returned instead of throwing.

4 of 4 new or added lines in 1 file covered. (100.0%)

4085 of 4792 relevant lines covered (85.25%)

3.58 hits per line