supabase / supabase-flutter / 27970191844

85%

Build Type

push

github

Committed by web-flow

Commit Message

fix(supabase_flutter): clear auth params from web URL after exchange (#1456)

## What

On Flutter web, after a successful OAuth/PKCE sign-in the auth `code`
(or implicit-flow tokens) stays in the browser URL. On the next page
refresh, `supabase_flutter` reads that URL again, sees the stale `code`,
and tries to exchange it a second time. The code verifier was already
consumed and removed during the first exchange, so the second attempt
throws:

```
AuthException(message: Code verifier could not be found in local storage.)
```

This logs the user out on every refresh while the `code` is still in the
URL.

## Fix

After a successful `getSessionFromUrl` on web, strip the auth parameters
from the browser URL using `history.replaceState`, mirroring what
`supabase-js` does. Unrelated query and fragment parameters are
preserved.

- `clear_auth_url_parameters.dart` holds the pure, testable
URL-stripping logic.
- `clear_auth_url_parameters_web.dart` / `_stub.dart` follow the
existing conditional-import pattern (`if (dart.library.js_interop)`) so
non-web platforms get a no-op.
- The cleanup is invoked from `_handleDeeplink` only on web after the
exchange succeeds.

## Test

Added `clear_auth_url_parameters_test.dart` covering PKCE code, implicit
fragment tokens, error params, and preservation of unrelated params.

Closes #836

Coverage Stats

16 of 18 new or added lines in 3 files covered. (88.89%)

1 existing line in 1 file now uncovered.

4101 of 4810 relevant lines covered (85.26%)

3.57 hits per line