supabase / supabase-flutter / 28227073552

86%

Build Type

push

github

Committed by web-flow

Commit Message

fix(gotrue): avoid duplicate auth error on recoverSession with invalid refresh token (#1450)

## What

Fixes the long-standing reports of `AuthException(message: Invalid
Refresh Token: Refresh Token Not Found, statusCode: 400)` surfacing as
an uncaught error (often seen in Sentry).

Closes #930

## Why

When `recoverSession` restores a persisted session whose refresh token
is invalid or expired, the refresh goes through `_callRefreshToken` ->
`_executeRefresh`. For a non-retryable `AuthException` (like "Refresh
Token Not Found"), `_executeRefresh` already does the right thing: it
removes the session and emits a `signedOut` event, deliberately **not**
calling `notifyException`.

The problem was that `recoverSession`'s blanket `catch` then called
`notifyException(error, stackTrace)` a **second time**, pushing the
`AuthException` onto the `onAuthStateChange` stream. For an expected
condition (a rotated, expired, or revoked token at app startup),
consumers listening to `onAuthStateChange` without an `onError` handler
get an uncaught async error. That is what those Sentry reports were.

## How

Notification in `recoverSession` is now explicit per path instead of a
catch-all re-notify:

- The refresh-token path defers entirely to `_callRefreshToken` /
`_executeRefresh`, the single owner of that outcome (`signedOut` for an
invalid token, an exception for a retryable failure). No more duplicate
stream error.
- Genuinely unexpected parse failures (corrupt JSON) are still notified.
- The explicit "missing data" and "Session expired" (`autoRefreshToken:
false`) notifications are preserved unchanged.

## Tests

- Updated `Sign out on wrong refresh token` to assert the invalid-token
path surfaces **only** a `signedOut` event and never a stream error,
while still throwing to the direct caller.
- Verified the unaffected `autoRefreshToken: false` path still emits its
exception (`supabase_flutter` "emits exception when no auto refresh"
still passes).

Coverage Stats

29 of 31 new or added lines in 1 file covered. (93.55%)

71 existing lines in 1 file now uncovered.

4100 of 4792 relevant lines covered (85.56%)

3.65 hits per line