supabase / supabase-flutter / 28241867675

86%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth): recognize error query parameter in auth callback redirects (#1472)

## What

OAuth error redirects can arrive as query parameters without an
`error_description` (e.g. `?error=access_denied`), per [RFC 6749
§4.1.2.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1)
where `error_description` is optional but `error` is required.

Previously these bare `?error=` redirects were silently dropped in two
places:

1. **`supabase_auth.dart` → `_isAuthCallbackDeeplink`** only matched
`error_description`, so a `?error=access_denied` deep link was never
recognized as an auth callback.
2. **`gotrue_client.dart` → `getSessionFromUrl`** only threw when
`error_description != null`, so even if the gate passed, a bare
`?error=` fell through to the misleading `"No access_token detected."`
instead of surfacing the actual OAuth error.

The result was that the user saw no feedback when an OAuth provider
returned an error without a description.

## Changes

- Widened the deep link gate to also match `error` and `error_code`.
- Made `getSessionFromUrl` throw for any of `error` / `error_code` /
`error_description`, with a fallback message when no description is
given. The `error` -> `code` and `error_code` -> `statusCode` mapping is
preserved.

## Tests

- `packages/gotrue/test/provider_test.dart`: new case for
`?error=access_denied&error_code=403` asserting the `AuthException`
carries the code and status.
- `packages/supabase_flutter/test/deep_link_test.dart`: new group
asserting a `?error=` deep link triggers `getSessionFromUrl` and
surfaces the `AuthException` on `onAuthStateChange`.

## Parity

Ports
[supabase-js#2407](https://github.com/supabase/supabase-js/pull/2407) to
Dart/Flutter.

Resolves SDK-1032 (and its duplicate SDK-1044).

Coverage Stats

2 of 3 new or added lines in 2 files covered. (66.67%)

1 existing line in 1 file now uncovered.

4108 of 4798 relevant lines covered (85.62%)

3.65 hits per line