supabase / supabase-flutter / 28525039155

86%

Build Type

push

github

Committed by web-flow

Commit Message

fix(gotrue): allow TOTP MFA enrollment without an issuer (#1501)

## What

`GoTrueMFAApi.enroll()` no longer requires an `issuer` when enrolling a
TOTP factor. The canonical call now works:

```dart
final res = await supabase.auth.mfa.enroll(); // factorType defaults to totp
```

## Why

`issuer` is documented as optional for TOTP (`/// [issuer] : Domain
which the user is enrolled with (TOTP only).`) and is optional in
supabase-js, but the argument validation made it mandatory:

```dart
if (factorType == FactorType.totp && issuer != null) {
  body['issuer'] = issuer;
} else if (factorType == FactorType.phone && phone != null) {
  body['phone'] = phone;
} else {
  throw ArgumentError('Invalid arguments, expected an issuer for totp ...');
}
```

When a TOTP factor is enrolled without an `issuer`, both `if` branches
are false, so it falls through to the `else` and throws `ArgumentError`
synchronously, before any request is sent. The standard `mfa.enroll()`
therefore always failed unless an issuer was passed.

This was an unintended regression from #1188 (Add phone mfa enrollment),
which introduced the combined branch. The existing `enroll totp`
integration test always passes `issuer: 'MyFriend'`, so it never
exercised the no-issuer path.

The fix separates the factor-type handling so TOTP forwards `issuer`
only when provided, while phone enrollment keeps its existing
requirement that a phone number is supplied. The original `else` also
acted as a catch-all that rejected any factor type other than
`totp`/`phone` (`webauthn`, `unknown`); splitting the branches without
keeping an equivalent catch-all would have silently dropped that
validation, letting `enroll(factorType: FactorType.webauthn)` reach the
network with an incomplete, unvalidated body instead of failing fast.
The fix keeps that catch-all as its own `else`.

## Not a breaking change

- TOTP enrollment with an `issuer` behaves exactly as before (the value
is still sent).
- Phone enrollment is unc... (continued)

Coverage Stats

5 of 5 new or added lines in 1 file covered. (100.0%)

103 existing lines in 1 file now uncovered.

4190 of 4884 relevant lines covered (85.79%)

3.86 hits per line