supabase / supabase-flutter / 28525039155
93%

DEFAULT BRANCH: main
Ran
Jobs 8
Files 81
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 85.79% (+0.2%) from 85.629%
28525039155

push

github

web-flow 
fix(gotrue): allow TOTP MFA enrollment without an issuer (#1501)

## What

`GoTrueMFAApi.enroll()` no longer requires an `issuer` when enrolling a
TOTP factor. The canonical call now works:

```dart
final res = await supabase.auth.mfa.enroll(); // factorType defaults to totp
```

## Why

`issuer` is documented as optional for TOTP (`/// [issuer] : Domain
which the user is enrolled with (TOTP only).`) and is optional in
supabase-js, but the argument validation made it mandatory:

```dart
if (factorType == FactorType.totp && issuer != null) {
  body['issuer'] = issuer;
} else if (factorType == FactorType.phone && phone != null) {
  body['phone'] = phone;
} else {
  throw ArgumentError('Invalid arguments, expected an issuer for totp ...');
}
```

When a TOTP factor is enrolled without an `issuer`, both `if` branches
are false, so it falls through to the `else` and throws `ArgumentError`
synchronously, before any request is sent. The standard `mfa.enroll()`
therefore always failed unless an issuer was passed.

This was an unintended regression from #1188 (Add phone mfa enrollment),
which introduced the combined branch. The existing `enroll totp`
integration test always passes `issuer: 'MyFriend'`, so it never
exercised the no-issuer path.

The fix separates the factor-type handling so TOTP forwards `issuer`
only when provided, while phone enrollment keeps its existing
requirement that a phone number is supplied. The original `else` also
acted as a catch-all that rejected any factor type other than
`totp`/`phone` (`webauthn`, `unknown`); splitting the branches without
keeping an equivalent catch-all would have silently dropped that
validation, letting `enroll(factorType: FactorType.webauthn)` reach the
network with an incomplete, unvalidated body instead of failing fast.
The fix keeps that catch-all as its own `else`.

## Not a breaking change

- TOTP enrollment with an `issuer` behaves exactly as before (the value
is still sent).
- Phone enrollment is unc... (continued)

4190 of 4884 relevant lines covered (85.79%)

3.86 hits per line

Coverage Regressions

Lines Coverage ∆ File
103
73.06
0.05% packages/gotrue/lib/src/gotrue_client.dart
Jobs
ID Job ID Ran Files Coverage
6 gotrue - 28525039155.6 27
84.68
GitHub Action Run
7 supabase_flutter - 28525039155.7 11
79.26
GitHub Action Run
8 supabase - 28525039155.8 15
81.8
GitHub Action Run
7 functions_client - 28444889808.7 2
98.57
GitHub Action Run
4 postgrest - 28433368938.4 9
84.29
GitHub Action Run
6 storage_client - 28444889808.6 5
92.98
GitHub Action Run
7 realtime_client - 28433368938.7 11
88.4
GitHub Action Run
3 yet_another_json_isolate - 28433368938.3 1
79.03
GitHub Action Run
Source Files on build 28525039155