supabase / supabase-flutter / 28525677261

86%

push

github

fix(gotrue): handle access token without amr claim in getAuthenticatorAssuranceLevel (#1478)

## What

`GoTrueClient.mfa.getAuthenticatorAssuranceLevel()` no longer throws
when the current session's access token has no `amr` claim — it returns
an empty `currentAuthenticationMethods` list instead.

## Why

The method cast the claim unconditionally:

```dart
final amr = (payload['amr'] as List)
    .map((e) => AMREntry.fromJson(Map.from(e)))
    .toList();
```

When the access token carries no `amr` claim, `payload['amr']` is
`null`, so `null as List` throws `type 'Null' is not a subtype of type
'List<dynamic>'`. This is a synchronous getter that callers don't expect
to throw, and tokens without `amr` are easy to hit (custom/minimal JWTs,
third-party signers). The fix defaults to an empty list:

```dart
final amr = (payload['amr'] as List? ?? [])
```

## Not a breaking change

When `amr` is present the behavior is identical. The only change is that
an absent claim yields an empty list rather than a crash.

## Tests

Added `packages/gotrue/test/mfa_aal_test.dart`: recovers a session whose
access token has `aal` but no `amr`, and asserts
`getAuthenticatorAssuranceLevel()` returns `aal1` with empty methods.
Without the fix the test crashes with the `Null is not a subtype of
List` cast error.

---------

Co-authored-by: Lukas Klingsbo <lukas.klingsbo@gmail.com>

1 of 1 new or added line in 1 file covered. (100.0%)

4191 of 4884 relevant lines covered (85.81%)

3.86 hits per line