supabase / supabase-flutter / 28597364234

86%

Build Type

push

github

Committed by web-flow

Commit Message

fix(supabase_flutter): preserve hash routes and repeated query keys when clearing auth params (#1511)

## What

`removeAuthParametersFromUrl` cleans the auth parameters out of a URL
after a code exchange. It had two bugs that broke URLs it was supposed
to leave intact:

1. **Hash-based routes were corrupted.** The fragment was parsed with
`Uri.splitQueryString` and re-emitted as query parameters, so a route
like `#/dashboard` became `#%2Fdashboard`. Hash-based routing is Flutter
web's **default** URL strategy, so after a PKCE callback the app route
was mangled.
2. **Repeated query keys were dropped.** It read `queryParameters` (last
value wins), so `?tag=a&tag=b` collapsed to `?tag=b`.

Both contradict the function's own docstring ("preserving any unrelated
parameters").

## Why

```dart
// (1) fragment treated as a query string, then re-encoded
Uri.splitQueryString(currentUri.fragment)   // '/dashboard' -> {'/dashboard': ''}
// (2) last-wins map loses duplicates
Map<String, String>.of(currentUri.queryParameters)  // ?tag=a&tag=b -> {tag: b}
```

Fix:
- Use `queryParametersAll` so repeated keys are preserved.
- Only rewrite the fragment when it actually contains an auth parameter
(implicit flow: `#access_token=...`); otherwise preserve it verbatim so
routes aren't touched.

## Not a breaking change

Auth clearing is unchanged: the PKCE `code` in the query and
implicit-flow tokens in the fragment are still removed. Only
previously-corrupted output changes — hash routes and duplicate query
keys are now preserved.

## Tests

Extends `clear_auth_url_parameters_test.dart` (all 6 existing tests
still pass):
- `#/dashboard` is preserved (was `#%2Fdashboard`).
- `?tag=a&tag=b&code=abc123` → `?tag=a&tag=b` (was `?tag=b`).
- Implicit-flow tokens in the fragment are still cleared.

The two new bug tests fail on the current code and pass with the fix.
`dart format` and `dart analyze --fatal-warnings` are clean.

---------

Co-authored-by: Lukas Klingsbo <lukas.kl... (continued)

Coverage Stats

10 of 10 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

4208 of 4897 relevant lines covered (85.93%)

3.97 hits per line