supabase / supabase-swift / 28715233386

81%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth): decode callback URL params once, with form semantics (#1070)

* fix(auth): parse callback URL params with URL form decoding

extractParams had three defects versus parseParametersFromURL in
auth-js:

- Fragment pairs whose value contains an equals sign were dropped, and
  trailing base64 padding was truncated, because the parser split on
  every equals sign and kept only exact pairs.
- The fragment was taken from URLComponents.fragment, which percent-
  decodes before splitting, so encoded delimiters (%26, %3D) corrupted
  the parse and double-encoded values decoded twice.
- Plus signs were never decoded as spaces on either path, so GoTrue
  error descriptions rendered as Email+link+is+invalid+or+has+expired.

Parse the percent-encoded fragment and query with the same
URLSearchParams semantics: split pairs first, then decode plus signs
and percent escapes once.

* refactor(auth): address review — remove double + decoding, keep prior pair semantics

- Drop the now-redundant `+`→space passes in handleImplicitGrantFlow and
  handlePKCEFlow (decoding is centralized in extractParams; the second pass
  corrupted values with a literal + sent as %2B).
- Drop bare keys and empty-value pairs so error-detection control flow
  matches the previous implementation.
- Rename the private helper to parseFormEncodedPairs and build pairs
  directly instead of allocating URLQueryItem.

* test(auth): cover reviewer scenarios — bare query key dropped, literal + preserved

* chore: ignore url-encoded cspell fragments

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Coverage Stats

18 of 18 new or added lines in 2 files covered. (100.0%)

6 existing lines in 2 files now uncovered.

7665 of 9468 relevant lines covered (80.96%)

36.87 hits per line