supabase / supabase-flutter / 28852642300

86%

push

github

fix(gotrue): handle already-consented OAuth authorization responses (#1536)

> Stacked on #1535. Review/merge that one first.

## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

`getAuthorizationDetails` crashed with a `FormatException` when the
OAuth 2.1 server short-circuited the consent flow. This happens when a
user who already approved a client starts a new authorization for it:
the server returns a redirect-only body (`{"redirect_url":
"...?code=..."}`) with no user or client, which the parser rejected
because it required a user object.

## What is the new behavior?

`getAuthorizationDetails` now checks whether a `redirect_url` is present
returning `OAuthAuthorizationRedirectResponse` when it is present. When
the key isn't present the old `OAuthAuthorizationDetailsResponse` object
is returned.

Callers now switch on the result and forward the redirect instead of
losing it to an exception. Genuinely malformed detail bodies (no
redirect_url and no user) still throw, so validation isn't weakened.

## Additional context

BREAKING CHANGE: `getAuthorizationDetails` now returns the sealed
`OAuthAuthorizationResponse` instead of
`OAuthAuthorizationDetailsResponse`. Callers must switch/cast to access
client, user, scope and redirectUri.

11 of 11 new or added lines in 1 file covered. (100.0%)

4456 of 5157 relevant lines covered (86.41%)

3.99 hits per line