supabase / supabase-flutter / 31160110944
89%

DEFAULT BRANCH: main
Ran
Jobs 9
Files 99
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 87.351% (+0.1%) from 87.208%
31160110944

push

github

web-flow 
fix(gotrue)!: emit userUpdated instead of signedIn when an email change is confirmed (#1664)

## What

Confirming an email or phone change emitted `AuthChangeEvent.signedIn`,
which made it indistinguishable from an actual sign in. It now emits
`AuthChangeEvent.userUpdated`, the same event that requesting the change
through `updateUser()` emits.

Closes #1398.

## Why this is breaking

The change is silent: nothing stops compiling, the session is still
saved and `currentSession` still updates, only the emitted event
differs. Any `onAuthStateChange` listener that navigates or fetches on
`signedIn` and relied on an email-change confirmation reaching it has to
handle `userUpdated` as well. That is why it is landing on v3.

## The three confirmation paths

| Confirmation | Before | After |
| --- | --- | --- |
| `verifyOTP()` with `OtpType.emailChange` or `OtpType.phoneChange` |
`signedIn` | `userUpdated` |
| `getSessionFromUrl()` with an implicit `type=email_change` link |
`signedIn` | `userUpdated` |
| `exchangeCodeForSession()` for a PKCE code from an email change |
`signedIn` | `userUpdated` |

The PKCE path needed a little more than a branch.
`exchangeCodeForSession()` had no way to know what the code was issued
for, so it always fell through to `signedIn`. `updateUser()` now
persists `userUpdated` alongside the code verifier and the exchange
reads it back, which is the same mechanism `resetPasswordForEmail()`
already used for `passwordRecovery`. As a side effect
`AuthSessionUrlResponse.redirectType` is `'userUpdated'` for that flow
instead of `null`, so the response can be branched on directly.

`phoneChange` is included next to `emailChange` because it is the same
class of operation, and leaving it out would mean a confirmed phone
change and a confirmed email change emit different events for no reason.

Note that supabase-js still emits `SIGNED_IN` here, so this is a
deliberate divergence rather than a parity fix. The issue calls out the
JS behaviour... (continued)

5628 of 6443 relevant lines covered (87.35%)

4.1 hits per line

Coverage Regressions

Lines Coverage ∆ File
5
92.86
 0.36% packages/gotrue/lib/src/fetch.dart
3
96.97
 2.85% packages/gotrue/lib/src/gotrue_admin_api.dart
2
91.67
 0.36% packages/gotrue/lib/src/types/auth_response.dart
Jobs
ID Job ID Ran Files Coverage
7 supabase_flutter - 31160110944.7 10
79.31
 GitHub Action Run
8 gotrue - 31160110944.8 28
88.07
 GitHub Action Run
9 supabase - 31160110944.9 13
87.19
 GitHub Action Run
3 storage_client - 31109618140.3 13
84.52
 GitHub Action Run
4 functions_client - 31109618140.4 3
98.86
 GitHub Action Run
7 postgrest - 31109618140.7 10
85.61
 GitHub Action Run
6 realtime_client - 31109618140.6 11
90.19
 GitHub Action Run
3 supabase_common - 31089994561.3 10
100.0
 GitHub Action Run
2 yet_another_json_isolate - 31109618140.2 1
93.65
 GitHub Action Run
Source Files on build 31160110944