supabase / supabase-flutter / 31805117378

89%

push

github

fix(auth): parse expires_in as num in Session.fromJson (#1716)

## What

Fixes an issue where `Session.fromJson` threw a runtime `TypeError` on
Web when compiled with WebAssembly (`flutter build web --wasm`) during
cross-tab authentication synchronization.

Resolves #1687

---

## Root Cause Analysis

In `packages/supabase_auth/lib/src/types/session.dart`,
`Session.fromJson` previously cast `json['expires_in']` directly to
`int?`:

```dart
expiresIn: json['expires_in'] as int?,
```

While JSON parsed by Dart's native `dart:convert` `jsonDecode`
deserializes integer literals as `int`, `Session.fromJson` is also
invoked directly with map payloads from JavaScript interop in
`AuthClient._mayStartBroadcastChannel` (via `broadcast_web.dart`):

```dart
if (messageEvent['session'] != null) {
  session = Session.fromJson(messageEvent['session']);
}
```

In Dart JS-interop (`dartify()`), all JavaScript numbers cross the
boundary as `double` values (e.g. `3600.0`).

- **Under `dart2js`:** Dart integers and doubles share an underlying
JavaScript `Number` representation at runtime, so `3600.0 as int?`
succeeded without throwing.
- **Under `dart2wasm` & Dart VM:** `int` and `double` are distinct
runtime types. Attempting to cast `3600.0 as int?` results in a runtime
error:
  ```
  TypeError: type 'double' is not a subtype of type 'int?' in type cast
  ```

Because this exception occurred inside the `BroadcastChannel`
`onMessage` event listener (outside the initial channel setup
`try/catch` guard), all remaining operations in the listener were
aborted:
- `_saveSession(session)` / `_removeSession()` was skipped.
- `notifyAllSubscribers(event, session: session, broadcast: false)` was
skipped.

Consequently, receiving browser tabs silently failed to synchronize
session state (login, logout, token refresh), causing unexpected
sign-outs or stale tokens when switching between tabs.

---

## Changes

### 1. `Session.fromJson`
In
[`packages/supabase_auth/lib/src/types/sessi... (continued)

7 of 7 new or added lines in 3 files covered. (100.0%)

5716 of 6497 relevant lines covered (87.98%)

4.09 hits per line