supabase / supabase-flutter / 32016794095

89%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth): fail with an AuthException when a redirect response has no url (#1728)

## What kind of change does this PR introduce?

Bug fix. Closes SDK-1497.

## What is the current behavior?

Two methods read a `url` out of an untyped response body without
checking it.

`getLinkIdentityUrl` handed the value straight to `OAuthResponse`:

```dart
return OAuthResponse(provider: provider, url: response['url']);
```

`getSSOSignInUrl` cast it:

```dart
return Uri.parse(response['url'] as String);
```

`strict-casts` is not enabled, so the first line compiles as an implicit
downcast. Both forms behave the same at runtime: if the server omits
`url`, or
sends a number or a list for it, the caller gets a bare `TypeError` from
whichever line consumes the value first, with nothing pointing at the
response
that caused it. A `TypeError` is also outside this package's exception
hierarchy, so callers that catch `AuthException` do not see it.

Worth being explicit about: adding an `as String` to the first line
would have
changed nothing at runtime. The implicit downcast already throws the
same
`TypeError` in the same place. Only a real check changes the behaviour.

## What is the new behavior?

Both call sites read the field through one helper that validates it and
throws
an `AuthException` at the response boundary:

```dart
String _urlFromResponse(dynamic response) {
  final url = response is Map ? response['url'] : null;
  if (url is! String) {
    throw AuthException('No url detected.');
  }
  return url;
}
```

The message follows the convention the client already uses for missing
response
fields (`No access_token detected.`, `No refresh_token detected.`, and
so on).
The `response is Map` guard means a body that is not an object at all, a
JSON
list for instance, reports the same error rather than a
`NoSuchMethodError`.

## Tests

`packages/supabase_auth/test/redirect_url_mock_test.dart` covers both
methods
against three malformed bodies each: field absent, field ... (continued)

Coverage Stats

10 of 10 new or added lines in 1 file covered. (100.0%)

23 existing lines in 1 file now uncovered.

5732 of 6496 relevant lines covered (88.24%)

4.11 hits per line