supabase / supabase-flutter / 32228326353

89%

Build Type

push

github

Committed by web-flow

Commit Message

fix(gotrue)!: assert asyncStorage is provided for PKCE flow in the constructor (#1489)

**Root cause**
When `flowType` is `AuthFlowType.pkce` (the default) and no
`asyncStorage` is provided, calling `getOAuthSignInUrl()` or
`getLinkIdentityUrl()` fails late at call time. To provide a better
developer experience and fail fast, the misconfiguration should be
validated up front in the constructor.

**Fix**
Added an `assert` in the `GoTrueClient` constructor to validate that
`asyncStorage != null` if `flowType == AuthFlowType.pkce`.

**Tests**
- Added a unit test in `gotrue/test/client_test.dart` to verify that
GoTrueClient throws an `AssertionError` if `asyncStorage` is missing
when using PKCE flow.
- Updated all test suites in `gotrue` and `supabase` packages to pass a
mock storage or specify `implicit` flow type where no storage was
configured.

Fixes #1446

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added in-memory storage for PKCE code verifiers.
* Supabase clients now provide in-memory PKCE storage by default for
same-process authentication flows.
* Added guidance for configuring persistent storage when PKCE values
must survive app restarts.

* **Bug Fixes**
* PKCE authentication now validates that required storage is configured.
  * OAuth sign-in URLs correctly include a PKCE code challenge.

* **Tests**
  * Expanded coverage for PKCE setup and in-memory storage behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Lukas Klingsbo <lukas.klingsbo@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Coverage Stats

8 of 8 new or added lines in 3 files covered. (100.0%)

7 existing lines in 1 file now uncovered.

5789 of 6546 relevant lines covered (88.44%)

4.2 hits per line