supabase / supabase-flutter / 32250379512

89%

Build Type

push

github

Committed by web-flow

Commit Message

feat(auth): store PKCE verifiers per flow to survive overlapping flows (#1662)

## Summary

Each PKCE flow now keeps its code verifier in a slot of its own instead
of a single fixed key that a later flow silently overwrote. Starting an
OAuth sign-in while a password recovery was still pending used to break
whichever of the two completed second.

**Outcome:** implemented

Closes #1648, SDK-1429.

## What changed

- **Per-flow verifier slots**
(`packages/supabase_auth/lib/src/pkce_verifier_store.dart`, new).
Verifiers are stored under
`supabase.auth.token-flow-<flowId>-code-verifier`. At most five are
kept, oldest evicted first, tracked in an index entry because
`AuthAsyncStorage` cannot enumerate keys. Flow ids are validated against
a fixed shape both when they are read and when they are stored, since
they can arrive from a callback URL and a slot written under an id the
index cannot validate could never be evicted again. Marked `@internal`.
- **`OAuthResponse.flowId`** returns the id of the flow that
`getOAuthSignInUrl` or `getLinkIdentityUrl` started, `null` on the
implicit flow.
- **`exchangeCodeForSession(authCode, {String? flowId})`** picks that
flow's verifier. A given flow id is looked up in its slot only,
deliberately without falling back to the most recent verifier:
submitting a mismatched verifier would spend the single-use auth code. A
malformed flow id fails immediately with a message naming it, rather
than surfacing later as a missing verifier, which would point at storage
instead of the callback URL. Without a flow id the most recently started
flow's verifier is used, so existing callers behave exactly as before.
- **`getSessionFromUrl`** reads the reserved `sb_flow_id` query
parameter off the callback URL, which is how `supabase_flutter` handles
auth deep links, so the right verifier is picked without the app
threading anything itself.
- **`appendPkceFlowIdToRedirects`** on `AuthClient`, `AuthClientOptions`
and `FlutterAuthClientOptions`... (continued)

Coverage Stats

139 of 141 new or added lines in 5 files covered. (98.58%)

1 existing line in 1 file now uncovered.

5911 of 6659 relevant lines covered (88.77%)

4.27 hits per line