supabase / supabase-swift / 35210399762

90%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth): listen on the callback scheme the provider redirects to (#1363)

The two halves of the ASWebAuthenticationSession flow resolved the
redirect with opposite precedence. The authorize request used
`redirectTo ?? configuration.redirectToURL`, so the provider sent the
user to the per-call URL; the session was told to listen on
`(configuration.redirectToURL ?? redirectTo)?.scheme`, the configured
one. A client that set both with different schemes therefore listened
on a scheme the provider never redirected to: the callback was never
matched, the continuation never resumed, and the flow hung with no
error until the user cancelled — surfacing as canceledLogin, which
points nowhere near the cause.

Inverting the one expression would have fixed the symptom. The cause is
that the rule was written out twice, in two functions, which is what
let them drift apart in the first place. So the precedence now lives in
oauthRedirectURL(redirectTo:configured:), both halves route through it,
and oauthCallbackScheme takes the already-resolved URL instead of
re-deriving it. Disagreement stops being a thing that has to be
remembered and becomes structurally impossible.

Two invariants, two tests. prefersThePerCallURLOverTheConfiguredOne
pins which URL wins, and fails if the precedence is re-inverted
(verified by mutation). theCallbackSchemeAlwaysMatchesTheResolvedRedirect
pins that the scheme always belongs to the resolved redirect across
every combination — it cannot fail while both sides share one
resolution, which is the point, and it documents the invariant for
whoever is tempted to re-derive it.

Not marked breaking: under the old behavior this combination hung the
flow, so no working integration can depend on it.

Fixes SDK-1873

Co-authored-by: Claude <noreply@anthropic.com>

Coverage Stats

9 of 16 new or added lines in 1 file covered. (56.25%)

38 existing lines in 1 file now uncovered.

10606 of 11925 relevant lines covered (88.94%)

108.64 hits per line