supabase / supabase-flutter / 35341226893

91%

push

github

fix(auth)!: parse OAuth clients without a name (#1854)

## Summary

Every `admin.oauth` call that returns a client throws `type 'Null' is
not a subtype of type 'String' in type cast` when the client has no
name, because `OAuthClient.fromJson` casts `client_name` to a
non-nullable `String`.

A client name is optional in Auth.
[`validateClientName`](https://github.com/supabase/auth/blob/<a class=hub.com/supabase/supabase-flutter/commit/4eee58f296d9698a1c2c0ae14d7a0b379c7622d3">4eee58f29/internal/api/oauthserver/service.go#L60-L66)
only rejects names over 1024 characters, and the response field is
tagged `omitempty`
([`internal/api/oauthserver/handlers.go`](https://github.com/supabase/auth/blob/4eee58f296d9698a1c2c0ae14d7a0b379c7622d3/internal/api/oauthserver/handlers.go#L30-L47)),
so a client registered without one comes back with no `client_name` key
at all:

```json
{"client_id": "8f2a1c33-3a1e-4f56-9f0b-2d1d5b8a91c4", "client_type": "public", "token_endpoint_auth_method": "none", "registration_type": "dynamic", "redirect_uris": ["https://example.com/callback"], "grant_types": ["authorization_code"], "response_types": ["code"], "created_at": "2025-01-01T00:00:00Z", "updated_at": "2025-01-01T00:00:00Z"}
```

`clientName` is now a `String?`. The same shape reaches `createClient`,
`getClient`, `updateClient` and `listClients`, and `listClients` is the
worst case, since a single nameless client fails the parse of the whole
page.

The sibling type already models it this way:
`OAuthAuthorizedClient.clientName`, which the consent flow parses from
the same column, is a `String?`.

## Compatibility

This is breaking against v2, where the field is non-nullable, so
`MIGRATION.md` gets an entry next to the other OAuth ones.

I left `CreateOAuthClientOptions.clientName` required. The server
accepts a registration without a name, so it could be relaxed too, but
that is a wider change and nothing forces it: clients you create through
the SDK keep their name. Say the word if you want them to match.

## Test

`test/src/types/oa... (continued)

1 of 1 new or added line in 1 file covered. (100.0%)

7863 of 8689 relevant lines covered (90.49%)

4.65 hits per line