supabase / supabase-flutter / 37469753458

92%

push

github

fix(auth): decode OAuth clients that omit redirect_uris or grant_types (#1923)

Auth tags `redirect_uris`, `grant_types` and `response_types` on an
OAuth client `omitempty`, and Go drops an `omitempty` slice when it is
empty as well as when it is nil. A client holding none of them arrives
without the key, and `OAuthClient.fromJson` threw on the `as List` cast.
One such client failed the whole response, so `listClients`,
`getClient`, `createClient`, `updateClient` and `regenerateClientSecret`
all threw.

## The change

All three now decode a missing key or an explicit null as an empty list.
The public types stay `List<...>`, so this is not a breaking change (the
Swift SDK made them optional instead, see supabase/supabase-swift#1349,
because a default there needed a hand-written decoder).

## Left alone

`OAuthAuthorizationDetailsResponse.redirectUri` is `omitempty` on the
server too, but `/oauth/authorize` rejects a request without a
`redirect_uri` that matches a registered one, so an authorization always
carries it.

## Tests

New `OAuthClient.fromJson` tests decode a client without the three keys
and with them set to null. Both fail against the old cast.

Unknown grant and response types still throw, which SDK-2127 covers. The
other `omitempty` fields and the always-null `scope` field are breaking
to fix, so they are tracked in SDK-2160.

Fixes SDK-2126

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* OAuth client data can now be parsed when redirect URIs, grant types,
or response types are missing or explicitly null. These fields default
to empty lists, allowing records without them to be read consistently.
* **Tests**
* Added coverage confirming that each of these fields parses as an empty
list when omitted or set to null.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

10 of 10 new or added lines in 1 file covered. (100.0%)

9309 of 10176 relevant lines covered (91.48%)

5.18 hits per line