supabase / supabase-flutter / 37471661362

92%

push

github

fix(auth): refreshing a different invalid token signs out the current session (#1922)

## Problem

The guard around a failed token refresh compared a session version
number, not which refresh token the request redeemed. The version only
moves when the session is replaced, so a failed refresh of a token the
client never stored looked like a failed refresh of the stored session:

- User B is signed in. `refreshSession(tokenA)`, `setSession(tokenA)` or
`recoverSession` with another user's expired session sends a revoked
token A. The server answers `refresh_token_not_found`, the version is
unchanged, and the client removes B's session and emits `signedOut`.
- The `refresh_token_already_used` branch returned the stored session to
a caller who asked to refresh token A, handing B's session to whoever
held A.

## Change

`_doRefresh` now scopes the failure handling to the session the rejected
token belongs to:

- The stored session is handed back on `refresh_token_already_used`, or
removed with a `signedOut`, only while its refresh token is the one the
request redeemed.
- A refresh that started with no stored session, the recovery of an
expired persisted session on cold start, still signs out, but only while
nothing has been stored since. A user who signed in while that refresh
was in flight stays signed in.

The success path is unchanged: any sign-in bumps the version, so a stale
result is already discarded there.

No public API changes. Behaviour change on public paths: a foreign
token's `refresh_token_not_found` or `refresh_token_already_used` no
longer signs out or hands over the stored user. The `Sign out on wrong
refresh token` test in `client_test.dart` asserted the old behaviour and
now asserts the new one.

## Tests

New `refresh_token_ownership_test.dart`, built on
`MockSupabaseHttpClient`:

- `refreshSession` and `setSession` with a foreign rejected token keep
the stored session and emit no `signedOut`.
- A foreign `refresh_token_already_used` thro... (continued)

5 of 5 new or added lines in 1 file covered. (100.0%)

9301 of 10165 relevant lines covered (91.5%)

5.28 hits per line