supabase / supabase-flutter / 37939731741

92%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth): only apply an updateUser response to the session of the same user (#1936)

Fixes #1931

## Problem

`updateUser` reads `currentSession` again once the request returns and
copies the returned user into it. If the user signs out and someone else
signs in while the request is in flight, the response overwrites the new
session's user, leaving user B's tokens paired with user A's profile,
and a `userUpdated` event is emitted for it.

## Fix

The returned user is only written into the stored session when its id
matches the session's user id. A session that changed for the same user
in the meantime (for example a refresh or a fresh sign in) still takes
the update.

## Tests

`update_user_race_test.dart` holds the `PUT /user` response open while
the session changes, and covers both cases: a different user signing in
is left untouched with no `userUpdated` event, and the same user with a
newer session still gets the update.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* User updates no longer overwrite a different user’s active session
when sign-in changes while an update is in progress.
* When the same user signs in again during an update, the returned
profile changes are applied without replacing the newer access token.
The user-updated event is emitted only when the response belongs to the
active user.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Coverage Stats

2 of 2 new or added lines in 1 file covered. (100.0%)

40 existing lines in 1 file now uncovered.

9452 of 10307 relevant lines covered (91.7%)

5.25 hits per line