supabase / supabase-flutter / 38904765807

92%

push

github

fix(auth)!: throw when a client has no asyncStorage for the pkce flow (#1971)

Fixes [SDK-2259](https://linear.app/supabase/issue/SDK-2259).

## Problem

A plain `SupabaseClient(url, key)` uses the pkce flow without an
`asyncStorage`. The `AuthClient` constructor guarded this with an
assert, which causes two problems:

- `dart run` and AOT builds skip asserts, so they fail later at the
first pkce call with a null check error, far from the cause.
- The message comes from deep inside `supabase_auth` and doesn't say the
fix belongs in the `SupabaseClient` constructor.

## Changes

- `SupabaseClient` checks its `authOptions` before it builds anything
else and throws an `ArgumentError`. The message names the fix
(`authOptions: AuthClientOptions(asyncStorage:
MemoryAuthAsyncStorage())` or the implicit flow). When the code runs
inside a `package:test` test, found through the `#test.invoker` zone
value, the message also points to `testSupabaseClient` from
`supabase_test`. The JSON isolate the client already spawned is disposed
before the throw.
- `AuthClient` throws an `ArgumentError` instead of asserting, for both
the pkce case and `persistSession` without a storage. Debug and release
builds now fail the same way.
- `exchangeCodeForSession` throws an `AuthException` instead of
asserting when there is no verifier store. This can still happen with
the implicit flow and no storage.
- A `SupabaseClient` with a third-party `accessToken` no longer builds
an `AuthClient` at all, since `supabase.auth` already throws in that
mode. Without this, such clients would start throwing in release builds.
- MIGRATION.md gets a section about standalone and server clients
needing an `asyncStorage`, also listed under the changes the compiler
won't catch.

## Breaking change

A client created without an `asyncStorage` under the pkce flow used to
build fine in release builds. It now throws at construction.

18 of 19 new or added lines in 2 files covered. (94.74%)

9648 of 10488 relevant lines covered (91.99%)

5.44 hits per line