supabase / supabase-flutter / 39922342490

93%

push

github

fix(realtime): keep the realtime access token in sync with third-party auth and every session change (#2016)

Realtime channels kept using a stale JWT in two cases, so realtime RLS
failed or saw the wrong identity.

## Changes

- **Third-party `accessToken` is asked on every heartbeat.**
`sendHeartbeat` passed the cached token to `setAccessToken`, which only
consults `customAccessToken` when given `null`, so the provider ran once
at connect and never again. Firebase, Auth0 and Clerk users lost
realtime once their first token expired. The heartbeat now calls
`setAccessToken(null)`, matching realtime-js. A throwing provider is
logged and the current token is kept, so the heartbeat timer never
surfaces an unhandled error.
- **Every session change reaches realtime.** `SupabaseClient` only
forwarded `initialSession`, `signedIn` and `tokenRefreshed`. Sessions
from `mfaChallengeVerified`, `passwordRecovery` and `userUpdated` (email
change redirects) left realtime on the previous token, for example still
aal1 after `mfa.verify`. Every event other than `signedOut` now forwards
its token, and `setAccessToken` already skips unchanged tokens.

## Tests

- `supabase_realtime/test/heartbeat_test.dart`: token rotation across
heartbeats with a custom provider, and a throwing provider keeping the
current token.
- `supabase/test/realtime_access_token_test.dart`: realtime follows
sign-in, refresh, sign-out (API key fallback), MFA verify, password
recovery and email change redirects.

Fixes SDK-2332


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Bug Fixes**
* Realtime connections now use the current authentication token after
sign-in, token refresh, MFA verification, and recovery or email-change
redirects. After sign-out, they fall back to the API key.
* Custom token providers are checked before acknowledged heartbeats so
realtime access can stay up to date. If token retrieva... (continued)

19 of 20 new or added lines in 2 files covered. (95.0%)

10735 of 11707 relevant lines covered (91.7%)

5.4 hits per line