supabase / supabase-flutter / 39958731293

94%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth)!: harden PKCE verifiers, redirectType, signOut and dispose edge cases (#2027)

Fixes
[SDK-2342](https://linear.app/supabase/issue/SDK-2342/fixauth-pkce-verifier-redirecttype-signout-and-dispose-edge-cases).

Five auth edge cases from the v3 review. Each one has a regression test
built on `supabase_test`.

## Changes

### 1. A failed request no longer replaces the PKCE verifier an earlier
email needs

The verifier is still stored before the request goes out, because the
request carries its challenge. When the request fails, the new
`PKCEVerifierStore.discard` removes the verifier's slot and index entry.
If the failed flow was the one under the mirror key, the mirror goes
back to the newest flow that is still pending. A rate-limited second
`signInWithOtp` therefore leaves the first email's link working.

Covered: `signUp` (email), `signInWithOtp` (email), `resend` (email),
`updateUser` (email change), `resetPasswordForEmail`, `getSSOSignInUrl`
and `getLinkIdentityUrl`.

For the email flows, the verifier is discarded when the server answered
with a 4xx error (`AuthApiException`, `AuthUnknownException`). It is
kept when the request may still have gone through and sent the email: no
answer at all (`AuthRetryableFetchException`), or a 5xx
(`AuthRetryableApiException`) that a gateway can return after GoTrue
sent the email. SSO and identity linking return a URL rather than
sending an email, so they discard on any failure.

`resend(type: OtpType.emailChange)` now stores the verifier with the
email-change marker, the same way `updateUser` does. A resent
email-change link exchanged through PKCE therefore reports `emailChange`
and emits `userUpdated`, like the implicit flow.

Known limit: if starting the failed flow evicted the oldest of the 5
pending verifiers, that evicted verifier is not restored.

### 2. `AuthSessionUrlResponse.redirectType` is a typed
`AuthRedirectType` (breaking)

The new enum has three values: `signIn`, `passwordRecovery` and
`em... (continued)

Coverage Stats

83 of 90 new or added lines in 3 files covered. (92.22%)

60 existing lines in 3 files now uncovered.

11449 of 12416 relevant lines covered (92.21%)

5.62 hits per line