supabase / supabase-flutter / 40901490500

94%

push

github

fix(auth): align getClaims and ErrorCode with the canonical spec (#2099)

## Summary

Three drifts found in the canonical behavior audit (SDK-1499):

- SDK-2579: an unknown `kid` in `getClaims` no longer waits for a fixed
30 second window since the last JWKS fetch. The first unknown `kid`
forces a refetch immediately. Each forced refetch that does not resolve
the `kid` doubles the wait before the next one (1, 2, 4, 8, then 16
seconds), and tokens arriving during the wait go through `getUser`. A
refetch that resolves the `kid` clears the wait.
`AuthConstants.jwksUnknownKeyRefetchInterval` is replaced by
`jwksMinRefetchBackoff` and `jwksMaxRefetchBackoff`.
- SDK-2580: `JwtHeader.algorithm` is now nullable, so a token without
`alg` decodes instead of throwing. `getClaims` sends a token with a
missing or unsupported `alg` to `getUser`, as it already did for `HS*`
and tokens without a `kid`.
- SDK-2585: adds `ErrorCode.emailAddressInvalid`
(`email_address_invalid`).

Linear: SDK-2579, SDK-2580, SDK-2585.

## Test plan

- [x] Rotation right after a fetch verifies immediately without
`getUser`
- [x] Repeated unknown `kid`s follow the 1 to 16 second backoff and the
wait clears once a `kid` resolves
- [x] Missing, unsupported and `none` algorithms go through `getUser`
- [x] `ErrorCode.emailAddressInvalid` round trips through `fromCode`
- [x] `dart test` for the get claims suites, `dcm analyze`, `dart
format`


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved sign-in token verification for unknown signing keys. The
system refreshes keys immediately, then increases the wait between
retries up to 16 seconds when a key remains unavailable. During the
wait, or when a token uses a missing or unsupported signing algorithm,
verification falls back to the Auth server.
* Added a specific authentication error code for invalid email
addresses.
<!-- end of au... (continued)

20 of 21 new or added lines in 2 files covered. (95.24%)

12403 of 13164 relevant lines covered (94.22%)

6.55 hits per line