supabase / supabase-flutter / 40930954513

94%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth): fail a global or others sign out answered with session_not_found (#2108)

## Summary

`signOut` treated a `403 session_not_found` from `/logout` as "already
signed out" for every scope. That answer only means the current session
is gone, while the other sessions of the user can still exist. So:

- `signOut(scope: SignOutScope.global)` removed the local session,
emitted `signedOut` and returned success, although the other sessions
were still alive.
- `signOut(scope: SignOutScope.others)` returned success without having
revoked anything.

Following the error table of the proposed sign out spec
(supabase/sdk#302):

| Server answer | `local` | `global` | `others` |
| ------------------------ | ------------------ |
--------------------------- | --------------------------- |
| `204` | Success | Success | Success |
| `403` `user_not_found` | Already signed out | Already signed out |
Already signed out |
| `403` `session_not_found`| Already signed out | Throws, local session
kept | Throws, local session kept |

For `global` the local session is kept on that failure, so the app can
fall back to `SignOutScope.local` to sign out the device. The `signOut`
dartdoc now says so.

## Tests

`sign_out_scope_test.dart` gets a group that runs each scope against
`204`, `403 user_not_found` and `403 session_not_found`, checking the
local session, the emitted events and, for the failures, the thrown
error code. The old global test that expected success on
`session_not_found` is replaced, and an others test made redundant by
the new group is removed.

Fixes SDK-2600

Coverage Stats

3 of 3 new or added lines in 1 file covered. (100.0%)

25 existing lines in 1 file now uncovered.

12497 of 13260 relevant lines covered (94.25%)

6.58 hits per line