supabase / supabase-flutter / 41066574325

94%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth): sign out as asked when a global or others sign out finds the refresh token rejected (#2110)

Resolves SDK-2602.

Implements the `global` and `others` part of the sign out spec in
https://github.com/supabase/sdk/pull/302, as amended by
https://github.com/supabase/sdk/pull/302#pullrequestreview-5702878352.

## Problem

`signOut(scope: global | others)` refreshed an expired access token
through `getSession()`. When the server rejected the refresh token, that
regular refresh signed the device out with
`SignOutReason.sessionExpired`, even though the user asked to sign out,
and `signOut` rethrew the raw refresh error. The app could not tell that
the other sessions were left alive.

## Changes

- `global` and `others` now refresh an expired access token themselves
instead of through `getSession()`. A failed refresh emits no events.
- When the server rejects the refresh token, the device is signed out
with `SignOutReason.userInitiated`, no `/logout` request is sent, and
`signOut` throws the new `AuthSessionsNotRevokedException`. It carries
the requested `scope` and the refresh error as `cause`, and its message
says to sign in again to revoke the other sessions.
- A transient refresh failure keeps the session and throws as before,
and an access token still inside its expiry margin is still used to
revoke.
- Registered `AuthSessionsNotRevokedException` as a supporting symbol of
`auth.session.sign_out`.
- Updated the `signOut` dartdoc, the `signOut()` section of
`MIGRATION.md` and the auth setup skill.

## Deviation from the review: a successful refresh is stored

The review asks for the refresh token to be kept in memory, with the
refreshed session not stored. This PR stores a successful refresh and
emits `tokenRefreshed`, like a regular refresh does. Only a failed
refresh stays in memory and emits nothing.

The reason is refresh token rotation. Once a refresh token has been
rotated, reusing it after the reuse interval (10 seconds by default)
makes t... (continued)

Coverage Stats

20 of 34 new or added lines in 2 files covered. (58.82%)

23 existing lines in 3 files now uncovered.

12520 of 13298 relevant lines covered (94.15%)

6.64 hits per line