fix(gotrue)!: assert asyncStorage is provided for PKCE flow in the constructor

packages/supabase/lib/src/supabase_client.dart

@@ -44,9 +44,11 @@ import 'trace_http_client.dart';
 /// Pass an instance of `YAJsonIsolate` to [isolate] to use your own persisted
 /// isolate instance. A new instance will be created if [isolate] is omitted.
 ///
-/// Pass an instance of `AuthAsyncStorage` to the `pkceAsyncStorage` field of
-/// [authOptions] and set its `authFlowType` field to `AuthFlowType.pkce` in
-/// order to perform auth actions with pkce flow.
+/// The pkce flow is used by default and keeps its code verifiers in the
+/// `AuthAsyncStorage` passed to the `pkceAsyncStorage` field of [authOptions].
+/// Pass a `MemoryAuthAsyncStorage` when the flow starts and completes within
+/// the same process, or a persistent implementation when the code is exchanged
+/// after a restart.
 /// {@endtemplate}
 class SupabaseClient {
   final String _supabaseKey;

packages/supabase/lib/src/supabase_client_options.dart

@@ -34,6 +34,14 @@ class PostgrestClientOptions {
 
 class AuthClientOptions {
   final bool autoRefreshToken;
+
+  /// Storage for the code verifiers of the pkce flow, required when
+  /// [authFlowType] is [AuthFlowType.pkce].
+  ///
+  /// Pass a [MemoryAuthAsyncStorage] when the flow starts and completes within
+  /// the same process. A persistent implementation is needed when the code is
+  /// exchanged after a restart, which is what `supabase_flutter` does with
+  /// shared preferences.
   final AuthAsyncStorage? pkceAsyncStorage;
   final AuthFlowType authFlowType;
 

packages/supabase/test/client_test.dart

@@ -1,7 +1,8 @@
 import 'dart:async';
 import 'dart:io';
 
-import 'package:supabase/supabase.dart';
+import 'package:supabase/src/supabase_client.dart' as real;
+import 'package:supabase/supabase.dart' hide SupabaseClient;
 import 'package:supabase_common/supabase_common.dart';
 import 'package:test/test.dart';
 import 'package:yet_another_json_isolate/yet_another_json_isolate.dart';
@@ -183,6 +184,36 @@ void main() {
   });
 
   group('auth', () {
+    test('the pkce flow asserts when no pkceAsyncStorage is given', () {
+      expect(
+        () => real.SupabaseClient('http://localhost:1', 'supabaseKey'),
+        throwsA(
+          isA<AssertionError>().having(
+            (error) => error.message,
+            'message',
+            contains('You need to provide asyncStorage to perform pkce flow.'),
+          ),
+        ),
+      );
+    });
+
+    test('the pkce flow works with a MemoryAuthAsyncStorage', () async {
+      final supabase = real.SupabaseClient(
+        'http://localhost:1',
+        'supabaseKey',
+        authOptions: AuthClientOptions(
+          pkceAsyncStorage: MemoryAuthAsyncStorage(),
+        ),
+      );
+      addTearDown(supabase.dispose);
+
+      final response = await supabase.auth.getOAuthSignInUrl(
+        provider: OAuthProvider.github,
+      );
+
+      expect(response.url.queryParameters, contains('code_challenge'));
+    });
+
     test('properly set Authorization header', () async {
       final (:sessionString, :accessToken) = getSessionData(
         DateTime.now().add(Duration(hours: 1)),
@@ -469,3 +500,28 @@ void main() {
     });
   });
 }
+
+/// A [real.SupabaseClient] that falls back to an in-memory pkce storage, so the
+/// tests below do not have to pass one at every construction site.
+class SupabaseClient extends real.SupabaseClient {
+  SupabaseClient(
+    super.supabaseUrl,
+    super.supabaseKey, {
+    super.postgrestOptions,
+    AuthClientOptions authOptions = const AuthClientOptions(),
+    super.storageOptions,
+    super.functionsOptions,
+    super.realtimeClientOptions,
+    super.accessToken,
+    super.headers,
+    super.httpClient,
+    super.isolate,
+  }) : super(
+         authOptions: AuthClientOptions(
+           autoRefreshToken: authOptions.autoRefreshToken,
+           pkceAsyncStorage:
+               authOptions.pkceAsyncStorage ?? MemoryAuthAsyncStorage(),
+           authFlowType: authOptions.authFlowType,
+         ),
+       );
+}

packages/supabase/test/mock_test.dart

@@ -372,11 +372,13 @@ void main() {
       headers: {
         'X-Client-Info': 'supabase-flutter/0.0.0',
       },
+      authOptions: const AuthClientOptions(authFlowType: AuthFlowType.implicit),
     );
     customHeadersClient = SupabaseClient(
       'http://${mockServer.address.host}:${mockServer.port}',
       apiKey,
       headers: {'X-Client-Info': 'supabase-flutter/0.0.0', ...customHeaders},
+      authOptions: const AuthClientOptions(authFlowType: AuthFlowType.implicit),
     );
     hasListener = false;
   });
@@ -848,6 +850,9 @@ void main() {
           'http://${errorServer.address.host}:${errorServer.port}',
           'test-key',
           headers: {'X-Client-Info': 'supabase-flutter/0.0.0'},
+          authOptions: const AuthClientOptions(
+            authFlowType: AuthFlowType.implicit,
+          ),
         );
 
         final stream = errorClient.from('todos').stream(primaryKey: ['id']);
@@ -879,6 +884,9 @@ void main() {
             throw Exception('Token retrieval failed');
           },
           headers: {'X-Client-Info': 'supabase-flutter/0.0.0'},
+          authOptions: const AuthClientOptions(
+            authFlowType: AuthFlowType.implicit,
+          ),
         );
 
         // Should handle token errors gracefully
@@ -897,6 +905,9 @@ void main() {
           'http://${mockServer.address.host}:${mockServer.port}',
           'test-key',
           headers: {'X-Client-Info': 'supabase-flutter/0.0.0'},
+          authOptions: const AuthClientOptions(
+            authFlowType: AuthFlowType.implicit,
+          ),
         );
 
         // First dispose should succeed

packages/supabase/test/realtime_test.dart

@@ -27,6 +27,9 @@ void main() {
       supabase = SupabaseClient(
         'http://${mockServer.address.host}:${mockServer.port}',
         'supabaseKey',
+        authOptions: const AuthClientOptions(
+          authFlowType: AuthFlowType.implicit,
+        ),
       );
 
       channel = supabase.channel('realtime');

packages/supabase/test/stream_filter_test.dart

@@ -8,6 +8,8 @@ import 'package:web_socket_channel/io.dart';
 
 import 'package:supabase_common/testing.dart';
 
+import 'utils.dart';
+
 /// Asserts how the filters of `stream()` are sent to the realtime server and to
 /// PostgREST, without needing either of them to be running.
 void main() {
@@ -36,6 +38,7 @@ void main() {
     supabase = SupabaseClient(
       'http://${InternetAddress.loopbackIPv4.address}:${mockServer.port}',
       localStackServiceRoleKey,
+      authOptions: AuthClientOptions(pkceAsyncStorage: TestAsyncStorage()),
     );
   });
 

packages/supabase/test/stream_integration_test.dart

@@ -8,6 +8,8 @@ import 'package:test/test.dart';
 
 import 'package:supabase_common/testing.dart';
 
+import 'utils.dart';
+
 late SupabaseClient _supabase;
 
 void main() {
@@ -541,8 +543,11 @@ void main() {
 const _streamTimeout = Duration(seconds: 10);
 const _warmUpPrefix = 'warm_up_';
 
-SupabaseClient _createClient() =>
-    SupabaseClient(localStackUrl, localStackServiceRoleKey);
+SupabaseClient _createClient() => SupabaseClient(
+  localStackUrl,
+  localStackServiceRoleKey,
+  authOptions: AuthClientOptions(pkceAsyncStorage: TestAsyncStorage()),
+);
 
 /// Listens to [stream] and asserts that it emits [expectedSnapshots] in order,
 /// where every snapshot is the result of [project] applied to the emitted rows.

packages/supabase/test/trace_propagation_test.dart

@@ -4,6 +4,8 @@ import 'package:supabase/src/trace_http_client.dart';
 import 'package:supabase/supabase.dart';
 import 'package:test/test.dart';
 
+import 'utils.dart';
+
 const _sampledTraceparent =
     '00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01';
 const _unsampledTraceparent =
@@ -132,6 +134,7 @@ void main() {
       _supabaseUrl,
       'anon-key',
       tracePropagationOptions: optionsWith(() => context),
+      authOptions: AuthClientOptions(pkceAsyncStorage: TestAsyncStorage()),
       httpClient: MockClient((request) async {
         restRequest = request;
         return Response(
@@ -156,6 +159,7 @@ void main() {
     final supabase = SupabaseClient(
       _supabaseUrl,
       'anon-key',
+      authOptions: AuthClientOptions(pkceAsyncStorage: TestAsyncStorage()),
       httpClient: MockClient((request) async {
         restRequest = request;
         return Response(

packages/supabase/test/utils.dart

@@ -1,5 +1,7 @@
 import 'dart:convert';
 
+import 'package:supabase/supabase.dart';
+
 /// Construct session data for a given expiration date
 ({String accessToken, String sessionString}) getSessionData(DateTime dateTime) {
   final expiresAt = dateTime.millisecondsSinceEpoch ~/ 1000;
@@ -26,3 +28,5 @@ import 'dart:convert';
       'at":"2023-04-01T08:35:05.226938Z"}}';
   return (accessToken: accessToken, sessionString: sessionString);
 }
+
+class TestAsyncStorage extends MemoryAuthAsyncStorage {}

packages/supabase_auth/example/main.dart

@@ -12,6 +12,9 @@ Future<void> main() async {
       'Authorization': 'Bearer $supabaseKey',
       'apikey': supabaseKey,
     },
+    // The pkce flow needs somewhere to keep its code verifiers. Swap this for
+    // a persistent storage when the code exchange can happen after a restart.
+    asyncStorage: MemoryAuthAsyncStorage(),
   );
 
   try {

packages/supabase_auth/lib/src/auth_client.dart

@@ -45,7 +45,8 @@ class _SessionState {
 /// [httpClient] custom http client.
 ///
 /// [asyncStorage] local storage to store pkce code verifiers. Required when
-/// using the pkce flow.
+/// using the pkce flow. Pass a [MemoryAuthAsyncStorage] when the verifiers
+/// do not need to outlive the process.
 ///
 /// Set [flowType] to [AuthFlowType.implicit] to perform old implicit auth flow.
 /// {@endtemplate}
@@ -157,7 +158,13 @@ class AuthClient {
     Client? httpClient,
     AuthAsyncStorage? asyncStorage,
     AuthFlowType flowType = AuthFlowType.pkce,
-  }) : _url = url ?? AuthConstants.defaultAuthUrl,
+  }) : assert(
+         flowType != AuthFlowType.pkce || asyncStorage != null,
+         'You need to provide asyncStorage to perform pkce flow. Pass a '
+         'MemoryAuthAsyncStorage when the code verifiers do not need to '
+         'outlive the process.',
+       ),
+       _url = url ?? AuthConstants.defaultAuthUrl,
        _headers = {...AuthConstants.defaultHeaders, ...?headers},
        _httpClient = httpClient,
        _asyncStorage = asyncStorage,

packages/supabase_auth/lib/src/types/auth_async_storage.dart

@@ -14,3 +14,26 @@ abstract class AuthAsyncStorage {
   /// Removes an item asynchronously from the storage for the given key.
   Future<void> removeItem({required String key});
 }
+
+/// A [AuthAsyncStorage] that keeps the pkce code verifiers in memory only.
+///
+/// Everything it holds is lost when the process exits, so a pkce flow started
+/// before a restart can no longer be completed. Use a persistent
+/// implementation when the code exchange happens after the app was closed,
+/// which is what `supabase_flutter` does with shared preferences.
+class MemoryAuthAsyncStorage extends AuthAsyncStorage {
+  final _items = <String, String>{};
+
+  @override
+  Future<String?> getItem({required String key}) async => _items[key];
+
+  @override
+  Future<void> setItem({required String key, required String value}) async {
+    _items[key] = value;
+  }
+
+  @override
+  Future<void> removeItem({required String key}) async {
+    _items.remove(key);
+  }
+}

packages/supabase_auth/test/admin_delete_user_test.dart

@@ -4,6 +4,8 @@ import 'package:supabase_auth/supabase_auth.dart';
 import 'package:http/http.dart';
 import 'package:test/test.dart';
 
+import 'utils.dart';
+
 class _CapturingHttpClient extends BaseClient {
   Request? lastRequest;
 
@@ -25,6 +27,7 @@ void main() {
     client = AuthClient(
       url: 'http://localhost:9999',
       httpClient: httpClient,
+      asyncStorage: TestAsyncStorage(),
     );
   });
 

packages/supabase_auth/test/admin_test.dart

@@ -32,6 +32,7 @@ void main() {
         'Authorization': 'Bearer ${getServiceRoleToken(env)}',
         'apikey': getServiceRoleToken(env),
       },
+      asyncStorage: TestAsyncStorage(),
     );
   });