Skip to content

fix(gotrue): replace assert with AuthException for PKCE asyncStorage check#1349

Open
sanadidari wants to merge 1 commit intosupabase:mainfrom
sanadidari:fix/gotrue-pkce-null-check
Open

fix(gotrue): replace assert with AuthException for PKCE asyncStorage check#1349
sanadidari wants to merge 1 commit intosupabase:mainfrom
sanadidari:fix/gotrue-pkce-null-check

Conversation

@sanadidari
Copy link
Copy Markdown

Fixes #1319

Problem

When flowType is AuthFlowType.pkce (the default) and no asyncStorage
is provided, calling getOAuthSignInUrl() or getLinkIdentityUrl() crashes
in release mode with a cryptic Null check operator used on a null value
error. The existing assert() only runs in debug builds and is silently
stripped in release.

Changes

  • _getUrlForProvider: replace assert + _asyncStorage! with an explicit
    null check that throws a descriptive AuthException in all build modes.
  • getLinkIdentityUrl: add null check on res['url'] before casting,
    throwing a descriptive AuthException if the provider returns no URL.

Before / After

// Before (crashes silently in release)
assert(_asyncStorage != null, 'You need to provide asyncStorage...');
await _asyncStorage!.setItem(...);

// After (throws clear error in all build modes)
final storage = _asyncStorage;
if (storage == null) {
  throw AuthException('asyncStorage is required for PKCE flow...');
}
await storage.setItem(...);

…check

Added error handling for missing OAuth URL and updated PKCE flow storage check.
@Vinzent03
Copy link
Copy Markdown
Collaborator

I think a better solution for this is to add an assert statement in the constructor of the gotrue client. But that is a breaking change and therefore add it in v3 #1278 of the library.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Null check operator used on a null value

2 participants