docs(examples): add authentication example covering all sign in methods#1627
Merged
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis pull request adds a Flutter authentication example to the workspace. It provides password, email and phone OTP, OAuth, anonymous account linking, sign-out, and TOTP MFA flows through an authentication repository and UI, with local Supabase configuration, email templates, SMTP capture, web bootstrap files, and documentation. ChangesAuthentication example
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant HomePage
participant AuthRepository
participant SupabaseAuth
participant LocalSMTP
HomePage->>AuthRepository: submit authentication action
AuthRepository->>SupabaseAuth: execute selected auth operation
SupabaseAuth-->>LocalSMTP: capture OTP or recovery email
SupabaseAuth-->>AuthRepository: return auth response
AuthRepository-->>HomePage: update authentication view
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@examples/authentication/lib/auth_repository.dart`:
- Around line 42-44: Update AuthRepository methods sendPasswordReset and
sendEmailOtp to accept and forward the appropriate redirect parameters
(redirectTo/emailRedirectTo) to the Supabase auth calls, preserving existing
email behavior. Also update _OAuthButtons._signIn to provide the configured
redirectTo when invoking signInWithOAuth so native OAuth flows return to the
app.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e9744760-d435-4658-80c1-a5c010b5545d
📒 Files selected for processing (11)
examples/README.mdexamples/authentication/.gitignoreexamples/authentication/README.mdexamples/authentication/analysis_options.yamlexamples/authentication/lib/auth_repository.dartexamples/authentication/lib/main.dartexamples/authentication/lib/models.dartexamples/authentication/pubspec.yamlexamples/authentication/web/index.htmlexamples/supabase/config.tomlpubspec.yaml
Add a single example under examples/authentication that demonstrates every supabase_flutter sign in method except passkeys: email & password, magic link and email OTP, phone (SMS) OTP, OAuth social, anonymous sign in with account upgrade, and TOTP multi-factor authentication. All auth calls live in a thin AuthRepository so the flows are easy to read and to drive from an integration test. The shared Supabase config enables anonymous sign in, phone auth with a local test OTP, TOTP MFA and the local mail server. Covers SDK-1059, SDK-1060, SDK-1061, SDK-1062, SDK-1063 and SDK-1064.
The default magic-link email only carries a link, so the authentication
example's email OTP flow could not be completed by typing a code. Add a custom
magic_link template that also shows {{ .Token }}, matching what the example's UI
and README describe.
…n example The example only sent the reset email. Add the recovery step: enter the code from the email and a new password to finish the reset (verifyOTP with OtpType.recovery, then updateUser). Add a recovery email template that includes the code, matching the magic-link one.
Two fixes in the authentication example found while writing its tests: - A phone-only user comes back with an empty email string, so the account title fell back to nothing instead of the phone number. - The signed-in view was a const instance, which the framework skips rebuilding, so upgrading an anonymous account did not refresh the screen. Pass the user in so it rebuilds on every auth change.
Pass a redirectTo/emailRedirectTo through the OAuth, magic link/email OTP and password reset calls so native builds return to the app after the provider or email link, using a deep link that is null on web (site URL) and registered in the shared config's additional_redirect_urls.
spydon
force-pushed
the
lukasklingsbo/sdk-1059-1064-example-authentication
branch
from
July 21, 2026 13:22
bf794de to
e6a6196
Compare
spydon
added a commit
that referenced
this pull request
Jul 22, 2026
## What Adds a repo-level `.coderabbit.yaml` that disables CodeRabbit's failing commit status: ```yaml reviews: commit_status: true fail_commit_status: false ``` ## Why Open PRs are currently showing a red `CodeRabbit` check with the reason **"Review rate limited"** (e.g. #1630, #1629, #1627), even though nothing is actually wrong with the change. A completed review shows `pass` (e.g. #1626). - `commit_status: true` keeps the useful passing check for completed reviews. - `fail_commit_status: false` stops CodeRabbit from setting a `failure` status when it can't review (which is what the rate-limit case triggers). Committing the config overrides CodeRabbit's cloud/org defaults. ## Note If a rate-limited PR still goes red after this lands, the rate-limit failure path ignores this flag and the only remaining lever is `commit_status: false` (disables the check entirely, losing the green pass too).
…9-1064-example-authentication # Conflicts: # examples/README.md
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@examples/authentication/README.md`:
- Line 3: Update the user-facing descriptions in the authentication README to
consistently hyphenate “sign-in,” including the overview and the referenced
email, phone, and anonymous sign-in descriptions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 967427ce-7168-4dad-8bed-0761bf2dda52
📒 Files selected for processing (13)
examples/README.mdexamples/authentication/.gitignoreexamples/authentication/README.mdexamples/authentication/analysis_options.yamlexamples/authentication/lib/auth_repository.dartexamples/authentication/lib/main.dartexamples/authentication/lib/models.dartexamples/authentication/pubspec.yamlexamples/authentication/web/index.htmlexamples/supabase/config.tomlexamples/supabase/templates/magic_link.htmlexamples/supabase/templates/recovery.htmlpubspec.yaml
🚧 Files skipped from review as they are similar to previous changes (9)
- examples/authentication/web/index.html
- examples/authentication/pubspec.yaml
- pubspec.yaml
- examples/authentication/.gitignore
- examples/authentication/lib/models.dart
- examples/README.md
- examples/supabase/config.toml
- examples/authentication/lib/auth_repository.dart
- examples/authentication/lib/main.dart
mandarini
approved these changes
Jul 22, 2026
…9-1064-example-authentication # Conflicts: # examples/README.md
spydon
added a commit
that referenced
this pull request
Jul 23, 2026
…1628) Stacked on #1627. ## What Adds `examples/authentication/integration_test/authentication_test.dart`, an end-to-end suite that drives the authentication app widgets against the local Supabase stack, mirroring the `database_crud` and `passkeys` example tests. One sign in method per test: - **Email & password**: sign up, sign out, a failed sign in, then a successful one. - **Password reset**: request a reset, read the recovery code back from the local mail server, set a new password, then sign in with it. - **Passwordless email OTP**: send the code, read it back from the mail server, enter it and verify. - **Phone SMS OTP**: send to the configured test number and verify with the fixed test code, so no SMS provider is needed. - **Anonymous**: continue as a guest, then upgrade the same user to a permanent account with an email and password. - **MFA (TOTP)**: enroll a factor, compute the current code from the returned secret (RFC 6238, in-test), verify it, then remove the factor. - **OAuth**: assert the provider buttons render. The redirect itself hands off to an external browser and deep link that cannot be automated headlessly, so it is exercised manually per the README. Adds `crypto` and `http` as dev dependencies, used only by the test to compute the TOTP code and to read OTP emails from the local mail server. ## Web vs native targets The password reset and email OTP tests read the code back from the local mail server over HTTP. A browser blocks that cross-origin request, so those two are skipped on web (via `kIsWeb`) and run on native targets such as `-d macos`, where there is no such restriction. ## Verification Ran the suite headlessly against the running local stack (Chrome + chromedriver): **7 passed, 2 skipped, 0 failed**. The five widget-driven flows that don't touch the mail server pass end to end (email & password, phone SMS OTP, anonymous + upgrade, MFA, OAuth buttons), and the two mail-server tests are skipped on web. Both skipped flows were additionally validated end to end against the backend API (email delivery, the six-digit-code extraction, recovery verify, and setting a new password), and they run on `-d macos`. Writing the tests surfaced two real bugs in the example, fixed in the base PR #1627: a phone-only user has an empty email string (so the account title showed nothing), and the signed-in view was a `const` instance the framework skipped rebuilding (so an anonymous upgrade did not refresh the screen). `dart format` and `flutter analyze` are clean. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added end-to-end integration tests covering password, passwordless email OTP, phone sign-in, anonymous upgrade, MFA (TOTP add/remove), and OAuth button rendering. * **Bug Fixes** * Improved test coverage around recovery and OTP behaviors, including appropriate web-vs-native skipping. * **Documentation** * Expanded the authentication example guide with clearer local test instructions, including which flows are automated vs manually exercised and the exact `flutter test` command. * **Chores** * Updated the authentication example dependencies to enable local OTP retrieval and MFA TOTP generation during tests. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a single example app under
examples/authenticationthat demonstrates everysupabase_fluttersign in method except passkeys (which already have their ownpasskeysexample). Pick a method with the chips at the top; once signed in you land on an account screen that manages MFA and can upgrade an anonymous user to a permanent account.Covers these parity example tickets:
signUp,signInWithPassword, and a full password reset (resetPasswordForEmail, thenverifyOTPwithOtpType.recoveryandupdateUser)signInWithOtp(email:)+verifyOTP(type: OtpType.email)signInWithOAuth(Google, GitHub, Apple), including deep-link redirectsignInWithOtp(phone:)+verifyOTP(type: OtpType.sms)signInAnonymously, thenupdateUserto upgrade to a permanent accountauth.mfa.enroll,challengeAndVerify,listFactors,unenrollHow
supabase.auth.*calls live inlib/auth_repository.dart, kept separate from the UI so the flows are easy to read and to drive from an integration test. The UI just calls the repository and rebuilds fromonAuthStateChange.database_crudexample.examples/supabase/config.tomlenables anonymous sign in, phone auth (with a local test OTP so no SMS provider is needed), TOTP MFA, and the local mail server. Custommagic_linkandrecoveryemail templates include the one-time code so the email OTP and reset flows can be completed by typing it.[inbucket]was renamed to the current[local_smtp]section along the way. The example stores no data of its own, so it needs no migration or seed.Testing
Booted the shared local stack and verified against the API that email/password sign up, email OTP (captured by the local mail server), the full password reset loop, phone OTP with the test number, anonymous sign in and its upgrade to a permanent account all work.
dart formatandflutter analyzeare clean. End-to-end integration tests follow in stacked PR #1628; writing them surfaced two display/rebuild bugs that are fixed here.Summary by CodeRabbit
New Features
Documentation