feat: Upgrade Auth0.swift to v3.0.2 by NandanPrabhu · Pull Request #909 · auth0/auth0-flutter

NandanPrabhu · 2026-07-28T04:58:54Z

Summary

Upgraded Auth0.swift dependency from v2.x to v3.0.1 for iOS, macOS, tvOS, and watchOS
Updated all Darwin plugin method handlers to handle Auth0 v3 API changes
Updated test suite to match new Auth0.swift v3.0.1 signatures
Removed deprecated APIs and adapted to new error handling patterns

Key Changes

Dependency Updates

Updated podspec files to use Auth0.swift 3.0.2
Updated Swift Package Manager dependencies

API Migration

Error Handling: Migrated from .webAuthError() to .authenticationError() for WebAuth errors
Credentials Manager: Updated credential manager API calls for v3 signatures
Auth API: Adapted authentication API method handlers for new response types
MFA API: Updated multifactor authentication handlers
Passkey Support: Updated passkey credential exchange methods

Test Suite Updates

Updated test mocks and spies to match Auth0.swift v3.0.1 signatures
Fixed error handling assertions in test cases
Updated method signatures across all test files

Test Plan

All existing unit tests pass
iOS example app runs successfully
Login/logout flow works
Credentials manager operations work
MFA flows work correctly
Passkey authentication works

coderabbitai · 2026-07-28T04:59:03Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (3)

main
beta-release/.*
release/.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 212001d2-f774-43aa-9640-7273be6d1e93

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/auth0-swift-v3.0

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Bumps the native iOS/macOS SDK dependency from 2.23.0 to 3.0.1 across the podspecs, Package.swift, and Package.resolved lockfiles, and updates every native call site for the v3 breaking changes: the Authentication -> MFAClient split for OTP login/MFA challenge, WebAuth.clearSession -> logout, CredentialsManager.store/clear becoming throwing calls, CredentialsManager.user -> userProfile(), UserInfo -> UserProfile, and Credentials.expiresIn -> expiresAt. Also updates the Dart-facing multifactorChallenge API: authenticatorId is now required and the types parameter is removed, since Auth0.swift v3's MFAClient.challenge(with:mfaToken:) has no equivalent for challenge-type filtering.

…test suite Fixes a remaining compile error in WebAuthLoginMethodHandler.swift: Auth0.swift v3 made WebAuthentication.safariProvider @MainActor-isolated, which broke the default-argument closure and its call site. Also adds UIScene support (SceneDelegate.swift + Info.plist manifest) and bumps the example app's CocoaPods deployment target to 15.0, both needed to actually launch the example app on current Xcode/iOS Simulator versions. Migrates the darwin plugin's XCTest suite (previously untouched by the v3 dependency bump) to the new SDK shape: Telemetry -> Auth0ClientInfo, UserInfo -> UserProfile, expiresIn -> expiresAt, throwing CredentialsStorage, Request<T,E> -> any Requestable/TokenRequestable (via new MockRequest/MockTokenRequest test doubles), the Authentication -> MFAClient split for OTP login and MFA challenge, and the new WebAuthError cases. All 358 RunnerTests unit tests pass.

The macOS test target was missing 8 MFA-related test files that are referenced by other test files. This caused compilation errors in GitHub Actions when building macOS tests, specifically: - SpyMFAClient not found (defined in MfaSpies.swift) - Other MFA test infrastructure missing Added the following test files to the macOS RunnerTests target: - MfaSpies.swift - MfaGetAuthenticatorsMethodHandlerTests.swift - MfaEnrollTotpMethodHandlerTests.swift - MfaEnrollPhoneMethodHandlerTests.swift - MfaEnrollEmailMethodHandlerTests.swift - MfaEnrollPushMethodHandlerTests.swift - MfaChallengeMethodHandlerTests.swift - MfaVerifyMethodHandlerTests.swift These files already existed in the iOS test target and are shared via relative path (../ios/Tests/Mfa/).

utkrishtsahu · 2026-08-03T09:57:44Z

-        callback(self.credentialsManager.store(credentials: credentials))
+        do {
+            try self.credentialsManager.store(credentials: credentials)
+            callback(true)


store now throws a typed CredentialsManagerError, but this collapses it to a bare false — the caller can't tell why the save failed. Map the caught error to a FlutterError, the way ClearApiCredentialsMethodHandler does in this same PR. Right now the two credential handlers are inconsistent and the new throwing contract buys nothing.

utkrishtsahu · 2026-08-03T09:58:13Z

-        callback(self.credentialsManager.clear())
+        do {
+            try self.credentialsManager.clear()
+            callback(true)


Same issue: the thrown error is discarded. Either propagate FlutterError(from: CredentialsManagerError) or state why clear intentionally stays boolean-only.

utkrishtsahu · 2026-08-03T09:58:43Z

+    // were removed in Auth0.swift v3. These two method handlers use the dedicated `MFAClient`
+    // instead (see Auth0.swift's V3_MIGRATION_GUIDE.md), so they need an `MFAClient` rather than
+    // the `Authentication` client passed to every other handler here.
+    var mfaClientProvider: (_ account: Account) -> MFAClient = { account in


This bypasses everything clientProvider sets up (lines 55–65): no .using(inLibrary:version:) and no useDPoP(). So loginWithOTP and multifactorChallenge now go out without the SDK user-agent header, and ignore useDPoP even when the caller requested it. Apply the same using(...)/DPoP setup to the MFA client — note it needs the userAgent/arguments, which the current closure signature ((_ account: Account)) doesn't take.

utkrishtsahu · 2026-08-03T09:59:20Z

  final String mfaToken;
-  final List<ChallengeType>? types;
-  final String? authenticatorId;
+  final String authenticatorId;


authenticatorId is now required and types removed on the shared platform-interface, but only the Swift native side is updated to match. Android's MultifactorChallengeApiRequestHandler.kt still reads request.data["types"] and treats authenticatorId as optional — after this merges, every Android multifactorChallenge call receives types == null and a shape it doesn't expect. The Dart signature change and the Android handler need to move together.

utkrishtsahu · 2026-08-03T10:00:01Z

    dependencies: [
-        .package(url: "https://github.com/auth0/Auth0.swift", exact: "2.23.0"),
-        .package(url: "https://github.com/auth0/JWTDecode.swift", exact: "3.3.0"),
+        .package(url: "https://github.com/auth0/Auth0.swift", from: "3.0.0"),


SPM floats to any 3.x here while the podspecs pin exact 3.0.1 (and the PR title says 3.0.2). SPM and CocoaPods consumers can resolve to different Auth0.swift builds and CI only exercises one. Pick one version and match it across Package.swift + all three podspecs.

utkrishtsahu · 2026-08-03T10:00:36Z


-  s.dependency 'Auth0', '2.23.0'
-  s.dependency 'JWTDecode', '3.3.0'
+  s.dependency 'Auth0', '3.0.1'


Two things on this line: (a) version mismatch with Package.swift's from: "3.0.0" and the 3.0.2 in the PR title — reconcile; (b) the 3.0 bump silently inherits Auth0.swift's new defaults (scope gaining offline_access, minTTL default 0 → 60), which are runtime behavior shifts for existing apps the moment this merges. Confirm intended or gate/document.

utkrishtsahu · 2026-08-03T10:01:24Z

Deleting these means the example apps re-resolve to whatever 3.x is newest on each build — non-reproducible. Regenerate pinned to the chosen version, or gitignore them deliberately.

…andlers now return flutter result on storing and clearing

NandanPrabhu had a problem deploying to internal July 28, 2026 04:58 — with GitHub Actions Failure

NandanPrabhu temporarily deployed to internal July 28, 2026 04:58 — with GitHub Actions Inactive

NandanPrabhu temporarily deployed to internal July 28, 2026 06:07 — with GitHub Actions Inactive

NandanPrabhu had a problem deploying to internal July 28, 2026 06:07 — with GitHub Actions Failure

NandanPrabhu temporarily deployed to internal July 28, 2026 06:07 — with GitHub Actions Inactive

NandanPrabhu had a problem deploying to internal July 29, 2026 05:20 — with GitHub Actions Failure

NandanPrabhu changed the title ~~feat: Upgrade Auth0.swift to v3.0.1~~ feat: Upgrade Auth0.swift to v3.0.2 Jul 30, 2026

NandanPrabhu temporarily deployed to internal August 3, 2026 05:11 — with GitHub Actions Inactive

NandanPrabhu marked this pull request as ready for review August 3, 2026 05:56

NandanPrabhu requested a review from a team as a code owner August 3, 2026 05:56

NandanPrabhu commented Aug 3, 2026

View reviewed changes

Comment thread auth0_flutter/darwin/auth0_flutter/Sources/auth0_flutter/AuthAPI/AuthAPIHandler.swift Outdated

NandanPrabhu added 4 commits August 3, 2026 14:02

Fixes macOS unit tests

b78b3a2

NandanPrabhu force-pushed the feat/auth0-swift-v3.0 branch from 9c259b3 to b78b3a2 Compare August 3, 2026 08:33

NandanPrabhu temporarily deployed to internal August 3, 2026 08:33 — with GitHub Actions Inactive

utkrishtsahu reviewed Aug 3, 2026

View reviewed changes

utkrishtsahu requested changes Aug 3, 2026

View reviewed changes

Removes existing mfa flow from auth api handler. credential manager h…

88922ca

…andlers now return flutter result on storing and clearing

NandanPrabhu temporarily deployed to internal August 3, 2026 13:32 — with GitHub Actions Inactive

NandanPrabhu deployed to internal August 3, 2026 13:32 — with GitHub Actions Active

NandanPrabhu temporarily deployed to internal August 3, 2026 13:32 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Upgrade Auth0.swift to v3.0.2 - #909

feat: Upgrade Auth0.swift to v3.0.2#909
NandanPrabhu wants to merge 5 commits into
develop/v3.0from
feat/auth0-swift-v3.0

NandanPrabhu commented Jul 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading

Review skipped

Uh oh!

Uh oh!

utkrishtsahu Aug 3, 2026

Uh oh!

utkrishtsahu Aug 3, 2026

Uh oh!

utkrishtsahu Aug 3, 2026

Uh oh!

utkrishtsahu Aug 3, 2026

Uh oh!

utkrishtsahu Aug 3, 2026

Uh oh!

utkrishtsahu Aug 3, 2026

Uh oh!

utkrishtsahu Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

NandanPrabhu commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key Changes

Dependency Updates

API Migration

Test Suite Updates

Test Plan

Uh oh!

coderabbitai Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Uh oh!

utkrishtsahu Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

NandanPrabhu commented Jul 28, 2026 •

edited

Loading

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading