feat(auth): add admin updateFactor for MFA factors

[spydon]

Linear: SDK-2256

Why

auth.admin.update_mfa_factor was added to the capability matrix in supabase/sdk#255 and released in capability-matrix v1.15.0. It is the only way to change a factor's friendly name, or a phone factor's number, after enrollment.

What

• Adds AuthAdminMFAApi.updateFactor({userId, factorId, friendlyName, phone}), which sends PUT /admin/users/{userId}/factors/{factorId}. Only the fields that are given go into the body, so the server's partial-update semantics carry through. Both ids are checked with validateUuid before any request is sent, like listFactors and deleteFactor.
• Adds AuthMFAAdminUpdateFactorResponse, holding the updated Factor.
• Registers auth.admin.update_mfa_factor as implemented in sdk-compliance.yaml.
• Bumps the supabase/sdk pin in validate-capabilities.yml and sync-compliance.yml from capability-matrix v1.14.0 to v1.15.0, the first tag that defines the id. The reusable Dart workflow is unchanged between the two tags.

Verification

• New mock tests cover the method, path, body shape and response parsing. Integration tests against the local stack rename the seeded factor and check that an empty update leaves it unchanged. Id validation is covered in admin_test.dart.
• Against capability-matrix v1.15.0: check-api-symbols, check-drift and validate-compliance all pass.

Summary by CodeRabbit

• New Features
  • Administrators can now update an MFA factor’s friendly name or phone number. Any fields not supplied remain unchanged, and the updated factor is returned.
  • Phone-number changes are ignored for factors that aren’t phone-based.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: supabase/supabase-flutter/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9677bd9a-c35e-4ec0-9e64-6cc8e01665ef

📥 Commits

Reviewing files that changed from the base of the PR and between 8d9a929 and 8f4f38f.

📒 Files selected for processing: 8

• .github/workflows/sync-compliance.yml
• .github/workflows/validate-capabilities.yml
• packages/supabase_auth/lib/src/auth_admin_mfa_api.dart
• packages/supabase_auth/lib/src/types/mfa.dart
• packages/supabase_auth/test/admin_test.dart
• packages/supabase_auth/test/admin_update_factor_test.dart
• packages/supabase_auth/test/src/auth_admin_mfa_api_test.dart
• sdk-compliance.yaml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Walkthrough

The admin MFA API adds factor updates with optional friendly name and phone fields. It validates the user and factor IDs, parses the response, adds tests, and registers the capability in compliance configuration.

Changes: Admin MFA factor update

Layer / File(s)	Summary
Factor update API and response model packages/supabase_auth/lib/src/types/mfa.dart, packages/supabase_auth/lib/src/auth_admin_mfa_api.dart	Adds a response model and an updateFactor method. The method validates both IDs, sends only non-null update fields, and parses the response.
Factor update validation and behavior tests packages/supabase_auth/test/admin_test.dart, packages/supabase_auth/test/admin_update_factor_test.dart, packages/supabase_auth/test/src/auth_admin_mfa_api_test.dart	Tests cover invalid IDs, request method and body, response parsing, and updated factor details.
Capability compliance registration sdk-compliance.yaml, .github/workflows/sync-compliance.yml, .github/workflows/validate-capabilities.yml	Registers the update capability as implemented and updates both compliance workflow references to v1.15.0.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant AuthAdminMFAApi
  participant AuthAPI
  Caller->>AuthAdminMFAApi: updateFactor(userId, factorId, optional fields)
  AuthAdminMFAApi->>AuthAPI: PUT factor endpoint with non-null fields
  AuthAPI-->>AuthAdminMFAApi: Factor update response
  AuthAdminMFAApi-->>Caller: AuthMFAAdminUpdateFactorResponse

Loading

Suggested reviewers: grdsdev

Merge Risk: ⚪ Minimal · up to 8f4f3

The factor-update response matches the server contract, and no actionable merge-blocking issue was identified. This change is ready to merge after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the main change: adding admin MFA factor updates through updateFactor.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (8 skipped: 8 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}