fix(auth): sign in on web via the Firebase popup, not google_sign_in - #24
Merged
Merged
Conversation
The hosted web build could not sign in at all. ApiRepository obtained the Google credential with GoogleSignIn.instance.authenticate(), and google_sign_in_web refuses that outright -- supportsAuthenticate() is false and authenticate() throws UnimplementedError -- so every tap on the only sign-in button on the only shipping target ended in sign-in did not complete: UnimplementedError: authenticate is not supported on the web. Fix: on the web the popup comes from FirebaseAuth instead (FirebaseAuth.signInWithPopup(GoogleAuthProvider())), which completes the sign-in itself. Native android/iOS keeps the v7 flow it needs -- authenticate() -> idToken -> GoogleAuthProvider.credential -> signInWithCredential -- because signInWithPopup is a web-only capability. Consequences worth noting: - AuthRepository.handleGoogleSignIn now returns the signed-in User rather than an AuthCredential. The two transports reach a user in a different number of steps, and a caller handed a credential would have to run a second sign-in to get a user -- a second popup on the web. The bloc's _signInThenFetchToken no longer makes that call, and the credential conversion moved inside the repository where it is used. - The web/native branch is injected (ApiRepository(isWeb:)) so the branch the shipped app takes can be executed under `flutter test`, where kIsWeb is false. That is why this shipped: every test injected a mocked AuthRepository, so the real web path never ran. - FirebaseConfig.googleWebClientId is gone. It existed to feed the google_sign_in web flow; the Firebase popup needs no Google client ID in the app -- the provider is configured on the Firebase project. Nothing else referenced it, and no release script passes GOOGLE_WEB_CLIENT_ID. Coverage: new test/repositories/api_repository_web_test.dart drives the real ApiRepository against a recording FirebaseAuth -- one popup, with a google.com provider, no follow-up signInWithCredential, and popup failures propagate rather than being swallowed. Verified by mutation: reverting the branch selection fails 5 of those 6 tests. Failures still surface as ApiNoData carrying the FirebaseAuthException code (popup_blocked_by_browser, popup_closed_by_user, ...), the existing bloc contract. Issue: workspace-0vt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The hosted web build could not sign in at all. ApiRepository obtained the Google credential with GoogleSignIn.instance.authenticate(), and google_sign_in_web refuses that outright -- supportsAuthenticate() is false and authenticate() throws UnimplementedError -- so every tap on the only sign-in button on the only shipping target ended in
sign-in did not complete: UnimplementedError: authenticate is not
supported on the web.
Fix: on the web the popup comes from FirebaseAuth instead (FirebaseAuth.signInWithPopup(GoogleAuthProvider())), which completes the sign-in itself. Native android/iOS keeps the v7 flow it needs -- authenticate() -> idToken -> GoogleAuthProvider.credential -> signInWithCredential -- because signInWithPopup is a web-only capability.
Consequences worth noting:
flutter test, where kIsWeb is false. That is why this shipped: every test injected a mocked AuthRepository, so the real web path never ran.Coverage: new test/repositories/api_repository_web_test.dart drives the real ApiRepository against a recording FirebaseAuth -- one popup, with a google.com provider, no follow-up signInWithCredential, and popup failures propagate rather than being swallowed. Verified by mutation: reverting the branch selection fails 5 of those 6 tests.
Failures still surface as ApiNoData carrying the FirebaseAuthException code (popup_blocked_by_browser, popup_closed_by_user, ...), the existing bloc contract.
Issue: workspace-0vt