Skip to content

feat: Flutter SDK update for version 24.1.0#309

Closed
ChiragAgg5k wants to merge 2 commits into
mainfrom
dev
Closed

feat: Flutter SDK update for version 24.1.0#309
ChiragAgg5k wants to merge 2 commits into
mainfrom
dev

Conversation

@ChiragAgg5k
Copy link
Copy Markdown
Member

@ChiragAgg5k ChiragAgg5k commented May 7, 2026

This PR contains updates to the SDK for version 24.1.0.

What's Changed

  • Added: Added setCookie() method to Client, ClientIO, and ClientBrowser for forwarding incoming Cookie headers in server-side runtimes
  • Added: Added fusionauth, keycloak, and kick OAuth providers to OAuthProvider enum
  • Updated: Updated X-Appwrite-Response-Format header to 1.9.4
  • Updated: Reformatted generated code to use 4-space indentation

@greptile-apps
Copy link
Copy Markdown

greptile-apps Bot commented May 7, 2026

Greptile Summary

This PR updates the Flutter SDK to version 24.1.0, adding a setCookie() method across all Client implementations, three new OAuth providers (fusionauth, keycloak, kick), and bumping the X-Appwrite-Response-Format header to 1.9.4.

  • setCookie() is added to Client, ClientBase, ClientBrowser, and ClientIO to forward incoming Cookie headers in server-side runtimes; the ClientIO implementation has a potential conflict with the existing CookieManager interceptor that could silently drop the manually-set cookie.
  • Three new OAuth providers are inserted alphabetically into OAuthProvider; CI workflows are updated to actions/checkout@v6 and the pubspec.yaml/README.md version references are updated consistently.

Confidence Score: 3/5

The new setCookie() feature in ClientIO can silently conflict with the CookieManager interceptor, meaning forwarded cookies may be dropped or overwritten in a non-empty jar; needs a fix before the server-side cookie forwarding use-case is reliable.

The setCookie() method in ClientIO stores the header as 'Cookie' (capitalized) in _headers, while the CookieManager interceptor later writes jar cookies under the lowercase 'cookie' key. dart:io's case-insensitive HttpHeaders collapses these to the same canonical header, and the winning value depends on iteration order. In any session where the cookie jar is non-empty, the manually-forwarded cookie could be lost without any error or warning.

lib/src/client_io.dart — the setCookie/CookieManager interaction needs attention before this is shipped.

Important Files Changed

Filename Overview
lib/src/client_io.dart Adds setCookie() which conflicts with the CookieManager interceptor — the manually-set Cookie header and jar cookies use different case keys in a case-sensitive Map, and dart:io resolves duplicates non-deterministically.
lib/src/client_browser.dart Adds setCookie() and bumps version/response-format header; the Cookie header is a browser-forbidden header and will be silently dropped in web environments.
lib/src/client.dart Adds setCookie(String value) to the abstract Client interface; minor double-period typo in the doc comment.
lib/src/client_base.dart Adds setCookie override declaration to ClientBase; straightforward interface compliance.
lib/src/enums/o_auth_provider.dart Adds fusionauth, keycloak, and kick OAuth providers in alphabetical order; no issues.
pubspec.yaml Version bumped from 24.0.0 to 24.1.0.
CHANGELOG.md Adds 24.1.0 changelog entry documenting all new additions and updates.

Reviews (1): Last reviewed commit: "Commit from GitHub Actions (Format and p..." | Re-trigger Greptile

Comment thread lib/src/client_io.dart
Comment on lines +124 to +130
/// The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes.
@override
ClientIO setCookie(value) {
config['cookie'] = value;
addHeader('Cookie', value);
return this;
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 setCookie conflicts with CookieManager interceptor

addHeader('Cookie', value) stores the manual cookie as the key 'Cookie' in _headers. During call(), the CookieManager interceptor then runs request.headers.addAll({HttpHeaders.cookieHeader: cookie}) (using the lowercase key 'cookie'). Because http.BaseRequest.headers is a case-sensitive Map<String, String>, both entries co-exist, but when IOClient forwards them to dart:io's HttpHeaders.set() — which is case-insensitive — the last write for the canonical cookie header wins. The outcome (which value is kept) depends on iteration order and is non-deterministic across Dart versions. In a non-empty cookie jar scenario the forwarded cookie may be silently dropped or partially overwritten by jar cookies.

Comment thread lib/src/client.dart
Comment on lines +84 to +85
/// The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes..
Client setCookie(String value);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Double period at end of doc comment.

Suggested change
/// The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes..
Client setCookie(String value);
/// The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes.
Client setCookie(String value);

Comment on lines +98 to +104
/// The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes.
@override
ClientBrowser setCookie(value) {
config['cookie'] = value;
addHeader('Cookie', value);
return this;
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Cookie is a forbidden header in browsers

Cookie is on the Fetch spec's forbidden header list, so browsers silently discard it when sent via fetch or XMLHttpRequest. Calling setCookie() on ClientBrowser will store the value in config but the header will never reach the server. This is likely acceptable since the method is documented as being for server-side runtimes, but a guard or debugPrint warning when this is called in a browser context would prevent silent mis-use.

@ChiragAgg5k
Copy link
Copy Markdown
Member Author

Closing — changes not substantial enough to warrant a release.

@ChiragAgg5k ChiragAgg5k closed this May 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant