fix(gotrue): preserve the error message on 5xx responses - #1653
Conversation
`_handleError` short-circuited on `statusCode >= 500` before parsing the body, so a JSON error body surfaced as a raw JSON string and an HTML or empty body surfaced as noise. Parse the body first, and when it isn't JSON fall back to the response's reason phrase, then to a synthesized `HTTP <status>` for HTTP/2 responses which carry no reason phrase.
github-actions
Bot
added
the
auth
|
Warning Review limit reached
Next review available in: 13 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughGotrue fetch handling now provides fallback messages for retryable HTTP errors. Tests cover JSON and non-JSON 5xx responses, reason phrases, synthesized status messages, and non-retryable 4xx decode failures. ChangesGotrue server error handling
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant GotrueFetch
participant HTTPClient
participant AuthRetryableFetchException
GotrueFetch->>HTTPClient: request HTTP response
HTTPClient-->>GotrueFetch: status, reason phrase, and body
GotrueFetch->>AuthRetryableFetchException: throw status or decoded message for 500+ responses
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/gotrue/lib/src/fetch.dart`:
- Line 65: Wrap the comment near the fetch response decoding logic so each Dart
source line stays within the repository’s 80-character limit, preserving its
wording and meaning; run dart format afterward.
In `@packages/gotrue/test/fetch_test.dart`:
- Around line 131-145: Add a separate 5xx test in the fetch test group using
RawBodyHttpClient with reasonPhrase explicitly set to an empty string, and
assert through _expectRetryableFetch that the message is HTTP 502 and statusCode
is 502. Keep the existing unset-reason test to retain null coverage, and run the
relevant gotrue test suite.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 60293d1a-c509-4699-95e3-0f4df2abc5e2
📒 Files selected for processing (3)
packages/gotrue/lib/src/fetch.dartpackages/gotrue/test/custom_http_client.dartpackages/gotrue/test/fetch_test.dart
Also wrap the empty body comment to fit within 80 characters.
There was a problem hiding this comment.
Pull request overview
This PR adjusts GotrueFetch._handleError so 5xx responses preserve a meaningful error message by parsing JSON bodies first, and falling back to the HTTP reason phrase (or HTTP <status> when absent), aligning behavior with supabase-js and fixing #1651.
Changes:
- Reorders 5xx error handling to parse JSON bodies before throwing
AuthRetryableFetchException. - Adds a reason-phrase /
HTTP <status>fallback for empty or non-JSON 5xx responses. - Adds unit tests covering JSON vs non-JSON 5xx behavior and validates non-JSON 4xx remains
AuthUnknownException.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| packages/gotrue/lib/src/fetch.dart | Reorders 5xx error handling and adds fallback message derivation via reason phrase / synthesized status text. |
| packages/gotrue/test/fetch_test.dart | Adds regression tests for server-error messaging behavior across JSON/non-JSON/empty bodies. |
| packages/gotrue/test/custom_http_client.dart | Adds a raw-body test client to simulate non-JSON/HTML error responses. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| return StreamedResponse( | ||
| Stream.value(utf8.encode(body)), | ||
| statusCode, | ||
| request: request, | ||
| reasonPhrase: reasonPhrase, | ||
| ); |
| test('falls back to the reason phrase on an empty 5xx body', () async { | ||
| final client = RawBodyHttpClient( | ||
| '', | ||
| statusCode: 503, | ||
| reasonPhrase: 'Service Unavailable', | ||
| ); | ||
|
|
||
| await _expectRetryableFetch( | ||
| client, | ||
| message: 'Service Unavailable', | ||
| statusCode: '503', | ||
| ); | ||
| }); |
Also declare a UTF-8 charset on `RawBodyHttpClient` responses, since `package:http` otherwise decodes the body as Latin-1.
What
GotrueFetch._handleErrorshort-circuited onstatusCode >= 500before it looked at the body, and setmessage: response.bodyunconditionally. That meant:{"code":"unexpected_failure","msg":"Error sending confirmation email"}surfaced as the raw JSON string instead of the server sent messageThe 5xx check now runs after the body is parsed, so the server sent message wins. When the body isn't JSON (or is empty), the message falls back to the response's reason phrase, and then to a synthesized
HTTP <status>since HTTP/2 responses carry no reason phrase.Non-5xx handling is untouched: a non-JSON 4xx body still throws
AuthUnknownException.{"msg":"Error sending confirmation email"}{"msg":"Error sending confirmation email"}Error sending confirmation emailBad GatewayBad GatewayHTTP 502Service UnavailableAuthRetryableFetchExceptionand itsstatusCodeare unchanged, so retry behavior is unaffected.Why
Parity with
supabase-js, which made the same reordering in supabase/supabase-js#2587 (a6bcd6ae).Fixes #1651
Summary by CodeRabbit