Swift Auth SDK doesn't attach Sign in with Apple's accessToken & refreshTokens to Auth.Session

Open
#2,155 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
go, swift

Research direction

Start with the Swift SDK signInWithIdToken call and inspect how Auth.Session maps providerAccessToken and providerRefreshToken from the Supabase Auth response. Then trace the corresponding Apple sign-in handling in the Go auth service; done means Apple’s access and refresh tokens are available in those Session fields without requiring a second authentication flow.

Written by the indexing model from the issue text.

Description

bug

Bug report

  • I confirm this is a bug with Supabase, not with my own application.
  • I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

The Auth.Session object returned by Supabase's Swift SDK after attempting a Sign in with Apple doesn't appear to return Apple's accessToken or refreshToken in the providerAccessToken or providerRefreshToken fields.

                    let appleIDSession = try await supabaseClient.auth.signInWithIdToken(
                        credentials: .init(provider: .apple, idToken: idToken)
                    )

Checking appleIDSession, you'll see that providerAccessToken and providerRefreshToken are nil and the session's returned accessToken and refreshToken appear to be a Supabase accessToken & refreshToken.

This is troublesome as in trying to Sign in With Apple's token revocation on account deletion by the user, we need to send the Apple accessToken and refreshTokens as documented here: https://github.com/supabase/auth/issues/1308#issuecomment-2518664931

If one instead takes the Apple authorization code and manually hits Apple's token API endpoint, we can get the correct Apple accessToken & refreshToken, but then Supabase will be unable to use the IdToken as it is one-time use and would force us to do a second auth it seems.

Is there any other way to access these from the database side in our Edge Functions?

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. With Supabase Swift SDK, do Sign in With Apple using the following:
                    let appleIDSession = try await supabaseClient.auth.signInWithIdToken(
                        credentials: .init(provider: .apple, idToken: idToken)
                    )
  1. Review the access and refresh token properties and note how none seem to be the Apple access token & refresh token

Expected behavior

Sign in with Apple's accessToken and refreshToken should fill in to Auth.Session's providerAccessToken and providerRefreshToken

Screenshots

N/A

System information

  • OS: iOS with Supabase Swift SDK
  • Browser (if applies): N/A
  • Version of supabase-js: N/A
  • Version of Node.js: N/A

Additional context

Dominant language
Go
Stars
2.6k
Forks
764
Avg merge
5d 3h
Merged PRs (30d)
39

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from supabase/auth

All issues in supabase/auth

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.