[firebase_auth]: ActionCodeOperation mapping fails due to incorrect requestType casting in ActionCodeInfo

[emisanpre]

Is there an existing issue for this?

• [x] I have searched the existing issues.

Which plugins are affected?

Auth

Which platforms are affected?

iOS

Description

I've already reported this issue in Firebes iOS SDK https://github.com/firebase/firebase-ios-sdk/issues/15010.

In FirebaseAuth/Sources/Swift/ActionCode/ActionCodeInfo.swift, the method actionCodeOperation(forRequestType:) uses camelCase (e.g. "resetPassword", "verifyEmail") to match against the request type string received from the server.

This method should use SCREAMING_SNAKE_CASE.

Because of this mismatch, the method always returns .unknown.

The iOS SDK works as expected, probably the bug comes from flutterfire? I'm not sure.

Reproducing the issue

1. In flutter, try to check an action code:

final action = await _auth.checkActionCode(emailLink.code);
final operation = action.operation;
final isEmailValidation = operation == ActionCodeInfoOperation.verifyEmail;

2. When passed to actionCodeOperation(forRequestType:), the internal mapping in ActionCodeInfo returns .unknown.
3. On iOS isEmailValidation is false, because operation is always returning ActionCodeInfoOperation.unknown.

Firebase Core version

3.14.0

Flutter Version

3.32.2

Relevant Log Output

Flutter dependencies

Expand Flutter dependencies snippet

Replace this line with the contents of your `flutter pub deps -- --style=compact`.

Additional context and comments

Debug screenshots:

[MichaelVerdon]

Hi there 👋 , I was able to reproduce your issue so it will be investigated further!

[MichaelVerdon]

After spending some time investigating, it seems to get evaluated to Unknown before it even undergoes the check on our ios to dart bridge. We are suspecting it could be a native issue but we will try confirm this a bit more.

[MichaelVerdon]

Do you think you could provide a repo we can clone and investigate on? we believe this is a native issue but before we mark it as that we would like to try investigate a full MRE if we can.

[emisanpre]

Hi @MichaelVerdon, unfortunately I can’t share the repository where this issue occurs. However, I’ve already reported the problem in the Firebase iOS SDK repository: https://github.com/firebase/firebase-ios-sdk/issues/15010. It works as expected in a native environment.

This issue wasn’t present before — everything was working fine about a month ago, but I’m not exactly sure when it started happening. I suspect it began after updating to firebase_core version 3.14.0.

[emisanpre]

@MichaelVerdon I created a small and quick demo repository that simulates the behavior from my real project. The only difference here is that you need to manually copy and paste the oobCode from the URL you get from firebase emulator:

http://127.0.0.1:9099/emulator/action?mode=verifyEmail&lang=en&oobCode=I-g_U2kGv1pFGHkIk_o2ABZgaIV2oNL_aNZT4LccAh70U5i8v9dv_A&apiKey=fake-api-key ---> I-g_U2kGv1pFGHkIk_o2ABZgaIV2oNL_aNZT4LccAh70U5i8v9dv_A

Test the issue on iOS, the expected behavior is to successfully verify the email from the app.

[SelaseKay]

Hi @emisanpre, thanks for the additional feedback. I was able to reproduce the issue. As @MichaelVerdon pointed out, it appears to originate from the native SDK. I’ll open a PR to bump the firebase-ios-sdk version. Once that’s merged, it would be great if you could test again to confirm whether it resolves the problem.

[SelaseKay]

Hi @emisanpre, could you test again with the latest firebase_auth version?

[emisanpre]

Hi @SelaseKay ! I upgrade pub file and pods and the error still there ☹️

[emisanpre]

@SelaseKay I'm not entirely sure, but the error shown in the screenshots above comes from the Firebase backend response 👀. It seems like Firebase somehow detects (possibly via a header) that the request is coming from a Flutter app, and that’s why the requestType in the response is VERIFY_EMAIL instead of verifyEmail 🤔.

As I mentioned, this only happens in the Flutter iOS environment, not in a native iOS app, which is why I suspect that might be the cause.

[SelaseKay]

Hi @emisanpre, you're right. It appears the issue still persists. Were you able to test with an iOS only(native) project?

[emisanpre]

Hi @SelaseKay ! I didn't test it in an native iOS project (I haven't developed in native swift yet) but in the issue I opened on firebase-ios-sdk it appears to work as expected... I share you the link of the comment.

https://github.com/firebase/firebase-ios-sdk/issues/15010#issuecomment-2997691859

[SelaseKay]

Hi @emisanpre, I'm able to confirm that issue originates from iOS native SDK. I tested with Firebase iOS SDK version 11.15.0 and was able to reproduce on native. @rizafran , could you confirm which version of iOS SDK you tested with?

[rizafran]

Hi @SelaseKay, I tried it using 11.15.0. The action code in the URL I got (when I clicked it in the email) is still in camel case and I was able to successfully login and verify email. Here's my logs:

URL: https://[redacted].firebaseapp.com//auth/links?link=https://[redacted].firebaseapp.com//auth/action?apiKey%3DAIzaSyDwcU_23U55LusGkS4FptsOF8DQT9Kf3ZQ%26mode%3DverifyEmail%26oobCode%3DFOXBSkBoWjMU1WBxpzdajzu%26continueUrl%3Dhttps://[redacted].firebaseapp.com/email%253D%252525[email]lang%3Den Lang: Optional("en") actionCode Optional(2) -which is the value for verify email operation.

[SelaseKay]

@rizafran, that's strange. In my case, I passed the oobjCode(from the link sent to my email) to the checkActionCode function and observed the requestType value returned. It was VERIFY_EMAIL.

[emisanpre]

Hi @rizafran @SelaseKay ! any update with this bug? I update to the recent flutter version (3.32.8) and firebase packages (firebase_auth: ^6.0.0 & firebase_core: ^4.0.0) and error still there.

[rizafran]

I tried to redownload a new copy of iOS quickstart to reproduce the issue again, but I'm still getting the camel case and successfully logged in ☹️.

Hi @SelaseKay, may I know if you use this for testing? I tried to use it, and I'm also getting the signIn and verifyEmail. I only noticed that the Check Action Code button returns the VERIFY_EMAIL.