handle_exception never raises AuthWeakPasswordError for responses without an error code

[hsusul]

Bug report

supabase_auth.helpers.handle_exception has a legacy branch meant to raise AuthWeakPasswordError for auth responses that report a weak password without an error code. The branch's condition can never be true, so those responses are downgraded to a generic AuthApiError and callers lose .reasons.

https://github.com/supabase/supabase-py/blob/main/src/auth/src/supabase_auth/helpers.py#L165-L178

if (
    isinstance(data, dict)
    and data
    and isinstance(data.get("weak_password"), dict)   # must be a dict ...
    and data.get("weak_password")
    and isinstance(data.get("weak_password"), list)   # ... and also a list
    and len(data["weak_password"])
):

A value cannot be both a dict and a list, so the guard is always False. The checks are also on the wrong object: reasons (the list) is nested inside weak_password (the dict), so len(data["weak_password"]) measures the wrong thing.

The existing test suite documents this — tests/test_helpers.py contains a test whose comment reads "there's a logical error in the code ... This can never be true", and another that only reaches the branch by monkeypatching isinstance and len.

Reproduction

from unittest.mock import MagicMock
from httpx import HTTPStatusError, Response
from supabase_auth.helpers import handle_exception

response = MagicMock(spec=Response)
response.status_code = 422
response.headers = {}
response.json.return_value = {
    "message": "Password too weak",
    "weak_password": {"reasons": ["length", "characters"]},
}

error = handle_exception(
    HTTPStatusError("weak password", request=MagicMock(), response=response)
)
print(type(error).__name__, getattr(error, "reasons", None))

Expected behavior

AuthWeakPasswordError ['length', 'characters'] — matching auth-js, which raises AuthWeakPasswordError when data.weak_password.reasons is a non-empty array of strings (fetch.ts).

Actual behavior

AuthApiError None — the application cannot tell the user why the password was rejected.

Impact

Auth servers that do not send code / error_code (responses predating the 2024-01-01 API version, which the code explicitly intends to support) never produce AuthWeakPasswordError from this SDK.

System information

• supabase-py: main @ bb7ecc5
• Package: supabase_auth