Dev

.github/workflows/test.yml

@@ -189,7 +189,7 @@ jobs:
         shell: bash
         run: |
           languages=()
-          for language in javascript go python swift php java csharp; do
+          for language in javascript go python swift php java csharp dart kotlin; do
             directory="scripts/code-type-checking/$language/snippets"
             if [[ -d "$directory" ]] && find "$directory" -type f -print -quit | grep -q .; then
               languages+=("$language")
@@ -217,6 +217,8 @@ jobs:
             scripts/code-type-checking/php/snippets
             scripts/code-type-checking/java/snippets
             scripts/code-type-checking/csharp/snippets
+            scripts/code-type-checking/dart/snippets
+            scripts/code-type-checking/kotlin/snippets
           if-no-files-found: error
           retention-days: 1
 

docs/authentication/email-password/initial-setup.mdx

@@ -1145,8 +1145,8 @@ fileprivate class NetworkManager {
 ```
 
 ```dart title="Mobile" option="mobile-frameworks:flutter"
-import 'package:http/http.dart' as base_http;
-import 'package:supertokens_flutter/http.dart' as supertokens_http;
+import 'package:supertokens_flutter/http.dart' as http;
+// SuperTokens wraps the package:http API.
 
 Future<void> makeRequest() async {
     Uri uri = Uri.parse("http://localhost:3001/api");
@@ -1243,8 +1243,8 @@ fileprivate class NetworkManager {
 ```
 
 ```dart title="Mobile" option="mobile-frameworks:flutter"
-// Import http from the SuperTokens package
-import 'package:supertokens_flutter/http.dart' as http;
+import 'package:http/http.dart' as base_http;
+import 'package:supertokens_flutter/http.dart' as supertokens_http;
 
 Future<void> makeRequest() async {
     Uri uri = Uri.parse("http://localhost:3001/api");

docs/authentication/m2m/client-credentials.mdx

@@ -310,8 +310,15 @@ async function verifySessionOrOAuthToken(req: Request, res: Response, next: Next
   const authorization = req.headers.authorization;
 
   if (authorization !== undefined) {
+    const separator = authorization.indexOf(" ");
+    const scheme = authorization.slice(0, separator);
+    const token = authorization.slice(separator + 1);
+    if (separator < 1 || scheme.toLowerCase() !== "bearer" || !token) {
+      return res.status(401).json({ message: "Unauthorized" });
+    }
+
     try {
-      const result = await OAuth2Provider.validateOAuth2AccessToken(match[1], {
+      const result = await OAuth2Provider.validateOAuth2AccessToken(token, {
         audience: "<AUDIENCE>",
         clientId: "<CLIENT_ID>",
         scopes: ["<REQUIRED_SCOPE>"],
@@ -351,9 +358,13 @@ def verify_session_or_oauth_token(request: Request) -> bool:
     authorization = request.headers.get("authorization")
 
     if authorization is not None:
+        scheme, separator, token = authorization.partition(" ")
+        if scheme.lower() != "bearer" or not separator or not token:
+            raise HTTPException(status_code=401, detail="Unauthorized")
+
         try:
             result = validate_oauth2_access_token(
-                token=match.group(1),
+                token=token,
                 requirements=OAuth2TokenValidationRequirements(
                     audience="<AUDIENCE>",
                     client_id="<CLIENT_ID>",

docs/authentication/m2m/legacy-flow.mdx

@@ -194,22 +194,24 @@ func createServiceAccessToken() (string, error) {
 from supertokens_python.recipe.jwt import asyncio
 from supertokens_python.recipe.jwt.interfaces import CreateJwtOkResult
 
-response = await asyncio.create_jwt(
-    {
-        "iss": "https://auth.example.com",
-        "aud": "service-m2",
-        "sub": "service-m1",
-        "source": "microservice",
-        "token_type": "service_access",
-        "permissions": ["comments:write"],
-    },
-    validity_seconds=300,
-    use_static_signing_key=False,
-)
-if not isinstance(response, CreateJwtOkResult):
-    raise RuntimeError("JWT creation failed")
 
-access_token = response.jwt
+async def create_service_access_token() -> str:
+    response = await asyncio.create_jwt(
+        {
+            "iss": "https://auth.example.com",
+            "aud": "service-m2",
+            "sub": "service-m1",
+            "source": "microservice",
+            "token_type": "service_access",
+            "permissions": ["comments:write"],
+        },
+        validity_seconds=300,
+        use_static_signing_key=False,
+    )
+    if not isinstance(response, CreateJwtOkResult):
+        raise RuntimeError("JWT creation failed")
+
+    return response.jwt
 ```
 </ContentOption>
 <ContentOption title="Syncio" value="syncio">

docs/authentication/social/custom-invite-flow.mdx

@@ -148,6 +148,7 @@ Use the check functions from the previous code snippet.
 The overrides reject a provider response without an email before the SDK can generate a synthetic email for a provider
 configured not to require one.
 
+
 <CodeGroup group="backend-language">
 <Tab title="Node.js" value="nodejs">
 ```tsx check=false reason="This example omits surrounding application and SuperTokens configuration."
@@ -230,8 +231,10 @@ ThirdParty.init({
 ```
 </Tab>
 <Tab title="Go" value="go">
+
 Pass the `isEmailAllowed` helper from the previous step to `initThirdPartyWithInvites`, and include the returned recipe in your SuperTokens `RecipeList`. Add your provider configuration to the `TypeInput` below.
 
+
 ```go
 import (
 	"errors"

docs/authentication/social/initial-setup.mdx

@@ -1094,6 +1094,13 @@ async function handleGoogleCallback() {
 ```tsx
 import ThirdParty from "supertokens-node/recipe/thirdparty";
 
+declare function consumeAppleMobileTransaction(input: {
+  id: string;
+  appType: "android";
+  clientType: string;
+  expectedCallback: string;
+}): Promise<{ appRedirectURI: string } | undefined>;
+
 ThirdParty.init({
   override: {
     apis: (original) => {
@@ -1161,6 +1168,8 @@ Follow Apple's official [Configure Sign in with Apple for the web](https://devel
 </ContentOption>
 <ContentOption title="Mobile" value="mobile">
 **Go**
+
+Pass your transaction-consumption implementation to `initThirdPartyWithAppleMobile`, and include the returned recipe in your SuperTokens `RecipeList`. The helper must return an error for missing, expired, or mismatched transactions. Add your Apple provider configuration to the `TypeInput` below.
 </ContentOption>
 </DependentContent>
 
@@ -1192,8 +1201,6 @@ async function appleSignInClicked() {
 ```
 </Tab>
 <Tab title="Mobile" value="mobile">
-Pass your transaction-consumption implementation to `initThirdPartyWithAppleMobile`, and include the returned recipe in your SuperTokens `RecipeList`. The helper must return an error for missing, expired, or mismatched transactions. Add your Apple provider configuration to the `TypeInput` below.
-
 ```go
 import (
 	"net/http"
@@ -1274,10 +1281,27 @@ This only works for providers which support the [PKCE flow](https://oauth.net/2/
 <CodeGroup passive group="frontend-custom-ui">
 <Tab title="Mobile" value="mobile">
 ```python
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+from urllib.parse import urlencode
+
 from supertokens_python.recipe import thirdparty
 from supertokens_python.recipe.thirdparty.interfaces import APIInterface, APIOptions
-from typing import Dict, Any
-from urllib.parse import urlencode
+
+
+@dataclass
+class AppleMobileTransaction:
+    app_redirect_uri: str
+
+
+async def consume_apple_mobile_transaction(
+    id: str,
+    app_type: str,
+    client_type: str,
+    expected_callback: str,
+) -> Optional[AppleMobileTransaction]:
+    # Atomically consume and return the matching transaction from your database.
+    raise NotImplementedError
 
 def override_thirdparty_apis(original_implementation: APIInterface):
     original_apple_redirect_post = original_implementation.apple_redirect_handler_post