Skip to content

Api._delete swallows non-200 responses, so deleteUser() and signOut() report success on failure #452

Description

@jordivilaga

Steps to reproduce

  1. Get the backend to reject a DELETE. The simplest way today is auth.deleteUser(), which always returns 401 (see #<issue 1>); revoking
    the session from the dashboard and then calling auth.signOut() reproduces it independently.
  2. Observe what the caller receives.

Expected results

The rejection surfaces as a ClerkError, the way _housekeeping handles other responses, so the host app can tell the user something went
wrong.

Actual results

othing is thrown and no result is returned. The response is only written to the log.

This is worse than a lost error, because _tokenCache.clear() in the same method also wipes the local session: currentClient() then
returns Client.empty and isSignedIn becomes false. The SDK state after a failed deletion is identical to a successful one, so a host app
has no signal at all — it signs the user out, sends them to the sign-in screen, and the account is still there. The user believes they
deleted their account.

Code sample

Code sample
lib/src/clerk_api/api.dart — the status is logged and then dropped:                                                                      
                                                                                                                                           
  Future<bool> _delete(String path, {bool requiresSessionId = false}) async {                                                              
    ...                                                                                                                                    
    if (resp.statusCode == 200) {                                                                                                          
      return true;                                                                                                                         
    } else {                                                                                                                               
      logSevere('HTTP error on DELETE $path: ${resp.statusCode}', resp.body);                                                              
    }                                                                                                                                      
                                                                                                                                           
  Future<Client> deleteUser() async {                                                                                                      
    await _delete('/me', requiresSessionId: true);   // bool discarded                                                                     
    return Client.empty;                                                                                                                   
  }                                                                                                                                        
                                                                                                                                           
  lib/src/clerk_auth/auth.dart — the return value is discarded again:

Future<void> deleteUser() async {                                                                                                        
    if (env.user.actions.deleteSelf) {                                                                                                     
      await _api.deleteUser();                                                                                                             
      client = await _api.currentClient();                                                                                                 
      update();                                                                                                                            
    }                                                                                                                                      
                                                                                                                                           
  Both callers of _delete are affected: deleteUser() (/me) and signOut() (/client).

Screenshots or Video

Screenshots / Video demonstration

[Upload media here]

Logs

Logs
[Paste your logs here]

Flutter Doctor output

Doctor output
[Paste your output here]

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions