[Bug]: Receive an event .signedIn instead of .passwordRecovery when verify email OTP with type .recovery

[vatson1]

Version

2.37.0

Platform

iOS

Swift Version

6.0

What happened?

The issue is similar to
supabase/auth-js#349

Steps to Reproduce

1. Import Supabase
2. Create a client
   supabase = SupabaseClient(supabaseURL: ..., supabaseKey: ...)
3. Create a user (can do manually in Supabase UI)
4. Run a task which will track auth events (can do in AppModel)

        Task {
            for await (event, session) in supabase.auth.authStateChanges {
                await MainActor.run {
                    switch event {
                    case .initialSession:
                        print(event.rawValue)
                    case .passwordRecovery:
                        print(event.rawValue)
                    case .signedIn:
                        print(event.rawValue)
                    case .signedOut:
                        print(event.rawValue)
                    case .tokenRefreshed:
                        print(event.rawValue)
                    default:
                        break
                    }
                }
            }
        }

5. Trigger sending a recovery email

try await supabase.auth.resetPasswordForEmail(email)

6. Call OTP verification by the token

try await supabase.auth.verifyOTP(email: email, token: emailConfirmationCode, type: .recovery)

7. Check the event type received

Actual Result:

Expected Behaviour:
event = passwordRecovery

Code Sample

Relevant log output

[vatson1]

Probably the issue is somewhere here

supabase-swift/Sources/Auth/AuthClient.swift

Lines 890 to 895 in af786cb

	await sessionManager.update(session)
	eventEmitter.emit(.signedIn, session: session)
	if let type = params["type"], type == "recovery" {
	eventEmitter.emit(.passwordRecovery, session: session)
	}

[grdsdev]

Hi @vatson1! 👋

Thanks for reporting this issue. The behavior you're seeing is actually expected when using the PKCE flow type.

When you verify an OTP with type .recovery using the PKCE flow, the SDK establishes a session as part of the verification process, which triggers the .signedIn event. This is by design in the PKCE flow, not a bug.

The .passwordRecovery event is typically used in non-PKCE flows or when handling password recovery through different mechanisms. With PKCE, the verification process completes the authentication flow, resulting in a signed-in session, which is why you see .signedIn instead.

If you need to distinguish password recovery from regular sign-ins, you can:

1. Track the recovery flow in your app state before calling verifyOTP
2. Check the session metadata or user state after verification
3. Use a custom flow that doesn't rely solely on the auth event type

If you have any questions or need help implementing a workaround, feel free to ask here!

Thanks again for the detailed report! 🙏