@depup/supabase__auth-js 2.110.8-depup.0 → 2.111.0-depup.0

package/dist/main/GoTrueClient.js

@@ -717,6 +717,7 @@ class GoTrueClient {
      */
     async signUp(credentials) {
         var _a, _b, _c;
+        let flowId = null;
         try {
             let res;
             if ('email' in credentials) {
@@ -725,11 +726,11 @@ class GoTrueClient {
                 let codeChallengeMethod = null;
                 if (this.flowType === 'pkce') {
                     ;
-                    [codeChallenge, codeChallengeMethod] = await (0, helpers_1.getCodeChallengeAndMethod)(this.storage, this.storageKey);
+                    [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
                 }
                 res = await (0, fetch_1._request)(this.fetch, 'POST', `${this.url}/signup`, {
                     headers: this.headers,
-                    redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
+                    redirectTo: this._maybeAppendFlowIdToRedirect(options === null || options === void 0 ? void 0 : options.emailRedirectTo, flowId),
                     body: {
                         email,
                         password,
@@ -760,7 +761,7 @@ class GoTrueClient {
             }
             const { data, error } = res;
             if (error || !data) {
-                await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+                await (0, helpers_1.removePKCEVerifier)(this.storage, this.storageKey, flowId);
                 return this._returnResult({ data: { user: null, session: null }, error: error });
             }
             const session = data.session;
@@ -772,7 +773,7 @@ class GoTrueClient {
             return this._returnResult({ data: { user, session }, error: null });
         }
         catch (error) {
-            await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+            await (0, helpers_1.removePKCEVerifier)(this.storage, this.storageKey, flowId);
             if ((0, errors_1.isAuthError)(error)) {
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
@@ -987,7 +988,8 @@ class GoTrueClient {
      * {
      *   data: {
      *     provider: 'github',
-     *     url: <PROVIDER_URL_TO_REDIRECT_TO>
+     *     url: <PROVIDER_URL_TO_REDIRECT_TO>,
+     *     flowId: <PKCE_FLOW_ID_OR_NULL>
      *   },
      *   error: null
      * }
@@ -1060,12 +1062,29 @@ class GoTrueClient {
      *
      * @remarks
      * - Used when `flowType` is set to `pkce` in client options.
+     * - When several PKCE flows are in flight at once, pass `options.flowId` so
+     *   the code is exchanged with the verifier created by that specific flow.
+     *   The flow id is returned by `signInWithOAuth`, and with
+     *   `experimental.appendPkceFlowIdToRedirects` enabled it also arrives on
+     *   your callback URL as the reserved `sb_flow_id` query parameter (read
+     *   automatically in a browser).
+     * - When a flow id is present but its stored verifier is gone (evicted,
+     *   already used, or from another device), the call fails with a verifier
+     *   missing error instead of trying another flow's verifier — a mismatched
+     *   verifier would consume the single-use code. Without any flow id the
+     *   most recently stored verifier is used, as before.
      *
      * @example Exchange Auth Code
      * ```js
      * supabase.auth.exchangeCodeForSession('34e770dd-9ff9-416c-87fa-43b31d7ef225')
      * ```
      *
+     * @example Exchange Auth Code for a specific flow (e.g. in a server-side callback handler)
+     * ```js
+     * const flowId = requestUrl.searchParams.get('sb_flow_id')
+     * supabase.auth.exchangeCodeForSession(code, flowId ? { flowId } : undefined)
+     * ```
+     *
      * @exampleResponse Exchange Auth Code
      * ```json
      * {
@@ -1223,15 +1242,15 @@ class GoTrueClient {
      * }
      * ```
      */
-    async exchangeCodeForSession(authCode) {
+    async exchangeCodeForSession(authCode, options) {
         await this.initializePromise;
         if (this.lock != null) {
             // TODO(v3): remove legacy lock path
             return this._acquireLock(this.lockAcquireTimeout, async () => {
-                return this._exchangeCodeForSession(authCode);
+                return this._exchangeCodeForSession(authCode, options);
             });
         }
-        return this._exchangeCodeForSession(authCode);
+        return this._exchangeCodeForSession(authCode, options);
     }
     /**
      * Signs in a user by verifying a message signed by the user's private key.
@@ -1573,8 +1592,23 @@ class GoTrueClient {
             throw error;
         }
     }
-    async _exchangeCodeForSession(authCode) {
-        const storageItem = await (0, helpers_1.getItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+    async _exchangeCodeForSession(authCode, options) {
+        const hasExplicitFlowId = (options === null || options === void 0 ? void 0 : options.flowId) != null;
+        const requestedFlowId = hasExplicitFlowId
+            ? (0, helpers_1.validatePKCEFlowId)(options === null || options === void 0 ? void 0 : options.flowId)
+            : (0, helpers_1.isBrowser)()
+                ? (0, helpers_1.validatePKCEFlowId)((0, helpers_1.parseParametersFromURL)(window.location.href)[constants_1.PKCE_FLOW_ID_PARAM])
+                : null;
+        if (hasExplicitFlowId && !requestedFlowId) {
+            this._debug('#_exchangeCodeForSession()', 'provided flowId is not a valid flow id', options === null || options === void 0 ? void 0 : options.flowId);
+        }
+        // With a flow id (explicit or from the callback URL) the lookup is
+        // slot-only and a miss fails fast — see retrievePKCEVerifier. An invalid
+        // explicit flow id also fails fast rather than borrowing another flow's
+        // verifier.
+        const { verifier: storageItem, flowId } = hasExplicitFlowId && !requestedFlowId
+            ? { verifier: null, flowId: null }
+            : await (0, helpers_1.retrievePKCEVerifier)(this.storage, this.storageKey, requestedFlowId);
         const [codeVerifier, redirectType] = (storageItem !== null && storageItem !== void 0 ? storageItem : '').split('/');
         try {
             if (!codeVerifier && this.flowType === 'pkce') {
@@ -1588,7 +1622,7 @@ class GoTrueClient {
                 },
                 xform: fetch_1._sessionResponse,
             });
-            await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+            await (0, helpers_1.removePKCEVerifier)(this.storage, this.storageKey, flowId);
             if (error) {
                 throw error;
             }
@@ -1606,7 +1640,7 @@ class GoTrueClient {
             return this._returnResult({ data: Object.assign(Object.assign({}, data), { redirectType: redirectType !== null && redirectType !== void 0 ? redirectType : null }), error });
         }
         catch (error) {
-            await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+            await (0, helpers_1.removePKCEVerifier)(this.storage, this.storageKey, flowId);
             if ((0, errors_1.isAuthError)(error)) {
                 return this._returnResult({
                     data: { user: null, session: null, redirectType: null },
@@ -1805,6 +1839,7 @@ class GoTrueClient {
      */
     async signInWithOtp(credentials) {
         var _a, _b, _c, _d, _f;
+        let flowId = null;
         try {
             if ('email' in credentials) {
                 const { email, options } = credentials;
@@ -1812,7 +1847,7 @@ class GoTrueClient {
                 let codeChallengeMethod = null;
                 if (this.flowType === 'pkce') {
                     ;
-                    [codeChallenge, codeChallengeMethod] = await (0, helpers_1.getCodeChallengeAndMethod)(this.storage, this.storageKey);
+                    [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
                 }
                 const { error } = await (0, fetch_1._request)(this.fetch, 'POST', `${this.url}/otp`, {
                     headers: this.headers,
@@ -1824,7 +1859,7 @@ class GoTrueClient {
                         code_challenge: codeChallenge,
                         code_challenge_method: codeChallengeMethod,
                     },
-                    redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
+                    redirectTo: this._maybeAppendFlowIdToRedirect(options === null || options === void 0 ? void 0 : options.emailRedirectTo, flowId),
                 });
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
@@ -1848,7 +1883,7 @@ class GoTrueClient {
             throw new errors_1.AuthInvalidCredentialsError('You must provide either an email or phone number.');
         }
         catch (error) {
-            await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+            await (0, helpers_1.removePKCEVerifier)(this.storage, this.storageKey, flowId);
             if ((0, errors_1.isAuthError)(error)) {
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
@@ -2083,29 +2118,30 @@ class GoTrueClient {
      * ```
      */
     async signInWithSSO(params) {
-        var _a, _b, _c, _d, _f;
+        var _a, _b, _c, _d;
+        let flowId = null;
         try {
             let codeChallenge = null;
             let codeChallengeMethod = null;
             if (this.flowType === 'pkce') {
                 ;
-                [codeChallenge, codeChallengeMethod] = await (0, helpers_1.getCodeChallengeAndMethod)(this.storage, this.storageKey);
+                [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
             }
             const result = await (0, fetch_1._request)(this.fetch, 'POST', `${this.url}/sso`, {
-                body: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, ('providerId' in params ? { provider_id: params.providerId } : null)), ('domain' in params ? { domain: params.domain } : null)), { redirect_to: (_b = (_a = params.options) === null || _a === void 0 ? void 0 : _a.redirectTo) !== null && _b !== void 0 ? _b : undefined }), (((_c = params === null || params === void 0 ? void 0 : params.options) === null || _c === void 0 ? void 0 : _c.captchaToken)
+                body: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, ('providerId' in params ? { provider_id: params.providerId } : null)), ('domain' in params ? { domain: params.domain } : null)), { redirect_to: this._maybeAppendFlowIdToRedirect((_a = params.options) === null || _a === void 0 ? void 0 : _a.redirectTo, flowId) }), (((_b = params === null || params === void 0 ? void 0 : params.options) === null || _b === void 0 ? void 0 : _b.captchaToken)
                     ? { gotrue_meta_security: { captcha_token: params.options.captchaToken } }
                     : null)), { skip_http_redirect: true, code_challenge: codeChallenge, code_challenge_method: codeChallengeMethod }),
                 headers: this.headers,
                 xform: fetch_1._ssoResponse,
             });
             // Automatically redirect in browser unless skipBrowserRedirect is true
-            if (((_d = result.data) === null || _d === void 0 ? void 0 : _d.url) && (0, helpers_1.isBrowser)() && !((_f = params.options) === null || _f === void 0 ? void 0 : _f.skipBrowserRedirect)) {
+            if (((_c = result.data) === null || _c === void 0 ? void 0 : _c.url) && (0, helpers_1.isBrowser)() && !((_d = params.options) === null || _d === void 0 ? void 0 : _d.skipBrowserRedirect)) {
                 window.location.assign(result.data.url);
             }
             return this._returnResult(result);
         }
         catch (error) {
-            await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+            await (0, helpers_1.removePKCEVerifier)(this.storage, this.storageKey, flowId);
             if ((0, errors_1.isAuthError)(error)) {
                 return this._returnResult({ data: null, error });
             }
@@ -2225,6 +2261,7 @@ class GoTrueClient {
      * ```
      */
     async resend(credentials) {
+        let flowId = null;
         try {
             const endpoint = `${this.url}/resend`;
             if ('email' in credentials) {
@@ -2233,7 +2270,7 @@ class GoTrueClient {
                 let codeChallengeMethod = null;
                 if (this.flowType === 'pkce') {
                     ;
-                    [codeChallenge, codeChallengeMethod] = await (0, helpers_1.getCodeChallengeAndMethod)(this.storage, this.storageKey);
+                    [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
                 }
                 const { error } = await (0, fetch_1._request)(this.fetch, 'POST', endpoint, {
                     headers: this.headers,
@@ -2244,10 +2281,10 @@ class GoTrueClient {
                         code_challenge: codeChallenge,
                         code_challenge_method: codeChallengeMethod,
                     },
-                    redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
+                    redirectTo: this._maybeAppendFlowIdToRedirect(options === null || options === void 0 ? void 0 : options.emailRedirectTo, flowId),
                 });
                 if (error) {
-                    await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+                    await (0, helpers_1.removePKCEVerifier)(this.storage, this.storageKey, flowId);
                 }
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
@@ -2269,7 +2306,7 @@ class GoTrueClient {
             throw new errors_1.AuthInvalidCredentialsError('You must provide either an email or phone number and a type');
         }
         catch (error) {
-            await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+            await (0, helpers_1.removePKCEVerifier)(this.storage, this.storageKey, flowId);
             if ((0, errors_1.isAuthError)(error)) {
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
@@ -2671,7 +2708,6 @@ class GoTrueClient {
                     // JWT contains a `session_id` which does not correspond to an active
                     // session in the database, indicating the user is signed out.
                     await this._removeSession();
-                    await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
                 }
                 return this._returnResult({ data: { user: null }, error });
             }
@@ -2803,6 +2839,7 @@ class GoTrueClient {
         return await this._updateUser(attributes, options);
     }
     async _updateUser(attributes, options = {}) {
+        let flowId = null;
         try {
             return await this._useSession(async (result) => {
                 const { data: sessionData, error: sessionError } = result;
@@ -2817,11 +2854,11 @@ class GoTrueClient {
                 let codeChallengeMethod = null;
                 if (this.flowType === 'pkce' && attributes.email != null) {
                     ;
-                    [codeChallenge, codeChallengeMethod] = await (0, helpers_1.getCodeChallengeAndMethod)(this.storage, this.storageKey);
+                    [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
                 }
                 const { data, error: userError } = await (0, fetch_1._request)(this.fetch, 'PUT', `${this.url}/user`, {
                     headers: this.headers,
-                    redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
+                    redirectTo: this._maybeAppendFlowIdToRedirect(options === null || options === void 0 ? void 0 : options.emailRedirectTo, flowId),
                     body: Object.assign(Object.assign({}, attributes), { code_challenge: codeChallenge, code_challenge_method: codeChallengeMethod }),
                     jwt: session.access_token,
                     xform: fetch_1._userResponse,
@@ -2836,7 +2873,7 @@ class GoTrueClient {
             });
         }
         catch (error) {
-            await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+            await (0, helpers_1.removePKCEVerifier)(this.storage, this.storageKey, flowId);
             if ((0, errors_1.isAuthError)(error)) {
                 return this._returnResult({ data: { user: null }, error });
             }
@@ -3229,11 +3266,14 @@ class GoTrueClient {
                 this._debug('#_initialize()', 'begin', 'is PKCE flow', true);
                 if (!params.code)
                     throw new errors_1.AuthPKCEGrantCodeExchangeError('No code detected.');
-                const { data, error } = await this._exchangeCodeForSession(params.code);
+                const { data, error } = await this._exchangeCodeForSession(params.code, {
+                    flowId: params[constants_1.PKCE_FLOW_ID_PARAM],
+                });
                 if (error)
                     throw error;
                 const url = new URL(window.location.href);
                 url.searchParams.delete('code');
+                url.searchParams.delete(constants_1.PKCE_FLOW_ID_PARAM);
                 window.history.replaceState(window.history.state, '', url.toString());
                 return {
                     data: { session: data.session, redirectType: (_a = data.redirectType) !== null && _a !== void 0 ? _a : null },
@@ -3303,8 +3343,16 @@ class GoTrueClient {
      * Checks if the current URL and backing storage contain parameters given by a PKCE flow
      */
     async _isPKCECallback(params) {
+        if (!params.code) {
+            return false;
+        }
+        const flowId = (0, helpers_1.validatePKCEFlowId)(params[constants_1.PKCE_FLOW_ID_PARAM]);
+        if (flowId &&
+            (await (0, helpers_1.getItemAsync)(this.storage, (0, helpers_1.pkceVerifierSlotKey)(this.storageKey, flowId)))) {
+            return true;
+        }
         const currentStorageContent = await (0, helpers_1.getItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
-        return !!(params.code && currentStorageContent);
+        return !!currentStorageContent;
     }
     /**
      * Inside a browser context, `signOut()` will remove the logged in user from the browser session and log them out - removing all items from localstorage and then trigger a `"SIGNED_OUT"` event.
@@ -3362,7 +3410,6 @@ class GoTrueClient {
             var _a;
             const removeCurrentSession = async () => {
                 await this._removeSession();
-                await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
             };
             const { data, error: sessionError } = result;
             if (sessionError && !(0, errors_1.isAuthSessionMissingError)(sessionError)) {
@@ -3606,10 +3653,16 @@ class GoTrueClient {
             catch (err) {
                 await ((_b = this.stateChangeEmitters.get(id)) === null || _b === void 0 ? void 0 : _b.callback('INITIAL_SESSION', null));
                 this._debug('INITIAL_SESSION', 'callback id', id, 'error', err);
-                if ((0, errors_1.isAuthSessionMissingError)(err) || (0, errors_1.isAuthRetryableFetchError)(err)) {
-                    // A missing session or a transient/aborted network failure (e.g. a
-                    // superseded page navigation cancelling the in-flight request) is
-                    // not an application error — warn rather than surface it raw.
+                if ((0, errors_1.isAuthSessionMissingError)(err) ||
+                    (0, errors_1.isAuthRetryableFetchError)(err) ||
+                    ((0, errors_1.isAuthApiError)(err) &&
+                        (err.code === 'refresh_token_not_found' ||
+                            err.code === 'refresh_token_already_used' ||
+                            err.code === 'session_expired'))) {
+                    // A missing session, a transient/aborted network failure (e.g. a
+                    // superseded page navigation cancelling the in-flight request), or
+                    // a dead refresh token (e.g. stale SSR cookies) is not an
+                    // application error — warn rather than surface it raw.
                     console.warn(err);
                 }
                 else {
@@ -3688,9 +3741,10 @@ class GoTrueClient {
     async resetPasswordForEmail(email, options = {}) {
         let codeChallenge = null;
         let codeChallengeMethod = null;
+        let flowId = null;
         if (this.flowType === 'pkce') {
             ;
-            [codeChallenge, codeChallengeMethod] = await (0, helpers_1.getCodeChallengeAndMethod)(this.storage, this.storageKey, true // isPasswordRecovery
+            [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod(true // isPasswordRecovery
             );
         }
         try {
@@ -3702,11 +3756,11 @@ class GoTrueClient {
                     gotrue_meta_security: { captcha_token: options.captchaToken },
                 },
                 headers: this.headers,
-                redirectTo: options.redirectTo,
+                redirectTo: this._maybeAppendFlowIdToRedirect(options.redirectTo, flowId),
             });
         }
         catch (error) {
-            await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+            await (0, helpers_1.removePKCEVerifier)(this.storage, this.storageKey, flowId);
             if ((0, errors_1.isAuthError)(error)) {
                 return this._returnResult({ data: null, error });
             }
@@ -3789,7 +3843,8 @@ class GoTrueClient {
      * {
      *   data: {
      *     provider: 'github',
-     *     url: <PROVIDER_URL_TO_REDIRECT_TO>
+     *     url: <PROVIDER_URL_TO_REDIRECT_TO>,
+     *     flowId: <PKCE_FLOW_ID_OR_NULL>
      *   },
      *   error: null
      * }
@@ -3803,18 +3858,20 @@ class GoTrueClient {
     }
     async linkIdentityOAuth(credentials) {
         var _a;
+        let flowId = null;
         try {
             const { data, error } = await this._useSession(async (result) => {
                 var _a, _b, _c, _d, _f;
                 const { data, error } = result;
                 if (error)
                     throw error;
-                const url = await this._getUrlForProvider(`${this.url}/user/identities/authorize`, credentials.provider, {
+                const { url, flowId: urlFlowId } = await this._getUrlForProvider(`${this.url}/user/identities/authorize`, credentials.provider, {
                     redirectTo: (_a = credentials.options) === null || _a === void 0 ? void 0 : _a.redirectTo,
                     scopes: (_b = credentials.options) === null || _b === void 0 ? void 0 : _b.scopes,
                     queryParams: (_c = credentials.options) === null || _c === void 0 ? void 0 : _c.queryParams,
                     skipBrowserRedirect: true,
                 });
+                flowId = urlFlowId;
                 return await (0, fetch_1._request)(this.fetch, 'GET', url, {
                     headers: this.headers,
                     jwt: (_f = (_d = data.session) === null || _d === void 0 ? void 0 : _d.access_token) !== null && _f !== void 0 ? _f : undefined,
@@ -3826,13 +3883,16 @@ class GoTrueClient {
                 window.location.assign(data === null || data === void 0 ? void 0 : data.url);
             }
             return this._returnResult({
-                data: { provider: credentials.provider, url: data === null || data === void 0 ? void 0 : data.url },
+                data: { provider: credentials.provider, url: data === null || data === void 0 ? void 0 : data.url, flowId },
                 error: null,
             });
         }
         catch (error) {
             if ((0, errors_1.isAuthError)(error)) {
-                return this._returnResult({ data: { provider: credentials.provider, url: null }, error });
+                return this._returnResult({
+                    data: { provider: credentials.provider, url: null, flowId },
+                    error,
+                });
             }
             throw error;
         }
@@ -3875,7 +3935,7 @@ class GoTrueClient {
                 return this._returnResult({ data, error });
             }
             catch (error) {
-                await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+                await (0, helpers_1.removePKCEVerifier)(this.storage, this.storageKey, null);
                 if ((0, errors_1.isAuthError)(error)) {
                     return this._returnResult({ data: { user: null, session: null }, error });
                 }
@@ -3980,7 +4040,7 @@ class GoTrueClient {
         return isValidSession;
     }
     async _handleProviderSignIn(provider, options) {
-        const url = await this._getUrlForProvider(`${this.url}/authorize`, provider, {
+        const { url, flowId } = await this._getUrlForProvider(`${this.url}/authorize`, provider, {
             redirectTo: options.redirectTo,
             scopes: options.scopes,
             queryParams: options.queryParams,
@@ -3990,7 +4050,7 @@ class GoTrueClient {
         if ((0, helpers_1.isBrowser)() && !options.skipBrowserRedirect) {
             window.location.assign(url);
         }
-        return { data: { provider, url }, error: null };
+        return { data: { provider, url, flowId }, error: null };
     }
     /**
      * Recovers the session from LocalStorage and refreshes the token
@@ -4338,7 +4398,7 @@ class GoTrueClient {
         this.lastRefreshFailure = null;
         this.suppressGetSessionWarning = false;
         await (0, helpers_1.removeItemAsync)(this.storage, this.storageKey);
-        await (0, helpers_1.removeItemAsync)(this.storage, this.storageKey + '-code-verifier');
+        await (0, helpers_1.removeAllPKCEVerifiers)(this.storage, this.storageKey);
         await (0, helpers_1.removeItemAsync)(this.storage, this.storageKey + '-user');
         if (this.userStorage) {
             await (0, helpers_1.removeItemAsync)(this.userStorage, this.storageKey + '-user');
@@ -4704,15 +4764,23 @@ class GoTrueClient {
      * @param options.queryParams An object of key-value pairs containing query parameters granted to the OAuth application.
      */
     async _getUrlForProvider(url, provider, options) {
+        let redirectTo = options === null || options === void 0 ? void 0 : options.redirectTo;
+        let codeChallenge = null;
+        let codeChallengeMethod = null;
+        let flowId = null;
+        if (this.flowType === 'pkce') {
+            ;
+            [codeChallenge, codeChallengeMethod, flowId] = await this._getCodeChallengeAndMethod();
+            redirectTo = this._maybeAppendFlowIdToRedirect(redirectTo, flowId);
+        }
         const urlParams = [`provider=${encodeURIComponent(provider)}`];
-        if (options === null || options === void 0 ? void 0 : options.redirectTo) {
-            urlParams.push(`redirect_to=${encodeURIComponent(options.redirectTo)}`);
+        if (redirectTo) {
+            urlParams.push(`redirect_to=${encodeURIComponent(redirectTo)}`);
         }
         if (options === null || options === void 0 ? void 0 : options.scopes) {
             urlParams.push(`scopes=${encodeURIComponent(options.scopes)}`);
         }
-        if (this.flowType === 'pkce') {
-            const [codeChallenge, codeChallengeMethod] = await (0, helpers_1.getCodeChallengeAndMethod)(this.storage, this.storageKey);
+        if (codeChallenge != null && codeChallengeMethod != null) {
             const flowParams = new URLSearchParams({
                 code_challenge: `${encodeURIComponent(codeChallenge)}`,
                 code_challenge_method: `${encodeURIComponent(codeChallengeMethod)}`,
@@ -4726,7 +4794,27 @@ class GoTrueClient {
         if (options === null || options === void 0 ? void 0 : options.skipBrowserRedirect) {
             urlParams.push(`skip_http_redirect=${options.skipBrowserRedirect}`);
         }
-        return `${url}?${urlParams.join('&')}`;
+        return { url: `${url}?${urlParams.join('&')}`, flowId };
+    }
+    /**
+     * Appends the reserved flow id parameter to a redirect URL so the callback
+     * can be matched to the verifier stored for its flow. Opt-in via
+     * `experimental.appendPkceFlowIdToRedirects`: redirect URLs are validated
+     * against the project's allow list including the query string, so an extra
+     * parameter can stop exact (non-wildcard) entries from matching.
+     */
+    _maybeAppendFlowIdToRedirect(redirectTo, flowId) {
+        if (!redirectTo || !flowId || !this.experimental.appendPkceFlowIdToRedirects) {
+            return redirectTo !== null && redirectTo !== void 0 ? redirectTo : undefined;
+        }
+        return (0, helpers_1.appendFlowIdToRedirectTo)(redirectTo, flowId);
+    }
+    /**
+     * Generates and stores a PKCE challenge/verifier pair for a new flow,
+     * logging any pending verifier the bounded slot ring evicts.
+     */
+    async _getCodeChallengeAndMethod(isPasswordRecovery = false) {
+        return (0, helpers_1.getCodeChallengeAndMethod)(this.storage, this.storageKey, isPasswordRecovery, (evictedFlowId) => this._debug('#_getCodeChallengeAndMethod()', 'evicted oldest pending PKCE verifier slot', evictedFlowId));
     }
     async _unenroll(params) {
         try {