feat: expose flowOutput on AuthenticationResponse (#154)

Author: shilgapira

src/flows/FlowCoordinator.swift

@@ -307,25 +307,40 @@ public class DescopeFlowCoordinator {
     }
 
     // Authentication
+    
+    private func handleData(_ data: Data?) async {
+        let jwtResponse = await parseJWTResponse(data)
+        if let jwtResponse {
+            do {
+                let authResponse = try jwtResponse.convert()
+                logger.debug("Finishing flow with an authentication response", data)
+                return handleSuccess(authResponse)
+            } catch {
+                logger.debug("Finishing flow with a partial authentication response")
+            }
+        }
 
-    private func handleAuthentication(_ data: Data) {
-        logger.info("Finishing flow authentication")
-        Task {
-            guard let authResponse = await parseAuthentication(data) else { return }
-            handleSuccess(authResponse)
+        if let session = flow?.providedSession {
+            if jwtResponse == nil {
+                logger.info("Finishing flow authentication without an authentication response")
+            }
+            return handleSuccess(AuthenticationResponse(sessionToken: session.sessionToken, refreshToken: session.refreshToken, user: session.user, isFirstAuthentication: false, flowOutput: jwtResponse?.flowOutput ?? [:]))
         }
+        
+        logger.error("Couldn't find session to finish flow", flow?.sessionProvider == nil ? "nil provider" : "custom provider")
+        handleError(DescopeError.flowFailed.with(message: "No valid authentication tokens found"))
     }
 
-    private func parseAuthentication(_ data: Data) async -> AuthenticationResponse? {
+    private func parseJWTResponse(_ data: Data?) async -> DescopeClient.JWTResponse? {
+        guard let data, let webView else { return nil }
         do {
-            guard let webView else { return nil }
             var jwtResponse = try JSONDecoder().decode(DescopeClient.JWTResponse.self, from: data)
             let cookies = await webView.configuration.websiteDataStore.httpCookieStore.cookies(for: jwtResponse.cookieDomain, at: webView.url)
             try jwtResponse.setValues(from: data, cookies: cookies, refreshCookieName: bridge.attributes.refreshCookieName)
-            return try jwtResponse.convert()
+            return jwtResponse
         } catch {
+            // should never happen because all JWTResponse fields are optional
             logger.error("Unexpected error parsing authentication response", error, String(bytes: data, encoding: .utf8))
-            handleError(DescopeError.flowFailed.with(message: "No valid authentication response found"))
             return nil
         }
     }
@@ -401,13 +416,8 @@ extension DescopeFlowCoordinator: FlowBridgeDelegate {
     }
 
     func bridgeDidFinish(_ bridge: FlowBridge, data: Data?) {
-        if let data {
-            handleAuthentication(data)
-        } else if let session = flow?.providedSession {
-            handleSuccess(AuthenticationResponse(sessionToken: session.sessionToken, refreshToken: session.refreshToken, user: session.user, isFirstAuthentication: false))
-        } else {
-            logger.error("Couldn't find session to finish flow", flow?.sessionProvider == nil ? "nil provider" : "custom provider")
-            handleError(DescopeError.flowFailed.with(message: "No valid authentication tokens found"))
+        Task { @MainActor in
+            await handleData(data)
         }
     }
 }

src/internal/http/DescopeClient.swift

@@ -443,11 +443,18 @@ final class DescopeClient: HTTPClient, @unchecked Sendable {
         var sessionJwt: String?
         var refreshJwt: String?
         var user: UserResponse?
-        var firstSeen: Bool
+        var firstSeen: Bool?
         var cookieDomain: String?
         var cookieName: String?
         var sessionCookieName: String?
         var externalToken: String?
+        var flowOutput: [String: Any]?
+
+        // we enumerate the properties explicitly to skip over flowOutput, whose
+        // arbitrary JSON object is populated separately in setValues below
+        enum CodingKeys: String, CodingKey {
+            case sessionJwt, refreshJwt, user, firstSeen, cookieDomain, cookieName, sessionCookieName, externalToken
+        }
 
         mutating func setValues(from data: Data, response: HTTPURLResponse) throws {
             guard let url = response.url, let fields = response.allHeaderFields as? [String: String] else { return }
@@ -463,6 +470,9 @@ final class DescopeClient: HTTPClient, @unchecked Sendable {
             if let dict = json["user"] as? [String: Any] {
                 user?.setCustomAttributes(from: dict)
             }
+            if let output = json["flowOutput"] as? [String: Any], !output.isEmpty {
+                flowOutput = output
+            }
             if sessionJwt == nil || sessionJwt == "" {
                 let name = (sessionCookieName == "" ? nil : sessionCookieName) ?? DescopeClient.sessionCookieName
                 sessionJwt = findTokenCookie(named: name, in: cookies)

src/internal/others/Internal.swift

@@ -227,9 +227,10 @@ extension AuthenticationResponse: Codable {
     enum CodingKeys: String, CodingKey {
         case sessionToken = "sessionJwt"
         case refreshToken = "refreshJwt"
+        case externalToken
         case user
         case isFirstAuthentication
-        case externalToken
+        case flowOutput
     }
 
     public init(from decoder: Decoder) throws {
@@ -239,6 +240,11 @@ extension AuthenticationResponse: Codable {
         user = try values.decode(DescopeUser.self, forKey: .user)
         isFirstAuthentication = try values.decode(Bool.self, forKey: .isFirstAuthentication)
         externalToken = try values.decodeIfPresent(String.self, forKey: .externalToken)
+        if let value = try values.decodeIfPresent(String.self, forKey: .flowOutput) {
+            flowOutput = (try? JSONSerialization.jsonObject(with: Data(value.utf8))) as? [String: Any] ?? [:]
+        } else {
+            flowOutput = [:]
+        }
     }
 
     public func encode(to encoder: Encoder) throws {
@@ -248,6 +254,11 @@ extension AuthenticationResponse: Codable {
         try values.encode(user, forKey: .user)
         try values.encode(isFirstAuthentication, forKey: .isFirstAuthentication)
         try values.encodeIfPresent(externalToken, forKey: .externalToken)
+        if !flowOutput.isEmpty, JSONSerialization.isValidJSONObject(flowOutput) {
+            let data = try JSONSerialization.data(withJSONObject: flowOutput)
+            let value = String(bytes: data, encoding: .utf8)
+            try values.encodeIfPresent(value, forKey: .flowOutput)
+        }
     }
 }
 

src/internal/routes/Auth.swift

@@ -21,7 +21,7 @@ final class Auth: DescopeAuth {
     func migrateSession(externalToken: String) async throws(DescopeError) -> AuthenticationResponse {
         let response: MigrateResponse = try await client.migrate(externalToken: externalToken).convert()
         let user = try await me(refreshJwt: response.refreshToken.jwt)
-        return AuthenticationResponse(sessionToken: response.sessionToken, refreshToken: response.refreshToken, user: user, isFirstAuthentication: false)
+        return AuthenticationResponse(sessionToken: response.sessionToken, refreshToken: response.refreshToken, user: user, isFirstAuthentication: false, flowOutput: [:])
     }
 
     func revokeSessions(_ revoke: RevokeType, refreshJwt: String) async throws(DescopeError) {

src/internal/routes/Shared.swift

@@ -73,7 +73,7 @@ extension DescopeClient.JWTResponse {
         guard let sessionJwt, !sessionJwt.isEmpty else { throw DescopeError.decodeError.with(message: "Missing session JWT") }
         guard let refreshJwt, !refreshJwt.isEmpty else { throw DescopeError.decodeError.with(message: "Missing refresh JWT") }
         guard let user else { throw DescopeError.decodeError.with(message: "Missing user details") }
-        return try AuthenticationResponse(sessionToken: Token(jwt: sessionJwt), refreshToken: Token(jwt: refreshJwt), user: user.convert(), isFirstAuthentication: firstSeen, externalToken: externalToken)
+        return try AuthenticationResponse(sessionToken: Token(jwt: sessionJwt), refreshToken: Token(jwt: refreshJwt), externalToken: externalToken, user: user.convert(), isFirstAuthentication: firstSeen ?? false, flowOutput: flowOutput ?? [:])
     }
 }
 

src/sdk/SDK.swift

@@ -147,7 +147,7 @@ public extension DescopeSDK {
     static let name = "DescopeKit"
 
     /// The Descope SDK version
-    static let version = "0.11.1"
+    static let version = "0.11.2"
 }
 
 // Internal

src/types/Responses.swift

@@ -5,12 +5,13 @@ import UIKit
 #endif
 
 /// Returned from user authentication calls.
-public struct AuthenticationResponse: Sendable {
+public struct AuthenticationResponse: @unchecked Sendable {
     public var sessionToken: DescopeToken
     public var refreshToken: DescopeToken
+    public var externalToken: String?
     public var user: DescopeUser
     public var isFirstAuthentication: Bool
-    public var externalToken: String?
+    public var flowOutput: [String: Any]
 }
 
 /// Returned from the ``DescopeAuth/refreshSession(refreshJwt:)`` call.

test/http/JWTResponse.swift

@@ -48,6 +48,32 @@ class TestJWTResponse: XCTestCase {
         XCTAssertNil(authResponse.externalToken)
     }
 
+    func testFlowOutput() async throws {
+        // with flow output
+        var data = Data(flowOutputPayload.utf8)
+        var jwtResponse = try JSONDecoder().decode(DescopeClient.JWTResponse.self, from: data)
+        try jwtResponse.setValues(from: data, cookies: [], refreshCookieName: nil)
+        var authResponse: AuthenticationResponse = try jwtResponse.convert()
+        XCTAssertEqual("value", authResponse.flowOutput["key"] as? String)
+        XCTAssertEqual(3, authResponse.flowOutput["count"] as? Int)
+
+        // survives a Codable round-trip, serialized as a JSON string like customAttributes
+        let encoded = try JSONEncoder().encode(authResponse)
+        let object = try JSONSerialization.jsonObject(with: encoded) as? [String: Any]
+        XCTAssertTrue(object?["flowOutput"] is String)
+        let decoded = try JSONDecoder().decode(AuthenticationResponse.self, from: encoded)
+        XCTAssertEqual("value", decoded.flowOutput["key"] as? String)
+        XCTAssertEqual(3, decoded.flowOutput["count"] as? Int)
+        XCTAssertEqual(true, (decoded.flowOutput["nested"] as? [String: Any])?["inner"] as? Bool)
+
+        // no flow output
+        data = Data(noExternalTokenPayload.utf8)
+        jwtResponse = try JSONDecoder().decode(DescopeClient.JWTResponse.self, from: data)
+        try jwtResponse.setValues(from: data, cookies: [], refreshCookieName: nil)
+        authResponse = try jwtResponse.convert()
+        XCTAssertTrue(authResponse.flowOutput.isEmpty)
+    }
+
     func testPageCookie() async throws {
         let data = Data(authPayload.utf8)
 
@@ -118,6 +144,20 @@ private let externalTokenPayload = """
 }
 """
 
+private let flowOutputPayload = """
+{
+    "sessionJwt": "\(sessionJwt)",
+    "refreshJwt": "\(refreshJwt)",
+    "user": \(userPayload),
+    "firstSeen": true,
+    "flowOutput": {
+        "key": "value",
+        "count": 3,
+        "nested": { "inner": true }
+    }
+}
+"""
+
 private let noExternalTokenPayload = """
 {
     "sessionJwt": "\(sessionJwt)",