feat: Password support for /e/authorize endpoint by pmathew92 · Pull Request #1088 · auth0/Auth0.Android

pmathew92 · 2026-10-12T02:55:34Z

Changes

This PR adds the support for ROPG in the /e/authorize endpoint. On successful verification the auth0-server returns an authorization code which is exchanged for a valid set of Credentials.

Testing

Please describe how this can be tested by reviewers. Be specific about anything not tested and reasons why. Since this library has unit testing, tests should be added for new functionality and existing tests should complete without errors.

This change adds unit test coverage
This change adds integration test coverage
This change has been tested on the latest version of the platform/language or why not

Checklist

I have read the Auth0 general contribution guidelines
I have read the Auth0 Code of Conduct
All existing and new tests complete without errors

coderabbitai · 2026-10-12T02:55:44Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Team
Run ID: f7fa1f25-4165-450f-9394-c1e5f9bfd43c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

NandanPrabhu · 2026-10-30T07:05:23Z

+    when (e.error) {
+        is EmbeddedAuthError.InsufficientAuthorization -> { /* continuation → VerifyPassword */ }
+        EmbeddedAuthError.InvalidRequest -> {
+            /* the username was rejected (e.g. "Invalid username format.") — fix the input and identify again */


After InvalidRequest the SDK clears the session, so calling identify again fails with NoActiveSession. Suggest: "fix the input and restart with authorize()", as in the InvalidRequest KDoc and authorize.md.

NandanPrabhu · 2026-10-30T07:05:25Z

+        return this
+    }
+
+    fun willReturnInvalidUsernameFormat(): EmbeddedAuthMockServer {


willReturnInvalidUsernameFormat() isn't used by any test. A test for identify(USERNAME) returning InvalidRequest (session cleared) would have caught the docs issue in password-authorize.md.

NandanPrabhu · 2026-10-30T07:05:26Z

+    }
+
+    @Test
+    public fun `verifyPassword await keeps the session for retry when the token exchange fails`(): Unit = runTest {


Question: this test keeps the session after a failed token exchange (the token response has no id_token) and retries verifyPassword with the same auth_session. That retry runs /e/authorize again to get a new code, so it only works if the server accepts the same auth_session after it has already issued a code. The mock server can't tell us that. Can we confirm it with the server team?

For a network error on the token call the code may still be unused, so keeping the session is right there. We'd like both SDKs to behave the same, so we can align Auth0.swift once this is confirmed.

Good catch. Retrying with the same session is not correct .

NandanPrabhu · 2026-10-30T07:05:30Z

+    }
+
+    @Test
+    public fun `verifyPassword await should return credentials`(): Unit = runTest {


All the new verifyPassword tests use execute() or await(). Please add one test with start(callback) (success and failure), since that path goes through AdvancingRequest.start.

Intentionally avoided. await internally calls start. We are just writing duplicate tests.

NandanPrabhu · 2026-10-30T07:05:32Z

+/** The password is submitted as typed — never trimmed — and masked on screen. */
+@Composable
+private fun VerifyPasswordCard(onVerify: (String) -> Unit) {
+    var password by rememberSaveable { mutableStateOf("") }


rememberSaveable writes the password to the saved-state Bundle. Please use remember for the password field; samples get copied into real apps.

Posted by mistake

utkrishtsahu · 2026-10-30T08:58:16Z

    EMAIL,
    /** A phone number. */
    PHONE,
+    /** A username. */


The design doc says the username field can hold either a username or an email ({user_name} / {email}). This KDoc just says "A username." Could we say that an email is also valid, and mention it in password-authorize.md?

There is already an email. The intention was password can be used with both email and username. will update the design doc to clear the confusion. But this is correct

utkrishtsahu · 2026-10-30T08:59:01Z

+                onSubmit = { viewModel.identifyUsername(it) },
+            )
+
+            NextAction.VerifyPassword -> VerifyPasswordCard(


The sample never reads reason, so a wrong password just shows the password card again with no message. authorize.md shows how to surface INVALID_IDENTIFIER_OR_PASSWORD, so the sample should do the same.

pmathew92 force-pushed the feat/password branch from 20839a3 to 7544ab9 Compare October 21, 2026 06:53

Base automatically changed from feat/embedded_mfa to v5_development October 23, 2026 06:39

pmathew92 added 3 commits October 23, 2026 12:50

feat: Password support for /e/authorize endpoint

aa06e80

Added changes for sample app

ffa0c3b

Added required doc change

05cbe63

pmathew92 force-pushed the feat/password branch from 9a54293 to 05cbe63 Compare October 23, 2026 10:40

pmathew92 and others added 3 commits October 23, 2026 16:35

Added breached_password attacj protection

ae37d16

Added error case for no_next_step terminal scenario

e51c01e

Merge branch 'v5_development' into feat/password

9d097ea

pmathew92 marked this pull request as ready for review October 26, 2026 05:51

pmathew92 requested a review from a team as a code owner October 26, 2026 05:51

Changes with respect to tests and docs

a6554fc

NandanPrabhu reviewed Oct 30, 2026

View reviewed changes

Comment thread auth0/src/main/java/com/auth0/android/embedded/EmbeddedAuthClient.kt

NandanPrabhu reviewed Oct 30, 2026

View reviewed changes

Comment thread auth0/src/main/java/com/auth0/android/embedded/EmbeddedAuthError.kt

NandanPrabhu reviewed Oct 30, 2026

View reviewed changes

utkrishtsahu previously requested changes Oct 30, 2026

View reviewed changes

utkrishtsahu reviewed Oct 30, 2026

View reviewed changes

utkrishtsahu previously approved these changes Oct 30, 2026

View reviewed changes

Addressed the review comments from @nandan and @Utkrisht

ea16c30

pmathew92 dismissed utkrishtsahu’s stale review via ea16c30 October 30, 2026 09:13

NandanPrabhu approved these changes Oct 30, 2026

View reviewed changes

pmathew92 merged commit 58e1fa2 into v5_development Oct 30, 2026
7 of 9 checks passed

pmathew92 deleted the feat/password branch October 30, 2026 12:07

Conversation

pmathew92 commented Oct 12, 2026

Changes

Testing

Checklist

Uh oh!

coderabbitai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NandanPrabhu Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

NandanPrabhu Oct 30, 2026 •

edited

Loading