fix(gotrue): don't throw in verifyOTP when secure email/phone change returns no session

A secure email or phone change verifies in two steps. The server accepts
the first OTP without returning a session and only issues one once the
second OTP is verified. verifyOTP previously threw an AuthException
whenever the session was null, breaking the legitimate intermediate step.

Only persist the session and notify subscribers when a session is present,
and return the intermediate response otherwise, matching auth-js behaviour.

Fixes #981

Author: spydon

packages/gotrue/lib/src/gotrue_client.dart

@@ -607,17 +607,20 @@ class GoTrueClient {
 
     final authResponse = AuthResponse.fromJson(response);
 
-    if (authResponse.session == null) {
-      throw AuthException('An error occurred on token verification.');
+    // A secure email or phone change verifies in two steps: the server accepts
+    // the first OTP without returning a session and only issues one once the
+    // second OTP is verified. In that case there is nothing to persist yet, so
+    // return the intermediate response instead of treating it as an error.
+    final session = authResponse.session;
+    if (session != null) {
+      _saveSession(session);
+      notifyAllSubscribers(
+        type == OtpType.recovery
+            ? AuthChangeEvent.passwordRecovery
+            : AuthChangeEvent.signedIn,
+      );
     }
 
-    _saveSession(authResponse.session!);
-    notifyAllSubscribers(
-      type == OtpType.recovery
-          ? AuthChangeEvent.passwordRecovery
-          : AuthChangeEvent.signedIn,
-    );
-
     return authResponse;
   }
 

packages/gotrue/test/otp_mock_test.dart

@@ -466,22 +466,24 @@ void main() {
       );
     });
 
-    test('response with null session', () async {
+    test('response with null session returns the intermediate response',
+        () async {
       final client = GoTrueClient(
         url: 'https://example.com',
         httpClient: NullSessionClient(testEmail),
         asyncStorage: TestAsyncStorage(),
       );
 
-      await expectLater(
-        () => client.verifyOTP(
-          email: testEmail,
-          token: '123456',
-          type: OtpType.email,
-        ),
-        throwsA(isA<AuthException>().having((e) => e.message, 'message',
-            'An error occurred on token verification.')),
+      // Verifying the first OTP of a secure email change does not return a
+      // session. This should not throw, the intermediate response is returned
+      // so the second OTP can subsequently be verified.
+      final response = await client.verifyOTP(
+        email: testEmail,
+        token: '123456',
+        type: OtpType.emailChange,
       );
+
+      expect(response.session, isNull);
     });
   });