fix(gotrue): don't throw in verifyOTP when secure email/phone change returns no session

packages/gotrue/lib/src/gotrue_client.dart

@@ -607,17 +607,20 @@ class GoTrueClient {
 
     final authResponse = AuthResponse.fromJson(response);
 
-    if (authResponse.session == null) {
-      throw AuthException('An error occurred on token verification.');
+    // A secure email or phone change verifies in two steps: the server accepts
+    // the first OTP without returning a session and only issues one once the
+    // second OTP is verified. In that case there is nothing to persist yet, so
+    // return the intermediate response instead of treating it as an error.
+    final session = authResponse.session;
+    if (session != null) {
+      _saveSession(session);
+      notifyAllSubscribers(
+        type == OtpType.recovery
+            ? AuthChangeEvent.passwordRecovery
+            : AuthChangeEvent.signedIn,
+      );
     }
 
-    _saveSession(authResponse.session!);
-    notifyAllSubscribers(
-      type == OtpType.recovery
-          ? AuthChangeEvent.passwordRecovery
-          : AuthChangeEvent.signedIn,
-    );
-
     return authResponse;
   }
 

packages/gotrue/test/otp_mock_test.dart

@@ -475,22 +475,24 @@ void main() {
       );
     });
 
-    test('response with null session', () async {
+    test('response with null session returns the intermediate response',
+        () async {
       final client = GoTrueClient(
         url: 'https://example.com',
         httpClient: NullSessionClient(testEmail),
         asyncStorage: TestAsyncStorage(),
       );
 
-      await expectLater(
-        () => client.verifyOTP(
-          email: testEmail,
-          token: '123456',
-          type: OtpType.email,
-        ),
-        throwsA(isA<AuthException>().having((e) => e.message, 'message',
-            'An error occurred on token verification.')),
+      // Verifying the first OTP of a secure email change does not return a
+      // session. This should not throw, the intermediate response is returned
+      // so the second OTP can subsequently be verified.
+      final response = await client.verifyOTP(
+        email: testEmail,
+        token: '123456',
+        type: OtpType.emailChange,
       );
+
+      expect(response.session, isNull);
     });
   });