Skip to content

fix(auth): clear leftover MFA enrollment state after #2473's reset-on-entry - #2477

Open
demolaf wants to merge 3 commits into
version-10.0.0-beta05from
fix/mfa-enrollment-leftover-state
Open

fix(auth): clear leftover MFA enrollment state after #2473's reset-on-entry#2477
demolaf wants to merge 3 commits into
version-10.0.0-beta05from
fix/mfa-enrollment-leftover-state

Conversation

@demolaf

@demolaf demolaf commented Sep 3, 2026

Copy link
Copy Markdown
Member

#2473 clears MfaEnrollmentFlowState on entry to the flow. Two paths do not reach an entry.

Un-hosted MfaEnrollmentScreen. Driven without a host it owns its step and remembers its own
flow state, which nothing outside it can reset. onComplete() cleared only error and
lastException, so a caller that stays composed goes on showing VerifyFactor with the enrolled
number and code. It now resets and returns to its start step — the single allowed factor's
configure step, or the picker. Hosted is untouched. This flips two existing assertions that pinned
"does not navigate away on success", which is the behaviour being changed.

Entry from inside the flow. Both host call sites live on the success destination, which stays
composed while the push runs, so a second tap could reset the enrolment in progress rather than the
previous one. enterMfaEnrollment is now a no-op when a step of the flow is already on the stack,
which also enforces the pushUnique invariant that was previously only asserted in a comment.

Adds 5 tests: the un-hosted reset on both the single-factor and picker starts, re-entry from inside
the flow through both host call sites, and sign-out → second user. Each was verified to fail with
the product change reverted.


Maintainer note: Fixes internal CPRN-405

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request prevents state resets and duplicate entries when navigating within the MFA enrollment flow, particularly addressing issues with second taps and un-hosted screens. It introduces a guard to prevent re-entry when a flow step is already on the stack, resets the flow state on completion for un-hosted screens, and adds comprehensive tests covering these scenarios. The reviewer suggests reusing the existing mfaEnrollmentStartStep function in unhostedStartStep to reduce code duplication and improve maintainability.

Comment thread auth/src/main/java/com/firebase/ui/auth/ui/screens/mfa/MfaEnrollmentScreen.kt Outdated
@demolaf
demolaf marked this pull request as ready for review September 4, 2026 12:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant