refactor(auth)!: decouple reauthentication from the FirebaseAuthUI shared state flow by demolaf · Pull Request #2478 · firebase/FirebaseUI-Android

demolaf · 2026-09-04T11:32:44Z

FirebaseAuthUI was the SDK entry point, the process-wide AuthState channel and the reauthentication session store all at once. Reauthentication requests now travel on their own channel, provider code emits to an AuthFlowScope sink instead of the singleton's flow, and the phase machine lives in a composition-scoped holder — nine members deleted from FirebaseAuthUI, none added.

withReauth no longer retains the caller's lambda on a process-scoped singleton: it raises a request, suspends on a resolver, and retries on the caller's own coroutine. delete() goes through the same path instead of publishing Required and throwing.

AuthFlowScope.kt: provider extensions move off FirebaseAuthUI, so provider code can no longer reach the public state flow at all — the isolation is compiler-held rather than review-held.
ReauthFlowState.kt: the phase machine, scoped to one FirebaseAuthScreen's composition. Aborted now clears the phase and resolves the caller under both hosts.
Added SignInStateSequenceTest and ReauthFlowStateTest, plus emulator-backed e2e coverage for a password change and an account deletion through reauthentication.

⚠️ Breaking Changes

AuthState.Reauthentication.Required.retryOperation is removed outright — pre-GA, zero external usage, no shim.
AuthState.Reauthentication.Required's (user, reason) constructor is now internal. Raising a request is withReauth/delete()'s job; constructing one yourself no longer did anything.
A declined reauthentication throws AuthException.AuthCancelledException instead of returning quietly, and delete() reports that rather than InvalidCredentialsException.
Publishing AuthState.Reauthentication.Required to authStateFlow() yourself no longer raises a request; only withReauth and delete() do.
Rotation during the reauth sheet abandons the pending operation unless the caller launched from a scope that survives it.

Maintainer note: Fixes internal CPRN-413

…and a screen-scoped phase holder

… FirebaseAuthUI singleton

… a stale composition value

…hey belong to

… of returning quietly

…ad of calling it arming

…tead of the shared state flow

… for it

…y ends

…eauthentication

gemini-code-assist

Code Review

This pull request refactors the reauthentication flow in FirebaseUI Auth to use a composition-scoped AuthFlowScope and coroutine-based suspension (CompletableDeferred) instead of process-local callbacks on FirebaseAuthUI. This prevents sensitive operations from being lost or executed multiple times during Activity recreation. Various auth providers have been updated to emit states through this new scope. Feedback is provided to improve code safety in authUserState by avoiding the !! operator on user.email through smart casting.

…ternal

…from another

…means

demolaf · 2026-09-04T11:32:44Z

FirebaseAuthUI was the SDK entry point, the process-wide AuthState channel and the reauthentication session store all at once. Reauthentication requests now travel on their own channel, provider code emits to an AuthFlowScope sink instead of the singleton's flow, and the phase machine lives in a composition-scoped holder — nine members deleted from FirebaseAuthUI, none added.

withReauth no longer retains the caller's lambda on a process-scoped singleton: it raises a request, suspends on a resolver, and retries on the caller's own coroutine. delete() goes through the same path instead of publishing Required and throwing.

AuthFlowScope.kt: provider extensions move off FirebaseAuthUI, so provider code can no longer reach the public state flow at all — the isolation is compiler-held rather than review-held.
ReauthFlowState.kt: the phase machine, scoped to one FirebaseAuthScreen's composition. Aborted now clears the phase and resolves the caller under both hosts.
Added SignInStateSequenceTest and ReauthFlowStateTest, plus emulator-backed e2e coverage for a password change and an account deletion through reauthentication.

⚠️ Breaking Changes

AuthState.Reauthentication.Required.retryOperation is removed outright — pre-GA, zero external usage, no shim.
AuthState.Reauthentication.Required's (user, reason) constructor is now internal. Raising a request is withReauth/delete()'s job; constructing one yourself no longer did anything.
A declined reauthentication throws AuthException.AuthCancelledException instead of returning quietly, and delete() reports that rather than InvalidCredentialsException.
Publishing AuthState.Reauthentication.Required to authStateFlow() yourself no longer raises a request; only withReauth and delete() do.
Rotation during the reauth sheet abandons the pending operation unless the caller launched from a scope that survives it.

Maintainer note: Fixes internal CPRN-413

…and a screen-scoped phase holder

… FirebaseAuthUI singleton

… a stale composition value

…hey belong to

… of returning quietly

…ad of calling it arming

…tead of the shared state flow

… for it

…y ends

…eauthentication

gemini-code-assist

Code Review

This pull request refactors the reauthentication flow in FirebaseUI Auth to use a composition-scoped AuthFlowScope and coroutine-based suspension (CompletableDeferred) instead of process-local callbacks on FirebaseAuthUI. This prevents sensitive operations from being lost or executed multiple times during Activity recreation. Various auth providers have been updated to emit states through this new scope. Feedback is provided to improve code safety in authUserState by avoiding the !! operator on user.email through smart casting.

…ternal

…from another

…means

demolaf · 2026-09-04T11:32:44Z

FirebaseAuthUI was the SDK entry point, the process-wide AuthState channel and the reauthentication session store all at once. Reauthentication requests now travel on their own channel, provider code emits to an AuthFlowScope sink instead of the singleton's flow, and the phase machine lives in a composition-scoped holder — nine members deleted from FirebaseAuthUI, none added.

withReauth no longer retains the caller's lambda on a process-scoped singleton: it raises a request, suspends on a resolver, and retries on the caller's own coroutine. delete() goes through the same path instead of publishing Required and throwing.

AuthFlowScope.kt: provider extensions move off FirebaseAuthUI, so provider code can no longer reach the public state flow at all — the isolation is compiler-held rather than review-held.
ReauthFlowState.kt: the phase machine, scoped to one FirebaseAuthScreen's composition. Aborted now clears the phase and resolves the caller under both hosts.
Added SignInStateSequenceTest and ReauthFlowStateTest, plus emulator-backed e2e coverage for a password change and an account deletion through reauthentication.

⚠️ Breaking Changes

AuthState.Reauthentication.Required.retryOperation is removed outright — pre-GA, zero external usage, no shim.
AuthState.Reauthentication.Required's (user, reason) constructor is now internal. Raising a request is withReauth/delete()'s job; constructing one yourself no longer did anything.
A declined reauthentication throws AuthException.AuthCancelledException instead of returning quietly, and delete() reports that rather than InvalidCredentialsException.
Publishing AuthState.Reauthentication.Required to authStateFlow() yourself no longer raises a request; only withReauth and delete() do.
Rotation during the reauth sheet abandons the pending operation unless the caller launched from a scope that survives it.

Maintainer note: Fixes internal CPRN-413

…and a screen-scoped phase holder

… FirebaseAuthUI singleton

… a stale composition value

…hey belong to

… of returning quietly

…ad of calling it arming

…tead of the shared state flow

… for it

…y ends

…eauthentication

gemini-code-assist

Code Review

This pull request refactors the reauthentication flow in FirebaseUI Auth to use a composition-scoped AuthFlowScope and coroutine-based suspension (CompletableDeferred) instead of process-local callbacks on FirebaseAuthUI. This prevents sensitive operations from being lost or executed multiple times during Activity recreation. Various auth providers have been updated to emit states through this new scope. Feedback is provided to improve code safety in authUserState by avoiding the !! operator on user.email through smart casting.

…ternal

…from another

…means

demolaf · 2026-09-04T11:32:44Z

FirebaseAuthUI was the SDK entry point, the process-wide AuthState channel and the reauthentication session store all at once. Reauthentication requests now travel on their own channel, provider code emits to an AuthFlowScope sink instead of the singleton's flow, and the phase machine lives in a composition-scoped holder — nine members deleted from FirebaseAuthUI, none added.

withReauth no longer retains the caller's lambda on a process-scoped singleton: it raises a request, suspends on a resolver, and retries on the caller's own coroutine. delete() goes through the same path instead of publishing Required and throwing.

AuthFlowScope.kt: provider extensions move off FirebaseAuthUI, so provider code can no longer reach the public state flow at all — the isolation is compiler-held rather than review-held.
ReauthFlowState.kt: the phase machine, scoped to one FirebaseAuthScreen's composition. Aborted now clears the phase and resolves the caller under both hosts.
Added SignInStateSequenceTest and ReauthFlowStateTest, plus emulator-backed e2e coverage for a password change and an account deletion through reauthentication.

⚠️ Breaking Changes

AuthState.Reauthentication.Required.retryOperation is removed outright — pre-GA, zero external usage, no shim.
AuthState.Reauthentication.Required's (user, reason) constructor is now internal. Raising a request is withReauth/delete()'s job; constructing one yourself no longer did anything.
A declined reauthentication throws AuthException.AuthCancelledException instead of returning quietly, and delete() reports that rather than InvalidCredentialsException.
Publishing AuthState.Reauthentication.Required to authStateFlow() yourself no longer raises a request; only withReauth and delete() do.
Rotation during the reauth sheet abandons the pending operation unless the caller launched from a scope that survives it.

Maintainer note: Fixes internal CPRN-413

…and a screen-scoped phase holder

… FirebaseAuthUI singleton

… a stale composition value

…hey belong to

… of returning quietly

…ad of calling it arming

…tead of the shared state flow

… for it

…y ends

…eauthentication

gemini-code-assist

Code Review

This pull request refactors the reauthentication flow in FirebaseUI Auth to use a composition-scoped AuthFlowScope and coroutine-based suspension (CompletableDeferred) instead of process-local callbacks on FirebaseAuthUI. This prevents sensitive operations from being lost or executed multiple times during Activity recreation. Various auth providers have been updated to emit states through this new scope. Feedback is provided to improve code safety in authUserState by avoiding the !! operator on user.email through smart casting.

…ternal

…from another

…means

demolaf · 2026-09-04T11:32:44Z

FirebaseAuthUI was the SDK entry point, the process-wide AuthState channel and the reauthentication session store all at once. Reauthentication requests now travel on their own channel, provider code emits to an AuthFlowScope sink instead of the singleton's flow, and the phase machine lives in a composition-scoped holder — nine members deleted from FirebaseAuthUI, none added.

withReauth no longer retains the caller's lambda on a process-scoped singleton: it raises a request, suspends on a resolver, and retries on the caller's own coroutine. delete() goes through the same path instead of publishing Required and throwing.

AuthFlowScope.kt: provider extensions move off FirebaseAuthUI, so provider code can no longer reach the public state flow at all — the isolation is compiler-held rather than review-held.
ReauthFlowState.kt: the phase machine, scoped to one FirebaseAuthScreen's composition. Aborted now clears the phase and resolves the caller under both hosts.
Added SignInStateSequenceTest and ReauthFlowStateTest, plus emulator-backed e2e coverage for a password change and an account deletion through reauthentication.

⚠️ Breaking Changes

AuthState.Reauthentication.Required.retryOperation is removed outright — pre-GA, zero external usage, no shim.
AuthState.Reauthentication.Required's (user, reason) constructor is now internal. Raising a request is withReauth/delete()'s job; constructing one yourself no longer did anything.
A declined reauthentication throws AuthException.AuthCancelledException instead of returning quietly, and delete() reports that rather than InvalidCredentialsException.
Publishing AuthState.Reauthentication.Required to authStateFlow() yourself no longer raises a request; only withReauth and delete() do.
Rotation during the reauth sheet abandons the pending operation unless the caller launched from a scope that survives it.

Maintainer note: Fixes internal CPRN-413

…and a screen-scoped phase holder

… FirebaseAuthUI singleton

… a stale composition value

…hey belong to

… of returning quietly

…ad of calling it arming

…tead of the shared state flow

… for it

…y ends

…eauthentication

gemini-code-assist

Code Review

This pull request refactors the reauthentication flow in FirebaseUI Auth to use a composition-scoped AuthFlowScope and coroutine-based suspension (CompletableDeferred) instead of process-local callbacks on FirebaseAuthUI. This prevents sensitive operations from being lost or executed multiple times during Activity recreation. Various auth providers have been updated to emit states through this new scope. Feedback is provided to improve code safety in authUserState by avoiding the !! operator on user.email through smart casting.

…ternal

…from another

…means

demolaf · 2026-09-04T11:32:44Z

FirebaseAuthUI was the SDK entry point, the process-wide AuthState channel and the reauthentication session store all at once. Reauthentication requests now travel on their own channel, provider code emits to an AuthFlowScope sink instead of the singleton's flow, and the phase machine lives in a composition-scoped holder — nine members deleted from FirebaseAuthUI, none added.

withReauth no longer retains the caller's lambda on a process-scoped singleton: it raises a request, suspends on a resolver, and retries on the caller's own coroutine. delete() goes through the same path instead of publishing Required and throwing.

AuthFlowScope.kt: provider extensions move off FirebaseAuthUI, so provider code can no longer reach the public state flow at all — the isolation is compiler-held rather than review-held.
ReauthFlowState.kt: the phase machine, scoped to one FirebaseAuthScreen's composition. Aborted now clears the phase and resolves the caller under both hosts.
Added SignInStateSequenceTest and ReauthFlowStateTest, plus emulator-backed e2e coverage for a password change and an account deletion through reauthentication.

⚠️ Breaking Changes

AuthState.Reauthentication.Required.retryOperation is removed outright — pre-GA, zero external usage, no shim.
AuthState.Reauthentication.Required's (user, reason) constructor is now internal. Raising a request is withReauth/delete()'s job; constructing one yourself no longer did anything.
A declined reauthentication throws AuthException.AuthCancelledException instead of returning quietly, and delete() reports that rather than InvalidCredentialsException.
Publishing AuthState.Reauthentication.Required to authStateFlow() yourself no longer raises a request; only withReauth and delete() do.
Rotation during the reauth sheet abandons the pending operation unless the caller launched from a scope that survives it.

Maintainer note: Fixes internal CPRN-413

…and a screen-scoped phase holder

… FirebaseAuthUI singleton

… a stale composition value

…hey belong to

… of returning quietly

…ad of calling it arming

…tead of the shared state flow

… for it

…y ends

…eauthentication

gemini-code-assist

Code Review

This pull request refactors the reauthentication flow in FirebaseUI Auth to use a composition-scoped AuthFlowScope and coroutine-based suspension (CompletableDeferred) instead of process-local callbacks on FirebaseAuthUI. This prevents sensitive operations from being lost or executed multiple times during Activity recreation. Various auth providers have been updated to emit states through this new scope. Feedback is provided to improve code safety in authUserState by avoiding the !! operator on user.email through smart casting.

…ternal

…from another

…means

demolaf · 2026-09-04T11:32:44Z

FirebaseAuthUI was the SDK entry point, the process-wide AuthState channel and the reauthentication session store all at once. Reauthentication requests now travel on their own channel, provider code emits to an AuthFlowScope sink instead of the singleton's flow, and the phase machine lives in a composition-scoped holder — nine members deleted from FirebaseAuthUI, none added.

withReauth no longer retains the caller's lambda on a process-scoped singleton: it raises a request, suspends on a resolver, and retries on the caller's own coroutine. delete() goes through the same path instead of publishing Required and throwing.

AuthFlowScope.kt: provider extensions move off FirebaseAuthUI, so provider code can no longer reach the public state flow at all — the isolation is compiler-held rather than review-held.
ReauthFlowState.kt: the phase machine, scoped to one FirebaseAuthScreen's composition. Aborted now clears the phase and resolves the caller under both hosts.
Added SignInStateSequenceTest and ReauthFlowStateTest, plus emulator-backed e2e coverage for a password change and an account deletion through reauthentication.

⚠️ Breaking Changes

AuthState.Reauthentication.Required.retryOperation is removed outright — pre-GA, zero external usage, no shim.
AuthState.Reauthentication.Required's (user, reason) constructor is now internal. Raising a request is withReauth/delete()'s job; constructing one yourself no longer did anything.
A declined reauthentication throws AuthException.AuthCancelledException instead of returning quietly, and delete() reports that rather than InvalidCredentialsException.
Publishing AuthState.Reauthentication.Required to authStateFlow() yourself no longer raises a request; only withReauth and delete() do.
Rotation during the reauth sheet abandons the pending operation unless the caller launched from a scope that survives it.

Maintainer note: Fixes internal CPRN-413

…and a screen-scoped phase holder

… FirebaseAuthUI singleton

… a stale composition value

…hey belong to

… of returning quietly

…ad of calling it arming

…tead of the shared state flow

… for it

…y ends

…eauthentication

gemini-code-assist

Code Review

This pull request refactors the reauthentication flow in FirebaseUI Auth to use a composition-scoped AuthFlowScope and coroutine-based suspension (CompletableDeferred) instead of process-local callbacks on FirebaseAuthUI. This prevents sensitive operations from being lost or executed multiple times during Activity recreation. Various auth providers have been updated to emit states through this new scope. Feedback is provided to improve code safety in authUserState by avoiding the !! operator on user.email through smart casting.

…ternal

…from another

…means

demolaf · 2026-09-04T11:32:44Z

FirebaseAuthUI was the SDK entry point, the process-wide AuthState channel and the reauthentication session store all at once. Reauthentication requests now travel on their own channel, provider code emits to an AuthFlowScope sink instead of the singleton's flow, and the phase machine lives in a composition-scoped holder — nine members deleted from FirebaseAuthUI, none added.

withReauth no longer retains the caller's lambda on a process-scoped singleton: it raises a request, suspends on a resolver, and retries on the caller's own coroutine. delete() goes through the same path instead of publishing Required and throwing.

AuthFlowScope.kt: provider extensions move off FirebaseAuthUI, so provider code can no longer reach the public state flow at all — the isolation is compiler-held rather than review-held.
ReauthFlowState.kt: the phase machine, scoped to one FirebaseAuthScreen's composition. Aborted now clears the phase and resolves the caller under both hosts.
Added SignInStateSequenceTest and ReauthFlowStateTest, plus emulator-backed e2e coverage for a password change and an account deletion through reauthentication.

⚠️ Breaking Changes

AuthState.Reauthentication.Required.retryOperation is removed outright — pre-GA, zero external usage, no shim.
AuthState.Reauthentication.Required's (user, reason) constructor is now internal. Raising a request is withReauth/delete()'s job; constructing one yourself no longer did anything.
A declined reauthentication throws AuthException.AuthCancelledException instead of returning quietly, and delete() reports that rather than InvalidCredentialsException.
Publishing AuthState.Reauthentication.Required to authStateFlow() yourself no longer raises a request; only withReauth and delete() do.
Rotation during the reauth sheet abandons the pending operation unless the caller launched from a scope that survives it.

Maintainer note: Fixes internal CPRN-413

…and a screen-scoped phase holder

… FirebaseAuthUI singleton

… a stale composition value

…hey belong to

… of returning quietly

…ad of calling it arming

…tead of the shared state flow

… for it

…y ends

…eauthentication

gemini-code-assist

Code Review

This pull request refactors the reauthentication flow in FirebaseUI Auth to use a composition-scoped AuthFlowScope and coroutine-based suspension (CompletableDeferred) instead of process-local callbacks on FirebaseAuthUI. This prevents sensitive operations from being lost or executed multiple times during Activity recreation. Various auth providers have been updated to emit states through this new scope. Feedback is provided to improve code safety in authUserState by avoiding the !! operator on user.email through smart casting.

…ternal

…from another

…means

demolafand others added 12 commits September 3, 2026 19:56

refactor(auth)!: replace the retained reauth closure with a resolver …
d27083a
…and a screen-scoped phase holder

test(auth): record the ordered state sequence of each sign-in path
276e821

refactor(auth)!: give provider code its own flow scope instead of the…
5ebe580
… FirebaseAuthUI singleton

refactor(auth): read the arming guards off the back stack rather than…
4dedd10
… a stale composition value

refactor(auth): let a flow's screens read their state from the flow t…
097cc23
…hey belong to

feat(auth)!: report a declined reauthentication to the caller instead…
5fca2ef
… of returning quietly

refactor(auth): name what happens to a reauthentication request inste…
7a9869b
…ad of calling it arming

refactor(auth)!: give reauthentication requests their own channel ins…
0b17f77
…tead of the shared state flow

docs(auth): say what the reauthentication api does instead of arguing…
a78d1c2
… for it

test(auth): drive the reauthentication e2e tests through withReauth
eafa9e7

fix(auth): clear the reauthentication handover state however the retr…
fa66e51
…y ends

test(auth): cover a password change and an account deletion through r…
1481fbf
…eauthentication

github-project-automationBot added this to studio-2394994192-60a69 Sep 4, 2026

github-project-automationBot moved this to Backlog in studio-2394994192-60a69 Sep 4, 2026

gemini-code-assistBot reviewed Sep 4, 2026
View reviewed changes

Comment threadauth/src/main/java/com/firebase/ui/auth/AuthFlowScope.kt Outdated

demolaf requested a review from russellwheatley September 4, 2026 11:37

demolaf marked this pull request as ready for review September 4, 2026 11:37

demolaf added 3 commits September 4, 2026 12:50

refactor(auth)!: make Reauthentication.Required's user constructor in…
da2be3a
…ternal

test(auth): pin what makes one reauthentication request state differ …
26b1fbf
…from another

fix(auth): read a user's email once when deciding what their sign-in …
bf937e9
…means