AuthApiException - Invalid Refresh Token: Refresh Token Not Found

[JakesMD]

Describe the bug
When refreshing the session as a newly signed up user we get:

AuthApiException(message: Invalid Refresh Token: Refresh Token Not Found, statusCode: 400, code: refresh_token_not_found)

To Reproduce

1. Register a new user with OTP.
2. Trigger a session refresh.
3. The error above is thrown and the user is logged out. When trying to log back in you get "user does not exist".

Workaround

1. Register a new user with OTP.
2. Trigger a session refresh.
3. The error above is thrown and the user is logged out.
4. Register again with the same email address.
5. Trigger a session refresh.
6. Everything works as expected.

Expected behavior
Triggering a session refresh for the first time as a new user shouldn't fail.

Version (please complete the following information):

├── bstorage_client...
├── supabase_flutter 2.10.3
│   ├── supabase...
├── supabase...
├── bstorage_client...
├── bstorage_client...
├── supabase 2.10.0
│   ├── functions_client 2.5.0
│   ├── gotrue 2.16.0
│   ├── postgrest 2.5.0
│   ├── realtime_client 2.6.0
│   ├── storage_client 2.4.1
├── supabase...
├── typesafe_postgrest 0.3.2
│   ├── postgrest...
├── typesafe_supabase 0.1.0
│   ├── supabase...
│   └── typesafe_postgrest...
├── bstorage_client...
bstorage_client 0.0.0
├── supabase...

Additional context
First reports of this came in after we migrated to Flutter 3.38. No other changes to our codebase were made at that time. So may or may not have something to do with it.

Not reproducible locally.

Similar to this issue: supabase/ssr#68

Our use-case:

• User signs up
• User accepts an invitation to a team or creates a team
• The session is refreshed in order to fetch the updated custom claims with details about the team and the user's permissions.
• The session is refreshed whenever the app is opened in case the user's permissions have changed.