solve issue #256

[Bhush2003]

What does this PR do?

Fixes AppwriteException: Invalid OAuth2 Response. Key and Secret not available. (500), thrown by createOAuth2Session() and createOAuth2Token() whenever a custom (deep-link) success URL is passed in on mobile/desktop.

Root cause: the custom success URL was being forwarded to the server as a query param. The server compares its path against its own default success path to decide whether to append key/secret to the redirect. A custom deep-link scheme's path never matches that default, so the comparison silently fails and key/secret are omitted from the redirect — leaving the client with null for both and causing the crash. Web is unaffected since it completes login via a server-set session cookie instead of reading key/secret from the URL.

This PR:

Stops sending success to the server in both createOAuth2Session and createOAuth2Token (lib/services/account.dart). It's still used client-side only, to select the callback URL scheme webAuth() listens for. With success withheld, the server always falls back to its default path, so the key/secret check always passes.
Fixes webAuth() in lib/src/client_io.dart to extract just the scheme when callbackUrlScheme is a full URL rather than a bare scheme, instead of passing the whole URL through to flutter_web_auth_2 (which could never match it).

Test Plan

Manually tested against a self-hosted Appwrite 1.7.4 instance:

createOAuth2Session / createOAuth2Token with no custom success URL — unaffected, still works as before.
createOAuth2Token with a custom deep-link success URL — previously threw the 500 error, now resolves with a valid userId/secret and completes the session.
Flutter Web OAuth flow — unaffected, since it doesn't go through this code path.

No server-side (appwrite/appwrite) changes are required or included; this is a client-only fix.

Related PRs and Issues

Fixes #256

Have you read the Contributing Guidelines on issues?

Yes.

[github-actions]

This library is auto-generated by the Appwrite SDK Generator, and does not accept pull requests directly. To learn more about how you can help us improve this SDK, please check the contributing guide.

[greptile-apps]

Greptile Summary

This PR changes native OAuth callback handling to avoid the missing key/secret response and normalizes full callback URLs to URI schemes.

• Stops forwarding custom success URLs to the OAuth session and token endpoints.
• Extracts the scheme from full callback URLs on Windows and Linux before invoking flutter_web_auth_2.
• The new request and listener destinations can diverge for custom deep-link URLs.

Confidence Score: 4/5

The PR should not merge until custom desktop deep-link callbacks are kept aligned with the OAuth server's actual success redirect.

Both OAuth methods now omit the caller's custom redirect from the server request while configuring the native authentication listener from that same redirect, leaving a reachable scheme mismatch that prevents custom desktop OAuth flows from returning to the application.

Files Needing Attention: lib/services/account.dart

Important Files Changed

Filename	Overview
lib/services/account.dart	Removes the server-side custom success redirect from both OAuth flows, causing custom desktop callback listeners to wait for a URI the server was not instructed to use.
lib/src/client_io.dart	Normalizes full callback URLs to schemes on Windows/Linux; the logic is internally consistent but cannot compensate for the server redirect being omitted.

Comments Outside Diff (1)

1. lib/services/account.dart, line 1044-1048 (link)

   Custom OAuth redirect no longer matches

   When a Windows or Linux caller supplies a custom deep-link URL such as myapp://callback, this request omits success while webAuth still listens for the custom scheme, causing the server's default HTTPS redirect to bypass the application and preventing the OAuth flow from completing.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: lib/services/account.dart
   Line: 1044-1048
   
   Comment:
   **Custom OAuth redirect no longer matches**
   
   When a Windows or Linux caller supplies a custom deep-link URL such as `myapp://callback`, this request omits `success` while `webAuth` still listens for the custom scheme, causing the server's default HTTPS redirect to bypass the application and preventing the OAuth flow from completing.
   
   ---
   
   For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

   

Prompt To Fix All With AI

### Issue 1
lib/services/account.dart:1044-1048
**Custom OAuth redirect no longer matches**

When a Windows or Linux caller supplies a custom deep-link URL such as `myapp://callback`, this request omits `success` while `webAuth` still listens for the custom scheme, causing the server's default HTTPS redirect to bypass the application and preventing the OAuth flow from completing.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "solve issue #256" | Re-trigger Greptile}