fix(provider): fall back to returnTo for Auth Tab logout scheme

[utkrishtsahu]

Changes

WebAuthProvider.logout(account).withAuthTab() could never succeed. When Auth Tab is used, CustomTabsController.launchAsAuthTab derives the redirect scheme from the redirect_uri query parameter of the URL. The login flow always sets redirect_uri, but the logout flow only sets returnTo — so the lookup returned null and the SDK failed with a0.invalid_authorize_url before the browser ever opened.

Fix: In launchAsAuthTab, fall back to the returnTo query parameter when redirect_uri is absent, so the Auth Tab logout flow can resolve a scheme. Login behavior is unchanged (it always has redirect_uri).

• Classes/methods changed: CustomTabsController.launchAsAuthTab(...) (package-private, internal) — added a returnTo fallback for scheme resolution.
• Endpoints: none added, deleted, deprecated, or changed.
• Public API: no public API changes. This restores the intended behavior of the existing LogoutBuilder.withAuthTab() option; no new usage patterns are introduced.

Security note: this touches redirect/scheme handling. The change only broadens where the scheme is read from (redirect_uri → returnTo) for the logout flow; exact scheme resolution and validation are otherwise unchanged.

References

SDK-9834

Testing

Added a unit test covering the logout case where only returnTo is present, verifying the Auth Tab is launched (rather than failing with a0.invalid_authorize_url). The existing CustomTabsControllerTest suite continues to pass (19/19). Also verified end-to-end on a physical device (Pixel 7a) against a real Auth0 tenant: tapping "Log out (Auth Tab)" launched the browser and returned onSuccess with no error.

Reviewers can verify by:

• Running ./gradlew :auth0:testReleaseUnitTest and confirming CustomTabsControllerTest passes, including shouldLaunchAsAuthTabUsingReturnToWhenRedirectUriIsAbsent.

• Optionally, wiring WebAuthProvider.logout(account).withScheme(...).withAuthTab().start(...) in a sample app on a device with an Auth Tab–capable browser and confirming logout completes.

• This change adds unit test coverage

• This change adds integration test coverage

• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read the Auth0 general contribution guidelines

• I have read the Auth0 Code of Conduct

• All existing and new tests complete without errors

Summary by CodeRabbit

• Bug Fixes
  • Improved Auth Tab handling for authorization links that omit redirect_uri but provide a returnTo parameter.
  • Such links now launch through the Auth Tab flow as expected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d8b454c7-6292-46c7-8fa6-ac0311ce4483

📥 Commits

Reviewing files that changed from the base of the PR and between c09b36b and 8787675.

📒 Files selected for processing (2)

• auth0/src/main/java/com/auth0/android/provider/CustomTabsController.java
• auth0/src/test/java/com/auth0/android/provider/CustomTabsControllerTest.java

---

📝 Walkthrough

Walkthrough

Auth Tab redirect resolution now falls back to returnTo when redirect_uri is absent. A test verifies that this path invokes the Auth Tab launcher instead of directly starting an activity.

Changes

Auth Tab redirect handling

Layer / File(s)	Summary
Resolve and validate Auth Tab redirect URI auth0/src/main/java/com/auth0/android/provider/CustomTabsController.java, auth0/src/test/java/com/auth0/android/provider/CustomTabsControllerTest.java	launchAsAuthTab uses returnTo when redirect_uri is missing, and the new test verifies Auth Tab launcher usage for this URI shape.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: pmathew92

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: falling back to returnTo for Auth Tab logout scheme handling.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/logout-authtab-scheme-fallback

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}