[AndroidPoet]

What

Part of #1105 (the Apple half).

With the implicit flow, handleDeeplinks calls onSessionSuccess before the session is imported. parseFragmentAndImportSession calls onFinish and only then importSession, so inside the callback currentSessionOrNull() is still null and sessionStatus is not yet Authenticated. An app that navigates or reads the session in onSessionSuccess sees no session. The PKCE flow already imports first and then calls the callback. This affects both the Android and the Apple handleDeeplinks.

Fix

Call importSession before onFinish in parseFragmentAndImportSession.

Tests

New Auth/src/appleTest/kotlin/HandleDeeplinksTest.apple.kt drives the Apple handleDeeplinks(NSURL) against the mocked client:

• PKCE: the code and stored verifier are sent to /token?grant_type=pkce, and the session is stored when onSessionSuccess runs.
• PKCE without a stored verifier: onError gets the IllegalArgumentException and no session is stored.
• PKCE with error, error_code and error_description in the URL: an AuthEvent.OtpError is emitted and no request is sent.
• Implicit: the fragment session is imported after /user, and is current when onSessionSuccess runs. This one fails without the fix.
• A different scheme or host is ignored.

All 201 Auth macosArm64 tests and 196 Auth JVM tests pass, and detekt is clean. The Android half of #1105 needs Robolectric, so it is not in this PR.

No public API change.

Will revisit tomorrow