v0.3.3 - Fix Session Restoration Endpoint

🐛 Bug Fixes

Fixed Session Restoration Endpoint

• ✅ Correct endpoint - Now uses POST /runtime/auth/verify_refresh_token for session restoration
• ✅ Proper request format - Sends refresh token in request body with app-id
• ✅ Matches React SDK - Implements same session restoration flow as official React SDK
• ✅ Dedicated method - New _verifyRefreshToken() internal method for clarity

Impact: Session persistence was completely broken in v0.3.0-0.3.2. Persisted refresh tokens were being sent to the wrong endpoint (/v1/auth/me), which expects JWT access tokens.

Root Cause: Flutter SDK was using GET /v1/auth/me endpoint with refresh token as Bearer header. This endpoint is designed for authenticated user info retrieval, not session restoration. The correct endpoint is POST /runtime/auth/verify_refresh_token which accepts refresh tokens in request body.

Solution:

• Added _verifyRefreshToken() internal method that calls correct endpoint
• Updated attemptSessionRestore() to use new method
• Request format now matches React SDK: {'app-id': appId, 'refresh-token': refreshToken}

Research Sources:

• InstantDB Backend Docs
• React SDK authAPI.ts

Files changed:

• lib/src/auth/auth_manager.dart - Added _verifyRefreshToken(), updated attemptSessionRestore()
• CHANGELOG.md - Documented the fix
• pubspec.yaml - Version bump to 0.3.3

Migration: No code changes required - this is a pure bug fix that enables session persistence to work correctly.

Testing: Verified against React SDK implementation and InstantDB API documentation.