feat: adopt native SDK majors (Android v4, Swift v3) for v6

[subhankarmaiti]

Changes

Adopts the new native SDK majors — Auth0.Android 4.0.1 and Auth0.swift 3.0.1 — as the foundation for v6, and aligns the TypeScript surface with the API changes they bring.

Two breaking changes reach consumers:

• SSOCredentials.expiresIn is now expiresAt. Both native SDKs replaced the relative TTL with an absolute expiry, so the field is now an absolute UNIX timestamp in seconds, consistent with Credentials.expiresAt. Callers should stop adding it to the current time.
• WebAuthErrorCodes gained and lost members. NO_BUNDLE_IDENTIFIER, NO_AUTHORIZATION_CODE, and INVALID_INVITATION_URL can no longer be raised by Auth0.swift 3.0 and were removed; AUTHENTICATION_FAILED and CODE_EXCHANGE_FAILED were added for its new cases. PKCE_NOT_ALLOWED remains but is now Android-only.

Alongside that, iOS error mapping is materially better: server-returned errors such as access_denied and invalid_request now surface as their specific codes instead of collapsing into UNKNOWN_ERROR, because the underlying code is unwrapped from the error's cause. SSO_EXCHANGE_FAILED and CLEAR_FAILED are likewise reported instead of being flattened into a generic credentials-manager error. Passkey sign-in now opts into ID-token claim validation on iOS, matching what Android already did — Auth0.swift 3.0 made validateClaims() opt-in on direct token requests.

Build floors rise with the native majors: Android moves to minSdk 26, compile/target 36, JDK 17, Kotlin 2.0.21, and AGP 8.10.1; iOS builds against Swift 6 with the deployment target inherited from React Native's min_ios_version_supported. MIGRATION_GUIDE.md, README.md, and EXAMPLES.md are updated in step.

Summary by CodeRabbit

• New Features

  • SSO credentials now report expiration as an absolute expiresAt timestamp.
  • Added clearer authentication, code-exchange, SSO-exchange, and credential-clearing error codes.

• Bug Fixes

  • Improved Android and iOS error handling, passkey validation, logout, credential storage, and SSO exchanges.
  • Added support for updated native authentication SDK behavior.

• Documentation

  • Updated migration guidance, platform requirements, examples, and error-code references.

• Chores

  • Raised platform and toolchain requirements, including Swift, Android SDK, Java, and Xcode compatibility.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change upgrades Auth0 native SDK integrations and platform requirements. It replaces relative SSO expiration values with absolute timestamps, updates normalized error codes, adapts Android and iOS APIs, and refreshes migration guidance, examples, and tests.

Changes

Auth0 SDK migration

Layer / File(s)	Summary
Platform requirements and SDK dependencies A0Auth0.podspec, android/..., example/android/..., MIGRATION_GUIDE.md	The project now targets Swift 6, Auth0 SDK 3.x, Android SDK 36, Java 17, AGP 8.10.1, and updated minimum platform versions.
Session-transfer credential contract src/core/models/..., src/specs/..., src/types/..., EXAMPLES.md, src/**/__tests__/*	SSO credentials now expose expiresAt as an absolute UNIX timestamp. Models, native specifications, examples, fixtures, and tests use the updated field.
Normalized error contracts src/core/models/..., README.md, MIGRATION_GUIDE.md, src/**/__tests__/*	WebAuth and credentials-manager error constants and mappings now reflect updated Android and iOS native errors.
Android native integration android/src/main/java/com/auth0/react/A0Auth0Module.kt	The module adapts DPoP configuration, credential-manager constructors, SSO serialization, and native error handling to Auth0 Android 4.0.1.
iOS native integration ios/*.swift	The native clients use main-actor isolation, updated Auth0.swift builders and throwing APIs, expiresAt, passkey claim validation, and revised error mappings.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• auth0/react-native-auth0#1517: Both changes update native MFA and bridge integrations.
• auth0/react-native-auth0#1564: Both changes update native initialization and credential-manager setup.
• auth0/react-native-auth0#1603: Both changes update WebAuth error definitions, mappings, documentation, and tests.

Suggested reviewers: sanchitmehtagit

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adopting the Android v4 and Swift v3 native SDK major versions for v6.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/adopt-auth0-android-v4-swift-v3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 8

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@EXAMPLES.md`:
- Line 1973: Update the `expiresAt` labels in all three examples to explicitly
include the unit `(UNIX seconds)`, covering the occurrences near lines 1973,
2015, and 2050, without changing the surrounding example behavior.

In `@ios/NativeBridge.swift`:
- Around line 253-260: Update the clear-error handling in both affected paths
around the visible `credentialsManager.clear()` calls to reject caught failures
instead of converting them to `removed = false`. Map `CredentialsManagerError`
instances with `reactNativeErrorCode()`, and map all other errors to the generic
credentials-manager error code, preserving the existing successful clear
behavior.

In `@MIGRATION_GUIDE.md`:
- Around line 115-131: Update the “Removed and added WebAuthErrorCodes” section
to state that only three codes were removed, while PKCE_NOT_ALLOWED remains
available on Android but is no longer raised on iOS. Keep the existing per-code
table and action guidance consistent with this platform distinction.

In `@README.md`:
- Around line 893-894: Update the README error-mapping table’s INVALID_STATE row
to document the state_mismatch discriminator used by WebAuthError,
distinguishing it from ACCESS_DENIED while preserving the existing mappings.

In `@src/core/models/__tests__/SSOCredentials.spec.ts`:
- Around line 59-74: Ensure the Date.now mock created in the “should convert the
relative expires_in into an absolute expiresAt” test is restored even when
conversion or assertion fails, preferably by moving cleanup to the test suite’s
afterEach or wrapping the test body in try/finally; remove the current
success-only mockRestore call.

In `@src/core/models/CredentialsManagerError.ts`:
- Around line 65-68: Add SSO_EXCHANGE_FAILED and CLEAR_FAILED to the exported
CredentialsManagerError JSDoc type list, alongside the existing error-type
values, so the documented type contract matches the public constants.

In `@src/core/services/__tests__/AuthenticationOrchestrator.spec.ts`:
- Around line 911-913: Update the test around the AuthenticationOrchestrator
invocation to freeze Date.now() before invoking the orchestrator, use that
controlled clock for the expiresAt assertion, and restore the clock during test
cleanup.

In
`@src/platforms/native/adapters/__tests__/NativeCredentialsManager.errors.spec.ts`:
- Around line 239-269: The token-exchange parameterized tests incorrectly
exercise CLEAR_FAILED through getCredentials. Update the tests around
exchangeErrorTestCases to remove the clear cases, add a separate clear-error
table for CLEAR_FAILED and clearFailed, mock mockBridge.clearCredentials, invoke
manager.clearCredentials(), and assert using a clear-specific message while
preserving the existing exchange cases.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c03892f-6e09-4352-9ea1-ece0840dfa7c

📥 Commits

Reviewing files that changed from the base of the PR and between 8a7531d and d79afa9.

⛔ Files ignored due to path filters (1)

• example/ios/Podfile.lock is excluded by !**/*.lock

📒 Files selected for processing (25)

• A0Auth0.podspec
• EXAMPLES.md
• MIGRATION_GUIDE.md
• README.md
• android/build.gradle
• android/gradle.properties
• android/src/main/java/com/auth0/react/A0Auth0Module.kt
• example/android/app/build.gradle
• example/android/build.gradle
• ios/A0MfaClient.swift
• ios/MyAccount.swift
• ios/NativeBridge.swift
• ios/Passwordless.swift
• src/core/models/CredentialsManagerError.ts
• src/core/models/SSOCredentials.ts
• src/core/models/WebAuthError.ts
• src/core/models/__tests__/ErrorCodes.spec.ts
• src/core/models/__tests__/SSOCredentials.spec.ts
• src/core/services/__tests__/AuthenticationOrchestrator.spec.ts
• src/hooks/__tests__/Auth0Provider.spec.tsx
• src/platforms/native/adapters/__tests__/NativeCredentialsManager.errors.spec.ts
• src/platforms/native/adapters/__tests__/NativeCredentialsManager.spec.ts
• src/platforms/native/adapters/__tests__/NativeWebAuthProvider.errors.spec.ts
• src/specs/NativeA0Auth0.ts
• src/types/common.ts