Fix a regression where DirectAuth OOB channel_hint is missing (#253)

* Fix a regression where DirectAuth OOB channel_hint is missing
* Ensure the mock URLSession yields the thread before returning to avoid flaky tests

Author: AlexNachbaur

Sources/OktaDirectAuth/Internal/Requests/ChallengeRequest.swift

@@ -20,12 +20,14 @@ struct ChallengeRequest: AuthenticationFlowRequest {
     let clientConfiguration: OAuth2Client.Configuration
     let context: Flow.Context
     let mfaToken: String
+    let channel: DirectAuthenticationFlow.OOBChannel?
     let challengeTypesSupported: [GrantType]
 
     init(openIdConfiguration: OpenIdConfiguration,
          clientConfiguration: OAuth2Client.Configuration,
          context: DirectAuthenticationFlow.Context,
          mfaToken: String,
+         channel: DirectAuthenticationFlow.OOBChannel?,
          challengeTypesSupported: [GrantType]) throws
     {
         guard let url = openIdConfiguration.challengeEndpoint else {
@@ -36,6 +38,7 @@ struct ChallengeRequest: AuthenticationFlowRequest {
         self.clientConfiguration = clientConfiguration
         self.context = context
         self.mfaToken = mfaToken
+        self.channel = channel
         self.challengeTypesSupported = challengeTypesSupported
     }
 
@@ -87,6 +90,10 @@ extension ChallengeRequest: APIRequest, APIRequestBody {
             result["client_id"] = clientConfiguration.clientId
         }
 
+        if let channel {
+            result["channel_hint"] = channel
+        }
+
         return result
     }
 }

Sources/OktaDirectAuth/Internal/Step Handlers/OOBStepHandler.swift

@@ -103,6 +103,7 @@ final class OOBStepHandler<Factor: AuthenticationFactor>: StepHandler {
                                            clientConfiguration: flow.client.configuration,
                                            context: context,
                                            mfaToken: mfaToken,
+                                           channel: channel,
                                            challengeTypesSupported: [grantType])
         let response = try await request.send(to: flow.client)
         guard let oobResponse = response.result.oobResponse else {

Tests/OktaDirectAuthTests/RequestTests.swift

@@ -143,6 +143,7 @@ final class RequestTests: XCTestCase {
                                                        scope: "openid profile"),
                             context: .init(),
                             mfaToken: "abcd123",
+                            channel: nil,
                             challengeTypesSupported: [.password, .oob])
         XCTAssertEqual(request.bodyParameters?.stringComponents,
                        [
@@ -151,6 +152,23 @@ final class RequestTests: XCTestCase {
                         "challenge_types_supported": "password urn:okta:params:oauth:grant-type:oob"
                        ])
 
+        // Channel Hint
+        request = try .init(openIdConfiguration: openIdConfiguration,
+                            clientConfiguration: .init(issuerURL: issuer,
+                                                       clientId: "theClientId",
+                                                       scope: "openid profile"),
+                            context: .init(),
+                            mfaToken: "abcd123",
+                            channel: .push,
+                            challengeTypesSupported: [.oobMFA])
+        XCTAssertEqual(request.bodyParameters?.stringComponents,
+                       [
+                        "client_id": "theClientId",
+                        "mfa_token": "abcd123",
+                        "channel_hint": "push",
+                        "challenge_types_supported": "http://auth0.com/oauth/grant-type/mfa-oob"
+                       ])
+
         // Client Secret authentication
         request = try .init(openIdConfiguration: openIdConfiguration,
                             clientConfiguration: .init(issuerURL: issuer,
@@ -159,6 +177,7 @@ final class RequestTests: XCTestCase {
                                                        authentication: .clientSecret("supersecret")),
                             context: .init(),
                             mfaToken: "abcd123",
+                            channel: nil,
                             challengeTypesSupported: [.password, .oob])
         XCTAssertEqual(request.bodyParameters?.stringComponents,
                        [

Tests/TestCommon/URLSessionMock.swift

@@ -128,6 +128,7 @@ class URLSessionMock: URLSessionProtocol, @unchecked Sendable {
                     try await Task.sleep(delay: delay)
                 }
 
+                await MainActor.yield()
                 guard let data = call?.data,
                       let response = call?.response
                 else {