[Tr00d]

Summary

Admins can fetch a custom OAuth/OIDC provider by its identifier.

Capability: auth.admin.get_provider: Admin Get Provider.

Standalone: branches off master, which already has the shared CustomProvider types from #590. Its only overlap with the other custom-provider PRs is where each adds its member to Api, AdminClient, the two interfaces and PublicAPI.Unshipped.txt; whichever merges second rebases and keeps both sides.

Public API

// IGotrueAdminClient<TUser>
Task<CustomProvider> GetCustomProviderAsync(string identifier, CancellationToken cancellationToken = default);

var admin = new AdminClient(serviceRoleKey, new ClientOptions { Url = authUrl });
var provider = await admin.GetCustomProviderAsync("custom:mycompany");

New types: none. It returns the CustomProvider added in #590. IGotrueApi<TUser, TSession> gains the matching GetCustomProviderAsync(string jwt, string identifier, CancellationToken).

Behavior

Operation	GET /admin/custom-providers/{identifier} with the service-role key
Input	identifier, required, starting with custom:
Output	200 → CustomProvider. The return is never null: a missing provider throws.
Checks before the request	ArgumentNullException for null. ArgumentException when the identifier lacks the case-sensitive custom: prefix or contains /, \, ?, # or %. This is the check delete uses.
Failures	GotrueException: Reason = CustomProviderNotFound on 404 custom_provider_not_found; Reason = AdminTokenRequired on 401/403; ErrorCode = feature_disabled on 404 when custom providers are disabled. A null body also throws GotrueException.
State	None

Deviations from supabase-js

supabase-js puts the identifier into the URL without encoding or validation. This SDK rejects identifiers that would change the route before sending anything, as DeleteCustomProviderAsync does.

Tests

Tier	Class	Pins
E2E	GetCustomProviderTests	A seeded provider is returned as registered. Unknown identifier → CustomProviderNotFound. Non-admin key → AdminTokenRequired.
Contract	GetCustomProviderContractTests	Route and service-role credentials. Response mapping. 404 → CustomProviderNotFound. null body. A cancelled token sends nothing. The call completes when the caller blocks on a context that never runs continuations.
Unit	GetCustomProviderIdentifierTests	Null, unprefixed and route-changing identifiers rejected before the request

Changed-line coverage: 100% (7 lines, measured against master). Mutation: 2/2 killed on changed lines, 0 survivors (1 ignored). The local mutation run predates the split; the production code is unchanged and the mutation check on this PR reruns it.

No wire-shape approval snapshot: the request has no body.

Layout

Get has no types of its own, so it has no production folder. It returns Supabase.Gotrue.Common.CustomProvider from #590. Tests: packages/Gotrue/Gotrue.Tests/GetCustomProvider/.

Notes

The custom-provider route is now built in one helper (CustomProviderUrl), shared with delete.