feat(ui_oauth_twitter)!: replace twitter_login with signInWithProvider

[demolaf]

Closes #696.

twitter_login has not published a release since July 2023, and its Android build.gradle declares no namespace while pinning AGP 4.1.0. The namespace fix merged upstream in 2024 but was never released, which is why tests/android was held at AGP 8.7.3 with a hardcoded compileSdk, and why #693 could not adopt flutter_web_auth_2.

TwitterProvider now signs in through auth.signInWithProvider on Android and iOS, mirroring AppleProvider. Firebase performs the OAuth dance, so the Twitter API key and secret move out of the app binary and into the Firebase console. macOS and Windows keep the vendored OAuth 1.0a flow, which is why apiKey and apiSecretKey remain, now as optional parameters. With twitter_login gone, compileSdk returns to flutter.compileSdkVersion and AGP moves to 8.9.1, which unblocks #693.

Neither desktop platform can use signInWithProvider. On Windows the C++ SDK rejects it outright (firebase/flutterfire#13231). On macOS the generic OAuth flow does not exist in the Firebase Apple SDK at all: FIROAuthProvider.getCredentialWith(_:) is declared inside #if os(iOS) in firebase-ios-sdk 12.18.0, as is the AuthUIDelegate presentation layer behind it, and that has been true continuously since 9.5.0. FLTFirebaseAuthPlugin.swift's #if os(macOS) branch returning unsupported-platform is the visible symptom rather than the cause, and it cannot simply be removed, since there is no symbol for the plugin to call. Apple sign-in works on macOS only because it takes a separate launchAppleSignInRequest path built on ASAuthorization. What does work on macOS is the credential path, signInWithCredential and friends, which carry no such restriction, and that is exactly what the vendored OAuth 1.0a flow uses.

⚠️ Breaking change: consumers must set their Twitter app's callback URL to https://<project>.firebaseapp.com/__/auth/handler, add the Encoded App ID URL scheme on iOS, and register their SHA-1 on Android. Nothing stops compiling, so a debug-only diagnostic warns once when apiKey or apiSecretKey are passed on a platform that now ignores them. AuthAction.none throws UnsupportedError on Android and iOS, because a credential cannot be obtained without also creating a session, and the credential handed to onCredentialLinked is now a plain AuthCredential rather than an OAuthCredential. macOS and Windows behaviour is unchanged.

Still to do

Draft until these land:

• Documentation in docs/firebase-ui-auth/providers/oauth.md, covering the callback URL, URL scheme and SHA-1, and dropping the twitter_login install step.
• The Encoded App ID scheme in the firebase_ui_auth example's iOS Info.plist.
• Manual verification of a real sign-in on Android and iOS, plus a Windows regression run to confirm the OAuth 1.0a path still works. No automated test performs a real Twitter sign-in, so CI cannot cover any of the breaking changes above.

[gemini-code-assist]

Code Review

This pull request removes the dependency on the twitter_login package, transitioning the Twitter sign-in flow to use Firebase's native signInWithProvider on Android, iOS, and macOS. Consequently, apiKey and apiSecretKey are now optional and only required on Windows. The integration tests have been updated to mock the Firebase Auth provider instead of the third-party Twitter login client. Regarding the feedback, a critical issue was identified where a null auth.currentUser during a link or upgrade action would silently fail due to a null-shorting operator, leaving the UI hanging; adding an explicit null check and error notification is recommended.

[gemini-code-assist]

If auth.currentUser is null when attempting to link or upgrade an anonymous user, the null-shorting operator (?.) will cause the entire chain to evaluate to null and do nothing. This leaves the UI hanging in a loading state indefinitely because authListener.onError is never called.

We should explicitly check if auth.currentUser is null and notify the listener of the error.

    if (action == AuthAction.link || shouldUpgradeAnonymous) {
      final currentUser = auth.currentUser;
      if (currentUser == null) {
        authListener.onError(StateError('No user is currently signed in to link with.'));
        return;
      }

      currentUser
          .linkWithProvider(firebaseAuthProvider)
          .then(_onLinked)
          .catchError(authListener.onError);
      return;
    }