supabase / gotrue / 5614308813

65%

push

github

feat: serialized access to session in `refresh_token` grant (#1190)

Improves the `refresh_token` grant flow by serializing access over the
session ID, so that a session cannot concurrently be refreshed.

It achieves this by adding a boolean `forUpdate` parameter to
`models.FindSessionByID()` and `models.FindUserWithRefreshToken()`. This
in turn uses a [`SELECT ... FOR
UPDATE`](https://www.postgresql.org/docs/current/sql-select.html#SQL-FOR-UPDATE-SHARE)
query that locks the row from use with other flows that select it with a
`FOR UPDATE` clause.

60 of 60 new or added lines in 5 files covered. (100.0%)

7191 of 10897 relevant lines covered (65.99%)

50.69 hits per line