supabase / gotrue / 6884551105

65%

Build Type

push

github

Committed by web-flow

Commit Message

feat: allow unverified email signins (#1301)

## What kind of change does this PR introduce?
* If `GOTRUE_ALLOW_UNVERIFIED_EMAIL_SIGN_INS` is enabled, it will allow
a user with an unverified email address to sign in and obtain an access
token JWT
* This is particularly useful for OAuth in cases where the oauth
provider doesn't return an email address / the oauth user didn't verify
their email address with the OAuth provider.
* Tests that broke and needed fixing were due to these reasons:
* `RemoveUnconfirmedIdentities` was previously buggy and shouldn't be
retaining the user metadata of a previously unconfirmed identity
* `GOTRUE_ALLOW_UNVERIFIED_EMAIL_SIGN_INS` is enabled by default which
caused some tests to return an access token instead of an error for a
user with an unverified email

## Modifications made to automatic linking algorithm
* If the candidate identity doesn't have a verified email, the decision
should be to create a new account.
* If the email belongs to a user already, then we opt to create a new
user with no email. Previously, we would attempt to create a new user
and the db will return an error due to the partial unique constraint on
email violation. In order to add an email to the new user, they would
have to call update user (`PUT /user`) to add a new email.

Run Details

112 of 151 new or added lines in 6 files covered. (74.17%)

4 existing lines in 1 file now uncovered.

7582 of 11527 relevant lines covered (65.78%)

53.72 hits per line