supabase / gotrue / 8257426419

65%

Build Type

push

github

Committed by web-flow

Commit Message

fix: impose expiry on auth code instead of magic link (#1440)

## What kind of change does this PR introduce?

Currently, we check for flow state expiry rather than auth code expiry.
The auth code is created at the point when `/magiclink` is called and
expiry starts from then. However, the auth code should probably start
expiring when the link is verified and the auth code is issued.

We can eventually extend this to other magic link like flows if need. 

Note that the Flow State expiry is capped at 24 hours, as that is when
the regular cleanup takes place. Considered adding a hard restriction on
the maximum validity of `GOTRUE_MAILER_OTP_EXP` but there are a handful
of projects which have it >86400.

The handful of existing projects (number on internal channel) with a OTP
expiry of longer than 24 hours will continue to have the expiry capped
at 24 hours when using PKCE. This should be the same as the current
behaviour since we aren't changing the cleanup duration.

---------

Co-authored-by: joel <joel@joels-MacBook-Pro.local>

Run Details

12 of 16 new or added lines in 3 files covered. (75.0%)

1 existing line in 1 file now uncovered.

7828 of 11997 relevant lines covered (65.25%)

59.91 hits per line