supabase / auth / 8465280121

69%

Build Type

push

github

Committed by web-flow

Commit Message

feat: forbid generating an access token without a session (#1504)

## What kind of change does this PR introduce?

Enforces the precondition of a valid session before one can create an
access token. This supports refactors around `generateAccessToken` and
`updateMFASessionAndClaims`. Also allows for stronger guarantees within
the function since one can always assume there is a valid session.

There were a few test changes:
- To mirror real world use, Access Tokens should now only exist where
there is a valid session. We wrap `generateAccessToken` into a helper
`generateAccessTokenAndSession` to replace previous occurrences where
session was set to nil.
- We split TestUpdatePassword into cases where reauthentication is
required and reauthentication is not required. We also attach a session
to two of the test cases as they were previously nil

Run Details

6 of 11 new or added lines in 1 file covered. (54.55%)

17 existing lines in 4 files now uncovered.

8025 of 12325 relevant lines covered (65.11%)

59.87 hits per line