supabase / auth / 9767637889

69%

push

github

fix:  return proper error message when invalid email_change token is passed in (#1643)

## What kind of change does this PR introduce?

Currently, when `SECURE_EMAIL_CHANGE` is enabled and a dev invokes
`verifyOtp({type:'email_change', token:'<some-token>',
email:'<some-wrong-email>'})` an internalServerError and panic is
returned. After this change a 403 is returned as expected.

This is because when an invalid `email_change` OTP is submitted [an
access on ott.UserID (which is nil) is made
](https://github.com/supabase/auth/compare/j0/prevent_panic_on_email_change?expand=1#diff-55a81f8dc593de7e9c8b8dadf7159fe83L258)

3 of 6 new or added lines in 1 file covered. (50.0%)

8726 of 15110 relevant lines covered (57.75%)

54.46 hits per line