supabase / auth / 14443571697

69%

push

github

feat: allow limiting lifespan of low-aal sessions (#1942)

Adds a new optional config `GOTRUE_SESSIONS_ALLOW_LOW_AAL` (duration)
which when set will prevent the continued refreshing of a user session
if the session has not been upgraded to the highest possible AAL level
of the user.

For example if you set it to `1h` it means that a user who has MFA
factors enrolled must step-up the session to the highest AAL level for
their account within 1 hour, otherwise future session refreshes will
fail with a `Invalid Refresh Token: Session Expired (Low AAL: User Needs
MFA Verification)`) message.

41 of 50 new or added lines in 4 files covered. (82.0%)

10567 of 15512 relevant lines covered (68.12%)

65.02 hits per line