supabase / auth / 19297110881

69%

push

github

fix(social-auth): default to current_user:read for Figma provider (#2195)

## What kind of change does this PR introduce?

Bug fix for new Figma OAuth policy and scopes.

## What is the current behavior?

The `files:read` scope is used for Figma. It is now deprecated. For
older apps, this requests too many permissions. For newer apps, or those
who mistakenly started the upgrade process, this scope no longer
works...

## What is the new behavior?

The scope is changed to `current_user:read` which only requests name,
avatar, and email as opposed to any file data.

## Additional context

- https://developers.figma.com/docs/updates-to-figmas-developer-platform
- https://developers.figma.com/docs/rest-api/scopes

## Workaround

This can be used until the PR is merged, note that scopes does not
override but adds to the default, so `queryParams` is needed to override
the query parameter entirely.

```ts
await supabase.auth.signInWithOAuth({
  provider: 'figma',
  options: {
    redirectTo,
    scopes: 'current_user:read',
    // Clear default scope workaround
    queryParams: {
      scope: 'current_user:read',
    },
  }
});
```

Co-authored-by: Cemal Kılıç <cemalkilic@users.noreply.github.com>

1 of 1 new or added line in 1 file covered. (100.0%)

14004 of 20500 relevant lines covered (68.31%)

79.0 hits per line