supabase / auth / 21060916988

push

github

feat: replace JWT OAuth state with `flow_state.id` UUID (#2331)

- Migrate OAuth state parameter from JWT to UUID (`flow_state.id`)
- Add OAuth context fields to flow_state table (invite_token, referrer,
oauth_client_state_id, linking_target_id, email_optional)
- Make PKCE fields nullable to support implicit flow
- Always create flow_state record for all OAuth flows, not just PKCE
- Add IsPKCE() method to distinguish PKCE vs implicit flows
- Backward compatible: callback still accepts legacy JWT state format
- Update all external provider tests to verify UUID state format

In a follow-up release, the legacy JWT state support will be removed;
ensuring there are no breaking changes.

116 of 152 new or added lines in 6 files covered. (76.32%)

14724 of 21491 relevant lines covered (68.51%)

77.94 hits per line