go-pkgz / auth / 24808418198

84%

push

github

Merge commit from fork

The Patreon provider was hashing userInfo.ID (the uninitialized
destination field on a freshly created token.User), not the Patreon
account ID from the response. Every Patreon login therefore produced
the same local user ID: "patreon_" + sha1(""), i.e.
patreon_da39a3ee5.

That meant all Patreon-authenticated users on an application using
this library collapsed into a single local identity, allowing any
Patreon user to be treated as any other Patreon user on the same app.

Hash uinfoJSON.Data.ID instead, which is the Patreon numeric account
ID that the struct was already unmarshaling. Update the two existing
assertions that baked in the old constant, and add a regression test
that two distinct Patreon account IDs produce two distinct local IDs.

Applied to both the v1 (provider/) and v2 (v2/provider/) module paths.

1 of 1 new or added line in 1 file covered. (100.0%)

2706 of 3212 relevant lines covered (84.25%)

7.29 hits per line