supabase / auth / 28577589050

71%

master: 71%

Pull #2609

github

feat(token): add access_token grant for signing in with a Facebook access token

Facebook's native Android login reliably returns a classic Graph access token on every login, but only mints an OIDC id token (AuthenticationToken) on the first authorization. This makes the id_token grant unusable for repeat native logins without falling back to the browser flow.

Add an access_token grant that accepts a provider-issued access token, verifies via Facebook's /debug_token that it was issued for this app and is valid (mitigating access token substitution), fetches the user profile and issues a session.

The grant is only available to providers that implement the new AccessTokenVerifier interface, which for now is Facebook only.

78 of 110 new or added lines in 3 files covered. (70.91%)

18007 of 25263 relevant lines covered (71.28%)

661.51 hits per line