supabase / auth / 28647417099

71%

master: 71%

Build Type

Pull #2609

github

Committed by spydon

Commit Message

feat(token): add access_token grant for signing in with a provider access token

Facebook's native Android login reliably returns a classic Graph access token on every login, but only mints an OIDC id token (AuthenticationToken) on the first authorization, which makes the id_token grant unusable for repeat native logins without falling back to the browser flow.

Add an access_token grant that accepts a provider-issued access token, verifies via Facebook's /debug_token that it was issued for this app, is valid, and is a user token (mitigating access token substitution), fetches the profile and issues a session. The grant is only available to providers that implement the new AccessTokenVerifier interface, which for now is Facebook only.

Pull Request Pull Request #2609: feat(token): add access_token grant for signing in with a Facebook access token

Coverage Stats

91 of 113 new or added lines in 3 files covered. (80.53%)

3 existing lines in 1 file now uncovered.

18051 of 25293 relevant lines covered (71.37%)

661.17 hits per line