supabase / auth / 28649013321

71%

master: 71%

Build Type

Pull #2609

github

Committed by spydon

Commit Message

feat(token): add access_token grant for signing in with a provider access token

Facebook's native Android login reliably returns a classic Graph access token on every login, but only mints an OIDC id token (AuthenticationToken) on the first authorization, which makes the id_token grant unusable for repeat native logins without falling back to the browser flow.

Add an access_token grant that accepts a provider-issued access token, verifies via Facebook's /debug_token that it was issued for this app, is valid, and is a user token (mitigating access token substitution), fetches the profile and issues a session. The grant is only available to providers that implement the new AccessTokenVerifier interface, which for now is Facebook only.

Pull Request Pull Request #2609: feat(token): add access_token grant for signing in with a Facebook access token

Coverage Stats

91 of 118 new or added lines in 3 files covered. (77.12%)

5 existing lines in 2 files now uncovered.

18051 of 25298 relevant lines covered (71.35%)

660.96 hits per line