supabase / auth / 28777759058

71%

push

github

fix(mfa): use AMR method (not factor type) when downgrading sessions to AAL1 (#2615)

`DowngradeSessionsToAAL1` deleted AMR claims where
`authentication_method = factor_type`, but the column stores the AMR
method (`mfa/phone`, `mfa/webauthn`) — only "totp" matched, so
unenrolling a phone/webauthn factor left a stale AAL2 claim.

This PR:

- Maps factor type → AMR method before the delete
- Unknown types now error instead of silently mismatching
- Drops the dead "mfa/sms" alias

14 of 16 new or added lines in 1 file covered. (87.5%)

17976 of 25196 relevant lines covered (71.34%)

663.18 hits per line