supabase / auth / 28894581055

71%

master: 71%

Pull #2609

github

feat(token): add RFC 8693 token-exchange grant for provider access tokens

Adds grant_type=urn:ietf:params:oauth:grant-type:token-exchange so a client can sign in with a provider-issued access token (subject_token) instead of an OIDC id token.

Facebook's native Android login only mints an OIDC id token (carrying the email claims) on the first authorization, so signup stays on the id_token grant. On subsequent logins Facebook returns only a classic access token with no profile claims. This grant verifies the token belongs to the app via a provider-specific AccessTokenVerifier (Facebook: /debug_token, checking app id, validity and user-token type), reads the provider subject from it, and signs in the existing identity. It does not create accounts.

83 of 108 new or added lines in 3 files covered. (76.85%)

18061 of 25302 relevant lines covered (71.38%)

661.45 hits per line