supabase / auth / 28925647307

71%

master: 71%

Pull #2609

github

feat(token): add RFC 8693 token-exchange grant for provider access tokens

Adds grant_type=urn:ietf:params:oauth:grant-type:token-exchange so a client can sign in with a provider-issued access token (subject_token) instead of an OIDC id token.

Facebook's native Android login only mints an OIDC id token (carrying the email claims) on the first authorization, so signup stays on the id_token grant. On subsequent logins Facebook returns only a classic access token with no profile claims. This grant verifies the token belongs to the app via a provider-specific AccessTokenVerifier (Facebook: /debug_token, checking app id, validity and user-token type), reads the provider subject from it, and signs in the existing identity. It does not create accounts.

86 of 111 new or added lines in 3 files covered. (77.48%)

18064 of 25305 relevant lines covered (71.39%)

661.5 hits per line