supabase / auth / 30365488543

72%

push

github

fix: reject AT from banned users (#2642)

Reject requests from from banned users with still-valid access tokens.

The following endpoints will be affected:

### User & session
| Method | Path | Handler |
|---|---|---|
| `GET` | `/user` | `UserGet` |
| `PUT` | `/user` | `UserUpdate` |
| `GET` | `/reauthenticate` | `Reauthenticate` |
| `POST` | `/logout` | `Logout` (now also blocked for banned users) |

### Identities & OAuth grants
| Method | Path | Handler |
|---|---|---|
| `GET` | `/user/identities/authorize` | `LinkIdentity` |
| `DELETE` | `/user/identities/{identity_id}` | `DeleteIdentity` |
| `GET` | `/user/oauth/grants` | `UserListOAuthGrants` |
| `DELETE` | `/user/oauth/grants` | `UserRevokeOAuthGrant` |
| `POST` | `/token?grant_type=id_token` (with `link_identity=true`) |
`IdTokenGrant` (via direct `requireAuthentication` call) |

### MFA / factors
| Method | Path | Handler |
|---|---|---|
| `POST` | `/factors` | `EnrollFactor` |
| `POST` | `/factors/{factor_id}/challenge` | `ChallengeFactor` |
| `POST` | `/factors/{factor_id}/verify` | `VerifyFactor` |
| `DELETE` | `/factors/{factor_id}` | `UnenrollFactor` |

### Passkeys
| Method | Path | Handler |
|---|---|---|
| `POST` | `/passkeys/registration/options` |
`PasskeyRegistrationOptions` |
| `POST` | `/passkeys/registration/verify` | `PasskeyRegistrationVerify`
|
| `GET` | `/passkeys` | `PasskeyList` |
| `PATCH` | `/passkeys/{passkey_id}` | `PasskeyUpdate` |
| `DELETE` | `/passkeys/{passkey_id}` | `PasskeyDelete` |

### OAuth server (OIDC)
| Method | Path | Handler |
|---|---|---|
| `GET` | `/oauth/userinfo` | `OAuthUserInfo` |
| `GET` | `/oauth/authorizations/{authorization_id}` |
`OAuthServerGetAuthorization` |
| `POST` | `/oauth/authorizations/{authorization_id}/consent` |
`OAuthServerConsent` |

4 of 4 new or added lines in 1 file covered. (100.0%)

18329 of 25398 relevant lines covered (72.17%)

682.23 hits per line