supabase / auth / 35368409400

72%

push

github

feat(otp): switch one_time_tokens table to source of truth (#2788)

## What kind of change does this PR introduce?
Feat

## What is the current behavior?
We dual-write token data to the `one_time_tokens` and `users` table, but
read token data from them inconsistently.

## What is the new behavior?
When a flag `GOTRUE_EXPERIMENTAL_ENABLE_OTT_AS_SOURCE_OF_TRUTH` is
enabled, we treat `one_time_tokens` as the source of truth for token
data, and only lookup the user to validate eligibility and confirm
identifier binding.

## Additional context
I've intentionally split out the Twilio Verify flow + Test OTP handling
into a separate PR, but will wait until both are merged to release.

Closes AUTH-1553.

73 of 80 new or added lines in 3 files covered. (91.25%)

16584 of 23179 relevant lines covered (71.55%)

496.74 hits per line