supabase / auth / 35625721653

72%

push

github

fix: only trigger after-user-created hook on account creation (#2656)

## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

The external OAuth callback sets `createdUser = true` unconditionally,
discarding the `models.AccountLinkingDecision`. That branch handles
every OAuth sign-in, so `after-user-created` also fires for
`AccountExists` (returning user) and `LinkAccount` (new identity on an
existing user). Hook side effects therefore repeat on every sign-in, and
since the hook's error propagates out of the callback, a hook that
rejects a duplicate user breaks all OAuth sign-ins.

## What is the new behavior?

`createdUser` is gated on `decision == models.CreateAccount`, matching
the existing call sites in `token_oidc.go`, `web3.go` and `samlacs.go`.

## Additional context

Two regression tests in `ExternalTestSuite` cover the `AccountExists`
and `LinkAccount` paths.

3 of 3 new or added lines in 1 file covered. (100.0%)

16669 of 23257 relevant lines covered (71.67%)

496.26 hits per line