supabase / auth / 41032383523

72%

Build Type

push

github

Committed by web-flow

Commit Message

feat: clear existing password on recover (#2887)

## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

A password set on an unconfirmed account would remain valid if the
account was verified through a linked signup (magic link etc)

## What is the new behavior?

a password set on an unconfirmed account is now wiped when the email’s
owner proves ownership through a magic link, email OTP or password
recovery

Co-authored-by: Stojan Dimitrovski <sdimitrovski@gmail.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Coverage Stats

13 of 19 new or added lines in 3 files covered. (68.42%)

3 existing lines in 1 file now uncovered.

16699 of 23280 relevant lines covered (71.73%)

496.37 hits per line