41647899148
72%

Ran 03 Nov 2026 01:55PM UTC

Jobs 1

Files 208

Run time 1min

Badge

Embed ▾

Committed 03 Nov 2026 01:50PM UTC coverage: 71.661% (-0.07%) from 71.731%

Build # 41647899148

Build Type

push

github

Committed by

web-flow

Commit Message

fix: assert password is rejected after magic link/OTP (#2896)

## What kind of change does this PR introduce?

Bug fix (test only)

## What is the current behavior?

`TestOtp/TestOtpClearsUnconfirmedPassword` and
`TestOtp/TestOtpClearsUnconfirmedPasswordWithAutoconfirm` fail on
`master` since #2868 landed on top of #2887. Each PR was green on its
own.

- #2887 clears an unconfirmed user's password on magic link / OTP, and
its tests assert `HasPassword() == false`.
- #2868 makes `Signup` overwrite an unconfirmed user's password on every
attempt. `MagicLink` calls `Signup` with a random temporary password, so
the account now ends up with that random password rather than none.

## What is the new behavior?

The tests assert the security property #2887 is meant to protect: the
password set by whoever squatted the unconfirmed account no longer
authenticates, both right after `/otp` and after the email owner
confirms. A random temporary password the attacker doesn't know is the
same state new magic-link users already get.

No production code changes. The clear in `MagicLink` is kept: it commits
outside `Signup`'s transaction, so the attacker's password is still
removed if `Signup` rolls back (e.g. confirmation email rate-limited).

Verified locally: `go test ./internal/api/... ./internal/models/... -p
1` passes.

Coverage Stats

16712 of 23321 relevant lines covered (71.66%)

496.11 hits per line

Coverage Regressions

Lines	Coverage	∆	File
139	76.27	-0.29%	internal/models/user.go
64	61.06	-3.87%	internal/api/signup.go
2	63.57	0.0%	internal/api/token.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	41647899148.1	03 Nov 2026 01:55PM UTC	208	71.66	GitHub Action Run

supabase / auth / 41647899148
72%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 41647899148

supabase / auth / 41647899148 72%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 41647899148

supabase / auth / 41647899148
72%

README BADGES
x