supabase / auth / 41649064774

72%

push

github

fix(models): exclude oauth client sessions from mfa step-up invalidation (#2801) (#2802)

## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

Closes #2801.

When a user completes an MFA verification (`verifyTOTPFactor`,
`verifyPhoneFactor`, `verifyWebAuthnFactor`, or `RecoveryCodesVerify`),
GoTrue calls `models.InvalidateSessionsWithAALLessThan(tx, user.ID,
models.AAL2.String())`.

The function executes:
```sql
DELETE FROM sessions WHERE user_id = ? AND aal < ?
```

Because OAuth 2.1 client sessions are issued at `AAL1` and cannot step
up to `AAL2`, any MFA verification by the user deletes all sessions
issued to third-party OAuth clients. Subsequent refresh attempts by
those clients fail with `refresh_token_not_found`.

## What is the new behavior?

`InvalidateSessionsWithAALLessThan` now excludes sessions associated
with an OAuth client:
```sql
DELETE FROM sessions WHERE user_id = ? AND aal < ? AND oauth_client_id IS NULL
```

OAuth client session lifecycles remain managed by consent revocation via
`RevokeOAuthSessions`.

## Additional context

Added unit test
`TestInvalidateSessionsWithAALLessThan_PreservesOAuthSessions` in
`internal/models/sessions_test.go`. The test asserts that:
1. Standard browser AAL1 sessions are invalidated on step-up.
2. OAuth client sessions (`oauth_client_id` present) are preserved.
3. Higher-assurance AAL2 sessions are preserved.

Co-authored-by: Cemal Kılıç <cemalkilic@users.noreply.github.com>

1 of 1 new or added line in 1 file covered. (100.0%)

16712 of 23321 relevant lines covered (71.66%)

496.31 hits per line