[melcheikh]

What kind of change does this PR introduce?

Bug fix.

What is the current behavior?

Closes #2801.

When a user completes an MFA verification (verifyTOTPFactor, verifyPhoneFactor, verifyWebAuthnFactor, or RecoveryCodesVerify), GoTrue calls models.InvalidateSessionsWithAALLessThan(tx, user.ID, models.AAL2.String()).

The function executes:

DELETE FROM sessions WHERE user_id = ? AND aal < ?

Because OAuth 2.1 client sessions are issued at AAL1 and cannot step up to AAL2, any MFA verification by the user deletes all sessions issued to third-party OAuth clients. Subsequent refresh attempts by those clients fail with refresh_token_not_found.

What is the new behavior?

InvalidateSessionsWithAALLessThan now excludes sessions associated with an OAuth client:

DELETE FROM sessions WHERE user_id = ? AND aal < ? AND oauth_client_id IS NULL

OAuth client session lifecycles remain managed by consent revocation via RevokeOAuthSessions.

Additional context

Added unit test TestInvalidateSessionsWithAALLessThan_PreservesOAuthSessions in internal/models/sessions_test.go. The test asserts that:

1. Standard browser AAL1 sessions are invalidated on step-up.
2. OAuth client sessions (oauth_client_id present) are preserved.
3. Higher-assurance AAL2 sessions are preserved.

[lemiffe]

This also affects us, would be great to have it merged.
In our scenario we have an MCP session (aal1), and when a two factor code is verified (when I log onto my account in my app), Supabase Auth deletes the aal1 sessions ending my MCP session.

[dulacp]

@cemalkilic are you still working on this repo? or can you please route us to another maintainer.

We hit that too in production, active MCP sessions have their token being revoked when the user performs an MFA challenge.

[cemalkilic]

Thanks a lot for the fix and the thorough test, @melcheikh, and sorry it sat for so long.

I also checked the query plan: the delete still goes through the user_id index and the new oauth_client_id IS NULL condition is only a filter on that user's few rows, so there should be performance impact.

[melcheikh]

Thanks @cemalkilic, and thanks for checking the query plan!
On the MCP side of the OAuth server I've also opened #2894 (RFC 8707 resource indicators) and #2895 (Client ID Metadata Documents). Happy to adapt them to your plans for GA, and to help with the AAL / OAuth token endpoint work you mentioned (#2877) if that's useful.