fix(auth): stop putting the raw JWT in UserDoesntExist

src/auth/src/supabase_auth/_async/gotrue_client.py

@@ -750,7 +750,7 @@ async def set_session(self, access_token: str, refresh_token: str) -> AuthRespon
         else:
             user_response = await self.get_user(access_token)
             if user_response is None:
-                raise UserDoesntExist(access_token)
+                raise UserDoesntExist()
             session = Session(
                 access_token=access_token,
                 refresh_token=refresh_token,
@@ -1025,7 +1025,7 @@ async def _get_session_from_url(
         expires_at = time_now + int(expires_in)
         user = await self.get_user(access_token)
         if user is None:
-            raise UserDoesntExist(access_token)
+            raise UserDoesntExist()
         session = Session(
             provider_token=provider_token,
             provider_refresh_token=provider_refresh_token,

src/auth/src/supabase_auth/_sync/gotrue_client.py

@@ -746,7 +746,7 @@ def set_session(self, access_token: str, refresh_token: str) -> AuthResponse:
         else:
             user_response = self.get_user(access_token)
             if user_response is None:
-                raise UserDoesntExist(access_token)
+                raise UserDoesntExist()
             session = Session(
                 access_token=access_token,
                 refresh_token=refresh_token,
@@ -1019,7 +1019,7 @@ def _get_session_from_url(
         expires_at = time_now + int(expires_in)
         user = self.get_user(access_token)
         if user is None:
-            raise UserDoesntExist(access_token)
+            raise UserDoesntExist()
         session = Session(
             provider_token=provider_token,
             provider_refresh_token=provider_refresh_token,

src/auth/src/supabase_auth/errors.py

@@ -90,11 +90,6 @@
 ]
 
 
-class UserDoesntExist(Exception):
-    def __init__(self, access_token: str) -> None:
-        self.access_token = access_token
-
-
 class AuthError(Exception):
     def __init__(self, message: str, code: ErrorCode | None) -> None:
         Exception.__init__(self, message)
@@ -150,6 +145,17 @@ def to_dict(self) -> AuthApiErrorDict:
         }
 
 
+class UserDoesntExist(CustomAuthError):
+    def __init__(self) -> None:
+        CustomAuthError.__init__(
+            self,
+            "User does not exist for the provided access token",
+            "UserDoesntExist",
+            404,
+            "user_not_found",
+        )
+
+
 class AuthSessionMissingError(CustomAuthError):
     def __init__(self) -> None:
         CustomAuthError.__init__(

src/auth/tests/test_errors.py

@@ -0,0 +1,9 @@
+from supabase_auth.errors import AuthError, UserDoesntExist
+
+
+def test_user_doesnt_exist_never_carries_the_token() -> None:
+    error = UserDoesntExist()
+    assert isinstance(error, AuthError)
+    assert str(error) == "User does not exist for the provided access token"
+    assert error.args == ("User does not exist for the provided access token",)
+    assert not hasattr(error, "access_token")