fix: disallow setSession loophole

[j4w8n]

What kind of change does this PR introduce?

I managed to jack up my fork, so have to resubmit this.

Adds checks for the passed-in access_token. Also refactors setSession(), to align the method with common behaviors of other methods.

What is the current behavior?

Some people, including myself, are passing in an empty string for the access token, to force a session refresh even if the session isn't expired. There is now a refreshSession() method to accomplish this, as of supabase-js version 2.0.4

What is the new behavior?

Checks if the access token is an empty string. Also adds a regex check to the decodeJWTPayload() helper, to verify the access token is in base64url format; otherwise we could still pass in something like hello.there.world and we'd get the same forced refresh behavior.

As for the refactor, I noticed that this method is directly calling _refreshAccessToken() then calling _saveSession(). However, _callRefreshToken() is used on other methods; and is a better fit, since it seems to handle multiple refresh calls. Plus it calls _saveSession() itself, which eliminates the need for that call in setSession().

Additional context

Closes #490

[kangmingtay]

hey @j4w8n, thanks for making the time to fix this issue for us! just left a few comments but overall, it lgtm!

[kangmingtay]

thanks for making the changes! i'm marking this as a feat since it will be breaking for those who have been passing in an empty 'access token' as a hacky workaround

[github-actions]

🎉 This PR is included in version 2.4.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀