fix: add pending_password_set claim for invite/recovery sessions

[deepshekhardas]

Changes

Adds a \pending_password_set\ claim to JWT tokens for sessions created via invite or recovery flows before the user sets their password.

• **\ okens/service.go**: Added \PendingPasswordSet bool\ to \AccessTokenClaims. In \GenerateAccessToken(), sets \PendingPasswordSet = true\ when the session is a recovery session or when the user has no password and was invited.
• **\�pi/user.go**: In \UserUpdate(), checks \claims.PendingPasswordSet\ and rejects updates to email, phone, data, or app_metadata until the password is set.

Rationale

When a user is invited or goes through password recovery, the session is created via OTP/recovery verification. Before the password is set, this session should be restricted — only password updates should be allowed. RLS policies can also use the \pending_password_set\ claim to restrict data access.

Fixes #45210

[depthfirst-app]

🟡 Severity: MEDIUM

session.IsRecovery() is based on immutable AMR claims and will remain true for the lifetime of a recovery session, regardless of whether the user has since set their password. This means PendingPasswordSet is permanently true for any recovery session, preventing legitimate users from ever updating email/phone/data within that session after completing the password reset — contradicting the stated intent of "before the password is set, this session should be restricted."
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: The root cause is that session.IsRecovery() is evaluated based solely on immutable AMR claims in the session, which never get cleared even after the user successfully sets a password. The fix is to also require !userHasPassword when checking the recovery session, so that isPendingPasswordSet becomes false as soon as the user has a password. Change line 699 to gate session.IsRecovery() with the !userHasPassword condition, making the intent consistent: the restriction applies only before a password exists, regardless of how the session was created.

⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.

Suggested change

	isPendingPasswordSet := session.IsRecovery() ||
	isPendingPasswordSet := (!userHasPassword && session.IsRecovery()) ||