{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":279488921,"defaultBranch":"master","name":"auth","ownerLogin":"supabase","currentUserCanPush":false,"isFork":false,"isEmpty":false,"createdAt":"2020-07-14T05:14:31.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/54469796?v=4","public":true,"private":false,"isOrgOwned":true},"refInfo":{"name":"","listCacheKey":"v0:1726156161.0","currentOid":""},"activityList":{"items":[{"before":"a4c4d622fb91d434a8e2309438a1c0f59c917701","after":"49740079390a66a3f9c9aa08a43efc546abaf670","ref":"refs/heads/release-please--branches--master","pushedAt":"2024-09-12T15:46:07.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"github-actions[bot]","name":null,"path":"/apps/github-actions","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/15368?s=80&v=4"},"commit":{"message":"chore(master): release 2.160.1","shortMessageHtmlLink":"chore(master): release 2.160.1"}},{"before":"b9e1ee375396b5b7b11172a5361dea55d14ad0e5","after":null,"ref":"refs/heads/j0/update_phone_admin_methods","pushedAt":"2024-09-12T15:45:03.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"}},{"before":"7e472ad72042e86882dab3fddce9fafa66a8236c","after":"567ea7ebd18eacc5e6daea8adc72e59e94459991","ref":"refs/heads/master","pushedAt":"2024-09-12T15:45:01.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: update mfa admin methods (#1774)\n\n## What kind of change does this PR introduce?\r\n\r\nUpdate admin MFA methods to allow an admin to update a phone factor's\r\nphone number. Also disallows and removes factor type as an updatable\r\nfield. Having the factor type field is redundant as it previously\r\nallowed for update of only one factor type (TOTP).","shortMessageHtmlLink":"fix: update mfa admin methods (#1774)"}},{"before":"f9270dfb04c6c53603cbbb955b7f3e6cfd289024","after":"b9e1ee375396b5b7b11172a5361dea55d14ad0e5","ref":"refs/heads/j0/update_phone_admin_methods","pushedAt":"2024-09-12T12:26:22.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: updat test","shortMessageHtmlLink":"fix: updat test"}},{"before":"c17500566de03823b1c1d2644c9fc24a59508e95","after":"f9270dfb04c6c53603cbbb955b7f3e6cfd289024","ref":"refs/heads/j0/update_phone_admin_methods","pushedAt":"2024-09-12T11:54:08.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: change admin params","shortMessageHtmlLink":"fix: change admin params"}},{"before":"62e29ccaba641c4d7bae8bb72b982d9f39573de0","after":"c17500566de03823b1c1d2644c9fc24a59508e95","ref":"refs/heads/j0/update_phone_admin_methods","pushedAt":"2024-09-12T11:51:13.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: enforce validation on phone number passed in","shortMessageHtmlLink":"fix: enforce validation on phone number passed in"}},{"before":"afd4467cf294e79b169942a22596f67b2fd9cd0d","after":"62e29ccaba641c4d7bae8bb72b982d9f39573de0","ref":"refs/heads/j0/update_phone_admin_methods","pushedAt":"2024-09-12T11:48:29.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: remove stray webauthn entry","shortMessageHtmlLink":"fix: remove stray webauthn entry"}},{"before":null,"after":"afd4467cf294e79b169942a22596f67b2fd9cd0d","ref":"refs/heads/j0/update_phone_admin_methods","pushedAt":"2024-09-12T11:46:35.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: update phone admin methods","shortMessageHtmlLink":"fix: update phone admin methods"}},{"before":"03ce1cff77ef68c42c5c2b684b8e7c3b9dfd6126","after":"b403a0b957e3d63d84dffbb452edf5a320afc975","ref":"refs/heads/cs/feat-config-reloader","pushedAt":"2024-09-11T15:11:43.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"cstockton","name":"Chris Stockton","path":"/cstockton","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/180184?s=80&v=4"},"commit":{"message":"chore: fix gosec warning","shortMessageHtmlLink":"chore: fix gosec warning"}},{"before":"7faf1dc0a1dacc6721094306b764f59dc83af3b4","after":"a4c4d622fb91d434a8e2309438a1c0f59c917701","ref":"refs/heads/release-please--branches--master","pushedAt":"2024-09-11T14:32:22.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"github-actions[bot]","name":null,"path":"/apps/github-actions","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/15368?s=80&v=4"},"commit":{"message":"chore(master): release 2.160.1","shortMessageHtmlLink":"chore(master): release 2.160.1"}},{"before":"f988eb416b561efbd89becea4257fb555f1cd675","after":null,"ref":"refs/heads/j0/add_token_for_non_secure_email_change","pushedAt":"2024-09-11T14:31:22.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"}},{"before":"a6c18243b92b74798b6317e1c35c8a73bc3fd6e1","after":"7e472ad72042e86882dab3fddce9fafa66a8236c","ref":"refs/heads/master","pushedAt":"2024-09-11T14:31:20.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: add token to hook payload for non-secure email change (#1763)\n\n## What kind of change does this PR introduce?\r\n\r\nFix #1744 by introducing the token to the Auth Hook payload for Send\r\nEmail. The tokenHash seems to be already present.\r\n\r\nCurrently, it's passed into the function as `otpNew`. Though it is\r\nindeed the OTP needed to validate the new email address we place it in\r\nthe `token` field to maintain the convention that `token_hash_new` is\r\nonly populated when secure email change is enabled\r\n\r\nNew output structure:\r\n\r\n\"image\"\r\nsrc=\"https://github.com/user-attachments/assets/a8c44214-dcf2-4d2e-a653-b3953244ac69\"","shortMessageHtmlLink":"fix: add token to hook payload for non-secure email change (#1763)"}},{"before":"89204b845d120df446ed7fce1091dead59eb69d6","after":"c00ca0020e1066c1f3da0fccac7eb240d19eafca","ref":"refs/heads/j0/add_webauthn_config","pushedAt":"2024-09-11T14:21:43.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: default MFAFactorType to false","shortMessageHtmlLink":"fix: default MFAFactorType to false"}},{"before":"9d89e34fe2e8e3fc6c2c67fb3887e6d7ede82869","after":"f05a4b79a13d865736f6d07657967c35071a7f9b","ref":"refs/heads/hf/email-rate-limiting-new-config","pushedAt":"2024-09-11T14:11:27.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"hf","name":"Stojan Dimitrovski","path":"/hf","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/295870?s=80&v=4"},"commit":{"message":"feat: simplified, pro-rated email and sms rate limiter","shortMessageHtmlLink":"feat: simplified, pro-rated email and sms rate limiter"}},{"before":null,"after":"89204b845d120df446ed7fce1091dead59eb69d6","ref":"refs/heads/j0/add_webauthn_config","pushedAt":"2024-09-11T14:03:15.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: add initial webauthn configuration","shortMessageHtmlLink":"fix: add initial webauthn configuration"}},{"before":"7e897c6849a9e96a11ba2f1341ec343d67952c8a","after":"fb5b00940f44b34bc0e305c83d1a547f02202daa","ref":"refs/heads/j0/require_appropriate_aal_for_pw_update","pushedAt":"2024-09-11T13:43:47.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: add parens, add phone as sensitive field","shortMessageHtmlLink":"fix: add parens, add phone as sensitive field"}},{"before":"f48924958024846b871018a8b3dde9a760632429","after":"7e897c6849a9e96a11ba2f1341ec343d67952c8a","ref":"refs/heads/j0/require_appropriate_aal_for_pw_update","pushedAt":"2024-09-11T13:42:10.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: update HasMFAEnabled\n\nCo-authored-by: Stojan Dimitrovski ","shortMessageHtmlLink":"fix: update HasMFAEnabled"}},{"before":"00b1d59b32640fd57b96ee7b1873142ed79f08ae","after":"f48924958024846b871018a8b3dde9a760632429","ref":"refs/heads/j0/require_appropriate_aal_for_pw_update","pushedAt":"2024-09-11T11:20:16.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: update mfa enabled","shortMessageHtmlLink":"fix: update mfa enabled"}},{"before":"72aae98c8a09bcabf758ccbec4de4f9625427333","after":"00b1d59b32640fd57b96ee7b1873142ed79f08ae","ref":"refs/heads/j0/require_appropriate_aal_for_pw_update","pushedAt":"2024-09-11T11:11:11.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: refactor into dedicated function","shortMessageHtmlLink":"fix: refactor into dedicated function"}},{"before":null,"after":"03ce1cff77ef68c42c5c2b684b8e7c3b9dfd6126","ref":"refs/heads/cs/feat-config-reloader","pushedAt":"2024-09-10T22:29:01.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"cstockton","name":"Chris Stockton","path":"/cstockton","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/180184?s=80&v=4"},"commit":{"message":"feat: support for file based live configuration reloading\n\nA new optional flag (long: --watch-dir, short: -w) has been\nadded. When present any files with a \".env\" suffix will be\nloaded into the environment before the *GlobalConfiguration\nis created, otherwise existing behavior is preserved.\n\nIn addition when the watch-dir flag is present a goroutine\nwill be started in serve_cmd.go and begin blocking on a call\nto (*Reloader).Watch with a callback function that accepts a\n*conf.GlobalConfiguration object. Each time this function is\ncalled we create a new API object and store it within our\nAtomicHandler, previously given as the root handler to the\n*http.Server.\n\nThe Reloader uses some simple heuristics to deal with a few\nedge cases, an overview:\n\n - At most 1 configuration reload may happen per 10 seconds\n with a +-1s margin of error.\n - After a file within -watch-dir has changed the 10 second\n grace period begins. After that it will reload the config.\n - Config reloads first sort each file by name then processes\n them in sequence.\n - Directories within watch-dir are ignored during config\n reloading.\n - Implementation quirk: directory changes can trigger\n a config reload, as I don't stat fsnotify events. This\n\t and similar superfulous reloads could be easily fixed\n\t by storing a snapshot of os.Environ() after successful\n\t reloads to compare with the latest via slices.Equal()\n\t before reloading.\n - Files that do not end with a .env suffix are ignored.\n - It handles the removal or renaming of the -watch-dir\n during runtime, but an error message will be printed\n\tevery 10 seconds as long as it's missing.\n - The config file passed with -c is only loaded once. Live\n reloads only read the config dir. Meaning it would be\n\tpossible to create a config dir change that results in a\n\tnew final configuration on the next reload due to the\n\tpersistence of os.Environ().","shortMessageHtmlLink":"feat: support for file based live configuration reloading"}},{"before":"158f7050ce5adece073a46fe5d79d6c1508df81a","after":"9d89e34fe2e8e3fc6c2c67fb3887e6d7ede82869","ref":"refs/heads/hf/email-rate-limiting-new-config","pushedAt":"2024-09-10T17:33:46.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"hf","name":"Stojan Dimitrovski","path":"/hf","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/295870?s=80&v=4"},"commit":{"message":"feat: simplified, pro-rated email and sms rate limiter","shortMessageHtmlLink":"feat: simplified, pro-rated email and sms rate limiter"}},{"before":"f498771abf5b7281bba58829ac536907c3fe42d1","after":"158f7050ce5adece073a46fe5d79d6c1508df81a","ref":"refs/heads/hf/email-rate-limiting-new-config","pushedAt":"2024-09-10T17:28:28.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"hf","name":"Stojan Dimitrovski","path":"/hf","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/295870?s=80&v=4"},"commit":{"message":"feat: simplified, pro-rated email and sms rate limiter","shortMessageHtmlLink":"feat: simplified, pro-rated email and sms rate limiter"}},{"before":"17e4748c178d5b8eb521918609d97c48aa3ad9fe","after":"f57c2674fcf969a0b6ffa386d1ac91196afa5830","ref":"refs/heads/j0/add_scrypt_password_hash","pushedAt":"2024-09-10T11:55:41.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: update scrypt format","shortMessageHtmlLink":"fix: update scrypt format"}},{"before":"f21f53ea9a817d06b3a957e28a5bef4a453a74d0","after":"7faf1dc0a1dacc6721094306b764f59dc83af3b4","ref":"refs/heads/release-please--branches--master","pushedAt":"2024-09-09T19:04:06.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"github-actions[bot]","name":null,"path":"/apps/github-actions","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/15368?s=80&v=4"},"commit":{"message":"chore(master): release 2.160.1","shortMessageHtmlLink":"chore(master): release 2.160.1"}},{"before":"9d419b400f0637b10e5c235b8fd5bac0d69352bd","after":"a6c18243b92b74798b6317e1c35c8a73bc3fd6e1","ref":"refs/heads/master","pushedAt":"2024-09-09T19:03:14.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"hf","name":"Stojan Dimitrovski","path":"/hf","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/295870?s=80&v=4"},"commit":{"message":"chore: fix gosec warnings via ignore annotations in comments (#1770)\n\n## What kind of change does this PR introduce?\r\n\r\nFix to gosec warnings so builds can complete.\r\n\r\n## What is the current behavior?\r\n\r\nThe gosec checks are halting builds.\r\n\r\n## What is the new behavior?\r\n\r\nThe gosec checks are passing.\r\n\r\n## Additional context\r\n\r\nI didn't see any warnings that led to real vulnerabilities / security\r\nissues.\r\n\r\nThat said long term it may be worth adding some defensive bounds checks\r\nfor a couple of the integer overflow warnings, just to future proof us\r\nage the code ages. Given that we allow supabase users to write to the\r\ndatabase, not sure we can guarantee a user doesn't provide a\r\nbring-your-own-hash singup flow or something like that. Unbound\r\nallocations are a prime target for DoS attacks.\r\n\r\nFor the nonce issues, neither is was real issue. Open is not \"fixable,\r\nsee gosec issue [#1211](https://github.com/securego/gosec/issues/1211).\r\nFor Seal I tried:\r\n```\r\n\tnonce := make([]byte, cipher.NonceSize())\r\n\tif _, err := rand.Read(nonce); err != nil {\r\n\t\tpanic(err)\r\n\t}\r\n\r\n\tes := EncryptedString{\r\n\t\tKeyID: keyID,\r\n\t\tAlgorithm: \"aes-gcm-hkdf\",\r\n\t\tNonce: nonce,\r\n\t}\r\n\tes.Data = cipher.Seal(nil, es.Nonce, data, nil)\r\n```\r\n\r\nBut it then considers es.Nonce to be stored / hardcoded. The only fix I\r\ncould get to work was:\r\n```Go\r\n\tnonce := make([]byte, cipher.NonceSize())\r\n\tif _, err := rand.Read(nonce); err != nil {\r\n\t\tpanic(err)\r\n\t}\r\n\r\n\tes := EncryptedString{\r\n\t\tKeyID: keyID,\r\n\t\tAlgorithm: \"aes-gcm-hkdf\",\r\n\t\tNonce: nonce,\r\n\t\tData: cipher.Seal(nil, nonce, data, nil),\r\n\t}\r\n```\r\n\r\nIt seems the gosec tool requires using `rand.Read`. I changed the\r\n`cipher.NonceSize()` back to `12` (just in case it a numerical constant\r\nfor a reason) and it started failing again. I think it also checks that\r\ncipher.NonceSize() is used as well, just doesn't report that. I\r\nultimately decided to ignore this so there was no changes to crypto\r\nfunctions given the existing code is correct.\r\n\r\nCo-authored-by: Chris Stockton ","shortMessageHtmlLink":"chore: fix gosec warnings via ignore annotations in comments (#1770)"}},{"before":"b3e320ff4a307e18f97a72f25dcd358632b86baf","after":"17e4748c178d5b8eb521918609d97c48aa3ad9fe","ref":"refs/heads/j0/add_scrypt_password_hash","pushedAt":"2024-09-06T13:11:52.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: more updates around scrypt","shortMessageHtmlLink":"fix: more updates around scrypt"}},{"before":null,"after":"b3e320ff4a307e18f97a72f25dcd358632b86baf","ref":"refs/heads/j0/add_scrypt_password_hash","pushedAt":"2024-09-06T07:37:06.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: initial scrypt support","shortMessageHtmlLink":"fix: initial scrypt support"}},{"before":"1b2583842c3111a16d4259e542379f0fda3e0749","after":"72aae98c8a09bcabf758ccbec4de4f9625427333","ref":"refs/heads/j0/require_appropriate_aal_for_pw_update","pushedAt":"2024-09-06T05:14:54.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: add test","shortMessageHtmlLink":"fix: add test"}},{"before":"7c0a12887ffad3fa70f9561d66b3785353444558","after":"1b2583842c3111a16d4259e542379f0fda3e0749","ref":"refs/heads/j0/require_appropriate_aal_for_pw_update","pushedAt":"2024-09-05T11:25:13.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: udpate session","shortMessageHtmlLink":"fix: udpate session"}},{"before":null,"after":"7c0a12887ffad3fa70f9561d66b3785353444558","ref":"refs/heads/j0/require_appropriate_aal_for_pw_update","pushedAt":"2024-09-05T10:57:35.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"J0","name":"Joel Lee","path":"/J0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8011761?s=80&v=4"},"commit":{"message":"fix: update aal requirements to update user","shortMessageHtmlLink":"fix: update aal requirements to update user"}}],"hasNextPage":true,"hasPreviousPage":false,"activityType":"all","actor":null,"timePeriod":"all","sort":"DESC","perPage":30,"cursor":"djE6ks8AAAAEtJQdRgA","startCursor":null,"endCursor":null}},"title":"Activity ยท supabase/auth"}