Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

config push sends [auth.sms] enable_confirmations un-negated as sms_autoconfirm, so hosted projects get the opposite of local

Aperta
  • Qualcosa non va?
#6,997 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@7ttp ci sta già lavorando.

Dal 5/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

🐛 Bug supabase/cli
Affected area

Auth

Supabase CLI version

v2.98.0. The same code is on develop as of 2026-10-05.

Operating system

Ubuntu (GitHub Actions ubuntu-latest) for config push; macOS for supabase start.

Installation method

npm (via supabase/setup-cli@v3)

Command

supabase config push, compared with supabase start on the same config.toml.

Actual output

With this in supabase/config.toml:

[auth.email]
enable_confirmations = true

[auth.sms]
enable_confirmations = true

after supabase config push, the hosted project's GET /auth/v1/settings returns:

{ "mailer_autoconfirm": false, "phone_autoconfirm": true }

and the dashboard (Authentication > Sign In / Providers > Phone) shows "Enable phone confirmations" switched off.

So the email key means "require confirmation" and the identical SMS key means "skip confirmation". Locally, supabase start with the same file does require phone confirmation, so one config behaves in opposite ways on a local stack and on a hosted project.

Expected behavior

[auth.sms] enable_confirmations = true should set sms_autoconfirm = false on the hosted project, the way [auth.email] enable_confirmations = true sets mailer_autoconfirm = false, and the way supabase start already treats the SMS key.

Steps to reproduce
  1. Set [auth.sms] enable_confirmations = true in supabase/config.toml.
  2. Run supabase link --project-ref <ref> and supabase config push.
  3. Run curl https://<ref>.supabase.co/auth/v1/settings -H "apikey: <publishable key>". It returns "phone_autoconfirm": true, and the dashboard's Phone provider shows "Enable phone confirmations" off.
  4. Run supabase start with the same file. The local auth container gets GOTRUE_SMS_AUTOCONFIRM=false.
Additional context

Cause. In pkg/config/auth.go (v2.98.0; apps/cli-go/pkg/config/auth.go on develop) the email mapping negates in both directions and the SMS mapping does not:

// email
body.MailerAutoconfirm = nullable.NewNullableWithValue(!e.EnableConfirmations) // L700
e.EnableConfirmations = !ValOrDefault(remoteConfig.MailerAutoconfirm, false)   // L825

// sms
body.SmsAutoconfirm = nullable.NewNullableWithValue(s.EnableConfirmations)     // L1121
s.EnableConfirmations = ValOrDefault(remoteConfig.SmsAutoconfirm, false)       // L1170

internal/start/start.go negates both:

fmt.Sprintf("GOTRUE_MAILER_AUTOCONFIRM=%v", !utils.Config.Auth.Email.EnableConfirmations) // L1309
fmt.Sprintf("GOTRUE_SMS_AUTOCONFIRM=%v", !utils.Config.Auth.Sms.EnableConfirmations)      // L1325

Because the read-back (L1170) is un-negated as well, the pushed value round-trips and config push has no diff to show for the key, so nothing flags it.

Why it matters. With sms_autoconfirm on, a phone number is marked confirmed without an OTP, both on signup and on PUT /user {phone}. A project that sets enable_confirmations = true believes it requires phone verification and does not.

Suggested fix. Negate L1121 and L1170 to match the email mapping. That flips the hosted value for any project that has worked around this by setting false, so it needs a release note.

History. Reported before as #4413, which was closed as not planned without a fix.

Lingua principale
TypeScript
Stelle
2.4k
Fork
531
Merge medio
1g 4h
PR unite (30g)
351

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di supabase/cli

Tutte le issue di supabase/cli

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.