Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

config push sends [auth.sms] enable_confirmations un-negated as sms_autoconfirm, so hosted projects get the opposite of local

オープン
  • 何か問題がありますか？
#6,997 コメント 1 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@7ttp がすでに取り組んでいます。

2026年10月5日 から。

評価

この issue はまだ評価されていません。

説明

🐛 Bug supabase/cli
Affected area

Auth

Supabase CLI version

v2.98.0. The same code is on develop as of 2026-10-05.

Operating system

Ubuntu (GitHub Actions ubuntu-latest) for config push; macOS for supabase start.

Installation method

npm (via supabase/setup-cli@v3)

Command

supabase config push, compared with supabase start on the same config.toml.

Actual output

With this in supabase/config.toml:

[auth.email]
enable_confirmations = true

[auth.sms]
enable_confirmations = true

after supabase config push, the hosted project's GET /auth/v1/settings returns:

{ "mailer_autoconfirm": false, "phone_autoconfirm": true }

and the dashboard (Authentication > Sign In / Providers > Phone) shows "Enable phone confirmations" switched off.

So the email key means "require confirmation" and the identical SMS key means "skip confirmation". Locally, supabase start with the same file does require phone confirmation, so one config behaves in opposite ways on a local stack and on a hosted project.

Expected behavior

[auth.sms] enable_confirmations = true should set sms_autoconfirm = false on the hosted project, the way [auth.email] enable_confirmations = true sets mailer_autoconfirm = false, and the way supabase start already treats the SMS key.

Steps to reproduce
  1. Set [auth.sms] enable_confirmations = true in supabase/config.toml.
  2. Run supabase link --project-ref <ref> and supabase config push.
  3. Run curl https://<ref>.supabase.co/auth/v1/settings -H "apikey: <publishable key>". It returns "phone_autoconfirm": true, and the dashboard's Phone provider shows "Enable phone confirmations" off.
  4. Run supabase start with the same file. The local auth container gets GOTRUE_SMS_AUTOCONFIRM=false.
Additional context

Cause. In pkg/config/auth.go (v2.98.0; apps/cli-go/pkg/config/auth.go on develop) the email mapping negates in both directions and the SMS mapping does not:

// email
body.MailerAutoconfirm = nullable.NewNullableWithValue(!e.EnableConfirmations) // L700
e.EnableConfirmations = !ValOrDefault(remoteConfig.MailerAutoconfirm, false)   // L825

// sms
body.SmsAutoconfirm = nullable.NewNullableWithValue(s.EnableConfirmations)     // L1121
s.EnableConfirmations = ValOrDefault(remoteConfig.SmsAutoconfirm, false)       // L1170

internal/start/start.go negates both:

fmt.Sprintf("GOTRUE_MAILER_AUTOCONFIRM=%v", !utils.Config.Auth.Email.EnableConfirmations) // L1309
fmt.Sprintf("GOTRUE_SMS_AUTOCONFIRM=%v", !utils.Config.Auth.Sms.EnableConfirmations)      // L1325

Because the read-back (L1170) is un-negated as well, the pushed value round-trips and config push has no diff to show for the key, so nothing flags it.

Why it matters. With sms_autoconfirm on, a phone number is marked confirmed without an OTP, both on signup and on PUT /user {phone}. A project that sets enable_confirmations = true believes it requires phone verification and does not.

Suggested fix. Negate L1121 and L1170 to match the email mapping. That flips the hosted value for any project that has worked around this by setting false, so it needs a release note.

History. Reported before as #4413, which was closed as not planned without a fix.

主要言語
TypeScript
スター
2.4k
フォーク
533
平均マージ
22時間 20分
マージ済み PR（30日）
370

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

supabase/cli のほかの issue

supabase/cli の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。