@mccaskie-labs/workbench-config 0.1.24 → 0.1.25
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +6 -0
- package/dist/vendor-settings.js +20 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,11 @@
|
|
|
1
1
|
# @mccaskie-labs/workbench-config
|
|
2
2
|
|
|
3
|
+
## 0.1.25
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Vendor settings baseline: two new Supabase Auth rows. `supabase.auth.signup_skips_email_confirm` keeps "Confirm email" on (`mailer_autoconfirm` false), and `supabase.auth.anonymous_sign_ins` keeps anonymous sign-ins off (`external_anonymous_users_enabled` false). An app that trusts the email in a session is only safe while both hold.
|
|
8
|
+
|
|
3
9
|
## 0.1.24
|
|
4
10
|
|
|
5
11
|
### Patch Changes
|
package/dist/vendor-settings.js
CHANGED
|
@@ -87,6 +87,26 @@ export const VENDOR_SETTINGS = Object.freeze([
|
|
|
87
87
|
where: "Supabase: Authentication, Sign In / Providers, Email, Secure email change",
|
|
88
88
|
breaks: "Off: an address change is confirmed from the new address only, so the owner of the old one never hears of it.",
|
|
89
89
|
},
|
|
90
|
+
{
|
|
91
|
+
id: "supabase.auth.signup_skips_email_confirm",
|
|
92
|
+
vendor: "supabase",
|
|
93
|
+
area: "auth",
|
|
94
|
+
field: "mailer_autoconfirm",
|
|
95
|
+
type: "boolean",
|
|
96
|
+
value: false,
|
|
97
|
+
where: "Supabase: Authentication, Sign In / Providers, Email, Confirm email (on means this row is false)",
|
|
98
|
+
breaks: "On: anyone with the publishable key can sign up as any address without owning it. An app that trusts the email in the session (the template's admin claim, invitations) then hands that address's rights to a stranger.",
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
id: "supabase.auth.anonymous_sign_ins",
|
|
102
|
+
vendor: "supabase",
|
|
103
|
+
area: "auth",
|
|
104
|
+
field: "external_anonymous_users_enabled",
|
|
105
|
+
type: "boolean",
|
|
106
|
+
value: false,
|
|
107
|
+
where: "Supabase: Authentication, Sign In / Providers, Allow anonymous sign-ins",
|
|
108
|
+
breaks: "On: anyone with the publishable key gets a signed-in session with no address at all, and can then attach an address it doesn't own. Every \"signed in\" check in the app lets them through.",
|
|
109
|
+
},
|
|
90
110
|
]);
|
|
91
111
|
const override = z.strictObject({
|
|
92
112
|
id: z.string().min(1).max(100),
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mccaskie-labs/workbench-config",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.25",
|
|
4
4
|
"description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
|
|
5
5
|
"license": "UNLICENSED",
|
|
6
6
|
"type": "module",
|