@supabase/lite 0.6.2-next.4 → 0.7.1-next.1

package/LIMITATIONS.md

@@ -23,6 +23,10 @@ Anchors below point to the corresponding STATUS.md section. If a limitation here
 - Range operators (`rangeGt`, …) and quantified comparisons (`eq(any)`, …) → not implemented on SQLite. See [Range Operators](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#range-operators) and [Quantified Comparison Operators](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#quantified-comparison-operators).
 - `schema()` → SQLite is single-schema. See [Control & Specialized](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#control--specialized).
 
+## Auth (shipped with caveats)
+
+- `double_confirm_changes = true` (secure email change) is spec-compatible but **not** GoTrue's full two-mailbox flow: it finalizes from the current-email confirmation only, so it does not require the new mailbox to also confirm. It still prevents a session thief from changing the email using only a mailbox they control. See [Auth email delivery & templates](https://github.com/supabase-community/lite/blob/HEAD/docs/src/content/docs/auth/email.mdx).
+
 ## Auth (planned, not yet shipped)
 
 - OAuth, anonymous sign-in, identity linking, admin API, MFA → planned. See [Auth API: Planned](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#-planned).

package/STATUS.md

@@ -495,7 +495,7 @@ Backend implementation in `app/src/auth/`. GoTrue-compatible HTTP endpoints at `
 | `signUp()`             | `POST /signup`                         | Email/password, optional metadata, email confirmation                 |
 | `signInWithPassword()` | `POST /token?grant_type=password`      | JWT + refresh token                                                   |
 | `signInWithOtp()`      | `POST /otp`                            | Magic link / OTP via email                                            |
-| `verifyOtp()`          | `POST /verify`                         | Supports: signup, magiclink, recovery, email_change, reauthentication |
+| `verifyOtp()`          | `POST /verify`, `GET /verify`          | signup, magiclink, recovery, email_change, reauthentication. Numeric code + `token_hash` both verify against the DB (durable on Workers); `otp_expiry`/`otp_length` honored. `GET /verify` 303-redirects to `redirect_to` (allow-list checked) |
 | `refreshSession()`     | `POST /token?grant_type=refresh_token` | Token rotation, immediate reuse compatibility, session expiry checks  |
 | `signOut()`            | `POST /logout`                         | Scopes: local, global, others                                         |
 | `getUser()`            | `GET /user`                            | JWT-authenticated                                                     |
@@ -510,8 +510,10 @@ Supporting infrastructure:
 - Password hashing (bcrypt-compatible)
 - Refresh token rotation with revocation, reuse, and parent-chain tracking
 - Session management (create, validate, refresh, expire, delete)
-- Configurable email signup, confirmations, and secure/insecure email change
-- Mailer integration (confirmation, recovery, magic link, email change)
+- Configurable email signup, confirmations, and secure/insecure email change. Note: `double_confirm_changes=true` is spec-compatible (finalizes from the current-email confirmation, delivered to the current address) but does not implement GoTrue's full two-mailbox confirmation. See [LIMITATIONS.md](https://github.com/supabase-community/lite/blob/HEAD/LIMITATIONS.md#auth-shipped-with-caveats).
+- Mailer integration (confirmation, recovery, magic link, email change, reauthentication)
+- Default Supabase-styled email templates with `site_url`-based verify links; per-type overrides via `auth.email.template.<type>.{subject,content_path}` (GoTrue `{{ .ConfirmationURL }}` etc. variables)
+- Email drivers `Resend` / `AWS SES` / `Sendmail` (injected via `options.drivers.email`; default `NoopEmailDriver` logs only)
 
 ### 🔄 Planned
 

package/dist/cli/index.js

@@ -277,8 +277,9 @@ CREATE INDEX IF NOT EXISTS users_is_anonymous_idx
   ON auth.users (is_anonymous);
 
 -- Partial unique indexes on token columns.
--- Only hash tokens (len > 6) need uniqueness; 6-digit OTPs can collide across users.
--- Uses length check instead of GoTrue's Postgres regex \u2014 portable across Postgres and SQLite.
+-- Columns store the OTP hash (hex SHA-256 of email+otp, len > 6), not the raw
+-- 6-digit code, so the length guard always includes real tokens while staying
+-- portable across Postgres and SQLite (vs GoTrue's Postgres-only regex).
 CREATE UNIQUE INDEX IF NOT EXISTS users_confirmation_token_idx
   ON auth.users (confirmation_token)
   WHERE length(confirmation_token) > 6;

package/dist/index.d.ts

@@ -302,9 +302,22 @@ interface AuthConfig {
         enable_signup?: boolean;
         enable_confirmations?: boolean;
         double_confirm_changes?: boolean;
+        otp_length?: number;
+        otp_expiry?: number;
+        smtp?: {
+            sender_name?: string;
+            admin_email?: string;
+        };
+        template?: Partial<Record<EmailTemplateType, EmailTemplateConfig>>;
     };
     enable_confirmations?: boolean;
     site_url?: string;
+    additional_redirect_urls?: string[];
+}
+type EmailTemplateType = "invite" | "confirmation" | "recovery" | "magic_link" | "email_change";
+interface EmailTemplateConfig {
+    subject?: string;
+    content_path?: string;
 }
 
 type Dialect$1 = "postgres" | "sqlite";
@@ -541,6 +554,11 @@ interface MailMeta {
     tokenNew?: string;
     tokenHashNew?: string;
     redirectTo?: string;
+    /** Current (old) email — used as the `Email` template var for email change. */
+    currentEmail?: string;
+    /** Pending (new) email — used as the `NewEmail` template var for email change. */
+    newEmail?: string;
+    data?: string;
 }
 
 declare class AuthService {
@@ -553,6 +571,18 @@ declare class AuthService {
     private sessionTimeboxSeconds?;
     private sessionInactivitySeconds?;
     constructor(repo: AuthRepository, config: AuthConfig, mailer: Mailer);
+    private get otpLength();
+    private get otpExpirySeconds();
+    /**
+     * Returns a safe post-verification redirect target: `redirectTo` if allowed,
+     * otherwise `site_url`. Mirrors GoTrue's `IsRedirectURLValid`:
+     *   - same scheme + host + port as `site_url` (any path; port ignored for
+     *     loopback hosts), or
+     *   - a glob match of `additional_redirect_urls` against the full URL
+     *     (patterns use `.`/`/` as separators, so `*` does not cross them but
+     *     `**` does).
+     */
+    resolveEmailRedirect(redirectTo?: string | null): string;
     signUp(email: string | undefined, password: string | undefined, data?: Record<string, unknown>): Promise<{
         user: UserResponse;
         session?: SessionResponse;
@@ -587,7 +617,8 @@ declare class AuthService {
     private mapUserToResponse;
     private mapIdentityToResponse;
     private findUserByTokenAndType;
-    private otpMatchesStoredTokenHash;
+    private static readonly SENT_AT_COLUMN;
+    private isTokenExpired;
     private getTokenColumnsForType;
     private createAuditLog;
 }
@@ -1120,6 +1151,15 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
             status: 200;
         };
     };
+} & {
+    "/verify": {
+        $get: {
+            input: {};
+            output: undefined;
+            outputFormat: "redirect";
+            status: 303;
+        };
+    };
 } & {
     "/recover": {
         $post: {