@supabase/lite 0.7.0 → 0.7.1-next.2

package/LIMITATIONS.md

@@ -23,6 +23,10 @@ Anchors below point to the corresponding STATUS.md section. If a limitation here
 - Range operators (`rangeGt`, …) and quantified comparisons (`eq(any)`, …) → not implemented on SQLite. See [Range Operators](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#range-operators) and [Quantified Comparison Operators](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#quantified-comparison-operators).
 - `schema()` → SQLite is single-schema. See [Control & Specialized](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#control--specialized).
 
+## Auth (shipped with caveats)
+
+- `double_confirm_changes = true` (secure email change) is spec-compatible but **not** GoTrue's full two-mailbox flow: it finalizes from the current-email confirmation only, so it does not require the new mailbox to also confirm. It still prevents a session thief from changing the email using only a mailbox they control. See [Auth email delivery & templates](https://github.com/supabase-community/lite/blob/HEAD/docs/src/content/docs/auth/email.mdx).
+
 ## Auth (planned, not yet shipped)
 
 - OAuth, anonymous sign-in, identity linking, admin API, MFA → planned. See [Auth API: Planned](https://github.com/supabase-community/lite/blob/HEAD/STATUS.md#-planned).

package/STATUS.md

@@ -495,7 +495,7 @@ Backend implementation in `app/src/auth/`. GoTrue-compatible HTTP endpoints at `
 | `signUp()`             | `POST /signup`                         | Email/password, optional metadata, email confirmation                 |
 | `signInWithPassword()` | `POST /token?grant_type=password`      | JWT + refresh token                                                   |
 | `signInWithOtp()`      | `POST /otp`                            | Magic link / OTP via email                                            |
-| `verifyOtp()`          | `POST /verify`                         | Supports: signup, magiclink, recovery, email_change, reauthentication |
+| `verifyOtp()`          | `POST /verify`, `GET /verify`          | signup, magiclink, recovery, email_change, reauthentication. Numeric code + `token_hash` both verify against the DB (durable on Workers); `otp_expiry`/`otp_length` honored. `GET /verify` 303-redirects to `redirect_to` (allow-list checked) |
 | `refreshSession()`     | `POST /token?grant_type=refresh_token` | Token rotation, immediate reuse compatibility, session expiry checks  |
 | `signOut()`            | `POST /logout`                         | Scopes: local, global, others                                         |
 | `getUser()`            | `GET /user`                            | JWT-authenticated                                                     |
@@ -510,8 +510,10 @@ Supporting infrastructure:
 - Password hashing (bcrypt-compatible)
 - Refresh token rotation with revocation, reuse, and parent-chain tracking
 - Session management (create, validate, refresh, expire, delete)
-- Configurable email signup, confirmations, and secure/insecure email change
-- Mailer integration (confirmation, recovery, magic link, email change)
+- Configurable email signup, confirmations, and secure/insecure email change. Note: `double_confirm_changes=true` is spec-compatible (finalizes from the current-email confirmation, delivered to the current address) but does not implement GoTrue's full two-mailbox confirmation. See [LIMITATIONS.md](https://github.com/supabase-community/lite/blob/HEAD/LIMITATIONS.md#auth-shipped-with-caveats).
+- Mailer integration (confirmation, recovery, magic link, email change, reauthentication)
+- Default Supabase-styled email templates with `site_url`-based verify links; per-type overrides via `auth.email.template.<type>.{subject,content_path}` (GoTrue `{{ .ConfirmationURL }}` etc. variables)
+- Email drivers `Resend` / `AWS SES` / `Sendmail` (injected via `options.drivers.email`; default `NoopEmailDriver` logs only)
 
 ### 🔄 Planned