smoonb 1.0.8 → 1.0.9

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.0.9] - 2026-10-10
+
+### Fixed
+
+- Treat SMTP passwords as write-only credentials. Never replay the protected SMTP value returned by the Management API from a legacy backup as the provider password.
+- Ask for the real SMTP password with hidden input before restoring any selected components. Fail before remote mutations if it is missing. Keep the entered password in memory only.
+- Verify readable Auth settings independently from password submission. Continue after the API accepts the supplied password, but report `applied_with_unverified_secrets` and require an authentication email test instead of claiming password or email-delivery verification.
+- Omit the protected SMTP value from new Auth snapshots and explicitly record that the provider password is required during restore. Existing backups remain usable.
+
+### Recovery from 1.0.8
+
+- If restore stopped at `Configuration verification failed: smtp_pass`, inspect its `report.json`. When Database and Edge Functions are already verified, run restore with those two components disabled and select Auth, Storage, Database Settings and Realtime as needed. Supply the real provider SMTP password when prompted; no new backup or destination project is required for this specific failure.
+
+### Tests
+
+- Cover legacy/new snapshots, hidden input, missing-password preflight, protected-value rejection, HTTP failures, readable-setting mismatches, partial verification reporting and continuation without reloading the database.
+
 ## [1.0.8] - 2026-10-10
 
 ### Fixed

package/README.md

@@ -313,7 +313,11 @@ Database loading uses one transaction, stops on errors, suspends triggers only o
 
 Optional URL remapping changes only the project's Supabase hostname, including URLs inside JSON and text files. It does not rename files or replace isolated project IDs. Historical URLs may also change; choose preservation when needed. Signed URLs, custom domains, external integrations and application API keys need separate validation. Destination platform keys are not replaced.
 
-Auth and Realtime are applied through the Management API and verified by reading them back. Legacy Realtime captures may be stale: restoration reproduces the recorded values and date, not the source project's current settings. New backups capture Realtime directly through the API. Legacy function backups without the JWT flag default to requiring JWT; new backups preserve that flag.
+Readable Auth and Realtime settings are applied through the Management API and verified by reading them back. The **SMTP password cannot be exported**: Supabase returns a protected value that cannot be used as the password in another project. Starting with 1.0.9, smoonb requests the real provider password with hidden input **before restoring any components**, including when using legacy backups. It stays in memory only and is sent to the destination Supabase project. The report distinguishes API password acceptance from readback verification (`applied_with_unverified_secrets`). Test an authentication email on the destination; API acceptance does not validate the password with the email provider.
+
+If a 1.0.8 restore stopped at `Configuration verification failed: smtp_pass` and its `report.json` confirms Database and Edge Functions, reuse the same backup and project: run `npx smoonb@1.0.9 restore`, answer **no** for Database and Edge Functions, and **yes** for the pending Auth, Storage, Database Settings and Realtime components. Enter the provider SMTP password when prompted. This specific failure does not require another backup or a database reload.
+
+Legacy Realtime captures may be stale: restoration reproduces the recorded values and date, not the source project's current settings. New backups capture Realtime directly through the API. Legacy function backups without the JWT flag default to requiring JWT; new backups preserve that flag.
 
 Reports are saved after each stage, including failures. External services cannot share the database transaction: earlier stages remain completed if a later stage fails. Do not reload the database into a populated destination. Resolve the reported stage and select only pending components, or use another empty project.
 

package/README.pt-BR.md

@@ -313,7 +313,11 @@ A carga do banco usa uma transação com interrupção em erro, suspende trigger
 
 O remapeamento opcional troca apenas o domínio Supabase do projeto em URLs, inclusive em JSON e arquivos de texto. Não troca IDs isolados nem nomes de arquivos. URLs históricas também podem ser afetadas; escolha preservar quando isso for necessário. URLs assinadas, domínios personalizados, integrações externas e chaves de API da aplicação precisam de validação específica. As chaves de plataforma do destino não são substituídas.
 
-Auth e Realtime são aplicados pela Management API e conferidos por nova leitura. A captura antiga de Realtime pode conter valores desatualizados: a restauração reproduz os valores e a data registrados, não o estado atual do projeto original. Novos backups capturam Realtime diretamente pela API. Em backups antigos sem o sinalizador de JWT de Functions, o padrão seguro é exigir JWT; os novos backups guardam esse sinalizador.
+As configurações legíveis de Auth e Realtime são aplicadas pela Management API e conferidas por nova leitura. A **senha SMTP não é exportável**: o Supabase devolve um valor protegido, que não pode ser usado como senha em outro projeto. A partir da versão 1.0.9, o smoonb solicita a senha real do provedor em campo oculto **antes de restaurar os componentes**, inclusive ao usar backups antigos. Ela permanece somente na memória e é enviada ao Supabase de destino. O relatório distingue senha aceita pela API de configurações verificadas por leitura (`applied_with_unverified_secrets`). Teste o envio de e-mail de autenticação no destino; aceitar uma senha pela API não comprova sua validade junto ao provedor.
+
+Se uma restauração 1.0.8 parou em `Configuration verification failed: smtp_pass` e o `report.json` confirmou Database e Edge Functions, use o mesmo backup e projeto: execute `npx smoonb@1.0.9 restore`, responda **não** para Database e Edge Functions e **sim** para Auth, Storage, Database Settings e Realtime que ficaram pendentes. Informe a senha SMTP do provedor quando solicitada. Não é necessário refazer o backup nem recarregar o banco nesse caso.
+
+A captura antiga de Realtime pode conter valores desatualizados: a restauração reproduz os valores e a data registrados, não o estado atual do projeto original. Novos backups capturam Realtime diretamente pela API. Em backups antigos sem o sinalizador de JWT de Functions, o padrão seguro é exigir JWT; os novos backups guardam esse sinalizador.
 
 O relatório é salvo durante cada etapa, inclusive em falhas. Serviços externos não participam da transação do banco: se uma etapa posterior falhar, as anteriores permanecem registradas como concluídas. Não repita a carga do banco em um destino já preenchido. Resolva a etapa indicada e selecione apenas os componentes pendentes, ou use outro projeto vazio.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoonb",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "Complete Supabase backup and migration tool. https://www.smoonb.com/#price",
   "preferGlobal": false,
   "preventGlobalInstall": true,

package/src/commands/backup/steps/05-auth-settings.js

@@ -2,6 +2,7 @@ const chalk = require('chalk');
 const path = require('path');
 const { writeJson } = require('../../../utils/fsx');
 const { t } = require('../../../i18n');
+const { authSnapshot } = require('../../../utils/auth-secrets');
 
 /**
  * Etapa 4: Backup Auth Settings via Management API
@@ -26,15 +27,18 @@ module.exports = async ({ projectId, accessToken, backupDir }) => {
 
     const authSettings = await authResponse.json();
     
-    // Salvar configurações de Auth
+    const snapshot = authSnapshot(authSettings);
+    // Never store the opaque SMTP readback as a recoverable password.
     const authSettingsPath = path.join(backupDir, 'auth-settings.json');
     await writeJson(authSettingsPath, {
       project_id: projectId,
       timestamp: new Date().toISOString(),
-      settings: authSettings
+      ...snapshot
     });
 
     console.log(chalk.green(`✅ Auth Settings exportadas: ${path.basename(authSettingsPath)}`));
+    if (snapshot.secrets.smtp_pass.requires_input)
+      console.log(chalk.yellow(getT('backup.smtp.passwordNotExported')));
     return { success: true };
 
   } catch (error) {

package/src/commands/restore/auth.js

@@ -0,0 +1,65 @@
+const fs = require('fs');
+const path = require('path');
+const inquirer = require('inquirer');
+const { t } = require('../../i18n');
+const { remapServiceUrls } = require('./dump');
+const { isMasked } = require('../../utils/auth-secrets');
+
+async function prepareAuth(
+  { backupPath, targetProject, remapUrls = true },
+  {
+    prompt = (questions) => inquirer.prompt(questions),
+    interactive = Boolean(process.stdin.isTTY),
+    log = console.log,
+  } = {},
+) {
+  const getT = global.smoonbI18n?.t || t;
+  const backup = JSON.parse(
+    fs.readFileSync(path.join(backupPath, 'auth-settings.json'), 'utf8'),
+  );
+  const settings =
+    backup.settings?.auth_url_config ||
+    backup.settings ||
+    backup.auth_url_config;
+  if (!settings || !Object.keys(settings).length)
+    throw new Error('Auth configuration missing from backup');
+  // Never replay an opaque value from a legacy backup as a password.
+  const { smtp_pass: stored, ...readable } = settings;
+  const desired = remapUrls
+    ? JSON.parse(
+        remapServiceUrls(
+          JSON.stringify(readable),
+          backup.project_id,
+          targetProject.targetProjectId,
+        ),
+      )
+    : readable;
+  const needsPassword = Boolean(
+    stored || settings.smtp_host || backup.secrets?.smtp_pass?.requires_input,
+  );
+  const writeOnly = {};
+  if (needsPassword) {
+    log(getT('restore.smtp.explanation'));
+    if (!interactive) throw new Error(getT('restore.smtp.interactiveRequired'));
+    const validate = (value) =>
+      typeof value === 'string' &&
+      value.trim().length > 0 &&
+      !isMasked(value) &&
+      value !== stored;
+    const answer = await prompt([
+      {
+        type: 'password',
+        name: 'smtpPassword',
+        mask: '*',
+        message: getT('restore.smtp.password'),
+        validate: (value) => validate(value) || getT('restore.smtp.required'),
+      },
+    ]);
+    if (!validate(answer.smtpPassword))
+      throw new Error(getT('restore.smtp.required'));
+    writeOnly.smtp_pass = answer.smtpPassword;
+  }
+  return { desired, writeOnly };
+}
+
+module.exports = { prepareAuth };

package/src/commands/restore/index.js

@@ -188,7 +188,10 @@ module.exports = async (options = {}) => {
     }
 
     if (restoreResults.authSettings) {
-      ui.success(`🔐 ${getT('restore.index.authSettingsRestored')}`);
+      if (restoreResults.authSettings.verified)
+        ui.success(`🔐 ${getT('restore.index.authSettingsRestored')}`);
+      else
+        ui.warn(getT('restore.smtp.accepted'));
     }
 
     if (restoreResults.storage) {

package/src/commands/restore/management.js

@@ -1,3 +1,5 @@
+const { isMasked } = require('../../utils/auth-secrets');
+
 async function management(
   target,
   endpoint,
@@ -33,9 +35,29 @@ async function applyConfig(
   desired,
   allowed,
   request = management,
+  { writeOnly = {} } = {},
 ) {
+  const secretFields = Object.keys(writeOnly);
+  for (const key of secretFields) {
+    if (
+      endpoint !== 'config/auth' ||
+      key !== 'smtp_pass' ||
+      !allowed.includes(key)
+    )
+      throw new Error(`Unsupported write-only configuration: ${key}`);
+    if (
+      typeof writeOnly[key] !== 'string' ||
+      !writeOnly[key].trim() ||
+      isMasked(writeOnly[key])
+    )
+      throw new Error(`A real credential is required: ${key}`);
+  }
+  if (endpoint === 'config/auth' && Object.hasOwn(desired, 'smtp_pass'))
+    throw new Error(
+      'SMTP password must be supplied separately, never copied from a configuration response',
+    );
   const before = await request(target, endpoint);
-  const patch = {};
+  const patch = { ...writeOnly };
   const unsupported = [];
   for (const [key, value] of Object.entries(desired)) {
     if (JSON.stringify(before[key]) === JSON.stringify(value)) continue;
@@ -43,10 +65,7 @@ async function applyConfig(
       unsupported.push(key);
       continue;
     }
-    if (
-      typeof value === 'string' &&
-      /^(\*{3,}|[•●]{3,}|\[redacted\])$/i.test(value)
-    )
+    if (isMasked(value))
       throw new Error(`Masked configuration cannot be restored: ${key}`);
     patch[key] = value;
   }
@@ -66,7 +85,10 @@ async function applyConfig(
     );
   return {
     success: true,
-    verified: true,
+    verified: secretFields.length === 0,
+    configuration_readback_verified: true,
+    write_only_fields_accepted: secretFields,
+    ...(secretFields.length ? { email_delivery_verified: false } : {}),
     fields_verified: Object.keys(desired).length,
     fields_updated: Object.keys(patch),
   };

package/src/commands/restore/runner.js

@@ -3,6 +3,7 @@ const path = require('path');
 const { t } = require('../../i18n');
 const { buildRestore, readDump } = require('./dump');
 const { storagePlan } = require('./steps/06-storage');
+const { prepareAuth } = require('./auth');
 const steps = {
   database: require('./steps/03-database'),
   edgeFunctions: require('./steps/04-edge-functions'),
@@ -21,6 +22,7 @@ async function runRestore(
     remapUrls = true,
   },
   implementations = steps,
+  { prepareAuthConfig = prepareAuth } = {},
 ) {
   if (selectedBackup.projectId === targetProject.targetProjectId)
     throw new Error('Restore requires a different, empty destination project');
@@ -84,24 +86,45 @@ async function runRestore(
       buildRestore(readDump(context.backupFilePath), context);
     if (components.storage)
       storagePlan(context.backupPath, context.backupFilePath);
+    // Resolve write-only credentials before restoring the database or any service.
+    if (components.authSettings)
+      context.authConfig = await prepareAuthConfig(context);
     for (const [name, step] of Object.entries(implementations)) {
       if (!components[name]) continue;
       current = name;
       report.results[name] = { success: false, status: 'running' };
       save();
       const labels = {
-        database: 'restoringDatabase', edgeFunctions: 'restoringEdgeFunctions',
-        authSettings: 'restoringAuthSettings', storage: 'restoringStorageBuckets',
-        databaseSettings: 'restoringDatabaseSettings', realtimeSettings: 'restoringRealtimeSettings',
+        database: 'restoringDatabase',
+        edgeFunctions: 'restoringEdgeFunctions',
+        authSettings: 'restoringAuthSettings',
+        storage: 'restoringStorageBuckets',
+        databaseSettings: 'restoringDatabaseSettings',
+        realtimeSettings: 'restoringRealtimeSettings',
       };
       console.log((global.smoonbI18n?.t || t)(`restore.index.${labels[name]}`));
       const result = await step(context);
-      if (!result?.success || !result?.verified)
+      const acceptedSmtp =
+        name === 'authSettings' &&
+        result?.configuration_readback_verified === true &&
+        result?.email_delivery_verified === false &&
+        result?.write_only_fields_accepted?.length === 1 &&
+        result.write_only_fields_accepted[0] === 'smtp_pass';
+      if (!result?.success || (!result?.verified && !acceptedSmtp))
         throw new Error(`Component ${name} did not pass verification`);
-      report.results[name] = { ...result, status: 'verified' };
+      report.results[name] = {
+        ...result,
+        status: result.verified
+          ? 'verified'
+          : 'applied_with_unverified_secrets',
+      };
       save();
+      if (acceptedSmtp)
+        console.log((global.smoonbI18n?.t || t)('restore.smtp.accepted'));
     }
-    report.status = 'verified';
+    report.status = Object.values(report.results).every((r) => r.verified)
+      ? 'verified'
+      : 'applied_with_unverified_secrets';
     report.completed_at = new Date().toISOString();
     save();
     return report.results;

package/src/commands/restore/steps/05-auth-settings.js

@@ -1,26 +1,15 @@
-const fs = require('fs');
-const path = require('path');
 const { applyConfig } = require('../management');
-const { remapServiceUrls } = require('../dump');
+const { prepareAuth } = require('../auth');
 const allowed = require('../auth-fields.json');
-module.exports = async ({ backupPath, targetProject, remapUrls = true }) => {
-  const backup = JSON.parse(
-    fs.readFileSync(path.join(backupPath, 'auth-settings.json'), 'utf8'),
+module.exports = async (context, { request } = {}) => {
+  const { desired, writeOnly } =
+    context.authConfig || (await prepareAuth(context));
+  return applyConfig(
+    context.targetProject,
+    'config/auth',
+    desired,
+    allowed,
+    request,
+    { writeOnly },
   );
-  const settings =
-    backup.settings?.auth_url_config ||
-    backup.settings ||
-    backup.auth_url_config;
-  if (!settings || !Object.keys(settings).length)
-    throw new Error('Auth configuration missing from backup');
-  const desired = remapUrls
-    ? JSON.parse(
-        remapServiceUrls(
-          JSON.stringify(settings),
-          backup.project_id,
-          targetProject.targetProjectId,
-        ),
-      )
-    : settings;
-  return applyConfig(targetProject, 'config/auth', desired, allowed);
 };

package/src/i18n/locales/en.json

@@ -18,6 +18,12 @@
   "prompt.confirmYes": "(Y/n)",
   "prompt.confirmNo": "(y/N)",
   "prompt.cancelled": "Operation cancelled.",
+  "backup.smtp.passwordNotExported": "⚠️ Supabase does not export the SMTP password. Keep it in your password manager: restoring Auth will require it. You do not need to create another backup.",
+  "restore.smtp.explanation": "The backup contains SMTP settings, but Supabase does not let you retrieve the password. Enter your email provider password (or the key used as the SMTP password). It will be sent only to the destination Supabase project and will not be saved by smoonb.",
+  "restore.smtp.password": "Email provider SMTP password:",
+  "restore.smtp.required": "Enter the real provider password, not the protected value in auth-settings.json. Use Ctrl+C to cancel before restoring any components.",
+  "restore.smtp.interactiveRequired": "Restoring Auth requires the SMTP password. Run in an interactive terminal to enter it securely before any components are restored.",
+  "restore.smtp.accepted": "⚠️ Auth: settings checked; SMTP password accepted by the API. Supabase does not allow password readback verification. Test an authentication email before using the project.",
 
   "error.generic": "Something went wrong.",
   "error.pathNotFound": "Path not found: {path}",

package/src/i18n/locales/pt-BR.json

@@ -18,6 +18,12 @@
   "prompt.confirmYes": "(S/n)",
   "prompt.confirmNo": "(s/N)",
   "prompt.cancelled": "Operação cancelada.",
+  "backup.smtp.passwordNotExported": "⚠️ O Supabase não exporta a senha SMTP. Guarde-a no seu gerenciador de senhas: ela será solicitada ao restaurar Auth. Não é necessário refazer o backup.",
+  "restore.smtp.explanation": "O backup contém as configurações SMTP, mas o Supabase não permite recuperar a senha. Informe a senha do provedor de e-mail (ou a chave usada como senha SMTP). Ela será enviada somente ao Supabase de destino e não será gravada pelo smoonb.",
+  "restore.smtp.password": "Senha SMTP do provedor de e-mail:",
+  "restore.smtp.required": "Informe a senha real do provedor, não o valor protegido de auth-settings.json. Use Ctrl+C para cancelar antes de restaurar os componentes.",
+  "restore.smtp.interactiveRequired": "A restauração de Auth precisa da senha SMTP. Execute em um terminal interativo para informá-la de forma oculta antes de restaurar os componentes.",
+  "restore.smtp.accepted": "⚠️ Auth: configurações conferidas; senha SMTP aceita pela API. O Supabase não permite conferir a senha por leitura. Teste o envio de e-mail de autenticação antes de usar o projeto.",
 
   "error.generic": "Algo inesperado aconteceu.",
   "error.pathNotFound": "Caminho não encontrado: {path}",

package/src/utils/auth-secrets.js

@@ -0,0 +1,23 @@
+// Supabase SMTP passwords are write-only. The GET response is not a
+// transferable credential, even when it looks like an ordinary string.
+// https://github.com/supabase/supabase/blob/master/apps/studio/components/interfaces/Auth/SmtpForm/SmtpForm.tsx
+function authSnapshot(settings) {
+  const { smtp_pass: smtpPass, ...readable } = settings;
+  return {
+    settings: readable,
+    secrets: {
+      smtp_pass: {
+        exportable: false,
+        requires_input: Boolean(smtpPass || settings.smtp_host),
+      },
+    },
+  };
+}
+
+function isMasked(value) {
+  return (
+    typeof value === 'string' && /^(\*{3,}|[•●]{3,}|\[redacted\])$/i.test(value)
+  );
+}
+
+module.exports = { authSnapshot, isMasked };