A way to specify user authentication strategy

[Sid-Sun]

I recently started workings on creative a notes API, I have a security background and wanted to have encryption on the data - I have a custom protocol for authentication users, it can be summarised as:

When user signs up, I create a random key used for encryption of their data, this key is encrypted with the user's password and stored in the database

When user logs in I fetch the encrypted key, decrypt it and if it is valid then user is authenticate and the key is them used for encryption / decryption of user data

I want to use Supabase in the project, Supabase provides its own authentication system but that won't allow me to implement my protocol without at least adding another layer of redundancy in authentication (fetch key & decrypt key after login is successful) additionally, the part I like about my approach is user's password is not stored in any form (including hashes) so it can be guaranteed only they can access their data

Being able to provide Supabase with either an API route or a function / lambda for use in authentication would go a long way to removing this limitation and allowing the services to be used in more versatile environments and applications.

[inian]

Hi @Sid-Sun, interesting approach!

When the user enters their username and password, you can call a stored procedure via rpc. The stored procedure can then decrypt the encrypted key and return the user data back. Postgres does support the basic crypto functions via pgcrypto.

We will be launching functions in a few months, so that would be a good place to run this code too.

[Sid-Sun]

Hi! Thanks for the quick response, sounds like a nice idea!

I think I'll try using rpc until functions are released. Can you tell me how I would have to handle email verification via rpc (or functions when they're released) or do would I need to rely on an external service for this?

[inian]

Check out SupaScript? @burggraf has built a way to write Javascript inside a stored procedure and has examples in the README on how to send emails. I remember he mentioned that he was able to call the Sendgrid API with this.

[burggraf]

I have a MailGun integration for sending email from PostgreSQL functions. It’s actually written in Pgplsql I think though so it doesn’t require PLV8 or SupaScript.