-
-
Notifications
You must be signed in to change notification settings - Fork 53
[MFA Bug] Can not enroll MFA use factor_type = "totp" #684
Description
Bug report
- I confirm this is a bug with Supabase, not with my own application.
- I confirm I have searched the Docs, GitHub Discussions, and Discord.
Describe the bug
model_validate error for class AuthMFAEnrollResponse when we enroll new MFA.
To Reproduce
When enrolling a new MFA factor using the following code:
self.anon_role.auth.mfa.enroll(
{
"factor_type": "totp",
"friendly_name": "test",
"issuer": "Test Platform",
"phone": "xxxx",
}
)It raises the following validation error:
1 validation error for AuthMFAEnrollResponse\nphone\n Field required [type=missing, input_value={'id': 'dc5440a6-7f38-4bf...ARFDY5QLJHF63L3YRRLJ6'}}, input_type=dict]\n For further information visit https://errors.pydantic.dev/2.10/v/missing
After reviewing the source code, the issue originates from the _enroll method:
def _enroll(self, params: MFAEnrollParams) -> AuthMFAEnrollResponse:
session = self.get_session()
if not session:
raise AuthSessionMissingError()
body = {
"friendly_name": params["friendly_name"],
"factor_type": params["factor_type"],
}
if params["factor_type"] == "phone":
body["phone"] = params["phone"]
else:
body["issuer"] = params["issuer"]
response = self._request(
"POST",
"factors",
body=body,
jwt=session.access_token,
xform=partial(model_validate, AuthMFAEnrollResponse),
)
if params["factor_type"] == "totp" and response.totp.qr_code:
response.totp.qr_code = f"data:image/svg+xml;utf-8,{response.totp.qr_code}"
return responsein the line xform=partial(model_validate, AuthMFAEnrollResponse)
The response I received from supabase server is
{'friendly_name': 'cdiam', 'id': '9fb8848b-49eb-49d3-ae35-daac2e2bf9d5', 'totp':...}However, the AuthMFAEnrollResponse model expects phone as a required field. Since phone is missing from the API response when using "factor_type": "totp", the validation fails, resulting in the error.
###Potential Fix
Modify the AuthMFAEnrollResponse schema to make phone optional when factor_type is "totp".
Expected behavior
Enroll MFA successfully