fix(cli): confine auth email content_path to project root (CLI-2320)

[Coly010]

Summary

config push resolves auth.email.template.*.content_path and
auth.email.notification.*.content_path from disk before uploading their
bytes as part of the auth config write. Resolution previously joined a
relative path onto the project root (or passed an absolute path through
unchanged) with no containment check, so a crafted content_path could
resolve outside the project. content_path is now confined to the project
root: any resolved path — a relative .. escape or an absolute path
elsewhere on disk — aborts before the file is read, using the existing
Invalid config for auth.email.<kind>.<name>.content_path: <reason> error
shape.

Linear: CLI-2320 (surfaced by CLI-2313's security review; intentionally kept
out of that PR).

What changed

• push.auth-email-content.ts — new resolveContainedContentPath normalizes
  the candidate path with path.resolve and rejects anything outside the
  discovered project root before readTemplateContent runs;
  legacyLoadAuthEmailContent's template and notification loops both route
  through it. The existing notification legacy-fallback behavior
  (supabase/-relative lookup) is preserved as long as the resolved result
  stays inside the root.
• push.auth-email-content.unit.test.ts — new coverage: absolute path outside
  root (template + notification), relative .. escape (template +
  notification), and a boundary case for a path resolving to exactly the
  project root.
• SIDE_EFFECTS.md — documents the containment rule in Files Read, Notes, and
  the exit-code table.

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@4ecb369efc53e08a29515727cde2a1eb55778fc9

Preview package for commit 4ecb369.

[github-actions]

🤖 AI Review

Six deduplicated findings were adjudicated from 6 Claude and 2 Codex findings. Four are confirmed, including the jointly identified symlink escape and false rejection of valid in-root paths. Two documentation findings are refuted because metadata-only stat calls do not read file contents and the documented notification fallback selects an in-root final path.

Findings

Severity	Location	Category	Sources	Claim
🔴 CRITICAL	apps/cli/src/commands/config/push/push.auth-email-content.ts:69	security	claude+codex	The containment check can be bypassed with an in-project symlink, allowing an outside file to be read and uploaded.
🟡 MINOR	apps/cli/src/commands/config/push/push.auth-email-content.ts:38	correctness	claude+codex	The containment predicate rejects valid in-root paths whose first component merely begins with two dots.
🟡 MINOR	apps/cli/src/commands/config/push/push.auth-email-content.ts:63	consistency	claude	Containment is implemented only in config push, while validation and supabase start still accept and consume out-of-root content_path values.
⚪ NIT	apps/cli/src/commands/config/push/push.auth-email-content.ts:72	error-handling	claude	The containment error omits the rejected resolved path, making the failure harder to diagnose.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/src/commands/config/push/push.auth-email-content.ts:63 (documentation): The statement that an out-of-root notification path is never read is inaccurate because the legacy resolver stats it before containment is checked.
  Refuted: statSync reads filesystem metadata, not the file's contents. The documentation says containment occurs before the file is read, and readFileSync is indeed reachable only after the containment check succeeds.
• apps/cli/src/commands/config/push/SIDE_EFFECTS.md:354 (documentation): The documentation incorrectly promises that every notification path initially resolving outside the root aborts, because the legacy fallback can redirect it to an in-root file.
  Refuted: The documentation already states that notifications use the legacy fallback. In the cited ../secrets.html case, the fallback's final selected path is inside the project root, so it satisfies the documented final-path containment rule rather than contradicting it.

Stats

Claude findings: 6 · Codex findings: 2 · Confirmed: 4 · Refuted: 2 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.