-
Notifications
You must be signed in to change notification settings - Fork 317
fix(auth): decouple provider enabled from signup control #4469
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: develop
Are you sure you want to change the base?
fix(auth): decouple provider enabled from signup control #4469
Conversation
Fixes email/phone authentication providers being incorrectly disabled when `enable_signup=false` is set in config.toml, which broke invite-only authentication setups. The CLI was incorrectly mapping `[auth.email].enable_signup` and `[auth.sms].enable_signup` to `GOTRUE_EXTERNAL_EMAIL_ENABLED` and `GOTRUE_EXTERNAL_PHONE_ENABLED`, conflating provider enablement with signup control. This caused the providers to be completely disabled, returning "email_provider_disabled" errors even for invite-only flows. Now email and phone providers are always enabled when `[auth].enabled=true`, aligning with the Docker Compose fix in supabase/supabase#XXXX. Signup control is handled separately via `GOTRUE_DISABLE_SIGNUP` which is already correctly mapped from `[auth].enable_signup`. This matches the OAuth provider pattern where providers are always enabled when configured, with separate control for signup permissions.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR fixes a critical bug where email and phone authentication providers were incorrectly disabled during local development when enable_signup=false was set in the config, breaking invite-only authentication flows. The fix decouples provider enablement from signup control to match the OAuth provider pattern.
Key changes:
- Hardcode
GOTRUE_EXTERNAL_EMAIL_ENABLED=trueandGOTRUE_EXTERNAL_PHONE_ENABLED=truein local development environment - Rely on existing
GOTRUE_DISABLE_SIGNUPfor signup control, which is properly mapped from[auth].enable_signup
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Pull Request Test Coverage Report for Build 19531912999Details
💛 - Coveralls |
|
Unfortunately your change makes
To achieve what you described, you want to use the following config instead. [auth]
enable_signup = false
[auth.email]
enable_signup = true |
|
You are correct! My apologies for the confusion. However, I think the current comment could be clearer since this setting does more than just control signups. What if we changed: To something like: This would help prevent others from encountering the same confusion I did. Happy to update both my PRs to just improve the documentation if that would be helpful! |
…t signup Updated config template comments for [auth.email] and [auth.sms] enable_signup to explain these control the entire provider, not just signup. Added invite-only configuration examples.
|
@sweatybridge Updated the issue and both PR's, hope this is more helpful |
Correction
Updated to Documentation-Only
After reviewer feedback, this is now a documentation improvement rather than code change.
What Changed
Updated
[auth.email].enable_signupand[auth.sms].enable_signupcomments in config templates to clarify:false= provider disabled (no login/invites/OTP/signup)true= provider enabled (signup requires[auth].enable_signup=true)Issue: supabase/supabase#40582
Companion PR: supabase/supabase#40575
Original PR
Fixes supabase/supabase#40582
Problem
When using invite-only authentication (
[auth].enable_signup=falseand[auth.email].enable_signup=false), the CLI incorrectly disables the entire email/phone authentication providers instead of just preventing self-signups.This causes:
422 email_provider_disablederrors when attempting to use OTP/magic linksRoot Cause
Lines 487 and 502 in
internal/start/start.gomap:utils.Config.Auth.Email.EnableSignup→GOTRUE_EXTERNAL_EMAIL_ENABLEDutils.Config.Auth.Sms.EnableSignup→GOTRUE_EXTERNAL_PHONE_ENABLEDThis conflates two distinct concerns:
Solution
Set
GOTRUE_EXTERNAL_EMAIL_ENABLED=trueandGOTRUE_EXTERNAL_PHONE_ENABLED=truewhen auth is enabled, since:if utils.Config.Auth.Enabledcheck (line 460) already gates provider initializationEnabledfield, onlyEnableSignupGOTRUE_DISABLE_SIGNUP(line 478)This fixes the inconsistency:
EnableSignupshould only control whether users can self-register, not whether the provider existsprovider.Enabledfield for this reasonTesting
Before:
After:
Same config now works - invites accepted ✅, OTP works ✅, self-signup blocked ✅
Fixes supabase/supabase#
Companion PR: supabase/supabase#40575 (Docker Compose fix)