Skip to content

Add flag to hide email and phone columns in auth users #39151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Oct 1, 2025
Merged

Add flag to hide email and phone columns in auth users #39151

merged 2 commits into from
Oct 1, 2025

Conversation

joshenlim
Copy link
Member

Context

Adds a flag in enabled features to toggle showing of email and phone columns in auth users page. Should also cover the column dropdown (which toggles visibility of the columns) -> email and phone options should be hidden if flag is off

To test

  • Verify this behaviour locally
  • Verify that staging preview is status quo

@joshenlim joshenlim requested a review from a team as a code owner October 1, 2025 06:39
@supabase Supabase
Copy link

supabase bot commented Oct 1, 2025

This pull request has been ignored for the connected project xguihxuzqibwxjnimxev because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

@joshenlim joshenlim changed the title add flag to hide email and phone columns in auth users Add flag to hide email and phone columns in auth users Oct 1, 2025
@vercel Vercel
Copy link

vercel bot commented Oct 1, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
design-system Ready Ready Preview Comment Oct 1, 2025 4:30pm
docs Ready Ready Preview Comment Oct 1, 2025 4:30pm
studio-self-hosted Ready Ready Preview Comment Oct 1, 2025 4:30pm
studio-staging Ready Ready Preview Comment Oct 1, 2025 4:30pm
ui-library Ready Ready Preview Comment Oct 1, 2025 4:30pm
zone-www-dot-com Ready Ready Preview Comment Oct 1, 2025 4:30pm
2 Skipped Deployments
Project Deployment Preview Comments Updated (UTC)
cms Ignored Ignored Oct 1, 2025 4:30pm
studio Ignored Ignored Oct 1, 2025 4:30pm

@snyk-io Snyk.io
Copy link

snyk-io bot commented Oct 1, 2025 •
edited
Loading

⛔ Snyk checks have failed. 2 issues have been found so far.

Icon Severity Issues
Critical 0
High 0
Medium 2
Low 0

⛔ code/snyk check is complete. 2 issues have been found. (View Details)

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

snyk-io[bot]
snyk-io bot reviewed Oct 1, 2025
View reviewed changes
apps/studio/components/interfaces/Auth/Users/UsersV2.tsx
(isSuccessStorage ||
(isErrorStorage && (errorStorage as Error).message.includes('data is undefined')))
) {
const columns = formatUserColumns({
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  DOM-based Cross-site Scripting (XSS)

Unsanitized input from a React useState value flows into a script 'src' attribute, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

Line 279 | CWE-79 | Priority score 650 | Learn more about this vulnerability
Data flow: 25 steps

Step 1

supabase/apps/studio/components/interfaces/Auth/Users/UsersV2.tsx

Line 111 in 94f3b32

const [filterKeywords, setFilterKeywords] = useState('')

Step 2 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L151

Step 3 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L148

Step 4 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L147

Step 5 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L136

Step 6 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L137

Step 7 - 12 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L181

Step 13 - 15 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L282

Step 16 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L279

Step 17 apps/studio/components/interfaces/Auth/Users/Users.utils.tsx#L252

Step 18 apps/studio/components/interfaces/Auth/Users/Users.utils.tsx#L253

Step 19 - 20 apps/studio/components/interfaces/Auth/Users/Users.utils.tsx#L288

Step 21 - 23 apps/studio/components/interfaces/Auth/Users/Users.utils.tsx#L351

Step 24 - 25

supabase/apps/studio/components/interfaces/Auth/Users/Users.utils.tsx

Line 364 in 94f3b32

src={icon}

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems like red herring

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

flows into a script 'src' attribute

it does what

apps/studio/components/interfaces/Auth/Users/UsersV2.tsx
})
}

const updatedColumns = formatUserColumns({
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  DOM-based Cross-site Scripting (XSS)

Unsanitized input from a React useState value flows into a script 'src' attribute, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

Line 429 | CWE-79 | Priority score 650 | Learn more about this vulnerability
Data flow: 25 steps

Step 1

supabase/apps/studio/components/interfaces/Auth/Users/UsersV2.tsx

Line 111 in 94f3b32

const [filterKeywords, setFilterKeywords] = useState('')

Step 2 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L151

Step 3 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L148

Step 4 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L147

Step 5 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L136

Step 6 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L137

Step 7 - 12 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L181

Step 13 - 15 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L432

Step 16 apps/studio/components/interfaces/Auth/Users/UsersV2.tsx#L429

Step 17 apps/studio/components/interfaces/Auth/Users/Users.utils.tsx#L252

Step 18 apps/studio/components/interfaces/Auth/Users/Users.utils.tsx#L253

Step 19 - 20 apps/studio/components/interfaces/Auth/Users/Users.utils.tsx#L288

Step 21 - 23 apps/studio/components/interfaces/Auth/Users/Users.utils.tsx#L351

Step 24 - 25

supabase/apps/studio/components/interfaces/Auth/Users/Users.utils.tsx

Line 364 in 94f3b32

src={icon}

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems like red herring but let me know if im overlooking something

@coveralls
Copy link

coveralls commented Oct 1, 2025 •
edited
Loading

Coverage Status

coverage: 69.874%. remained the same
when pulling b8a68e5 on chore/hide-email-phone-columns-in-auth-users
into 3f0c689 on master.

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 1, 2025 •
edited
Loading

Studio E2E Results

  • Total: 1
  • Passed: 1
  • Failed: 0
  • Skipped: 0
  • Timed out: 0
  • Interrupted: 0
  • Flaky: 0
  • Duration: 2.6s

Artifacts: https://github.com/supabase/supabase/actions/runs/18168684940

Last updated: Wednesday 1, October, 2025 16:41:11 (UTC)

charislam
charislam approved these changes Oct 1, 2025
View reviewed changes
Copy link
Contributor

@charislam charislam left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested as described.

Pushed small commit to add new flag to required flags.

apps/studio/components/interfaces/Auth/Users/UsersV2.tsx
(isSuccessStorage ||
(isErrorStorage && (errorStorage as Error).message.includes('data is undefined')))
) {
const columns = formatUserColumns({
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

flows into a script 'src' attribute

it does what

@alaister alaister merged commit 843234e into master Oct 1, 2025
19 of 20 checks passed
@alaister alaister deleted the chore/hide-email-phone-columns-in-auth-users branch October 1, 2025 17:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@snyk-io snyk-io[bot] snyk-io[bot] left review comments

@charislam charislam charislam approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@joshenlim @coveralls @charislam @alaister