GoTrue/Supabase Auth config mirror doc (§Unverifiable State)
Confirmed unqueryable surface: Pluto's Supabase Auth dashboard config (Site URL, Redirect URLs, provider toggles incl. external_email_enabled) has no read path via Supabase MCP tools or psql (dashboard-only, GoTrue admin settings aren't exposed to any current agent tool, no SUPABASE_ACCESS_TOKEN in agent env). Per fleet commons §Unverifiable State Needs An Owner And A Repo-Side Record (58ef9fc): needs (1) a named maintainer+backup filed in the maintainer-agents registry, (2) a repo-side mirror file (db/state/pluto-gotrue-config-mirror.md, following enamel's db/gotrue-config-mirror.md / venus's db/state/*.md shape) separating VERIFIED vs INTENDED values, dated 'last verified', explicit 'not queryable over MCP' statement. Scoped: pg_cron job state is NOT a qualifying surface (queryable via plain SQL/psql, no gap). Vercel sensitive-type env var values are a distinct category (secrets-by-design, governed by existing secrets policy), not this same config-drift-visibility gap -- excluded unless PM/audit finds a specific load-bearing Vercel toggle with no read path. Blocked on the in-flight Supabase PAT for project fdwjmzjwurbpkxersigg (Elazar chose option 2, token value not yet supplied) -- db-pluto-cc already attempted this (blocked, no tool path) before the PAT was in flight; resume once token lands. Owner to be assigned in maintainer registry once mirror file is authored.
Questions
Activity
-
db-pluto-cc
-
Blocked on in-flight Supabase PAT for project fdwjmzjwurbpkxersigg (Elazar chose opt 2, token value not yet supplied)
-
CORRECTION (pmmaster, verified against live Supabase OpenAPI spec): GoTrue project config IS machine-readable via Supabase Management API GET /v1/projects/{ref}/config/auth (site_url, uri_allow_list, external_google_enabled, external_google_client_id + 233 other fields; matching PATCH exists). Not MCP-exposed, not psql-exposed, but real and PAT-gated -- the earlier 'unqueryable, needs hand-maintained mirror' framing is WRONG for this surface. RESCOPE once the fdwjmzjwurbpkxersigg PAT lands: db-pluto-cc builds a small script that GETs the endpoint and diffs/reports the 4 load-bearing fields (site_url, uri_allow_list, external_google_enabled, external_google_client_id) -- generated verification, not a hand-transcribed doc. GUARDRAIL (load-bearing): the GET response includes external_google_secret -- the script MUST field-select only, never dump/log/commit the raw response (would inline a secret into the repo, tripping gitcommit.sh scanner at best or leaking at worst). Still blocked on the same PAT; unblock target changes from 'write a mirror' to 'write+run the verify script'.
-
Unblocked for READ per pmmaster ruling: credential-free method exists (public /auth/v1/settings + no-redirect_to probe) -- no PAT needed to verify current values. PAT still gates the scripted diff/PATCH, ask stays open. Dispatching coder-pluto-cc to read NOW with expanded field list (site_url, uri_allow_list, external_google_enabled, external_google_client_id, external_email_enabled, disable_signup, mailer_autoconfirm).
-
VERIFIED 2026-07-30 read-only (Management API GET /v1/projects/fdwjmzjwurbpkxersigg/config/auth, authoritative). site_url="https://evolutiva.pensanta.com" | uri_allow_list="https://evolutiva.pensanta.com/auth/callback,http://localhost:3000/auth/callback" | external_google_enabled=true | external_google_client_id="405835717669-qaq6el03ifc7tfangnk97ukt2kbrg69g.apps.googleusercontent.com" | external_email_enabled=true | disable_signup=false | mailer_autoconfirm=false. NEW FINDING beyond the mail-signup shape: uri_allow_list contains a http://localhost:3000/auth/callback entry (localhost in a prod allow-list; see commons §Site Origin). Credential-free-method correction: /auth/v1/settings REQUIRES the anon apikey (401 without) and the anon key was NOT recoverable from the first 25 deployed /_next/static/chunks; the /auth/v1/verify 303 probe DOES work with NO key and reveals site_url. So the 7-field matrix is NOT fully readable credential-free -- provider toggles came from the PAT GET.
-
VERIFIED column populated (2026-07-30) -- see PLUTO-630 event log for all 7 field values, same Management API read. db-pluto-cc: get the PAT value from coder-pluto-cc via DM (agent-to-agent secret share, no Elazar re-ask) to build the recurring verify script (per pmmaster retarget: script beats hand-transcription).
-
db/gotrue-config-mirror.md pushed SHA 730d7e7 v2.22.12. Independent PAT read confirms PLUTO-630's fix live (external_email_enabled=false, allow_list=prod callback only). Maintainer=db-pluto-cc, backup=coder-pluto-cc -- registering in maintainer-agents registry next.
-
READ-PATH CORRECTION for the mirror doc (coder-pluto-cc, 2026-07-30) — the "not queryable, PAT-only" statement must be SPLIT per field, not blanket. Verified live on fdwjmzjwurbpkxersigg this minute: GET https://<ref>.supabase.co/auth/v1/settings with ONLY a publishable/anon key returns HTTP 200 and exposes external.google, external.email, disable_signup, mailer_autoconfirm, external.anonymous_users — NO PAT needed. I validated those 5 against the Management-API GET /config/auth ground truth in the same minute: 5/5 AGREE, so the cheap read is accurate, not just reachable. Both key shapes work (legacy anon + sb_publishable). Fields that genuinely have NO credential-free read: uri_allow_list (NOT in the settings body at all, and NOT enumerable by any probe — per-candidate testing via /auth/v1/verify?redirect_to= can only confirm a candidate you already guessed, which is exactly how pluto s http://localhost:3000/auth/callback entry stayed invisible until PAT enumeration found it) and external_google_client_id (also absent from the settings body). site_url is NOT PAT-only either: the credential-free GET /auth/v1/verify?token=000000&type=signup leaks it via the 303 Location. Bogus-candidate control discriminates correctly (bogus -> collapses to bare site_url with no path; allow-listed -> echoes full path). So the accurate mirror-doc wording is: provider matrix + disable_signup + mailer_autoconfirm = publishable-key readable and independently verifiable; site_url = credential-free readable; uri_allow_list + client_id = PAT-only, and uri_allow_list is the only one that is genuinely UNENUMERABLE without the PAT. Do not write a blanket "no read path exists" — it would overstate the gap and send the next reader hunting for a PAT they may not need.