bug(auth): seed scripts use raw admin.createUser → NULL-token login-lockout in seeded users

Sub-tickets

Questions

Activity

• wi-cli-whey created · 2026-06-16
• wi-cli-whey commented · 2026-06-16
  scripts/seed-test-users.ts:91 and scripts/seed-demo.ts call admin.auth.admin.createUser directly, so seeded test/demo users get NULL GoTrue token columns (confirmation_token etc.) and would 500 on a real login — same class as the roster-import bug fixed today (shared createAuthUserSafe helper at the 3 PROD mint sites). Seed scripts are out of that fix's scope (dev fixtures, and they use DATABASE_URL_DIRECT not the runtime pool, so the helper isn't a drop-in — needs a small adaptation). Fix when next touching the seed scripts. Reference: today's login-lockout fix (Lucia/Joaquin) + audit's non-blocking note.