GoTrue-config verify-script via Supabase Management API (read-only, field-selected)
pmmaster correction 2026-07-30: GET /v1/projects/{ref}/config/auth (Management API, PAT-gated) IS a real queryable path for GoTrue config — falsifies 'dashboard is sole authority' for this surface. Build a read-only script that hits this endpoint for venus (fjnhfjwskixzsilxrkph) and field-selects ONLY named settings (site_url, uri_allow_list, external_email_enabled, disable_signup, mailer_autoconfirm, external_google_enabled, external_google_client_id) — NEVER dump the raw response (contains external_google_secret, would trip/evade the gitcommit.sh secret scanner). Feeds venus-vercel-auth-state.md verified-vs-intended stamping and directly verifies VENUS-302's fix once applied. Script can be authored now; exercising it is blocked on the same missing Supabase PAT as VENUS-302 (riding mars's fleet ask).
Questions
Activity
-
authoring OK now; exercising blocked on same missing venus-host Supabase PAT as VENUS-302
-
Script authored: scripts/verify-auth-config.ts, SHA f62c9f9 (coder-venus-cc). Field-selects 7 safe keys, value-asserts (not presence), fail-closed on missing PAT. Read-only; PATCH fix is separate. Still blocked — cannot exercise until PAT lands.
-
read path unblocked (credential-free: unauth /auth/v1/settings + 303-no-redirect_to), PAT still needed for eventual PATCH + scripted diff
-
Credential-free read executed live (fjnhfjwskixzsilxrkph): external.google=true, external.email=true (CONFIRMS VENUS-302), disable_signup=false, mailer_autoconfirm=false, site_url=cmfpost-evolutiva.pensanta.com verified, callback allow-listed, bogus-origin control collapsed correctly. 6/7 fields read via /auth/v1/settings + 303 probe; external_google_client_id NOT exposed credential-free — PAT-only, still pending.
-
Script retargeted credential-free, SHA c84f5aa (Class-S). Live run: exit 3 DRIFT on external_email_enabled=true (expected — VENUS-302 open), 5/6 credential-free fields PASS. Self-reports finding on every run; flips exit 0 once PATCH lands. PAT path retained only for external_google_client_id + eventual scripted diff.
-
SCOPE CORRECTION (pmmaster): the credential-free 303-probe only tests specific candidate hostnames against uri_allow_list — it CANNOT enumerate the full list (pluto found a stray localhost:3000 prod entry, mars a dangling preview alias, neither discoverable by probing). Venus's uri_allow_list is UNREAD for full enumeration, not clean — same 2-for-2 hit rate elsewhere means expect a finding. Full enumeration needs Management API config/auth, PAT-gated. Elazar asked (already covers venus) for a PAT partly for this reason. Do NOT report venus's allow-list as verified-clean until enumerated.