GoTrue-config verify-script via Supabase Management API (read-only, field-selected)

Sub-tickets

Activity

• wi-cli-venus created · 2026-07-30
• wi-cli-venus blocked · 2026-07-30
  authoring OK now; exercising blocked on same missing venus-host Supabase PAT as VENUS-302
• wi-cli-venus commented · 2026-07-30
  Script authored: scripts/verify-auth-config.ts, SHA f62c9f9 (coder-venus-cc). Field-selects 7 safe keys, value-asserts (not presence), fail-closed on missing PAT. Read-only; PATCH fix is separate. Still blocked — cannot exercise until PAT lands.
• wi-cli-venus statusChanged · 2026-07-30
  read path unblocked (credential-free: unauth /auth/v1/settings + 303-no-redirect_to), PAT still needed for eventual PATCH + scripted diff
• wi-cli-venus commented · 2026-07-30
  Credential-free read executed live (fjnhfjwskixzsilxrkph): external.google=true, external.email=true (CONFIRMS VENUS-302), disable_signup=false, mailer_autoconfirm=false, site_url=cmfpost-evolutiva.pensanta.com verified, callback allow-listed, bogus-origin control collapsed correctly. 6/7 fields read via /auth/v1/settings + 303 probe; external_google_client_id NOT exposed credential-free — PAT-only, still pending.
• wi-cli-venus commented · 2026-07-30
  Script retargeted credential-free, SHA c84f5aa (Class-S). Live run: exit 3 DRIFT on external_email_enabled=true (expected — VENUS-302 open), 5/6 credential-free fields PASS. Self-reports finding on every run; flips exit 0 once PATCH lands. PAT path retained only for external_google_client_id + eventual scripted diff.
• wi-cli-venus commented · 2026-07-30
  SCOPE CORRECTION (pmmaster): the credential-free 303-probe only tests specific candidate hostnames against uri_allow_list — it CANNOT enumerate the full list (pluto found a stray localhost:3000 prod entry, mars a dangling preview alias, neither discoverable by probing). Venus's uri_allow_list is UNREAD for full enumeration, not clean — same 2-for-2 hit rate elsewhere means expect a finding. Full enumeration needs Management API config/auth, PAT-gated. Elazar asked (already covers venus) for a PAT partly for this reason. Do NOT report venus's allow-list as verified-clean until enumerated.
• wi-cli-venus unblocked · 2026-08-19
  PAT LANDED 2026-07-30 — the blocker went stale the same day it was written. The pluto+venus account PAT (elazarpimentelgcaba@gmail.com, org fgwxpnbigunbelevzopy, covers exactly fjnhfjwskixzsilxrkph + fdwjmzjwurbpkxersigg) arrived via db-pluto-cc DM on 2026-07-30 and is in ltm.md. Nothing was ever waiting on it after that date; the row simply kept claiming it was. EXERCISED LIVE 2026-08-19T01:18Z: GET /v1/projects/fjnhfjwskixzsilxrkph/config/auth -> HTTP 200, all 7 named fields read, scripts/verify-auth-config.ts exits 0 with 6/6 asserted PASS and external_google_client_id recorded. external_email_enabled is now false, so VENUS-302 PATCH has landed and the old exit-3 DRIFT is gone. pmmaster CAVEAT NOW CLOSED, AND IT NEEDED MORE THAN A PAT READ. The caveat was: do NOT report venus uri_allow_list as verified-clean until ENUMERATED, because the credential-free probe can only ask is-this-ONE-candidate-allowed and cannot see an entry nobody thought to guess. pluto had a stray localhost:3000 in prod, mars a dangling preview alias, neither probe-discoverable. Reading the list once would have answered it for today only, so I put the enumeration IN THE SCRIPT: with a PAT it now compares the whole list against an explicit ALLOWED_REDIRECTS set and any extra is DRIFT/exit 3. MEASURED: venus uri_allow_list has exactly ONE entry, https://cmfpost-evolutiva.pensanta.com/auth/callback. Venus is genuinely clean where both siblings were not. Pushed on scripts/verify-auth-config.ts, falsification-verified (pointing ALLOWED_REDIRECTS at a URL venus does not carry -> DRIFT, exit 3). COVERAGE STATEMENT: an empty list is deliberately not a pass (that would mean login is broken, and a bare no-extras test would call it clean). Without a PAT the script now PRINTS that the allow-list was probed and not enumerated and that extras would be invisible — a silently omitted line reads as a clean allow-list. Remaining un-exercised: nothing on the 7 named fields; external_google_secret is never read by design.
• wi-cli-venus completed · 2026-08-19
  Resolved: PAT landed 2026-07-30 (blockedReason was stale), all 7 GoTrue config fields live-verified, script exit 0. uri_allow_list enumeration built into script (PAT compares full list vs allowed set, exit 3 on drift); credential-free path now explicitly labels itself as unenumerated rather than silently reading as clean. venus carries exactly 1 allow-list entry (callback), clean.