Merge branch 'master' into fix/openapi-spec-defects

Author: tsand

CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [2.195.0](https://github.com/supabase/auth/compare/v2.194.0...v2.195.0) (2026-07-30)
+
+
+### Features
+
+* gate SCIM router behind an experimental feature flag ([#2639](https://github.com/supabase/auth/issues/2639)) ([0fde049](https://github.com/supabase/auth/commit/0fde049ae7e60cdfa41daa6a52e7a1eb003f8733))
+
+
+### Bug Fixes
+
+* accept offline_access OAuth scope for MCP refresh clients ([#2630](https://github.com/supabase/auth/issues/2630)) ([059b86c](https://github.com/supabase/auth/commit/059b86c41fb622959c2cc8a82662462492f1e217))
+* **auditlogs:** add missing events to docs ([3e5d493](https://github.com/supabase/auth/commit/3e5d4935f3594fd4c90263c4b04c50482c9a09f8))
+* **auditlogs:** remove unused mfa code audit log events ([2909344](https://github.com/supabase/auth/commit/2909344fac21e1355a0a9f1c8316af654ec5aff3))
+* **auditlogs:** remove unused recovery codes audit log events ([d4ca02a](https://github.com/supabase/auth/commit/d4ca02acf217c1949fea5a356d855aac9dfeea5c))
+* persist last_sign_in_at on v2 refresh token issuance ([#2655](https://github.com/supabase/auth/issues/2655)) ([fc654b0](https://github.com/supabase/auth/commit/fc654b05e7a02a6a8c375b3a7895bcd563b790ca))
+* reject AT from banned users ([#2642](https://github.com/supabase/auth/issues/2642)) ([b6878c2](https://github.com/supabase/auth/commit/b6878c2fa63f805dbd27436c36ba7ebbc2b7e44d))
+* update google.golang.org/grpc to v1.82.1 ([#2651](https://github.com/supabase/auth/issues/2651)) ([4a596c0](https://github.com/supabase/auth/commit/4a596c0d556e7bed6874f87af18aab3f4fb4efa1))
+
 ## [2.194.0](https://github.com/supabase/auth/compare/v2.193.1...v2.194.0) (2026-07-27)
 
 

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.25.12-alpine3.23 as build
+FROM golang:1.26.5-alpine3.23 as build
 ENV GO111MODULE=on
 ENV CGO_ENABLED=0
 ENV GOOS=linux

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM golang:1.25.12-alpine3.23
+FROM golang:1.26.5-alpine3.23
 ENV GO111MODULE=on
 ENV CGO_ENABLED=0
 ENV GOOS=linux

README.md

@@ -466,6 +466,12 @@ The URI a OAuth2 provider will redirect to with the `code` and `state` values.
 
 The base URL used for constructing the URLs to request authorization and access tokens. Used by `gitlab` and `keycloak`. For `gitlab` it defaults to `https://gitlab.com`. For `keycloak` you need to set this to your instance, for example: `https://keycloak.example.com/realms/myrealm`
 
+#### Network hardening
+
+Configuring an external authentication provider causes Auth to make outbound HTTP requests to that provider's authorization, token, and userinfo endpoints. Configuring a provider either via `GOTRUE_EXTERNAL_*` settings or an admin API is an administrative action, and doing so implies trust in the hosts and URLs that will be contacted.
+
+The network Auth runs in should be hardened so these outbound connections cannot reach internal-only resources you don't want exposed, such as `localhost`/loopback addresses or cloud metadata endpoints (e.g. `169.254.169.254`). This matters most for providers with admin-configurable or discoverable endpoints (e.g. custom OAuth/OIDC providers), where a misconfigured or malicious URL could otherwise be used to reach internal infrastructure.
+
 #### Apple OAuth
 
 To try out external authentication with Apple locally, you will need to do the following:

example.env

@@ -270,3 +270,12 @@ GOTRUE_SMS_TEST_OTP_VALID_UNTIL="<ISO date time>" # (e.g. 2023-09-29T08:14:06Z)
 
 GOTRUE_MFA_WEB_AUTHN_ENROLL_ENABLED="false"
 GOTRUE_MFA_WEB_AUTHN_VERIFY_ENABLED="false"
+
+# Experimental Configuration
+# The functionality related to experimental features may change or be removed in future releases
+# without prior notice.
+
+# Creates the missing email identity for a user when a password is added to an
+# account that didn't have one (e.g. a user who signed up with an external
+# provider and later sets a password).
+GOTRUE_EXPERIMENTAL_CREATE_EMAIL_IDENTITY_ON_PASSWORD_SET_ENABLED="false"

go.mod

@@ -186,6 +186,6 @@ require (
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
-go 1.25.12
+go 1.26.5
 
 replace github.com/joho/godotenv => ./internal/forks/godotenv

go.sum

@@ -632,8 +632,6 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
 google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
 google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=

internal/api/admin.go

@@ -230,6 +230,9 @@ func (a *API) adminUserUpdate(w http.ResponseWriter, r *http.Request) error {
 		banDuration = &duration
 	}
 
+	// must be evaluated before setting password below (via user.SetPassword)
+	addingFirstPassword := params.Password != nil && *params.Password != "" && !user.HasPassword()
+
 	if params.Password != nil {
 		password := *params.Password
 
@@ -269,12 +272,12 @@ func (a *API) adminUserUpdate(w http.ResponseWriter, r *http.Request) error {
 
 		var identities []models.Identity
 		if params.Email != "" {
-			if identity, terr := models.FindIdentityByIdAndProvider(tx, user.ID.String(), "email"); terr != nil && !models.IsNotFoundError(terr) {
+			if identity, terr := models.FindIdentityByIdAndProvider(tx, user.ID.String(), EmailProvider); terr != nil && !models.IsNotFoundError(terr) {
 				return terr
 			} else if identity == nil {
 				// if the user doesn't have an existing email
 				// then updating the user's email should create a new email identity
-				i, terr := a.createNewIdentity(tx, user, "email", structs.Map(provider.Claims{
+				i, terr := a.createNewIdentity(tx, user, EmailProvider, structs.Map(provider.Claims{
 					Subject:       user.ID.String(),
 					Email:         params.Email,
 					EmailVerified: params.EmailConfirm,
@@ -305,12 +308,12 @@ func (a *API) adminUserUpdate(w http.ResponseWriter, r *http.Request) error {
 		}
 
 		if params.Phone != "" {
-			if identity, terr := models.FindIdentityByIdAndProvider(tx, user.ID.String(), "phone"); terr != nil && !models.IsNotFoundError(terr) {
+			if identity, terr := models.FindIdentityByIdAndProvider(tx, user.ID.String(), PhoneProvider); terr != nil && !models.IsNotFoundError(terr) {
 				return terr
 			} else if identity == nil {
 				// if the user doesn't have an existing phone
 				// then updating the user's phone should create a new phone identity
-				identity, terr := a.createNewIdentity(tx, user, "phone", structs.Map(provider.Claims{
+				identity, terr := a.createNewIdentity(tx, user, PhoneProvider, structs.Map(provider.Claims{
 					Subject:       user.ID.String(),
 					Phone:         params.Phone,
 					PhoneVerified: params.PhoneConfirm,
@@ -340,6 +343,12 @@ func (a *API) adminUserUpdate(w http.ResponseWriter, r *http.Request) error {
 		}
 		user.Identities = append(user.Identities, identities...)
 
+		if addingFirstPassword {
+			if terr := a.ensureEmailIdentityForPassword(tx, user); terr != nil {
+				return terr
+			}
+		}
+
 		if params.AppMetaData != nil {
 			if terr := user.UpdateAppMetaData(tx, params.AppMetaData); terr != nil {
 				return terr
@@ -407,7 +416,7 @@ func (a *API) adminUserCreate(w http.ResponseWriter, r *http.Request) error {
 		} else if user != nil {
 			return apierrors.NewUnprocessableEntityError(apierrors.ErrorCodeEmailExists, DuplicateEmailMsg)
 		}
-		providers = append(providers, "email")
+		providers = append(providers, EmailProvider)
 	}
 
 	if params.Phone != "" {
@@ -420,7 +429,7 @@ func (a *API) adminUserCreate(w http.ResponseWriter, r *http.Request) error {
 		} else if exists {
 			return apierrors.NewUnprocessableEntityError(apierrors.ErrorCodePhoneExists, "Phone number already registered by another user")
 		}
-		providers = append(providers, "phone")
+		providers = append(providers, PhoneProvider)
 	}
 
 	if params.Password != nil && params.PasswordHash != "" {
@@ -486,7 +495,7 @@ func (a *API) adminUserCreate(w http.ResponseWriter, r *http.Request) error {
 
 		var identities []models.Identity
 		if user.GetEmail() != "" {
-			identity, terr := a.createNewIdentity(tx, user, "email", structs.Map(provider.Claims{
+			identity, terr := a.createNewIdentity(tx, user, EmailProvider, structs.Map(provider.Claims{
 				Subject: user.ID.String(),
 				Email:   user.GetEmail(),
 			}))
@@ -498,7 +507,7 @@ func (a *API) adminUserCreate(w http.ResponseWriter, r *http.Request) error {
 		}
 
 		if user.GetPhone() != "" {
-			identity, terr := a.createNewIdentity(tx, user, "phone", structs.Map(provider.Claims{
+			identity, terr := a.createNewIdentity(tx, user, PhoneProvider, structs.Map(provider.Claims{
 				Subject: user.ID.String(),
 				Phone:   user.GetPhone(),
 			}))

internal/api/anonymous.go

@@ -24,7 +24,7 @@ func (a *API) SignupAnonymously(w http.ResponseWriter, r *http.Request) error {
 		return err
 	}
 	params.Aud = aud
-	params.Provider = "anonymous"
+	params.Provider = AnonymousProvider
 
 	newUser, err := params.ToUserModel(false /* <- isSSOUser */)
 	if err != nil {

internal/api/api.go

@@ -138,6 +138,8 @@ func NewAPIWithVersion(globalConfig *conf.GlobalConfiguration, db *storage.Conne
 		api.oauthServer = oauthserver.NewServer(globalConfig, db, api.tokenService)
 	}
 
+	api.scim = scim.NewServer(globalConfig)
+
 	if api.config.Password.HIBP.Enabled {
 		httpClient := &http.Client{
 			// all HIBP API requests should finish quickly to avoid
@@ -213,14 +215,6 @@ func NewAPIWithVersion(globalConfig *conf.GlobalConfiguration, db *storage.Conne
 		r.Post("/", api.ExternalProviderCallback)
 	})
 
-	api.scim = scim.NewServer(globalConfig)
-	r.Route("/scim/v2", func(r *router) {
-		r.Use(api.scim.Middleware)
-		r.Get("/ServiceProviderConfig", api.scim.ServiceProviderConfig)
-		r.Get("/ResourceTypes", api.scim.ResourceTypes)
-		r.Get("/Schemas", api.scim.Schemas)
-	})
-
 	r.Route("/", func(r *router) {
 
 		r.Use(api.isValidExternalHost)
@@ -456,6 +450,15 @@ func NewAPIWithVersion(globalConfig *conf.GlobalConfiguration, db *storage.Conne
 			r.With(api.requireAuthentication).Get("/authorizations/{authorization_id}", api.oauthServer.OAuthServerGetAuthorization)
 			r.With(api.requireAuthentication).Post("/authorizations/{authorization_id}/consent", api.oauthServer.OAuthServerConsent)
 		})
+
+		r.Route(scim.BasePath, func(r *router) {
+			r.Use(api.requireScimServerEnabled)
+			r.NotFound(api.scim.NotFound)
+
+			r.Get("/ServiceProviderConfig", api.scim.ServiceProviderConfig)
+			r.Get("/ResourceTypes", api.scim.ResourceTypes)
+			r.Get("/Schemas", api.scim.Schemas)
+		})
 	})
 
 	corsHandler := cors.New(cors.Options{