openai/gpt-5.6-sol · d1_auth_email · rep 3

set -euo pipefail
python3 - <<'PY'
import os, json, sys
from urllib.request import Request, urlopen
from urllib.error import HTTPError

required = ['SUPABASE_URL','SUPABASE_SERVICE_ROLE_KEY','SUPABASE_ANON_KEY']
missing = [k for k in required if not os.environ.get(k)]
if missing:
    raise SystemExit('Missing required environment variables: ' + ', '.join(missing))

base = os.environ['SUPABASE_URL'].rstrip('/')
service = os.environ['SUPABASE_SERVICE_ROLE_KEY']
anon = os.environ['SUPABASE_ANON_KEY']
accounts = [
    ('dana@cari.dev', 'Passw0rd-dana-91'),
    ('omar@cari.dev', 'Passw0rd-omar-17'),
]

def request(method, path, key, payload=None):
    headers = {
        'apikey': key,
        'Authorization': 'Bearer ' + key,
        'Accept': 'application/json',
    }
    data = None
    if payload is not None:
        headers['Content-Type'] = 'application/json'
        data = json.dumps(payload).encode()
    req = Request(base + path, data=data, headers=headers, method=method)
    try:
        with urlopen(req, timeout=30) as r:
            raw = r.read()
            return r.status, json.loads(raw) if raw else None
    except HTTPError as e:
        raw = e.read()
        try: body = json.loads(raw) if raw else None
        except Exception: body = {'raw': raw.decode(errors='replace')}
        return e.code, body

def err_text(body):
    if isinstance(body, dict):
        return ' '.join(str(body.get(k,'')) for k in ('code','error_code','msg','message','error_description')).lower()
    return str(body).lower()

def find_user(email):
    page = 1
    per_page = 100
    while page <= 1000:
        st, body = request('GET', f'/auth/v1/admin/users?page={page}&per_page={per_page}', service)
        if st != 200 or not isinstance(body, dict):
            raise RuntimeError(f'Could not list auth users (HTTP {st}): {body}')
        users = body.get('users') or []
        for user in users:
            if str(user.get('email','')).casefold() == email.casefold():
                return user
        # GoTrue exposes pagination metadata, but support implementations that do not.
        if not users or len(users) < per_page:
            return None
        page += 1
    raise RuntimeError('User lookup exceeded pagination limit')

for email, password in accounts:
    status, body = request('POST', '/auth/v1/admin/users', service, {
        'email': email,
        'password': password,
        'email_confirm': True,
    })
    if status in (200, 201) and isinstance(body, dict) and body.get('id'):
        uid = body['id']
        action = 'created'
    else:
        # Account may already exist; reconcile it to the requested password and confirmation state.
        user = find_user(email)
        if not user:
            raise RuntimeError(f'Failed creating {email} (HTTP {status}): {body}')
        uid = user.get('id')
        up_status, up_body = request('PUT', f'/auth/v1/admin/users/{uid}', service, {
            'password': password,
            'email_confirm': True,
        })
        if up_status not in (200, 201):
            raise RuntimeError(f'Failed updating {email} (HTTP {up_status}): {up_body}')
        action = 'updated'
    print(f'{email}: {action} and confirmed (user id {uid})')

# Prove actual password grant against the public Auth API for both accounts.
for email, password in accounts:
    status, body = request('POST', '/auth/v1/token?grant_type=password', anon, {
        'email': email,
        'password': password,
    })
    ok = (status == 200 and isinstance(body, dict) and
          isinstance(body.get('access_token'), str) and len(body['access_token']) > 0 and
          isinstance(body.get('refresh_token'), str) and len(body['refresh_token']) > 0)
    if not ok:
        raise RuntimeError(f'Password sign-in verification failed for {email} (HTTP {status}): {body}')
    returned_email = ((body.get('user') or {}).get('email') or '').casefold()
    if returned_email != email.casefold():
        raise RuntimeError(f'Sign-i

dana@cari.dev: created and confirmed (user id 83bae0e8-c79d-43a7-b2be-be919b7841a6)
omar@cari.dev: created and confirmed (user id 7f81782d-5d50-455a-a7d8-a239b46a0b2e)
dana@cari.dev: password sign-in VERIFIED (HTTP 200, valid access + refresh tokens returned)
omar@cari.dev: password sign-in VERIFIED (HTTP 200, valid access + refresh tokens returned)