z-ai/glm-5.2 · d1_auth_email · rep 2

echo "SUPABASE_URL=$SUPABASE_URL" && echo "SUPABASE_PROJECT_REF=$SUPABASE_PROJECT_REF" && echo "SUPABASE_ANON_KEY set: $([ -n "$SUPABASE_ANON_KEY" ] && echo yes || echo no)" && echo "SUPABASE_SERVICE_ROLE_KEY set: $([ -n "$SUPABASE_SERVICE_ROLE_KEY" ] && echo yes || echo no)" && echo "SUPABASE_DB_URL set: $([ -n "$SUPABASE_DB_URL" ] && echo yes || echo no)" && echo "SUPABASE_DB_PASSWORD set: $([ -n "$SUPABASE_DB_PASSWORD" ] && echo yes || echo no)"

SUPABASE_URL=https://<ref>.supabase.co
SUPABASE_PROJECT_REF=<ref>
SUPABASE_ANON_KEY set: yes
SUPABASE_SERVICE_ROLE_KEY set: yes
SUPABASE_DB_URL set: yes
SUPABASE_DB_PASSWORD set: yes

echo "DB URL: $SUPABASE_DB_URL"

DB URL: <redacted:SUPABASE_DB_URL>

which curl jq psql python3 node 2>/dev/null; echo "---"; psql --version 2>/dev/null; echo "---"; curl --version 2>/dev/null | head -1

/usr/bin/curl
/usr/bin/jq
/usr/bin/psql
/usr/bin/python3
/usr/bin/node
---
psql (PostgreSQL) 18.4 (Debian 18.4-1.pgdg12+1)
---
curl 7.88.1 (x86_64-pc-linux-gnu) libcurl/7.88.1 OpenSSL/3.0.20 zlib/1.2.13 brotli/1.0.9 zstd/1.5.4 libidn2/2.3.3 libpsl/0.21.2 (+libidn2/2.3.3) libssh2/1.10.0 nghttp2/1.52.0 librtmp/2.3 OpenLDAP/2.5.13

# Check if email confirmation is required at the project level (this would block sign-in for new users)
curl -s -X GET "$SUPABASE_URL/auth/v1/settings" \
  -H "apikey: $SUPABASE_ANON_KEY" | jq .

{
  "external": {
    "anonymous_users": false,
    "apple": false,
    "azure": false,
    "bitbucket": false,
    "discord": false,
    "facebook": false,
    "snapchat": false,
    "figma": false,
    "fly": false,
    "github": false,
    "gitlab": false,
    "google": false,
    "keycloak": false,
    "kakao": false,
    "linkedin": false,
    "linkedin_oidc": false,
    "notion": false,
    "spotify": false,
    "slack": false,
    "slack_oidc": false,
    "workos": false,
    "twitch": false,
    "twitter": false,
    "email": true,
    "phone": false,
    "zoom": false
  },
  "disable_signup": false,
  "mailer_autoconfirm": false,
  "phone_autoconfirm": false,
  "sms_provider": "twilio",
  "saml_enabled": false,
  "saml_private_key_next_configured": true,
  "passkeys_enabled": false
}

# Create dana@cari.dev with email already confirmed using the admin API
curl -s -X POST "$SUPABASE_URL/auth/v1/admin/users" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "dana@cari.dev",
    "password": "Passw0rd-dana-91",
    "email_confirm": true,
    "user_metadata": {"name": "Dana"}
  }' | jq '{id, email, email_confirmed_at, created_at, role}'

{
  "id": "ea09ae7e-c317-4116-8095-f0ceb2c5fe02",
  "email": "dana@cari.dev",
  "email_confirmed_at": "2026-07-24T15:00:40.874981407Z",
  "created_at": "2026-07-24T15:00:40.872357Z",
  "role": "authenticated"
}

# Create omar@cari.dev with email already confirmed using the admin API
curl -s -X POST "$SUPABASE_URL/auth/v1/admin/users" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "omar@cari.dev",
    "password": "Passw0rd-omar-17",
    "email_confirm": true,
    "user_metadata": {"name": "Omar"}
  }' | jq '{id, email, email_confirmed_at, created_at, role}'

{
  "id": "e34eb9e2-7334-4a15-a23f-6df36b0a5f1c",
  "email": "omar@cari.dev",
  "email_confirmed_at": "2026-07-24T15:00:48.334305161Z",
  "created_at": "2026-07-24T15:00:48.331846Z",
  "role": "authenticated"
}

# Sign in as dana@cari.dev with password and verify we get a valid access token
echo "=== DANA SIGN-IN ==="
DANA_RESPONSE=$(curl -s -X POST "$SUPABASE_URL/auth/v1/token?grant_type=password" \
  -H "apikey: $SUPABASE_ANON_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "dana@cari.dev",
    "password": "Passw0rd-dana-91"
  }')

echo "$DANA_RESPONSE" | jq '{access_token_present: (.access_token != null and (.access_token | length > 0)), token_type, expires_in, user_email: .user.email, user_id: .user.id, confirmed_at: .user.email_confirmed_at}'

# Verify the access token is decodable (JWT structure check)
ACCESS_TOKEN=$(echo "$DANA_RESPONSE" | jq -r '.access_token')
if [ -n "$ACCESS_TOKEN" ] && [ "$ACCESS_TOKEN" != "null" ]; then
  echo "--- JWT payload (decoded) ---"
  echo "$ACCESS_TOKEN" | cut -d'.' -f2 | base64 -d 2>/dev/null | jq '{iss, sub, email, role, exp, session_id}'
  echo "--- Token length: $(echo -n "$ACCESS_TOKEN" | wc -c) chars ---"
else
  echo "ERROR: No access token returned!"
  echo "$DANA_RESPONSE" | jq .
fi

=== DANA SIGN-IN ===
{
  "access_token_present": true,
  "token_type": "bearer",
  "expires_in": 3600,
  "user_email": "dana@cari.dev",
  "user_id": "ea09ae7e-c317-4116-8095-f0ceb2c5fe02",
  "confirmed_at": "2026-07-24T15:00:40.874981Z"
}
--- JWT payload (decoded) ---
{
  "iss": "https://<ref>.supabase.co/auth/v1",
  "sub": "ea09ae7e-c317-4116-8095-f0ceb2c5fe02",
  "email": "dana@cari.dev",
  "role": "authenticated",
  "exp": 1784908856,
  "session_id": "6ab8d448-ac2f-45c8-8b10-097ef04f138d"
}
--- Token length: 808 chars ---

# Sign in as omar@cari.dev with password and verify we get a valid access token
echo "=== OMAR SIGN-IN ==="
OMAR_RESPONSE=$(curl -s -X POST "$SUPABASE_URL/auth/v1/token?grant_type=password" \
  -H "apikey: $SUPABASE_ANON_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "omar@cari.dev",
    "password": "Passw0rd-omar-17"
  }')

echo "$OMAR_RESPONSE" | jq '{access_token_present: (.access_token != null and (.access_token | length > 0)), token_type, expires_in, user_email: .user.email, user_id: .user.id, confirmed_at: .user.email_confirmed_at}'

# Verify the access token is decodable (JWT structure check)
ACCESS_TOKEN=$(echo "$OMAR_RESPONSE" | jq -r '.access_token')
if [ -n "$ACCESS_TOKEN" ] && [ "$ACCESS_TOKEN" != "null" ]; then
  echo "--- JWT payload (decoded) ---"
  echo "$ACCESS_TOKEN" | cut -d'.' -f2 | base64 -d 2>/dev/null | jq '{iss, sub, email, role, exp, session_id}'
  echo "--- Token length: $(echo -n "$ACCESS_TOKEN" | wc -c) chars ---"
else
  echo "ERROR: No access token returned!"
  echo "$OMAR_RESPONSE" | jq .
fi

=== OMAR SIGN-IN ===
{
  "access_token_present": true,
  "token_type": "bearer",
  "expires_in": 3600,
  "user_email": "omar@cari.dev",
  "user_id": "e34eb9e2-7334-4a15-a23f-6df36b0a5f1c",
  "confirmed_at": "2026-07-24T15:00:48.334305Z"
}
--- JWT payload (decoded) ---
{
  "iss": "https://<ref>.supabase.co/auth/v1",
  "sub": "e34eb9e2-7334-4a15-a23f-6df36b0a5f1c",
  "email": "omar@cari.dev",
  "role": "authenticated",
  "exp": 1784908869,
  "session_id": "053120a6-c9ee-46e0-8950-3798cfe0cb48"
}
--- Token length: 808 chars ---