claude-opus-5 · d1_auth_email · rep 2

env | grep -i supabase | sed 's/\(KEY=.\{12\}\).*/\1.../' ; echo "---"; which curl psql jq python3

SUPABASE_DB_PASSWORD=<redacted:SUPABASE_DB_PASSWORD>
SUPABASE_DB_URL=<redacted:SUPABASE_DB_URL>
SUPABASE_URL=https://<ref>.supabase.co
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJI...
SUPABASE_PROJECT_REF=<ref>
SUPABASE_ANON_KEY=eyJhbGciOiJI...
---
/usr/bin/curl
/usr/bin/psql
/usr/bin/jq
/usr/bin/python3

echo "URL=$SUPABASE_URL"; echo "REF=$SUPABASE_PROJECT_REF"

URL=https://<ref>.supabase.co
REF=<ref>

curl -s -o /dev/null -w "health=%{http_code}\n" "$SUPABASE_URL/auth/v1/health"; curl -s "$SUPABASE_URL/auth/v1/health"; echo

health=401
{"message":"No API key found in request","hint":"No `apikey` request header or url param was found."}

curl -s "$SUPABASE_URL/auth/v1/admin/users?per_page=100" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" | jq '{total: (.users|length), emails: [.users[].email]}'

{
  "total": 0,
  "emails": []
}

for u in "dana@cari.dev:Passw0rd-dana-91" "omar@cari.dev:Passw0rd-omar-17"; do
  email="${u%%:*}"; pass="${u#*:}"
  echo "=== creating $email ==="
  curl -s -X POST "$SUPABASE_URL/auth/v1/admin/users" \
    -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
    -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
    -H "Content-Type: application/json" \
    -d "$(jq -nc --arg e "$email" --arg p "$pass" '{email:$e,password:$p,email_confirm:true}')" \
    | jq '{id, email, email_confirmed_at, confirmed_at, role, aud, error: .msg, code}'
done

=== creating dana@cari.dev ===
{
  "id": "0b91d8bc-e7ab-4dae-bc1c-7a42d841574f",
  "email": "dana@cari.dev",
  "email_confirmed_at": "2026-07-25T05:28:59.964067465Z",
  "confirmed_at": null,
  "role": "authenticated",
  "aud": "authenticated",
  "error": null,
  "code": null
}
=== creating omar@cari.dev ===
{
  "id": "c635a8e9-7c37-4b0d-bcbf-7a388390c6a3",
  "email": "omar@cari.dev",
  "email_confirmed_at": "2026-07-25T05:29:00.457290967Z",
  "confirmed_at": null,
  "role": "authenticated",
  "aud": "authenticated",
  "error": null,
  "code": null
}

for u in "dana@cari.dev:Passw0rd-dana-91" "omar@cari.dev:Passw0rd-omar-17"; do
  email="${u%%:*}"; pass="${u#*:}"
  echo "=== sign-in $email ==="
  curl -s -w '\nHTTP=%{http_code}\n' -X POST "$SUPABASE_URL/auth/v1/token?grant_type=password" \
    -H "apikey: $SUPABASE_ANON_KEY" \
    -H "Content-Type: application/json" \
    -d "$(jq -nc --arg e "$email" --arg p "$pass" '{email:$e,password:$p}')"
done

=== sign-in dana@cari.dev ===
{"access_token":"<jwt:authenticated>","token_type":"bearer","expires_in":3600,"expires_at":1784960945,"refresh_token":"5ozrun7i4ltp","user":{"id":"0b91d8bc-e7ab-4dae-bc1c-7a42d841574f","aud":"authenticated","role":"authenticated","email":"dana@cari.dev","email_confirmed_at":"2026-07-25T05:28:59.964067Z","phone":"","confirmed_at":"2026-07-25T05:28:59.964067Z","last_sign_in_at":"2026-07-25T05:29:05.368771453Z","app_metadata":{"provider":"email","providers":["email"]},"user_metadata":{"email_verified":true},"identities":[{"identity_id":"1dad3f48-f047-4a73-83d3-63d9ca5cc474","id":"0b91d8bc-e7ab-4dae-bc1c-7a42d841574f","user_id":"0b91d8bc-e7ab-4dae-bc1c-7a42d841574f","identity_data":{"email":"dana@cari.dev","email_verified":false,"phone_verified":false,"sub":"0b91d8bc-e7ab-4dae-bc1c-7a42d841574f"},"provider":"email","last_sign_in_at":"2026-07-25T05:28:59.962114Z","created_at":"2026-07-25T05:28:59.962189Z","updated_at":"2026-07-25T05:28:59.962189Z","email":"dana@cari.dev"}],"created_at":"2026-07-25T05:28:59.960732Z","updated_at":"2026-07-25T05:29:05.371651Z","is_anonymous":false},"weak_password":null}
HTTP=200
=== sign-in omar@cari.dev ===
{"access_token":"<jwt:authenticated>","token_type":"bearer","expires_in":3600,"expires_at":1784960945,"refresh_token":"btj3sxqnc4p6","user":{"id":"c635a8e9-7c37-4b0d-bcbf-7a388390c6a3","aud":"authenticated","role":"authenticated","email":"omar@cari.dev","email_confirmed_at":"2026-07-25T05:29:00.45729Z","phone":"","confirmed_at":"2026-07-25T05:29:00.45729Z","last_sign_in_at":"2026-07-25T05:29:05.815314582Z","app_metadata":{"provider":"email","providers":["email"]},"user_metadata":{"email_verified":true},"identities":[{"identity_id":"ff6d74b7-e2be-4ce4-82f2-d50326a0d9c3","id":"c635a8e9-7c37-4b0d-bcbf-7a388390c6a3","user_id":"c635a8e9-7c37-4b0d-bcbf-7a388390c6a3","identity_data":{"email":"omar@cari.dev","email_verified":false,"phone_verified":false,"sub":"c635a8e9-7c37-4b0d-bcbf-7a388390c6a3"},"provider":"email","last_sign_in_at":"2026-07-25T05:29:00.455487Z","created_at":"2026-07-25T05:29:00.455575Z","updated_at":"2026-07-25T05:29:00.455575Z","email":"omar@cari.dev"}],"created_at":"2026-07-25T05:29:00.454109Z","updated_at":"2026-07-25T05:29:05.81803Z","is_anonymous":false},"weak_password":null}
HTTP=200

for u in "dana@cari.dev:Passw0rd-dana-91" "omar@cari.dev:Passw0rd-omar-17"; do
  email="${u%%:*}"; pass="${u#*:}"
  tok=$(curl -s -X POST "$SUPABASE_URL/auth/v1/token?grant_type=password" -H "apikey: $SUPABASE_ANON_KEY" -H "Content-Type: application/json" -d "$(jq -nc --arg e "$email" --arg p "$pass" '{email:$e,password:$p}')" | jq -r .access_token)
  code=$(curl -s -o /tmp/me.json -w '%{http_code}' "$SUPABASE_URL/auth/v1/user" -H "apikey: $SUPABASE_ANON_KEY" -H "Authorization: Bearer $tok")
  echo "$email -> /auth/v1/user HTTP=$code identity=$(jq -r '.email + " role=" + .role' /tmp/me.json)"
done
echo "--- negative control (wrong password) ---"
curl -s -o /tmp/bad.json -w 'HTTP=%{http_code} ' -X POST "$SUPABASE_URL/auth/v1/token?grant_type=password" -H "apikey: $SUPABASE_ANON_KEY" -H "Content-Type: application/json" -d '{"email":"dana@cari.dev","password":"wrong"}'; jq -c '{error_code, msg}' /tmp/bad.json

dana@cari.dev -> /auth/v1/user HTTP=200 identity=dana@cari.dev role=authenticated
omar@cari.dev -> /auth/v1/user HTTP=200 identity=omar@cari.dev role=authenticated
--- negative control (wrong password) ---
HTTP=400 {"error_code":"invalid_credentials","msg":"Invalid login credentials"}

psql "$SUPABASE_DB_URL" -At -c "select email, email_confirmed_at is not null as confirmed, encrypted_password is not null and encrypted_password<>'' as has_pw, banned_until, deleted_at, last_sign_in_at from auth.users where email in ('dana@cari.dev','omar@cari.dev') order by email;"

dana@cari.dev|t|t|||2026-07-25 05:29:15.987626+00
omar@cari.dev|t|t|||2026-07-25 05:29:16.60804+00