Skip to content

Commit b9d0500

Browse files
hfdepthfirst-app[bot]
hf
and
depthfirst-app[bot]
authored
feat: reset main branch to 2.185.0 (#2325)
Resets the main branch (`master`) to have the same changeset as 2.184.0 but under 2.185.0. Original release please notes: ### Features * Add Sb-Forwarded-For header and IP-based rate limiting ([#2295](#2295)) ([e8f679b](e8f679b)) * allow amr claim to be array of strings or objects ([#2274](#2274)) ([607da43](607da43)) * Treat rate limit header value as comma-separated list ([#2282](#2282)) ([5f2e279](5f2e279)) ### Bug Fixes * check each type independently ([#2290](#2290)) ([d9de0af](d9de0af)) * fix the wrong error return value ([#1950](#1950)) ([e2dfb5d](e2dfb5d)) * **indexworker:** remove pg_trgm extension ([#2301](#2301)) ([c553b10](c553b10)) * **oauth-server:** allow custom URI schemes in client redirect URIs ([#2298](#2298)) ([ea72f57](ea72f57)) * tighten email validation rules ([#2304](#2304)) ([33bb372](33bb372)) --------- Co-authored-by: depthfirst-app[bot] <184448029+depthfirst-app[bot]@users.noreply.github.com>
1 parent 3ffce52 commit b9d0500

52 files changed

Lines changed: 428 additions & 1626 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/test.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,13 @@ jobs:
4949
- name: Run static check
5050
run: |
5151
set -x
52+
go install honnef.co/go/tools/cmd/staticcheck@latest
53+
go install github.com/nishanths/exhaustive/cmd/exhaustive@latest
5254
make static
5355
- name: Check gosec
5456
run: |
5557
set -x
58+
go install github.com/securego/gosec/v2/cmd/gosec@latest
5659
make sec
5760
- name: Init Database
5861
run: psql -f hack/init_postgres.sql postgresql://postgres:root@localhost:5432/postgres

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.25.5-alpine3.23 as build
1+
FROM golang:1.23.7-alpine3.20 as build
22
ENV GO111MODULE=on
33
ENV CGO_ENABLED=0
44
ENV GOOS=linux

‎Dockerfile.dev‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.25.5-alpine3.23
1+
FROM golang:1.23.7-alpine3.20
22
ENV GO111MODULE=on
33
ENV CGO_ENABLED=0
44
ENV GOOS=linux

‎Makefile‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
.PHONY: all build deps image migrate test vet sec format unused
2-
.PHONY: check-gosec check-oapi-codegen check-staticcheck
2+
.PHONY: check-exhaustive check-gosec check-oapi-codegen check-staticcheck
33
CHECK_FILES?=./...
44

55
ifdef RELEASE_VERSION
@@ -66,13 +66,18 @@ unused: | check-staticcheck # Look for unused code
6666
@echo "Code used only in _test.go (do move it in those files):"
6767
staticcheck -checks U1000 -tests=false $(CHECK_FILES)
6868

69-
static: | check-staticcheck
69+
static: | check-staticcheck check-exhaustive
7070
staticcheck ./...
71+
exhaustive ./...
7172

7273
check-staticcheck:
7374
@command -v staticcheck >/dev/null 2>&1 \
7475
|| go install honnef.co/go/tools/cmd/staticcheck@latest
7576

77+
check-exhaustive:
78+
@command -v exhaustive >/dev/null 2>&1 \
79+
|| go install github.com/nishanths/exhaustive/cmd/exhaustive@latest
80+
7681
generate: | check-oapi-codegen
7782
go generate ./...
7883

‎README.md‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -888,12 +888,6 @@ Enforce reauthentication on password update.
888888

889889
Use this to enable/disable anonymous sign-ins.
890890

891-
### IP address forwarding
892-
893-
`GOTRUE_SECURITY_SB_FORWARDED_FOR_ENABLED` - `bool`
894-
895-
Enable IP address forwarding using the `Sb-Forwarded-For` HTTP request header. When enabled, Auth will parse the first value of this header as an IP address and use it for IP address tracking and rate limiting. Make sure this header is fully trusted before enabling this feature by only passing it from trustworthy clients or proxies.
896-
897891
## Endpoints
898892

899893
Auth exposes the following endpoints:

‎cmd/migrate_cmd.go‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package cmd
22

33
import (
44
"embed"
5+
"fmt"
56
"net/url"
67
"os"
78

@@ -22,12 +23,12 @@ var migrateCmd = cobra.Command{
2223

2324
func migrate(cmd *cobra.Command, args []string) {
2425
globalConfig := loadGlobalConfig(cmd.Context())
25-
u, err := url.Parse(globalConfig.DB.URL)
26-
if err != nil {
27-
logrus.Fatalf("%+v", errors.Wrap(err, "parsing db connection url"))
28-
}
2926

3027
if globalConfig.DB.Driver == "" && globalConfig.DB.URL != "" {
28+
u, err := url.Parse(globalConfig.DB.URL)
29+
if err != nil {
30+
logrus.Fatalf("%+v", errors.Wrap(err, "parsing db connection url"))
31+
}
3132
globalConfig.DB.Driver = u.Scheme
3233
}
3334

@@ -52,12 +53,16 @@ func migrate(cmd *cobra.Command, args []string) {
5253
}
5354
}
5455

55-
q := u.Query()
56-
q.Add("application_name", "auth_migrations")
57-
u.RawQuery = q.Encode()
56+
u, _ := url.Parse(globalConfig.DB.URL)
57+
processedUrl := globalConfig.DB.URL
58+
if len(u.Query()) != 0 {
59+
processedUrl = fmt.Sprintf("%s&application_name=gotrue_migrations", processedUrl)
60+
} else {
61+
processedUrl = fmt.Sprintf("%s?application_name=gotrue_migrations", processedUrl)
62+
}
5863
deets := &pop.ConnectionDetails{
5964
Dialect: globalConfig.DB.Driver,
60-
URL: u.String(),
65+
URL: processedUrl,
6166
}
6267
deets.Options = map[string]string{
6368
"migration_table_name": "schema_migrations",

‎go.mod‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ require (
2828
github.com/sirupsen/logrus v1.9.3
2929
github.com/spf13/cobra v1.8.1
3030
github.com/stretchr/testify v1.10.0
31-
golang.org/x/crypto v0.40.0
31+
golang.org/x/crypto v0.36.0
3232
golang.org/x/oauth2 v0.27.0
3333
gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
3434
)
@@ -71,8 +71,8 @@ require (
7171
github.com/x448/float16 v0.8.4 // indirect
7272
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
7373
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
74-
golang.org/x/mod v0.26.0 // indirect
75-
golang.org/x/tools v0.35.0 // indirect
74+
golang.org/x/mod v0.22.0 // indirect
75+
golang.org/x/tools v0.29.0 // indirect
7676
google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de // indirect
7777
google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
7878
)
@@ -169,10 +169,10 @@ require (
169169
github.com/stretchr/objx v0.5.2 // indirect
170170
go.opentelemetry.io/proto/otlp v1.2.0 // indirect
171171
golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb
172-
golang.org/x/net v0.42.0 // indirect
173-
golang.org/x/sync v0.16.0
174-
golang.org/x/sys v0.34.0
175-
golang.org/x/text v0.27.0
172+
golang.org/x/net v0.38.0 // indirect
173+
golang.org/x/sync v0.12.0
174+
golang.org/x/sys v0.31.0
175+
golang.org/x/text v0.23.0
176176
golang.org/x/time v0.9.0
177177
google.golang.org/grpc v1.63.2 // indirect
178178
google.golang.org/protobuf v1.34.2 // indirect
@@ -181,4 +181,4 @@ require (
181181
gopkg.in/yaml.v3 v3.0.1 // indirect
182182
)
183183

184-
go 1.25.5
184+
go 1.23.7

‎go.sum‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -558,8 +558,8 @@ golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5y
558558
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
559559
golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
560560
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
561-
golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
562-
golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
561+
golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
562+
golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
563563
golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb h1:mIKbk8weKhSeLH2GmUTrvx8CjkyJmnU1wFmg59CUjFA=
564564
golang.org/x/exp v0.0.0-20230811145659-89c5cff77bcb/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
565565
golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -568,8 +568,8 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB
568568
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
569569
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
570570
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
571-
golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
572-
golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
571+
golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
572+
golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
573573
golang.org/x/net v0.0.0-20161007143504-f4b625ec9b21/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
574574
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
575575
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -587,8 +587,8 @@ golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfS
587587
golang.org/x/net v0.0.0-20221002022538-bcab6841153b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
588588
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
589589
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
590-
golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
591-
golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
590+
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
591+
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
592592
golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
593593
golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
594594
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -597,8 +597,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
597597
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
598598
golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
599599
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
600-
golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
601-
golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
600+
golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
601+
golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
602602
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
603603
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
604604
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -632,8 +632,8 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
632632
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
633633
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
634634
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
635-
golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
636-
golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
635+
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
636+
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
637637
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
638638
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
639639
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -650,8 +650,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
650650
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
651651
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
652652
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
653-
golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
654-
golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
653+
golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
654+
golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
655655
golang.org/x/time v0.0.0-20160926182426-711ca1cb8763/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
656656
golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
657657
golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
@@ -668,8 +668,8 @@ golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4f
668668
golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
669669
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
670670
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
671-
golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
672-
golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
671+
golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
672+
golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=
673673
golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
674674
golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
675675
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎internal/api/admin.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -390,7 +390,7 @@ func (a *API) adminUserCreate(w http.ResponseWriter, r *http.Request) error {
390390

391391
if err != nil {
392392
if errors.Is(err, bcrypt.ErrPasswordTooLong) {
393-
return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, "%s", err.Error())
393+
return apierrors.NewBadRequestError(apierrors.ErrorCodeValidationFailed, err.Error())
394394
}
395395
return apierrors.NewInternalServerError("Error creating user").WithInternalError(err)
396396
}

‎internal/api/anonymous_test.go‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ import (
1616
"github.com/supabase/auth/internal/conf"
1717
mail "github.com/supabase/auth/internal/mailer"
1818
"github.com/supabase/auth/internal/models"
19-
"github.com/supabase/auth/internal/storage"
2019
)
2120

2221
type AnonymousTestSuite struct {
@@ -26,14 +25,9 @@ type AnonymousTestSuite struct {
2625
}
2726

2827
func TestAnonymous(t *testing.T) {
29-
cb := func(cfg *conf.GlobalConfiguration, _ *storage.Connection) {
30-
if cfg != nil {
31-
cfg.RateLimitAnonymousUsers = 5
32-
}
33-
}
34-
35-
api, config, err := setupAPIForTestWithCallback(cb)
28+
api, config, err := setupAPIForTest()
3629
require.NoError(t, err)
30+
3731
ts := &AnonymousTestSuite{
3832
API: api,
3933
Config: config,

0 commit comments

Comments
 (0)