Repository navigation
Supabase auth hook, privacy safeguards and replay recovery (disabled) - #59
Merged
Merged
Conversation
Robertpaschal
changed the title
Robertpaschal
changed the title
Robertpaschal
marked this pull request as ready for review
October 26, 2026 07:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an opt-in Supabase Send Email Hook and an auth-only Rootmail send path. Codes and token-bearing bodies use a separate encrypted, expiring, non-persistent vault; retained messages preserve delivery metadata without content, conversation copies or engagement tracking. Both API and worker require an explicit workspace/client allowlist, off by default.
The adapter verifies raw-body signatures, preserves replay deadlines in a private PostgreSQL ledger, bounds the whole request to 4.5 seconds and acknowledges observed provider acceptance. The controlled Sprout host uses code-only delivery and an owner-inbox allowlist, separate limited database credentials, fixed errors and bounded containers on the existing host. Ordinary sending is preserved. Migrations 0083/0084 add nullable columns, a privacy constraint and a partial expiry index, compatible with older code while auth remains disabled.
Validation: full local tests (7 tasks, 258 API tests, 40 adapter tests), typecheck, six builds and design audit pass. Exact-head CI at ee2a8c1 passes, including pruned ARM images and the new hook entrypoint. Worker SES configuration-read permission was approved, applied and verified. QA sender/recipient and temporary server key are prepared.
Live auth delivery, native Sprout sign-in, real expiry/resend behavior and an independent customer setup walkthrough remain unverified. This release is gated for a controlled pilot, not unrestricted sending. SES sandbox limits remain. Client keys are not endpoint-limited send-only keys; no exactly-once claim. See docs/sprout-pilot-validation-2026-10-25.md and docs/supabase-hook-setup.md for rollout and rollback.