Stojan Dimitrovski

feat: add hashed refresh tokens

3

Today refresh tokens are stored _raw_ in the database. Should the database be stolen, leaked or misused by an external or internal party, it would be nearly trivial to issue...

Not sure what's wrong with this code... but it doesn't work. There appears to be an official function (although experimental) within ethers: https://docs.ethers.io/v5/single-page/#/v5/api/signer/-#-Signer-signTypedData

Build was missing for some reason. 😱

When the access token (JWT) contains a `session_id` property which does not correspond to a row in the `sessions` table, it means that the user has been signed out or...

feat: set `email_confirmed_at` to null when autoconfirm is on

2

A long-standing bug has been that when autoconfirm is on (should have been named "allow sign up without verifying email") it would set the `email_confirmed_at` column to the timestamp of...

fix: expose `X-Supabase-Api-Version` header in CORS

1

Fixes #1589.

fix: parse CacheDuration and ValidUntil in EntitiesDescriptor

1

Fixes issue with parsing the `CacheDuration` and `ValidUntil` attributes of `EntitiesDescriptor`. This was fixed on `EntityDescriptor` but seems to have been left out here. It's causing crashes. See: - https://github.com/supabase/auth/issues/1697

feat: email, sms rate limiting new config and refactored rate limiters

3

Adds a new config syntax that allows more flexible rate limiting configuration for the `GOTRUE_RATE_LIMIT_EMAIL_SENT`, `GOTRUE_RATE_LIMIT_SMS_SENT` configs. It can be added in follow up PRs to the other configs. It's...

feat: add `error_code` to log preview

2

Makes it easy to see the error code behind an API Gateway log entry. Example: