Disabling 'Confirm Email' still blocks non-confirmed users (created with admin client) from signing in

[reid-moffat]

Bug report

• [x] I confirm this is a bug with Supabase, not with my own application.
• [x] I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Disabling the 'Confirm Email' setting for email provider doesn't allow non-confirmed emails to sign in. I tried disabling the setting and then signing in with 3 cases, and all of them gave the same error ({"code":"email_not_confirmed","message":"Email not confirmed"}):

• Signing in with an already created account which isn't verified
• Deleting an existing account, re-creating it then attempting to sign in without confirming email
• Creating a new account on an email that's never been used before on my project then attempting to sign in without confirming email

To Reproduce

1. Go to the Authentication tab
2. Go to 'Providers'
3. Expand the email section
4. Disable the 'Confirm Email' setting
5. Save changes
6. Create a new user on your app using the admin auth API (Edge functions): supabase.auth.admin.createUser({ email, password });
7. Attempt to sign in to your app with the new account client-side: supabase.auth.signInWithPassword({ email, password });
8. Signing in will give {"code":"email_not_confirmed","message":"Email not confirmed"}

Expected behavior

Signing in should not be blocked due to email not being confirmed. Signing in should be allowed.

Screenshots

System information

• OS: Windows
• Browser: Chrome
• Version of supabase-js: 2.45.2
• Version of Node.js: v20.11.0

[teneburu]

I have this problem too

[ClovisGP]

Welcome to the group. Take a seat, put an emoji and wait with us ; )

[invoicingltd]

Me too. workaround for now?

[greendra8]

I had to manually set all unverified users to be verified after switching this setting.

UPDATE auth.users SET email_confirmed_at = NOW(), raw_user_meta_data = jsonb_set( raw_user_meta_data, '{email_verified}', 'true'::jsonb, true ) WHERE email_confirmed_at IS NULL;

[rcomesan]

Same problem here happening on Supabase CLI even after setting auth.email.enable_confirmations = false. To reproduce:

1. Call admin.admin.createUser with email_confirm: false
2. Calling auth.signInWithPassword throws email_not_confirmed

[obielwb]

same here

[Werineld]

why is this so hard to fix such an annoying bug...