add toggle for update password require reauthentication

studio/pages/api/auth/[ref]/config.ts

@@ -38,6 +38,7 @@ const handleGetAll = async (req: NextApiRequest, res: NextApiResponse) => {
     MAILER_URLPATHS_CONFIRMATION: '',
     MAILER_URLPATHS_RECOVERY: '',
     MAILER_URLPATHS_EMAIL_CHANGE: '',
+    SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION: false,
     SMTP_ADMIN_EMAIL: '',
     SMTP_HOST: null,
     SMTP_PORT: null,

studio/pages/project/[ref]/auth/settings.tsx

@@ -121,6 +121,7 @@ const Settings = () => {
             'JWT_EXP',
             'DISABLE_SIGNUP',
             'PASSWORD_MIN_LENGTH',
+            'SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION',
           ])}
           model={{
             SITE_URL: model.SITE_URL || undefined,
@@ -128,6 +129,7 @@ const Settings = () => {
             DISABLE_SIGNUP: model.DISABLE_SIGNUP,
             JWT_EXP: model.JWT_EXP || undefined,
             PASSWORD_MIN_LENGTH: model.PASSWORD_MIN_LENGTH || undefined,
+            SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION: model.SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION || false,
           }}
           onSubmit={(model: any) => onFormSubmit(model)}
         >
@@ -143,6 +145,7 @@ const Settings = () => {
           />
           <NumField name="JWT_EXP" step="1" />
           <NumField name="PASSWORD_MIN_LENGTH" step="1" />
+          <ToggleField name="SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION" />
           <ToggleField name="DISABLE_SIGNUP" />
         </SchemaFormPanel>
       </div>

studio/stores/jsonSchema/auth_gotrue_config.json

@@ -6,6 +6,7 @@
     "JWT_EXP",
     "JWT_AUD",
     "JWT_DEFAULT_GROUP_NAME",
+    "SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION",
     "EXTERNAL_EMAIL_ENABLED",
     "EXTERNAL_PHONE_ENABLED",
     "EXTERNAL_APPLE_ENABLED",
@@ -396,6 +397,11 @@
       "title": "Minimum password length",
       "type": "integer"
     },
+    "SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION": {
+      "title": "Enable strict password updates",
+      "type": "boolean",
+      "help": "If enabled, users need to reauthenticate via email or phone before updating their passwords."
+    },
     "SMS_AUTOCONFIRM": {
       "title": "Enable phone confirmations",
       "type": "boolean",