## What kind of change does this PR introduce?
After users have set up a new MFA (first or not), we must:
- check whether recovery codes have already been generated
- if there are none, generate recovery codes and display them, "forcing"
users to copy them
- if already generated, show them how many are still available
> [!NOTE]
> The _Delete my recovery codes_ button in last screenshot only appear
on local and staging environments
## How to test
- On an account that doesn't have recovery codes generated yet and has
an MFA added
- You should see an admonition suggesting to generate the codes
## Screenshots
<img width="729" height="306" alt="image"
src="https://github.com/user-attachments/assets/79ba3870-4ef8-4571-9fd6-36eed20c9c24"
/>
<img width="550" height="356" alt="image"
src="https://github.com/user-attachments/assets/1632611a-996a-470d-b6cd-a4693b0f4602"
/>
<img width="719" height="205" alt="image"
src="https://github.com/user-attachments/assets/73cef611-05cf-4fac-bbd2-243f9b28e48d"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added support for generating, copying, and confirming MFA recovery
codes.
- Added recovery-code status visibility, including remaining and
exhausted codes.
- Added the ability to delete recovery codes with confirmation.
- Added clear loading, success, and error states for recovery-code
actions.
- Recovery-code status refreshes after codes are generated or deleted.
- **Bug Fixes**
- Recovery-code notices now remain visible when all codes have been
used.
- Recovery-code dialogs can now be closed after generation errors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The SDK now handles orphaned lock recovery via steal internally
(supabase-js#2106). Keep the BroadcastChannel observability wrapper for
Sentry signals. The steal-based orphaned lock recovery in
`debuggableNavigatorLock` (packages/common/gotrue.ts) (introduced in
https://github.com/supabase/supabase/pull/39868) is now redundant,
supabase-js#2106 handles this natively in the SDK.
Removes the `navigator.locks.request({ steal: true })` block while
keeping the BroadcastChannel wrapper that sends lock-holder stack traces
to Sentry.
Related: supabase/supabase-js#2106, supabase/supabase-js#2125
* Added new case study for Rally
* ci: Autofix updates from GitHub workflow
* chore: colour correct rally logos
---------
Co-authored-by: kemal <hello@kemal.earth>
fix(common): prevent errors when accessing local storage in certain
browser setups
Got many reports of errors from accessing localStorage on Safari,
probably due to certain user security settings that cause the browser to
throw an error on storage access.
* fix: bump auth-js version to v2.67.3
* chore: add supabase/auth and supabase/dashboard as codeowners
* Revert "chore: add supabase/auth and supabase/dashboard as codeowners"
This reverts commit 57fc5776ba.
* bump supabase-js version
* import user type from single gotrue
* fix auth-js version in studio
* remove auth-js dep in studio
* fix ts
* use catalog versions
* fix ts
* Bump realtime-js version to avoid having 2 versions.
* Add @supabase/realtime-js to the pnpm catalog.
* upgrade realtime-js
---------
Co-authored-by: Alaister Young <a@alaisteryoung.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Gildas Garcia