Files
supabase/pnpm-workspace.yaml
T
Gildas Garcia 63bedef77f MFA Recovery codes: allow users to download their recovery codes (#50267)
## What kind of change does this PR introduce?

After users have set up a new MFA (first or not), we must:

- check whether recovery codes have already been generated
- if there are none, generate recovery codes and display them, "forcing"
users to copy them
- if already generated, show them how many are still available

> [!NOTE]
> The _Delete my recovery codes_ button in last screenshot only appear
on local and staging environments

## How to test

- On an account that doesn't have recovery codes generated yet and has
an MFA added
- You should see an admonition suggesting to generate the codes

## Screenshots

<img width="729" height="306" alt="image"
src="https://github.com/user-attachments/assets/79ba3870-4ef8-4571-9fd6-36eed20c9c24"
/>

<img width="550" height="356" alt="image"
src="https://github.com/user-attachments/assets/1632611a-996a-470d-b6cd-a4693b0f4602"
/>

<img width="719" height="205" alt="image"
src="https://github.com/user-attachments/assets/73cef611-05cf-4fac-bbd2-243f9b28e48d"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added support for generating, copying, and confirming MFA recovery
codes.
- Added recovery-code status visibility, including remaining and
exhausted codes.
  - Added the ability to delete recovery codes with confirmation.
- Added clear loading, success, and error states for recovery-code
actions.
  - Recovery-code status refreshes after codes are generated or deleted.

- **Bug Fixes**
- Recovery-code notices now remain visible when all codes have been
used.
  - Recovery-code dialogs can now be closed after generation errors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-09-15 11:16:47 +02:00

137 lines
4.1 KiB
YAML

packages:
- apps/*
- packages/*
- blocks/*
- e2e/*
blockExoticSubdeps: true
engineStrict: true
updateNotifier: false
# Doesn't work because of Typescript issues with peer dependencies, see https://github.com/pnpm/pnpm/issues/9739
enableGlobalVirtualStore: false
catalog:
'@monaco-editor/react': 4.8.0-rc.3
'@sentry/nextjs': ^10.59.0
'@sentry/tanstackstart-react': ^10.59.0
'@supabase/auth-js': 2.116.0
'@supabase/postgrest-js': 2.116.0
'@supabase/realtime-js': 2.116.0
'@supabase/ssr': 0.10.2
'@supabase/supabase-js': 2.116.0
'@tanstack/react-router': ^1.169.2
'@tanstack/react-start': ^1.167.65
'@tanstack/react-table': ^8.21.3
'@types/node': ^22.0.0
'@types/react': ^19.2.14
'@types/react-dom': ^19.2.3
# TypeScript 7 has no programmatic API until 7.1, so `typescript` stays aliased
# to the 6.0-API compat package for tools that import it (typescript-eslint,
# Next.js build typechecking), while `@typescript/native` provides the native
# TS 7 `tsc` binary used by typecheck scripts.
# https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/
'@typescript/native': npm:typescript@~7.0.2
'@vitejs/plugin-react': ^6.0.1
'@vitest/coverage-v8': ^5.0.0
'@vitest/ui': ^5.0.0
lodash: ^4.18.1
lodash-es: ^4.18.1
monaco-editor: 0.52.2
next: ^16.3.5
next-themes: ^0.4.6
postcss: ^8.5.18
radix-ui: ^1.4.3
react: ^19.2.6
react-dom: ^19.2.6
recharts: ^2.15.4
tailwindcss: ^4.2.4
tsx: ^4.22.0
typescript: ~6.0.2
valtio: ^2.3.2
vite: ^8.0.16
velite: ^0.4.0
vitest: ^5.0.0
zod: 3.25.76
allowBuilds:
'@parcel/watcher': false
'@sentry/cli': false
'@supabase/build-icons@file:packages/build-icons': set this to true or false
'@supabase/pg-meta@file:packages/pg-meta': set this to true or false
ai-commands@file:packages/ai-commands: set this to true or false
api-types@file:packages/api-types: set this to true or false
common@file:packages/common: set this to true or false
config@file:packages/config: set this to true or false
contentlayer2: false
core-js: false
dev-tools@file:packages/dev-tools: set this to true or false
es5-ext: false
esbuild: false
icons@file:packages/icons: set this to true or false
libpg-query: false
msw: false
node-pty: true
protobufjs: false
shared-data@file:packages/shared-data: set this to true or false
sharp: false
supabase: true
ui-patterns@file:packages/ui-patterns: set this to true or false
ui@file:packages/ui: set this to true or false
minimumReleaseAge: 4320
minimumReleaseAgeExclude:
- '@ai-sdk/*'
- '@supabase/*'
- '@supabase-labs/*'
- typescript
- '@typescript/*'
# First-party, published from supabase-community/mdast-jsx.
- mdast-jsx
# The following are excluded to fix vulnerablities.
- react-use
- '@astrojs/markdown-satteri@0.3.8'
- astro@7.2.6
- next@16.3.5
- '@next/env@16.3.5'
- '@next/swc-darwin-arm64@16.3.5'
- '@next/swc-darwin-x64@16.3.5'
- '@next/swc-linux-arm64-gnu@16.3.5'
- '@next/swc-linux-arm64-musl@16.3.5'
- '@next/swc-linux-x64-gnu@16.3.5'
- '@next/swc-linux-x64-musl@16.3.5'
- '@next/swc-win32-arm64-msvc@16.3.5'
- '@next/swc-win32-x64-msvc@16.3.5'
overrides:
'@ardatan/relay-compiler>immutable': ^3.8.3
'monaco-editor': 'catalog:'
'@mapbox/node-pre-gyp>tar': ^7.5.21
'@sentry/webpack-plugin>uuid': ^11.1.1
'@usercentrics/cmp-browser-sdk>uuid': ^11.1.1
braintrust>esbuild: ^0.28.1
braintrust>uuid: ^11.1.1
cacache>tar: ^7.5.21
dompurify: ^3.3.2
express-rate-limit>ip-address: ^10.1.1
# Pin h3 v1 to a single version so the Nuxt registry example (vue-blocks)
# doesn't end up with two copies (1.15.10 + 1.15.11) and hit nominal
# H3Event type mismatches. v2 (h3@2) is intentionally left untouched.
'h3@1': 1.15.11
lodash: 'catalog:'
lodash-es: 'catalog:'
mdx-bundler>uuid: ^11.1.1
node-gyp>tar: ^7.5.21
nodemailer: ^7.0.11
postcss: 'catalog:'
qs: ^6.15.2
refractor>prismjs: ^1.30.0
tmp: ^0.2.7
vite>esbuild: ^0.28.1
webpack: ^5.104.1
'codemirror-graphql>@codemirror/language': 6.11.0
'@esbuild-plugins/node-resolve>esbuild': ^0.28.1
patchedDependencies:
react-data-grid: patches/react-data-grid.patch