mirror of
https://github.com/supabase/supabase.git
synced 2026-10-11 04:15:04 +03:00
Gildas Garcia
1235245e6e
## Problem The API prevents users from deleting their last MFA when they also have recovery codes. However the UI doesn't and they may see an error instead of being guided. ## Solution Delete the recovery codes first. <img width="1080" height="850" alt="image" src="https://github.com/user-attachments/assets/67d999e7-06ff-4c0a-a2cc-11b864cb32f4" /> ## Review instructions Provide a clear numbered procedure that the PR reviewer can walk through. 1. With an account that have only one MFA and recovery codes generated 2. Delete the MFA => You should see the dialog as in above screenshot. Check the presence of _Your recovery codes will be deleted too_ After deletion, you shouldn't see the Recovery codes section anymore. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved multi-factor authentication management when recovery codes are available. - Users are warned that recovery codes will be deleted before removing their last authentication factor. - Removing the final authentication factor handles recovery-code deletion first. - Cancelling deletion leaves the factor and recovery codes unchanged. - Recovery-code handling applies only when enabled and relevant to last-factor removal. - Recovery-code management is available in all environments. - Delete actions are disabled while recovery-code status is loading, and an error message appears if recovery codes fail to load. <!-- end of auto-generated comment: release notes by coderabbit.ai -->