24 lines
3.5 KiB
Markdown
24 lines
3.5 KiB
Markdown
# Accounts and settings
|
||
|
||
Guests see **Log in** in the header. `/log-in` supports email/password login, account creation, password recovery, and email links for existing accounts. Signed-in users see **My account**; their dashboard links to `/settings`.
|
||
|
||
Display names are public map/contribution credits. They accept 2–32 characters, including Unicode, spaces and emoji, with control characters rejected. Names are not unique; login uses an email address. Changing a name does not change the account ID or moderator permissions. Existing names and roles are preserved when profiles are initialized.
|
||
|
||
New passwords require at least 12 characters and at most 72 UTF-8 bytes. Passwords are managed by Supabase Auth and are never stored in application profiles. Existing shorter passwords remain usable for login. Settings require the current password to change it; users who previously used email links can set their first password through email recovery. Successful changes revoke other refresh sessions; already issued access tokens can remain valid until expiry.
|
||
|
||
Recovery uses Supabase's verified code/token exchange and a ten-minute, HttpOnly grant tied to the authenticated user and session. Merely opening the reset page or supplying a destination URL does not authorize a password change. The grant cookie is cleared after a successful change. Redirect destinations are restricted to application routes. Account APIs enforce session authentication, origin checks, input validation and rate limits; contributor tokens cannot edit account identity or credentials.
|
||
|
||
## Supabase deployment configuration
|
||
|
||
No database migration is needed for these account changes: `profiles.display_name` already exists. Deploy the updated website, and configure `MINEGEO_URL` with its public HTTPS origin.
|
||
|
||
In Supabase Auth, set the Site URL to that origin and allow its `/auth/callback` URL (plus any development callback URLs you actually use). Keep email confirmation enabled and configure working email delivery. The recovery email template should link to `{{ .ConfirmationURL }}` so Supabase honors the `redirectTo` URL sent by MineGeo. A custom token-hash link may use `{{ .SiteURL }}/auth/confirm?token_hash={{ .TokenHash }}&type=recovery`. Do not append `/code=...` to the Site URL: it skips the callback route. PKCE email redirects use `/auth/callback`; custom confirmation templates should preserve the appropriate destination when returning to a pairing flow.
|
||
|
||
Set the provider's minimum password length to 12 as well, since direct Auth requests do not pass through application validation. Consider enabling secure password changes and leaked-password protection where your plan supports it. Provider hardening and SMTP settings are configured in Supabase; this change does not alter them automatically. See [password security](https://supabase.com/docs/guides/auth/password-security) and [redirect URL configuration](https://supabase.com/docs/guides/auth/redirect-urls).
|
||
|
||
## Verification
|
||
|
||
The 43 Node tests, TypeScript check and Next.js production build passed. A disposable real Supabase account verified normal password login, profile editing, role-escalation rejection, required/current-password validation, password replacement and rejection of the old password. Its sessions and account were removed afterward. HTTP checks verified guest header labels, login form rendering, settings access, expired recovery and invalid callback handling.
|
||
|
||
Browser testing was skipped at the user's request. Email delivery and a full emailed confirmation/recovery journey were not exercised.
|