Skip to content

feat: MFA factor enrollment notifications#2183

Merged
fadymak merged 5 commits intomasterfrom
iat/mfa-enrollment-notifications
Sep 30, 2025
Merged

feat: MFA factor enrollment notifications#2183
fadymak merged 5 commits intomasterfrom
iat/mfa-enrollment-notifications

Conversation

@fadymak
Copy link
Contributor

@fadymak fadymak commented Sep 30, 2025

This PR adds support for sending email notifications to a user when a factor has been enrolled/unenrolled for their account.

6 new environment variables are introduced:

  • GOTRUE_MAILER_SUBJECTS_MFA_FACTOR_{ENROLLED|UNENROLLED}_NOTIFICATION: Email subject to use for password changed notification.
  • GOTRUE_MAILER_TEMPLATES_MFA_FACTOR_{ENROLLED|UNENROLLED}_NOTIFICATION: The URL to specify a custom template.
  • GOTRUE_MAILER_NOTIFICATIONS_MFA_FACTOR_{ENROLLED|UNENROLLED}_ENABLED: whether the notification is enabled or not.

The feature is disabled by default. To enable it, the GOTRUE_MAILER_NOTIFICATIONS_MFA_FACTOR_{ENROLLED|UNENROLLED}_ENABLED environment variable must be set to true.

@fadymak fadymak requested a review from a team as a code owner September 30, 2025 11:14
@coveralls
Copy link

coveralls commented Sep 30, 2025

Pull Request Test Coverage Report for Build 18138239496

Details

  • 50 of 94 (53.19%) changed or added relevant lines in 5 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage decreased (-0.07%) to 67.614%

Changes Missing Coverage Covered Lines Changed/Added Lines %
internal/api/mail.go 18 30 60.0%
internal/api/mfa.go 12 28 42.86%
internal/mailer/templatemailer/templatemailer.go 0 16 0.0%
Totals Coverage Status
Change from base Build 18137474413: -0.07%
Covered Lines: 13353
Relevant Lines: 19749

💛 - Coveralls

Copy link
Contributor

@cstockton cstockton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 🚀

Base automatically changed from iat/email-changed-notification to master September 30, 2025 16:56
@fadymak fadymak force-pushed the iat/mfa-enrollment-notifications branch from 910e859 to 9c3a447 Compare September 30, 2025 17:16
@snyk-io
Copy link

snyk-io bot commented Sep 30, 2025

🎉 Snyk checks have passed. No issues have been found so far.

code/snyk check is complete. No issues have been found. (View Details)

@fadymak fadymak force-pushed the iat/mfa-enrollment-notifications branch from 9c3a447 to 5f8d8da Compare September 30, 2025 17:26
@fadymak fadymak merged commit 53db712 into master Sep 30, 2025
5 checks passed
@fadymak fadymak deleted the iat/mfa-enrollment-notifications branch September 30, 2025 17:38
fadymak pushed a commit that referenced this pull request Nov 4, 2025
🤖 I have created a release *beep* *boop*
---


##
[2.181.0](v2.180.0...v2.181.0)
(2025-10-31)


### Features

* add `.well-known/openid-configuration`
([#2197](#2197))
([9a8d0df](9a8d0df))
* add `auth_migration` annotation for the migrations
([#2234](#2234))
([b276d0b](b276d0b))
* add advisor to notify you when to double the max connection pool
([#2167](#2167))
([a72f5d9](a72f5d9))
* add after-user-created hook
([#2169](#2169))
([bd80df8](bd80df8))
* add support for account changes notifications in email send hook
([#2192](#2192))
([6b382ae](6b382ae))
* email address changed notification
([#2181](#2181))
([047f851](047f851))
* identity linked/unlinked notifications
([#2185](#2185))
([7d46936](7d46936))
* introduce v2 refresh token algorithm
([#2216](#2216))
([dea5b8e](dea5b8e))
* MFA factor enrollment notifications
([#2183](#2183))
([53db712](53db712))
* notify users when their phone number has changed
([#2184](#2184))
([21f3070](21f3070))
* **oauthserver:** add OAuth client admin update endpoint
([#2231](#2231))
([6296a5a](6296a5a))
* properly handle redirect url fragments and unusual hostnames
([#2200](#2200))
([aa0ac5b](aa0ac5b))
* store latest challenge/attestation data
([#2179](#2179))
([01ebce1](01ebce1))
* support percentage based db limits with reload support
([#2177](#2177))
([1731466](1731466))
* webauthn support schema changes, update openapi.yaml
([#2163](#2163))
([68cb8d2](68cb8d2))


### Bug Fixes

* gosec incorrectly warns about accessing signature[64]
([#2222](#2222))
([bca6626](bca6626))
* **openapi:** add missing OAuth client registration fields
([#2227](#2227))
([cf39a8a](cf39a8a))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
DevRyuki pushed a commit to sasatech-gk/supabase-auth that referenced this pull request Feb 23, 2026
🤖 I have created a release *beep* *boop*
---


##
[2.181.0](supabase/auth@v2.180.0...v2.181.0)
(2025-10-31)


### Features

* add `.well-known/openid-configuration`
([supabase#2197](supabase#2197))
([9a8d0df](supabase@9a8d0df))
* add `auth_migration` annotation for the migrations
([supabase#2234](supabase#2234))
([b276d0b](supabase@b276d0b))
* add advisor to notify you when to double the max connection pool
([supabase#2167](supabase#2167))
([a72f5d9](supabase@a72f5d9))
* add after-user-created hook
([supabase#2169](supabase#2169))
([bd80df8](supabase@bd80df8))
* add support for account changes notifications in email send hook
([supabase#2192](supabase#2192))
([6b382ae](supabase@6b382ae))
* email address changed notification
([supabase#2181](supabase#2181))
([047f851](supabase@047f851))
* identity linked/unlinked notifications
([supabase#2185](supabase#2185))
([7d46936](supabase@7d46936))
* introduce v2 refresh token algorithm
([supabase#2216](supabase#2216))
([dea5b8e](supabase@dea5b8e))
* MFA factor enrollment notifications
([supabase#2183](supabase#2183))
([53db712](supabase@53db712))
* notify users when their phone number has changed
([supabase#2184](supabase#2184))
([21f3070](supabase@21f3070))
* **oauthserver:** add OAuth client admin update endpoint
([supabase#2231](supabase#2231))
([6296a5a](supabase@6296a5a))
* properly handle redirect url fragments and unusual hostnames
([supabase#2200](supabase#2200))
([aa0ac5b](supabase@aa0ac5b))
* store latest challenge/attestation data
([supabase#2179](supabase#2179))
([01ebce1](supabase@01ebce1))
* support percentage based db limits with reload support
([supabase#2177](supabase#2177))
([1731466](supabase@1731466))
* webauthn support schema changes, update openapi.yaml
([supabase#2163](supabase#2163))
([68cb8d2](supabase@68cb8d2))


### Bug Fixes

* gosec incorrectly warns about accessing signature[64]
([supabase#2222](supabase#2222))
([bca6626](supabase@bca6626))
* **openapi:** add missing OAuth client registration fields
([supabase#2227](supabase#2227))
([cf39a8a](supabase@cf39a8a))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants