From 3a0266051103acaebdeaa9ed43ed6766d83b6c76 Mon Sep 17 00:00:00 2001
From: pavlov346346-source <pavlov346346@gmail.com>
Date: Fri, 11 Sep 2026 07:18:54 +0300
Subject: [PATCH] test: guard verified-email signup flow

---
 tests/auth-security-v1774.mjs | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 tests/auth-security-v1774.mjs

diff --git a/tests/auth-security-v1774.mjs b/tests/auth-security-v1774.mjs
new file mode 100644
index 0000000..d8a1247
--- /dev/null
+++ b/tests/auth-security-v1774.mjs
@@ -0,0 +1,20 @@
+import fs from 'node:fs';
+
+const auth=fs.readFileSync('public/core/auth-security-v1774.js','utf8');
+const perf=fs.readFileSync('public/core/performance.js','utf8');
+const migration=fs.readFileSync('ops/sql/SUPABASE-V17.7.4-AUTH-EMAIL-VERIFICATION.sql','utf8');
+let bad=0;
+const check=(ok,msg)=>{console.log(`${ok?'OK':'FAIL'}: ${msg}`);if(!ok)bad++;};
+
+check(auth.includes('emailRedirectTo:redirectUrl()'),'signup sets explicit confirmation redirect');
+check(auth.includes('showPublicConfirmation')&&auth.includes('Подтвердите email'),'public signup waits for email confirmation');
+check(auth.includes('showInviteConfirmation'),'invite signup waits for email confirmation');
+check(!auth.includes("registration_source:'caterium_public_signup'")&&!auth.includes("registration_source:'caterium_invite_signup'"),'security guard does not trust client-controlled registration_source');
+check(auth.includes("result.data?.session")&&auth.includes('signOutUnsafeSession'),'guard fails closed if server still auto-confirms');
+check(perf.includes('loadAuthSecurity')&&perf.includes('auth-security-v1774.js'),'auth security guard is loaded by performance core');
+check(migration.includes('drop trigger if exists caterium_autoconfirm_signup_v25 on auth.users'),'autoconfirm users trigger is removed');
+check(migration.includes('drop trigger if exists caterium_autoverify_identity_v25 on auth.identities'),'autoverify identity trigger is removed');
+check(migration.includes('drop function if exists public.caterium_autoconfirm_signup_v25()'),'unsafe autoconfirm function is removed');
+check(migration.includes('drop function if exists public.caterium_autoverify_identity_v25()'),'unsafe identity verification function is removed');
+
+if(bad)process.exit(1);