From 47fa747c93da60bdc95f755b17febb6e763ab4de Mon Sep 17 00:00:00 2001
From: pavlov346346-source <pavlov346346@gmail.com>
Date: Fri, 11 Sep 2026 07:18:59 +0300
Subject: [PATCH] security: remove client-controlled email autoconfirm triggers

---
 ops/sql/SUPABASE-V17.7.4-AUTH-EMAIL-VERIFICATION.sql | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 ops/sql/SUPABASE-V17.7.4-AUTH-EMAIL-VERIFICATION.sql

diff --git a/ops/sql/SUPABASE-V17.7.4-AUTH-EMAIL-VERIFICATION.sql b/ops/sql/SUPABASE-V17.7.4-AUTH-EMAIL-VERIFICATION.sql
new file mode 100644
index 0000000..e513c97
--- /dev/null
+++ b/ops/sql/SUPABASE-V17.7.4-AUTH-EMAIL-VERIFICATION.sql
@@ -0,0 +1,12 @@
+-- Caterium v17.7.4: require real Supabase email verification for client-created accounts.
+-- The removed triggers trusted raw_user_meta_data.registration_source, which is client-controlled.
+
+begin;
+
+drop trigger if exists caterium_autoconfirm_signup_v25 on auth.users;
+drop trigger if exists caterium_autoverify_identity_v25 on auth.identities;
+
+drop function if exists public.caterium_autoconfirm_signup_v25();
+drop function if exists public.caterium_autoverify_identity_v25();
+
+commit;