From 93d13d38781ca3f17f12cb5690c38300aad71abb Mon Sep 17 00:00:00 2001
From: pavlov346346-source <pavlov346346@gmail.com>
Date: Fri, 11 Sep 2026 10:09:45 +0300
Subject: [PATCH] db: add temporary-password marker backfill

---
 ops/sql/SUPABASE-V17.7.4-PASSWORD-SECURITY.sql | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 ops/sql/SUPABASE-V17.7.4-PASSWORD-SECURITY.sql

diff --git a/ops/sql/SUPABASE-V17.7.4-PASSWORD-SECURITY.sql b/ops/sql/SUPABASE-V17.7.4-PASSWORD-SECURITY.sql
new file mode 100644
index 0000000..3f1b244
--- /dev/null
+++ b/ops/sql/SUPABASE-V17.7.4-PASSWORD-SECURITY.sql
@@ -0,0 +1,15 @@
+-- Caterium v17.7.4: move mandatory temporary-password state to server-controlled app metadata.
+-- Legacy user_metadata is client-editable and must not be trusted for this security state.
+
+begin;
+
+update auth.users
+set raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb)
+  || jsonb_build_object(
+    'must_change_password', true,
+    'password_policy_version', 'v1774'
+  )
+where lower(coalesce(raw_user_meta_data->>'must_change_password', '')) = 'true'
+  and lower(coalesce(raw_app_meta_data->>'must_change_password', 'false')) <> 'true';
+
+commit;