Auth

Magic link only. No password to store, no reset flow, no credential for this app to be careless with.

The redirect is pinned to ${origin}${pathname} — origin-pinned so a stolen link cannot be bounced elsewhere, query-stripped so the token does not land beside whatever state was in the URL.

The profile row is created by the client on first sign-in, not by a trigger on auth.users. Supabase has tightened ownership of that table and the trigger now fails on many projects with must be owner of relation users — and because the SQL editor runs a script in one transaction, that single error rolls the whole schema back.

Nothing is trusted to the client by moving it: the INSERT privilege is narrowed to (id, email, display_name), so plan takes its default whatever the request contains.

An unknown email address gets no error — Supabase’s enumeration protection, which the copy explains rather than papers over.