$ the-wire · showcase
Studio tightens the MFA removal path; realtime preps a presence swap
By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology
A run of Studio commits makes authenticator removal, recovery codes, and MFA setup status genuinely trustworthy in the account security panel, while realtime lays the groundwork to run Rollcall's presence backend next to Phoenix in shadow mode.
fix(studio): preserve authenticator removal progress on failure (#52351) supabase/supabase
Failed authenticator removal no longer repeats completed steps on retry: errors render below the dialog content, progress is preserved, and removal is blocked until recovery-code status is known, with a Retry for failed status checks. A failed status check previously could let removal proceed before Studio knew whether recovery codes existed.
fix(studio): verify identity before removing authenticators (#52352) supabase/supabase
Removal now checks the session before showing the confirmation and, if the session has not completed MFA, presents a "Verify your identity" step instead of the toast with its unclear AAL1/AAL2 copy. It depends on the progress-preserving fix above.
feat(studio): resume account actions after recovery-code verification (#52747) supabase/supabase
Recovery-code verification now uses InterstitialLayout and returns to the selected authenticator's removal confirmation rather than dropping the user back on Security with the action abandoned. Cancel returns to Security without signing out, and verification never removes the authenticator automatically.
feat(studio): show recovery code health in account security (#52355) supabase/supabase
Account security now warns when recovery codes are running low or used up, with Regenerate placed beside the code count, and hides codes entirely until MFA is enabled. Standalone code deletion is gone; regeneration while MFA is on replaces it.
feat(studio): clarify authenticator setup and backup status (#52354) supabase/supabase
The setup list shows only verified authenticators, so abandoned setups no longer appear as configured factors, and backup guidance now comes from the shared recovery checks. Once those checks pass, the most relevant MFA action is emphasized.
fix(presence): count authorized fallback diffs (#2462) supabase/realtime
On the realtime side, presence fallback diffs are now counted only when authorized, fixing an undercount reproduced in a test first; the replacement test asserts the handler increments the presence events counter. Elsewhere in the long tail, presence gets a backend facade with the Phoenix implementation behind it and Rollcall can now take an optional ref so Phoenix and Rollcall share refs in sh...
