Fork dev

[mrigangha]

What kind of change does this PR introduce?

Create a supabase.auth.admin.getUserByEmail function #880

What is the current behavior?

Added a FindUserByEmail to user.go

[depthfirst-app]

🟡 Severity: MEDIUM

Missing Audience (aud) Check: This function searches users without validating the aud (audience) field, unlike the existing FindUserByEmailAndAudience. In multi-tenant systems, the aud field isolates users between different tenants/applications. Omitting this check allows one tenant to potentially access users from another tenant's database. The function also omits the is_sso_user = false filter, which could return SSO users that should be handled differently.
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Add the 'aud' (audience) parameter and include the 'is_sso_user = false' filter to prevent cross-tenant data access and exclude SSO users. The function signature should be: func FindUserByEmail(tx *storage.Connection, email, aud string) (*User, error) and the query should include: aud = ? and is_sso_user = false. This ensures tenant isolation in multi-tenant environments. If this function is strictly intended for admin-only cross-tenant operations, document this clearly and ensure it's only called from properly authorized admin endpoints.

⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.

Suggested change

	func FindUserByEmail(tx *storage.Connection, email string) (*User, error) {
	func FindUserByEmail(tx *storage.Connection, email, aud string) (*User, error) {
	return findUser(tx, "instance_id = ? and LOWER(email) = ? and aud = ? and is_sso_user = false", uuid.Nil, strings.ToLower(email), aud)
	}