Getting an error of: "User has more than one identity on signup"

[TaxNowAndrewY]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

An auth bug of "User has more than one identity on signup" occurs when:

1. a user signs up
2. has a phone number associated to the user via admin.auth.updateUserById while the user is in the verification state
3. Tries to use the method verifyOtp

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Sign up a user:

    signUpResult = await supabase.auth.signUp({
      email: payload.email,
      password: payload.password,
      options: {
        data: {
          first_name: payload.first_name,
          last_name: payload.last_name,
          phone_number: payload.phone_number,
        }
      }

2. Update their phone number with supabase.admin.auth.udpateUserById

await supabase.auth.admin.updateUserById(user.id, {
      phone: payload.phone_number,
      app_metadata: {
        inSignUpFlow: true
      },
      user_metadata: {
        first_name: payload.first_name,
        last_name: payload.last_name,
        phone_number: payload.phone_number
      }
    });

3. Get an OTP code with supabase.auth.signInWithOtp

4. Verify OTP with supabase.auth.verifyOtp

supabase.auth.verifyOtp({ email: <email>, token: <token>, type: 'email' })

Expected behavior

This flow was working previously (within the last few days)

Screenshots

If applicable, add screenshots to help explain your problem.

System information

• OS: [e.g. macOS, Windows]

• Browser (if applies) [e.g. chrome, safari]

• Version of supabase-js: [e.g. 6.0.2]

• Version of Node.js: [e.g. 10.10.0]

• macOS, m2

• edge

• supabase-js ^2.39.1

• node v18.18.0

Additional context

This github commit seems to be where the error is introduced:
483463e#diff-e47b259bf17912f7ca1f5163ccbfb8a8c23da6c399412ce5aef78b8b684df5e5R330

The problem presents itself as the same as this one here:
#1840

But issue 1840 was addressed with udpateUser instead of admin.auth.updateUserById. In short, I think the assumption that there can be only 1 identity before a user confirms their email is too broad since we would like to be able to capture this information and have it associated all in the sign up flow.

[cdavis1324]

We're experiencing this issue as well and the impact may be quite bad.

It seems that if you call updateUserById and don't pass the phone_confirm: true or email_confirm: true params after updating phone/email, users can get in a state where they can't login at all even if they have already confirmed their previous email/phone.

https://supabase.com/docs/reference/javascript/auth-admin-updateuserbyid

Our organization's existing use of updateUserById was NOT passing these params and we now have multiple users that can't login using verifyOtp.

Our workaround has been to update our codepath to pass the auto-confirmation params and then re-update their phone/email. This workaround is pretty cumbersome and leading to a lot of customer annoyance.

[cdavis1324]

I've been able to reproduce this bug via another method as well that seems to be a common use-case.

1. Create a user using auth.createUser and pass in both email and phone params.
2. Call auth.signInWithOtp with an email address
3. Call auth.verifyOtp with email and `type: 'email``

We're using the above flow to create users with both emails and phones on sign-up in our application and then letting them sign-in with either email or phone.

The above commit 483463e#diff-e47b259bf17912f7ca1f5163ccbfb8a8c23da6c399412ce5aef78b8b684df5e5R330 seems to have broken this use-case.

As @TaxNowAndrewY stated above, the assumption that a user only has 1 identity before confirming is wrong and breaks this use-case that previously worked.

[hf]

Yup this is a problem. We'll get on a fix for it but earliest deploy looks like it's Monday. Please write to supabase.help anyone that's affected by this so we roll out the fix ASAP on your projects. Please reference this issue!

[TaxNowAndrewY]

@hf Just confirming that the fix is deployed to prod env for supabase?

[cdavis1324]

@hf Has this fix been deployed yet? We're still seeing the User has more than one identity on signup in our logs

[kangmingtay]

hi everyone, this issue should be resolved now as we've deployed v2.168.0 (which contains the fix) to all projects. You can check which auth version your project is on from the [settings page].(https://supabase.com/dashboard/project/_/settings/infrastructure)