The Church of Pentecost Canada Inc

Self-Service Password Change — one-time Supabase setup

"Change My Password" re-signs in with the current password and then calls Supabase's own auth.updateUser() — but on this project, Supabase rejects that with a "current_password_required" error regardless, since a plain re-sign-in isn't the reauthentication method it wants for this specific check. This Edge Function verifies the current password itself, server-side, then sets the new one via the admin API (the same one admin-reset-password uses), which isn't subject to that restriction at all.

Step 1 — Create Edge Function named change-my-password

Supabase Dashboard → Edge Functions → New Function → paste this code (no extra secrets needed — SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are provided automatically):

Once deployed, "Change My Password" automatically uses this instead — no other change needed. If the function isn't deployed (or is unreachable), the change is blocked with a clear error rather than repeating the "current password required" failure with no way forward.

Admin Password Reset — one-time Supabase setup

Without this, "Reset Password" in User Management calls a database function that hand-writes a password hash directly into auth.users — a hash that isn't guaranteed to match what Supabase's own auth service expects when checking a sign-in, so the generated password can silently fail to work. This Edge Function fixes that by calling Supabase's real admin password-update API instead of re-implementing it.

Step 1 — Create Edge Function named admin-reset-password

Supabase Dashboard → Edge Functions → New Function → paste this code (no extra secrets needed — SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are provided automatically):

Once deployed, "Reset Password" automatically uses this instead — no other change needed. If the function isn't deployed (or is unreachable), the reset is blocked with a clear error rather than silently generating a password that won't actually work.

Login Lockout Protection — one-time Supabase setup

Without this, failed-login tracking lives only in the browser and is bypassed by clearing storage or opening a private window. Deploying this Edge Function moves the count to the database, where it can't be reset from the browser.

If you deployed this before: the code below fixes a real vulnerability in the first version — it scoped lockout to the account name alone, which let anyone remotely lock out any other user's account with no credentials, from outside the app entirely. Re-run both steps below to upgrade.

Step 1 — Run this SQL once (creates the tracking table, locked down so only this Edge Function can read or write it)

Step 2 — Create the Edge Function

Supabase Dashboard → Edge Functions → New Function → name it login-guard → paste this code (no extra secrets needed — SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are provided automatically):

Once deployed, lockout is enforced from the database and can't be reset by clearing browser storage. If the function isn't deployed (or is unreachable), the app automatically falls back to the previous browser-only check so login is never blocked by a missing function.