fix: update aal requirements to update user

supabase · Sep 5, 2024 · 7c0a128 · 7c0a128
1 parent 9d419b4
commit 7c0a128
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/internal/api/user.go b/internal/api/user.go
@@ -89,6 +89,11 @@ func (a *API) UserUpdate(w http.ResponseWriter, r *http.Request) error {
 
 	user := getUser(ctx)
 	session := getSession(ctx)
+	// Change to check for verified
+	// Allow for metadata update
+	if len(user.Factors) != 0 && session.AAL != models.AAL2 {
+		return unauthorizedError("need aal2")
+	}
 
 	if err := a.validateUserUpdateParams(ctx, params); err != nil {
 		return err