supabase / supabase / 42573921496

87%

push

github

feat(studio): show recovery code health in account security (#52355)

## Problem

Users can run out of recovery codes without a clear warning that they
have lost a backup way to sign in.

## Solution

Show a warning when codes are running low or used up, with Regenerate
beside the code count. When MFA is enabled but codes are missing,
explain how to generate them. Keep recovery codes hidden until MFA is
enabled.

Remove standalone code deletion. Users can regenerate codes while MFA is
enabled.

| Before | After |
| --- | --- |
| <img width="1024" height="682" alt="Security Account Supabase"
src="https://github.com/user-attachments/assets/1c7a4c52-00c9-4c31-8b3a-ef0599555a1a"
/> | <img width="1024" height="682" alt="81082"
src="https://github.com/user-attachments/assets/ae662802-4fab-4c93-a5cb-52ed39d16f87"
/> |
| _3/10 codes left._ | _3/10 codes left._ |
| <img width="1024" height="682" alt="21450"
src="https://github.com/user-attachments/assets/82049f44-2fca-4477-84bf-23ab009868be"
/> | <img width="1024" height="682" alt="Security Account Supabase"
src="https://github.com/user-attachments/assets/e2185026-af6a-42a5-bc10-b587e3d2d4ab"
/> |
| _0/10 codes left._ | _0/10 codes left._ |

## Review instructions

1. Open [Recovery
codes](https://studio-staging-git-dnywh-recovery-code-health-supabase.vercel.app/dashboard/account/security#recovery-codes)
with one authenticator and generated codes.
2. In DevTools, override GET `/factors/recovery-codes`: keep the other
fields, set `remaining` to `0`, save and reload. Check the warning.
Repeat with `3`, then restore the response.
3. With MFA off, check that the Recovery codes section is hidden.
Disable overrides before using Regenerate.

2070 of 2439 branches covered (84.87%)

Branch coverage included in aggregate %.

2863 of 3223 relevant lines covered (88.83%)

200.89 hits per line