config push sets external_email_enabled = false when [auth.email] enable_signup = false, disabling password sign-in for all users #7055

Summary

Running supabase config push against a remote project whose config.toml has [auth.email] enable_signup = false sets the project's external_email_enabled to false. Email/password sign-in then fails for every user with 422 email_provider_disabled, while the CLI reports the auth config as updated / up to date.

Version

Reproduced on CLI 2.109.1 (2026-07-17). The mapping is still on main at 753520f (2026-10-06): packages/config/src/project-config/registry-auth.ts:597, boolRow(["auth","email","enable_signup"], "external_email_enabled"). Latest release checked: v2.120.0.

Steps to reproduce

1. A remote project with the email provider enabled; email/password sign-in works.
2. supabase/config.toml contains:

   [auth]
   enable_signup = false
   
   [auth.email]
   enable_signup = false

   The intent is no public self-signup: accounts are created by admins through the Admin API.
3. supabase config push --project-ref <ref>
4. POST /auth/v1/token?grant_type=password with valid credentials.

Expected

[auth.email] enable_signup = false disables email signup only. Existing users can still sign in, and external_email_enabled stays true.

Actual

external_email_enabled flips true -> false (read back from GET /v1/projects/{ref}/config/auth). Sign-in returns 422 email_provider_disabled for everyone. The CLI prints no warning.

No workaround in config.toml

Adding enabled = true under [auth.email] is rejected ('auth.email' has invalid keys: enabled), and that parse error also breaks supabase db push. So a project that wants signup disabled cannot use config push at all.

Recovery

curl -X PATCH https://api.supabase.com/v1/projects/<ref>/config/auth \
  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" -H 'Content-Type: application/json' \
  -d '{"external_email_enabled": true}'

Related

• Bug: enable_signup=false disables entire email/phone provider instead of just signups supabase#40582 (open, no replies)
• fix(auth): decouple provider enabled from signup control #4469 (closed unmerged)

Suggested fix

Do not map [auth.email] enable_signup onto the provider toggle external_email_enabled, or accept [auth.email] enabled in the schema so the provider can be kept on explicitly.