Panic error in middleware when using Send SMS Hook

[Imperacltd]

1. full panic stack trace. below
2. both HTTP and PostgreSQL hooks cause the same panic

"{"component":"api","error":"500: Internal Server Error","level":"error","method":"POST","msg":"500: Internal Server Error","panic":"interface conversion: interface {} is nil, not string","path":"/signup","referer":"https://preview--agro-naija-ask.lovable.app/\",\"remote_addr\":\"81.221.149.106\",\"request_id\":\"9a45420c471a8bbd-ZRH\",\"stack\":\"goroutine 75 [running]:\nruntime/debug.Stack()\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/runtime/debug/stack.go:26 +0x64\ngithub.com/supabase/auth/internal/api.recoverer.func1.1()\n\t/home/runner/work/auth/auth/internal/api/errors.go:49 +0x60\npanic({0xcc3c40?, 0x4000575e00?})\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/runtime/panic.go:791 +0x124\ngithub.com/supabase/auth/internal/api.NewAPIWithVersion.timeoutMiddleware.func5.1({0xffff42f11fa0, 0x400035a300}, 0x4000304780)\n\t/home/runner/work/auth/auth/internal/api/middleware.go:431 +0x2cc\nnet/http.HandlerFunc.ServeHTTP(0x40004ec0e0?, {0xffff42f11fa0?, 0x400035a300?}, 0x10ef1c0?)\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/net/http/server.go:2220 +0x38\ngithub.com/supabase/auth/internal/api.recoverer.func1({0xffff42f11fa0?, 0x400035a300?}, 0x40004ec0e0?)\n\t/home/runner/work/auth/auth/internal/api/errors.go:62 +0x70\nnet/http.HandlerFunc.ServeHTTP(0x4000304780?, {0xffff42f11fa0?, 0x400035a300?}, 0x932dcc?)\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/net/http/server.go:2220 +0x38\ngithub.com/sebest/xff.(*XFF).Handler-fm.(*XFF).Handler.func1({0xffff42f11fa0, 0x400035a300}, 0x4000304780)\n\t/home/runner/go/pkg/mod/github.com/sebest/xff@v0.0.0-20160910043805-6c115e0ffa35/xff.go:128 +0x94\nnet/http.HandlerFunc.ServeHTTP(0x19b2300?, {0xffff42f11fa0?, 0x400035a300?}, 0x30?)\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/net/http/server.go:2220 +0x38\ngithub.com/go-chi/chi/v5/middleware.RequestLogger.func1.1({0x11042c0, 0x40001909a0}, 0x4000304640)\n\t/home/runner/go/pkg/mod/github.com/go-chi/chi/v5@v5.0.12/middleware/logger.go:55 +0x118\nnet/http.HandlerFunc.ServeHTTP(0x10f8bc0?, {0x11042c0?, 0x40001909a0?}, 0x3b7abc?)\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/net/http/server.go:2220 +0x38\ngithub.com/supabase/auth/internal/api.NewAPIWithVersion.NewStructuredLogger.func3.1({0x11042c0, 0x40001909a0}, 0x4000304640)\n\t/home/runner/work/auth/auth/internal/observability/request-logger.go:37 +0x124\nnet/http.HandlerFunc.ServeHTTP(0x4000304500?, {0x11042c0?, 0x40001909a0?}, 0xba6b2a934aaa0988?)\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/net/http/server.go:2220 +0x38\ngithub.com/supabase/auth/internal/api.NewAPIWithVersion.AddRequestID.func4.1({0x11042c0, 0x40001909a0}, 0x4000304500)\n\t/home/runner/work/auth/auth/internal/observability/request-logger.go:25 +0xd4\nnet/http.HandlerFunc.ServeHTTP(0x1108750?, {0x11042c0?, 0x40001909a0?}, 0x19abc40?)\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/net/http/server.go:2220 +0x38\ngithub.com/go-chi/chi/v5.(*Mux).ServeHTTP(0x400040b7a0, {0x11042c0, 0x40001909a0}, 0x4000304000)\n\t/home/runner/go/pkg/mod/github.com/go-chi/chi/v5@v5.0.12/mux.go:90 +0x280\ngithub.com/supabase/auth/internal/api.(*router).ServeHTTP(0x40003016c0?, {0x11042c0?, 0x40001909a0?}, 0x4000304000?)\n\t/home/runner/work/auth/auth/internal/api/router.go:55 +0x30\ngithub.com/supabase/auth/internal/api.NewAPIWithVersion.(*Cors).Handler.func9({0x11042c0, 0x40001909a0}, 0x4000304000)\n\t/home/runner/go/pkg/mod/github.com/rs/cors@v1.11.0/cors.go:289 +0x19c\nnet/http.HandlerFunc.ServeHTTP(0x4000363b28?, {0x11042c0?, 0x40001909a0?}, 0xffff89cb9108?)\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/net/http/server.go:2220 +0x38\ngithub.com/supabase/auth/internal/api.(*API).ServeHTTP(0x400035a1ec?, {0x11042c0?, 0x40001909a0?}, 0x3c67a8?)\n\t/home/runner/work/auth/auth/internal/api/api.go:415 +0x30\ngithub.com/supabase/auth/internal/reloader.(*AtomicHandler).ServeHTTP(0x10?, {0x11042c0?, 0x40001909a0?}, 0x40001909a0?)\n\t/home/runner/work/auth/auth/internal/reloader/handler.go:41 +0x80\nnet/http.serverHandler.ServeHTTP({0x11000c0?}, {0x11042c0?, 0x40001909a0?}, 0x6?)\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/net/http/server.go:3210 +0xbc\nnet/http.(*conn).serve(0x40004fc090, {0x1108718, 0x40003225a0})\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/net/http/server.go:2092 +0x4fc\ncreated by net/http.(*Server).Serve in goroutine 1\n\t/opt/hostedtoolcache/go/1.23.7/x64/src/net/http/server.go:3360 +0x3dc\n","time":"2025-11-26T00:27:05Z"}"

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Go to '…'
2. Click on '…'
3. Scroll down to '…'
4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

• OS: [e.g. macOS, Windows]
• Browser (if applies) [e.g. chrome, safari]
• Version of supabase-js: [e.g. 6.0.2]
• Version of Node.js: [e.g. 10.10.0]

Additional context

Add any other context about the problem here.

[sahknee]

Panic reproduced on standard Twilio path (no Send SMS hook)

We've reproduced the same panic (interface conversion: interface {} is nil, not string) deterministically on Auth v2.193.0 (Supabase hosted platform) without any SMS hook enabled — broadening the known trigger surface.

Trigger Conditions

All of the following are required:

• Endpoint: POST /auth/v1/otp with create_user: true for a NEW user
• Phone shape: Valid E.164 format but unassignable (e.g., NANP 555 area code) that Twilio rejects with error 21211 ("The 'To' number is not a valid phone number")
• Current behavior: GoTrue panics and returns bare 500 {"code":500,"error_code":"unexpected_failure","msg":"Internal Server Error"} instead of the expected 422 sms_send_failed
• Reliability: Reproduced 3/3 with curl against production hosted project. The newly created user row rolls back each time (DB stays clean). Interestingly, the same bad number occasionally surfaces the clean 422 sms_send_failed path (observed once when a user row already existed from a previous attempt), suggesting the panic is specific to the fresh-user creation branch.

Stack Trace Excerpt

Click to expand

{"level":"error","msg":"request panicked","panic":"interface conversion: interface {} is nil, not string"}
goroutine 65047 [running]:
runtime/debug.Stack()
github.com/supabase/auth/internal/api.recoverer.func1.1()
        /home/runner/_work/auth/auth/internal/api/errors.go:52 +0x5c
panic({0xfb2600?, 0x40007d41b0?})
github.com/supabase/auth/internal/api.NewAPIWithVersion.timeoutMiddleware.func8.1(...)
        /home/runner/_work/auth/auth/internal/api/middleware.go:560 +0x29c
net/http.HandlerFunc.ServeHTTP(...)
github.com/supabase/auth/internal/api.NewAPIWithVersion.limitRequestBody.func7.1(...)
        /home/runner/_work/auth/auth/internal/api/middleware.go:530 +0xec

(The panic occurs at middleware.go:560 in timeoutWriter.finallyWrite(w). Auth logs show "status":0 for these requests.)

Minimal Repro

curl -s -X POST "https://<project-ref>.supabase.co/auth/v1/otp" \
  -H "apikey: <anon-key>" -H "Content-Type: application/json" \
  -d '{"phone":"+15550001111","create_user":true,"data":{"name":"Repro"}}'

# Expected: 422 sms_send_failed (Twilio error 21211)
# Actual: 500 {"code":500,"error_code":"unexpected_failure","msg":"Internal Server Error"}

Config: sms_provider=twilio, hook_send_sms_enabled=false, no captcha, sms_autoconfirm=false.

Impact

End users who mistype their phone number at signup receive a generic 500 instead of a meaningful "invalid phone number" error. This typically causes apps to map to "temporary problem, try again later" — our tester retried the same mistyped number for an hour. The works-then-fails intermittency (depending on user state) makes it particularly hard for downstream developers to diagnose.

---

We're happy to provide the project ref and request IDs privately if useful for investigation.

[suvvvv]

Root cause: NewIdentity in internal/models/identity.go does an unchecked identityData["email"].(string). On a phone signup the empty email claim is dropped via structs:"email,omitempty", so a user-supplied data.email that is null (or otherwise non-string) reaches identityData and panics with interface conversion: interface {} is nil, not string — during identity creation, before any SMS is sent, which is why it surfaces as a bare 500 on the phone/OTP path rather than a meaningful error.

Opened #2804 to guard the assertion (ignore a non-string email instead of asserting) with regression tests.