Creating new users with "Auto Confirm User" selected overwrites raw_user_meta_data regardless of triggers

[rishiraj-58]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Supabase's "Add user" function in the "Authentication -> Users" tab overwrites any changes in the raw_user_meta_data column from "before insert" triggers, when the option "Auto Confirm User?" is selected.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Start from a clean database
2. Create the following trigger:

CREATE OR REPLACE FUNCTION public.poc_function()
RETURNS TRIGGER
LANGUAGE plpgsql
SECURITY DEFINER SET search_path = ''
AS $$
BEGIN
  new."raw_user_meta_data" := (coalesce(new."raw_user_meta_data", '{}')::jsonb || 
    jsonb_build_object('new_key', true));

  RETURN new;
END;
$$;

CREATE OR REPLACE TRIGGER on_auth_user_created
  BEFORE INSERT ON auth.users
  FOR EACH ROW
  EXECUTE FUNCTION public.poc_function();

4. Create a new user from the "Authentication -> Users" tab, with the option "Auto Confirm User?" checked.
5. Observe that this user only has the JSON {email_verified": true} in the raw_user_meta_data column.
6. Create another user from the "Authentication -> Users" tab, with the option "Auto Confirm User?" unchecked.
7. Observe that this user now has the JSON value {"new_key": true} in the raw_user_meta_data column

Expected behavior

Creating a user with the option "Auto Confirm User" with the trigger above should create a new user with the column raw_user_meta_data with the JSON value {email_verified": true, "new_key": true}.

[rishiraj-58]

I've successfully identified and fixed this issue!

Root Cause Found

The Confirm function in internal/models/user.go was overwriting user metadata instead of merging the email_verified: true flag with existing data.

Solution Implemented

• Reload user state from database to get latest metadata
• Merge email_verified: true with existing metadata
• Use existing UpdateUserMetaData function for proper updates

PR Created

Pull Request: #2089 - fix: preserve user metadata when email_confirm=true in Confirm function