Fix: Address info-level security findings

Author: lovable-dev[bot]

src/contexts/AuthContext.tsx

@@ -23,6 +23,7 @@ interface Profile {
   approval_status?: string;
   approved_by?: string;
   approved_at?: string;
+  is_core_team?: boolean;
 }
 
 interface AuthContextType {
@@ -324,19 +325,8 @@ export const AuthProvider: React.FC<{ children: React.ReactNode }> = ({ children
 
           const userProfile = await fetchProfile(session.user.id);
 
-          // Team members are auto-approved
-          const teamEmails = [
-            'matteo.maspero@dlinrt.eu',
-            'mustafa.kadhim@dlinrt.eu',
-            'ana.barragan@dlinrt.eu',
-            'paul.doolan@dlinrt.eu',
-            'federico.mastroleo@dlinrt.eu',
-            'viktor.rogowski@dlinrt.eu'
-          ];
-          const isTeamMember = teamEmails.includes(session.user.email?.toLowerCase() || '');
-          
-          // Check approval status - but don't block team members or admins
-          if (userProfile?.approval_status === 'pending' && !isTeamMember) {
+          // Check approval status - but don't block core team members or admins
+          if (userProfile?.approval_status === 'pending' && !userProfile?.is_core_team) {
             const { data: adminRole } = await supabase
               .from('user_roles')
               .select('role')

src/integrations/supabase/types.ts

@@ -526,6 +526,7 @@ export type Database = {
           first_name: string
           id: string
           institution: string | null
+          is_core_team: boolean | null
           last_name: string
           linkedin_url: string | null
           mfa_backup_codes_generated_at: string | null
@@ -545,6 +546,7 @@ export type Database = {
           first_name: string
           id: string
           institution?: string | null
+          is_core_team?: boolean | null
           last_name: string
           linkedin_url?: string | null
           mfa_backup_codes_generated_at?: string | null
@@ -564,6 +566,7 @@ export type Database = {
           first_name?: string
           id?: string
           institution?: string | null
+          is_core_team?: boolean | null
           last_name?: string
           linkedin_url?: string | null
           mfa_backup_codes_generated_at?: string | null

supabase/migrations/20251101230446_5a5db119-f359-4ad0-b7b6-e7739999e860.sql

@@ -0,0 +1,19 @@
+-- Add is_core_team column to profiles table
+ALTER TABLE public.profiles 
+ADD COLUMN is_core_team BOOLEAN DEFAULT false;
+
+-- Set existing core team members
+UPDATE public.profiles
+SET is_core_team = true
+WHERE email IN (
+  'matteo.maspero@dlinrt.eu',
+  'mustafa.kadhim@dlinrt.eu',
+  'ana.barragan@dlinrt.eu',
+  'paul.doolan@dlinrt.eu',
+  'federico.mastroleo@dlinrt.eu',
+  'viktor.rogowski@dlinrt.eu',
+  'info@dlinrt.eu'
+);
+
+-- Add comment for documentation
+COMMENT ON COLUMN public.profiles.is_core_team IS 'Core team members bypass account approval checks';