## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
The Auth rate-limit table contains stale customization statuses and time
windows, omits SMS and Web3 limits, and describes the anonymous sign-in
burst incorrectly.
## What is the new behavior?
- Aligns documented limits with the current Auth, Studio, and Management
API behavior
- Documents SMS, Web3, and sign-up/sign-in request limits
- Corrects verification, token, MFA, email, and anonymous sign-in
details
- Updates shared rate-limit values and units used by the docs
## Additional context
Validation:
- Prettier check
- Focused MDX lint
- Shared-data TypeScript check
- All 16 SharedData references resolve
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Refined authentication rate limits with clearer per-minute and
per-five-minute windows.
* Added rate limits for SMS, password reset requests, and Web3 sign-ups
and sign-ins.
* Updated sign-in, sign-up, verification, token refresh, MFA, and
anonymous sign-in limits, including customizable settings where
supported.
* Clarified email-sending limits and OTP behavior.
* **Documentation**
* Updated rate-limit reference tables and guidance on request bucket
capacity and sustained traffic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
This PR adds support for configuring end-user IP address forwarding to
Supabase Auth, as well as docs explaining the feature.
## What is the current behavior?
These settings don't exist in Studio. Users that wish to enable IP
address forwarding must do so through the management API.
## What is the new behavior?
Users can enable IP address forwarding in Studio directly without
needing to use the management API.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an "IP Address Forwarding" toggle in Auth rate limit settings as
a separate section with its own Save/Cancel behavior.
* **Documentation**
* Added a guide detailing when/how to forward end-user IPs, how to
enable the setting, required key types, Management API examples, and an
SDK/SSR snippet.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Cemal Kılıç <cemalkilic@users.noreply.github.com>
This PR fixes some prettier issues:
- Bump and unify all prettier versions to 3.7.3 across teh whole repo
- Bump the SQL prettier plugin
- When running `test:prettier`, check `mdx` files also
- Run the new prettier format on all files
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Partials are currently defined via MDX includes. This PR switches to pre-compile-time partials, which have a new syntax:
```
<$Partial path="path/to/file.mdx" />
```
## Rationale
This produces two improvements:
1. Partial substitution can occur in pipelines that don't use MDX compilation. For example, we can now do partial substitution before building the search index, so partial content will also be indexed.
2. After the App Router migration, the MDXProviders should've been deprecated, but were kept around for the sole reason of making partials work, and leading to us shipping unnecessary client-side code. We get a minor decrease in overall client bundle size (5.74 MB to 5.6 MB) by getting rid of the Providers.
## Breaking changes
Besides the change to partial syntax, the arguments are also less powerful than before because we are doing string substitution and don't have the full power of JS. Defining string variables is still possible (documented in the Contributing guide), and since that's all we actually do in practice, this shouldn't be too cumbersome. There is always the escape hatch of making a custom component for more complex content reuse cases.
ŁUKASZ KORBASIEWICZ