mirror of
https://github.com/supabase/supabase.git
synced 2026-10-14 05:39:11 +03:00
chore/function-recent-errors
4673
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Alaister YoungandAlaister Young
|
f8cc6c21bd |
[FE-2075] feat(studio): bump graphiql to v5 and use prebuilt component (#45404)
Adds `graphiql@5.2.2` and switches from our heavily-customised rebuild (which used `@graphiql/react` + `@graphiql/toolkit` directly) to the prebuilt component, restyled to match the dashboard. Role impersonation re-added as a sidebar plugin. This is a deliberately simpler setup than what we had – we lose some layout customisation (sidebar is forced to the left, role impersonation moves into the sidebar) but future upgrades become much easier since we're no longer maintaining a fork-by-rewrite. **Removed:** - `apps/studio/components/interfaces/GraphQL/GraphiQL.tsx` – custom rebuild - `apps/studio/components/interfaces/GraphQL/graphiql.module.css` – custom styles **Changed:** - Added `graphiql` ^5.2.2 (we previously didn't have the top-level package, just the subpackages) - `@graphiql/react` ^0.19.4 → ^0.37.3 (now Monaco-based; v0.19 was still on CodeMirror 5) - `@graphiql/toolkit` ^0.9.1 → ^0.11.3 - `GraphiQLTab.tsx` now wires up the prebuilt `<GraphiQL />` with worker setup, theme bridge, and plugins - New `graphiql.module.css` scopes restyling via `:global(...)` since we can't add hashed classes to the library's DOM - `RoleImpersonationSelector` gained an `orientation: 'horizontal' | 'vertical'` prop (default `horizontal`) so it fits in the sidebar pane – all existing call sites unchanged - `MonacoThemeProvider` exports `getTheme` so the GraphQL Monaco instance can reuse Studio's theme **Added:** - Theme bridge: `supabase-graphql-dark` / `supabase-graphql-light` Monaco themes synced with `next-themes` via `forcedTheme` - Role impersonation sidebar plugin (gated on `field.jwt_secret` read permission, same as before) ### Notes / tradeoffs - We don't share Studio's monaco instance – Studio loads it via AMD/CDN, GraphiQL bundles it as ESM. Both end up on `monaco-editor@0.52.2` but in different module systems. Sharing would require ripping out Studio's CDN loader (Studio-wide refactor, out of scope). GraphiQL's monaco is dynamically imported and only loads when the GraphQL tab opens. - The dark/light response panel uses different `--graphiql-response-bg` tokens because the editor sits at very different baseline lightness in each theme; a single token can't lift it meaningfully in both directions. - Session header (tabs row) is hidden – we don't expose multi-tab workflows. ## To test - Open `/project/<ref>/api/graphiql` in both light and dark themes – editor + response panel backgrounds, sidebar borders, button radii should all match the dashboard - Run a query and confirm syntax highlighting works (GraphQL-specific token `argument.identifier.gql` is purple) - Open the doc explorer and history sidebar plugins - As a user with `field.jwt_secret` read permission: open the Role Impersonation sidebar plugin, pick a role, confirm subsequent queries hit the API with the impersonated JWT - As a user without that permission: confirm the Role Impersonation plugin doesn't appear, history still does - Toggle theme while GraphiQL is open – Monaco theme should swap without a reload <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Vertical layout option for the role impersonation selector; radios can expand to full width. * **Improvements** * Revamped GraphiQL integration with updated upstream package, plugins, and editor theming for improved consistency and UX. * New GraphiQL styling and layout for clearer pane separation and polished controls. * Role selector radios now support a full-width mode for improved responsiveness. * **Chores** * Updated GraphiQL-related dependencies. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Joshen Lim
|
50eea124e7 |
Small tweaks to feature preview badge (#45409)
## Context Small improvements from this PR: https://github.com/supabase/supabase/pull/45373 - Fix feature preview badge alignment - Before: <img width="341" height="75" alt="image" src="https://github.com/user-attachments/assets/e6e2f727-fc75-4f70-b9cd-94d67aed8c5d" /> - After: <img width="365" height="64" alt="image" src="https://github.com/user-attachments/assets/3d6e5e5d-c285-48f4-8f8f-251c23101e41" /> - Shift feature preview badge for policies into tester side panel <img width="640" height="93" alt="image" src="https://github.com/user-attachments/assets/3efb73a7-f7f5-4ae0-8560-d1e0ba989626" /> - Realised that advisor settings wasn't set up to be behind the feature preview - Fixing that in this PR <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added preview badge indicator to the RLS Tester feature * **Style** * Improved spacing and layout alignment across authentication, database access, webhook, logging, and advisor interface components * Enhanced badge component styling for better vertical alignment <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Samir Ketema
|
d666b950ff |
feat: update audit log schema & UI (#45389)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? - Update to the audit log schema (changes were already applied in staging) - Updates the org & project audit log page to reflect the changes to the schema - The schema should be agnostic to whether logs were emitted to logflare with the old & new schema format - the backend adjusts old logs to the new format. ## What is the current behavior? Currently, the frontend is parsing the legacy schema as the backend returns this by default. It also doesn't show some of these new fields yet. ## What is the new behavior? ### Org Audit Logs - Table View <img width="1810" height="1310" alt="CleanShot 2026-04-29 at 18 27 22" src="https://github.com/user-attachments/assets/47fec068-1ffa-4e52-bc46-3bffdef55adb" /> ### Org Audit Logs - Single log View <img width="1842" height="1494" alt="CleanShot 2026-04-29 at 18 27 37" src="https://github.com/user-attachments/assets/3cff3bdf-4a6a-4981-acaa-7f95bb3ae9cf" /> Note that the `Target` field is no longer there. We just show the `metadata` JSON. <img width="1842" height="1494" alt="CleanShot 2026-04-29 at 18 27 40" src="https://github.com/user-attachments/assets/d2e681f0-41a6-4bc7-a3d7-ec7e8101616c" /> ### Account (Profile) Audit Logs - Table View <img width="1810" height="1310" alt="CleanShot 2026-04-29 at 18 25 20" src="https://github.com/user-attachments/assets/c72e19df-9b82-4611-8889-7af463769550" /> ### Account (Profile) Audit Logs - Single log View <img width="1810" height="1310" alt="CleanShot 2026-04-29 at 18 25 32" src="https://github.com/user-attachments/assets/46f8d3b6-4f2f-4944-b891-431a93e5f3c3" /> ## Additional context ⚠️ currently leaving the `do not merge` tag on, until: - [x] I have verified it works in staging - [x] We've deployed the new schema to production <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Audit logs now use the v2 format with microsecond-accurate timestamps, improved ordering, and a revamped details panel showing clearer actor/action/request/project/org fields and fallback labels. * Page/header layout updated so audit logs render at top level with adjusted spacing. * **Refactor** * Shared sorting and filtering utilities added for consistent user/project filtering and non-mutating log sorting. * **Tests** * Added tests for timestamp conversion, sorting, filtering, and date-range formatting. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ignacio DobronichandJoshen Lim
|
cf9d88700d |
fix: top-up loading state and show plan item on downgrade (#45430)
## Summary - **Subscription downgrade dialog**: The plan name row was being hidden in the charge breakdown when `changeType === 'downgrade'`, so users downgrading (e.g. Team → Pro) couldn't see which plan the cost referred to. Removed the downgrade exclusion so the plan name row renders consistently across upgrade/downgrade flows. - **Credit Top Up dialog**: The submit button only reflected `executingTopUp`/`paymentConfirmationLoading`, but the `onSubmit` handler runs several async steps first (hCaptcha, billing profile validation, Stripe `createPaymentMethod`) before the mutation flips `isPending`. That left a clickable window where users could trigger multiple top-ups. Added `form.formState.isSubmitting` to both `loading` and `disabled` so the button is locked for the full submit lifecycle. ## Test plan - [ ] Downgrade from Team → Pro and confirm the Pro plan row appears in the charge breakdown - [ ] Open Credit Top Up, submit, and rapidly click the Top Up button — verify only one charge is initiated - [ ] Verify Top Up button shows a loading state immediately on click (before the mutation starts) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Consistently show subscription plan cost during billing adjustments, including downgrades. * Improve Top Up button to reflect form submission state and prevent duplicate submissions. * **Style** * Enhanced text contrast for better readability in billing information displays. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Ivan Vasilov
|
bc8724c46e |
fix: Don't include fonts when rendering the svg in Schema visualizer (#45425)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved rendering and visual consistency of exported database schema images by refining font handling during SVG and PNG export processes. Schema diagrams now display with better visual fidelity when exported. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
87e8c59405 |
Add view data as user in auth users + refactor UI for role impersonation (#45358)
## Context As part of RLS testing, adding @awaseem's idea for having "View data as user" CTAs in the Auth Users's table <img width="348" height="190" alt="image" src="https://github.com/user-attachments/assets/855c8f54-0aba-478c-982b-1d9d29e419bd" /> ## Other changes Similar from @awaseem's suggestions, am also refactoring the Role Impersonation UI a little, mainly from a copy writing POV to improve the clarity of the UI. - More action-oriented and contextual header for the role impersonation popover - e.g Table Editor -> "View data as a role", or SQL Editor -> "Run SQL query as a role" - Updated labels to be bit more intuitive from a builder's POV - The actual database role is still mentioned in the option's description (so we aren't obfuscating the actual postgres logic) - Add label descriptors to elaborate what each role implies - e.g Anon -> "Not logged in" - Add docs button which points to [here](https://supabase.com/docs/guides/database/postgres/row-level-security#authenticated-and-unauthenticated-roles) that explains which roles Supabase uses - (Nit) Refactor to use Card component ### Before <img width="647" height="277" alt="image" src="https://github.com/user-attachments/assets/9ebae084-38b7-4e21-886b-f609bd71976e" /> ### After <img width="604" height="309" alt="image" src="https://github.com/user-attachments/assets/4d797309-1b6b-4fd0-aab3-63d5e144c53c" /> <img width="630" height="297" alt="image" src="https://github.com/user-attachments/assets/ca748635-c5da-4426-a9c3-8cb5aeef47a6" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added "View data as user" and "Run SQL as user" actions to user rows to impersonate a user and jump to table or SQL views. * Impersonation now surfaces an identity card in new tabs showing the impersonated identity and a Stop button. * **UI/UX Improvements** * Impersonation panels accept customizable headers, show clearer role labels (Postgres), richer role descriptions, condensed RLS copy, in-panel docs link, simplified "Stop" labels, and adjusted typography/padding for consistent styling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Kanishk Dudeja
|
e311b70387 |
chore(billing): disable tax ID banner (#45405)
This PR disables the tax ID banner. I haven't removed the code just in case we need to reintroduce it later. Will follow up with removing the code entirely or introducing a feature flag if we decide to keep it. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Disabled the tax identification banner display in the application interface. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan Vasilov
|
4c0d8cac4a |
fix: Fix the input group in database settings. (#45423)
The input groups in Database settings were rendered badly due to the Tailwind v4 bump. Before: <img width="767" height="585" alt="Screenshot 2026-04-30 at 16 59 55" src="https://github.com/user-attachments/assets/b55715b4-fdf2-4338-a10d-8c31138c49bc" /> After: |
||
|
Ali WaseemandJoshen Lim
|
2f5f6ffa79 |
chore: help users navigate graphql lints for anon and authenticated roles (#45295)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix, feature, docs update, ... - Hide lints when exposed within local storage - Revoke on roles <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a GraphQL-exposure action in linter items that shows a confirmation modal with the exact SQL, lets you revoke GraphQL access, executes the operation, shows success/error toasts, and refreshes lint results. * Added an informational callout linking to database integration settings when GraphQL exposure is detected. * Lint actions now close the side panel and return the UI to the list after completion. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Ali WaseemandJoshen Lim
|
9cd688528f |
feat(studio): change SQL editor assistant shortcut to Cmd+Shift+K (#45380)
## Summary Closes [FE-3109](https://linear.app/supabase/issue/FE-3109/change-sql-editor-assistant-shortcut-to-cmdshiftk). The SQL editor's "Generate SQL" Monaco action was bound to `Cmd+K`, which conflicted with the global command menu shortcut while the editor was focused. This PR moves the assistant shortcut to `Cmd+Shift+K` and makes `Cmd+K` open the global command menu from inside the editor. ## Changes - `MonacoEditor.tsx` — rebind `generate-sql` to `Cmd+Shift+K`. Add an `editor.addCommand` for `Cmd+K` that opens the global command menu (gated on the user's `COMMAND_MENU_OPEN` shortcut preference). Without this, Monaco swallows `Cmd+K` as a chord prefix and the global hotkey never fires inside the editor. - `SQLEditor.tsx` — update the empty-editor placeholder text from `CMD+K` to `CMD+SHIFT+K`. ## Notes - Monaco's standalone defaults bind `Cmd+Shift+K` to "Delete Line"; registering an `editor.addAction` with the same keybinding overrides it. - The same `Cmd+K` binding still exists in `apps/studio/components/ui/AIEditor/index.tsx` (used by the inline editor panel and edge functions). Out of scope for FE-3109 — happy to file a follow-up. ## Test plan - [x] Focus the SQL editor, press `Cmd+K` → global command menu opens. - [x] Focus the SQL editor, press `Cmd+Shift+K` → Generate SQL widget opens (or "Make an edit" if a diff is already visible). - [x] Disable the command menu shortcut in Account → Preferences → Keyboard shortcuts and confirm `Cmd+K` no longer opens the menu from inside the editor. - [x] Empty SQL snippet placeholder reads "Hit CMD+SHIFT+K to generate query…". <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Reorganized SQL editor keyboard shortcuts for clearer access * "Generate SQL" shortcut changed to Ctrl/Cmd + Shift + K (was Ctrl/Cmd + K) * Command menu can now be opened with Ctrl/Cmd + K when enabled * Editor UI shortcut hints updated to reflect the new bindings <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Ivan Vasilov
|
13df106d89 |
chore: Fix the Auth hook card CSS (#45415)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Refined layout styling in the authentication hook interface to optimize flex container behavior for improved responsiveness and visual alignment. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan VasilovandJordi Enric
|
56de26fe22 |
chore: Migrate the monorepo to use Tailwind v4 (#45318)
This PR migrates the whole monorepo to use Tailwind v4: - Removed `@tailwindcss/container-queries` plugin since it's included by default in v4, - Bump all instances of Tailwind to v4. Made minimal changes to the shared config to remove non-supported features (`alpha` mentions), - Migrate all apps to be compatible with v4 configs, - Fix the `typography.css` import in 3 apps, - Add missing rules which were included by default in v3, - Run `pnpm dlx @tailwindcss/upgrade` on all apps, which renames a lot of classes - Rename all misnamed classes according to https://tailwindcss.com/docs/upgrade-guide#renamed-utilities in all apps. --------- Co-authored-by: Jordi Enric <jordi.err@gmail.com> |
||
|
Gildas GarciaandJoshen Lim
|
f4abe3fca7 |
chore: migrate MultiSelectDeprecated to Shadcn multi-select (#45377)
## Problem We want to reduce the code we ship and maintain. ## Solution - Migrate old `MultiSelectDeprecated` usage to the new Shadcn `multi-select` - Fix `multi-select` background color to align it with other inputs - Fix `multi-select` popover content alignment (now align to its input start) ## Screenshots ### RLS policies Before: <img width="618" height="705" alt="image" src="https://github.com/user-attachments/assets/098504fc-21a9-4386-9390-e69f929189c1" /> After: <img width="549" height="704" alt="image" src="https://github.com/user-attachments/assets/06842e31-90bf-4d24-8c19-78f74941cd65" /> ### Storage policies Before: <img width="1177" height="664" alt="image" src="https://github.com/user-attachments/assets/3cf1afb4-9604-4ee9-b7b6-8371f94bcfcc" /> After: <img width="1170" height="653" alt="image" src="https://github.com/user-attachments/assets/e3b235d3-5890-45ff-9658-82c6612ac82a" /> ### Database indexes Before: <img width="675" height="496" alt="image" src="https://github.com/user-attachments/assets/84c0d3b6-45af-49dc-b4f4-274abed4cea7" /> After: <img width="674" height="498" alt="image" src="https://github.com/user-attachments/assets/697ceafc-256f-4106-9193-8697bc3d9d8e" /> ### Contact support Before: <img width="643" height="534" alt="image" src="https://github.com/user-attachments/assets/ee7fc790-622d-4c09-afab-269271a31af4" /> After: <img width="645" height="457" alt="image" src="https://github.com/user-attachments/assets/db0b9a32-95e0-4864-a12a-88828c431aab" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Replaced legacy multi-select controls with a unified selector UI: dynamic trigger labels, per-item disable support, explicit item rendering, deletable badges, and improved search/selection behavior. * **Chores** * Removed deprecated multi-select badge and legacy picker implementations; adjusted exports/types to align with the new selector components. * **Style** * Minor UI text and inline code styling improvements and modal spacing tweaks. * **Tests** * Updated end-to-end flows to wait and interact with the new pickers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Saxon Fletcher
|
3ef1c1e08c | Add recommendation on schema isolation (#45390) | ||
|
Danny White
|
5dee242aa3 |
chore(studio): remove project usage settings callout (#45393)
## What kind of change does this PR introduce? Dashboard cleanup and docs update. ## What is the current behaviour? Project Settings > General still shows a legacy "Project usage" section explaining that usage statistics moved to organisation settings. One troubleshooting page also links to the old project billing usage page. ## What is the new behaviour? The legacy Project Settings usage callout is removed, while the existing old usage route redirect remains in place for stale links. The MAU troubleshooting page now points users to the organisation usage page and tells them to select a specific project from the dropdown. | Before | After | | --- | --- | | <img width="1450" height="1314" alt="CleanShot 2026-04-30 at 16 11 16@2x" src="https://github.com/user-attachments/assets/3ad8c41f-2eab-406c-bfd8-f5737ae9a5a3" /> | <img width="1474" height="1004" alt="CleanShot 2026-04-30 at 16 11 04@2x-7CACB175-B6A9-4811-968F-030745F685AE" src="https://github.com/user-attachments/assets/f541ee60-0c24-49e4-9446-3bd58c516797" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated Monthly Active Users (MAU) documentation to reflect accessing usage data from the organization-level page instead of project settings * **Refactor** * Removed project-level usage viewing option from project settings interface <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
a34c299344 |
chore(studio): clarify pause project flow (#45392)
## What kind of change does this PR introduce? Minor UI and copywriting change. ## What is the current behavior? - Vague dialog copy for pausing a project - Plain pause icon looks like two Tim Tams ## What is the new behavior? - Clearer dialog copy - More standard pause button ## Additional context | Before | After | | --- | --- | | <img width="912" height="502" alt="11317" src="https://github.com/user-attachments/assets/55a64d01-8171-498e-a03f-2e0060995400" /> | <img width="850" height="476" alt="67001" src="https://github.com/user-attachments/assets/054a8ca0-e06c-417c-9668-c3847013bbe2" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced pause project confirmation dialog to clearly communicate the 90-day resume timeframe and backup availability after this period. * **Style** * Updated pause icon display. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Coenen Benjamin
|
151a1792d9 | feat(studio): add support for new ducklake destination in replication UI (#45370) | ||
|
Monica Khoury
|
49ff97af06 |
feat: add global feature preview badge for enabled preview features (#45373)
## What kind of change does this PR introduce? Fixes FE-2526. Adds a global Feature Preview badge to pages enabled via Feature Previews, improving visibility and making it clearer to users that the feature can be managed (or disabled) from the Feature Previews settings. ## Why Previously, once a feature preview was enabled, there was no clear indication within the UI that: - the feature was still in preview, or - where to go to disable it This lead to confusion and made the feature feel “permanent”. ## What’s included New FeaturePreviewBadge UI component <img width="417" height="80" alt="CleanShot 2026-04-29 at 17 20 10" src="https://github.com/user-attachments/assets/6fbc96e3-35ef-46d1-893a-2188c4d237a3" /> </br> Added badge across pages enabled via Feature Previews: - Webhooks - Unified Logs - JIT DB Access - Column Privileges - Policies - Merge page - Advisor Rules Consistent placement and styling. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Feature preview badges now appear across the platform on preview features, including Platform Webhooks, Database functionality, Unified Logs, Advisor Rules, and other features, providing quick identification and access to manage preview settings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas GarciaandJoshen Lim
|
a5b36d91de |
chore: migrate <Toggle> to <Switch> (#45314)
## Screenshots ### Row editor Before: <img width="683" height="74" alt="image" src="https://github.com/user-attachments/assets/0416859b-e471-4f11-be28-33e1e0e03415" /> After: <img width="675" height="65" alt="image" src="https://github.com/user-attachments/assets/57ff796e-a67d-42f5-9fe0-f7be831aabc6" /> ### Studio lite Before: <img width="673" height="400" alt="image" src="https://github.com/user-attachments/assets/51ff1cd3-3cc5-4aa2-befb-4f345a933186" /> After: <img width="644" height="402" alt="image" src="https://github.com/user-attachments/assets/4605ad0b-656f-4da2-86d7-8ec32dc54855" /> ### Database function Before: <img width="745" height="949" alt="image" src="https://github.com/user-attachments/assets/49fba21d-0d28-4037-beb7-9ecb13f12fe7" /> After: <img width="746" height="949" alt="image" src="https://github.com/user-attachments/assets/d6755b04-df97-4195-b473-98a0269923d9" /> ### Privacy settings (`www`) Before: <img width="1122" height="808" alt="image" src="https://github.com/user-attachments/assets/02f82691-f045-4d59-b5a4-1ce635e3d9af" /> After: <img width="1110" height="768" alt="image" src="https://github.com/user-attachments/assets/ef2ee049-4cbe-4209-851a-2f024ab0063b" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Replaced legacy toggle controls across the app with a unified Switch component for consistent interaction. * Improved labels, sizes, spacing and aria relationships for clearer UI, better accessibility, and more predictable behavior (settings, filters, editors, realtime controls, privacy modal). * Removed the old Toggle implementation, styles, and top-level exports from the UI package to standardize controls. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Ali WaseemandDanny White
|
fa8f49b261 |
feat(studio): add keyboard shortcuts to the SQL editor (#45335)
## Summary Adds the first batch of keyboard shortcuts for the SQL editor, following the registry pattern established for the table editor. ## Shortcuts | Shortcut | Action | Notes | | --- | --- | --- | | `Esc` | Blur the SQL editor | Registered as a Monaco command with a context-key precondition so inline widgets keep owning `Esc` (suggest, find, parameter hints, snippet/rename mode, accessibility help, inline suggestions, and selection cancellation). | | `Shift+E` | Focus the SQL editor | Pairs with `Esc` for mouse-free round-trip. | | `Alt+Shift+F` | Prettify SQL | Now wired through the registry; the tooltip and dropdown badge in `UtilityActions` read the keybind from the same source of truth. Works from inside the editor (Monaco action) and from anywhere on the page (`useShortcut`). | | `Mod+Shift+Enter` | Run EXPLAIN ANALYZE | Routes results into the Explain tab. Surfaces in the Monaco context menu next to "Run Query". | | `Shift+N` | Open a new SQL snippet | Navigates to `/sql/new?skip=true` to avoid the redirect-to-last-visited effect that fires on plain `/sql/new`. | All entries appear in the command menu (`Mod+P`) under "Shortcuts" while their host components are mounted. None are surfaced in Account → Preferences → Keyboard shortcuts yet (`showInSettings: false`), matching how the table editor shortcuts shipped. ## Notes - The blur shortcut intentionally lives on the Monaco instance rather than the document-level hotkey listener — the document listener can't preempt Monaco's own `Esc` handling. Other shortcuts that need to fire while the editor has focus (run, save, format, explain) are registered as Monaco actions; everything else uses `useShortcut`. - Format and explain are double-registered (Monaco action + `useShortcut`) so they fire whether the editor is focused or not. The Monaco actions don't read the user's enable/disable preference yet — same asymmetry as the existing run/save actions. - `Shift+N` is scoped to the SQL editor route. To make it work globally we'd register it at a higher layout level. ## Test plan - [x] Inside editor: `Esc` blurs; suggest/find/parameter hints still close on `Esc`; multi-cursor selection collapses on first `Esc`, blurs on second. - [x] Outside editor: `Shift+E` returns focus to the editor. - [x] `Alt+Shift+F` formats from inside and outside the editor; tooltip + dropdown badge show the correct keybind. - [x] `Mod+Shift+Enter` runs EXPLAIN ANALYZE and switches to the Explain tab. - [x] `Shift+N` opens a fresh snippet without bouncing back to the previous one. - [x] All five shortcuts appear in `Mod+P` with the right badges. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Keyboard shortcuts for SQL editor: format SQL, run EXPLAIN ANALYZE, focus/blur editor, and open a new SQL snippet. * Added "Prettify SQL" and "Run EXPLAIN ANALYZE" actions to the editor context menu with shortcuts. * Centralized registration of SQL editor shortcuts so they appear across the app. * **UX Improvements** * Escape key blurs editor focus when appropriate to allow easy exit without disrupting editor widgets. * **Style** * Adjusted success toast capitalization for copied Markdown. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> |
||
|
|
45ffa97240 |
[FE-3096] feat(studio): split edge function secrets into custom and default sections (#45355)
Splits the Edge Function secrets page into two sections so reserved Supabase env vars are always visible, even on new projects without any user secrets created. <img width="1605" height="1006" alt="Screenshot 2026-04-29 at 12 20 43 PM" src="https://github.com/user-attachments/assets/fc74f10e-557d-45bb-b0f0-66a706a9facb" /> **Added:** - `DefaultEdgeFunctionSecrets` component — a read-only reference list (Name + Description) of every `SUPABASE_*`, `SB_*`, and `DENO_*` env var available in every project, sourced from [the docs](https://supabase.com/docs/guides/functions/secrets#default-secrets) - `isInternalEdgeFunctionSecret` helper used to filter the custom secrets table **Changed:** - The custom secrets section now renders first (more actionable), with the educational default secrets section below it - Custom secrets table now filters out anything matching `SUPABASE_*` or any of the hardcoded default names **Removed:** - `isReservedSecret` regex check + its tooltip branches in `EdgeFunctionSecret.tsx` — dead code now that the custom table never receives an internal secret Addresses [FE-3096](https://linear.app/supabase/issue/FE-3096/split-edge-function-secrets-into-internal-and-user-defined-views). ## To test - Open `/project/_/functions/secrets` on a fresh project (no custom secrets) - "Default secrets" section is visible and lists all 9 env vars with descriptions - "Custom secrets" section shows the empty state - Create a custom secret — appears in the Custom section, not the Default section - Edit/delete dropdown still works on custom secrets - Search input only filters the custom secrets table <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a "Default secrets" section showing built-in edge-function secrets with names, descriptions, and a "Deprecated" badge where applicable. * Secret names are clickable to copy to clipboard with a success notification; secret names/values use inline code styling. * UI now separates "Custom secrets" and "Default secrets" with distinct empty states. * **Bug Fixes** * Edit/Delete controls reflect actual permission state (no longer disabled for default/reserved secrets). * **Tests** * Added tests for default-secret detection and visibility rules. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Danny White
|
05fc4aca13 |
chore(studio): clean up temporary access response typing (#45354)
## What kind of change does this PR introduce? Cleanup. ## What is the current behavior? Temporary access still has a couple of leftover JIT fallback messages and an unnecessary local unavailable-reason type after the Platform response types were split into `JitAccessResponse` and `JitStateResponse`. ## What is the new behavior? Studio relies on the generated `JitStateResponse` discriminated union for the toggle warning and uses temporary access copy consistently in the remaining fallback toasts. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Refined error messaging for temporary database access grant and revoke operations. * Enhanced condition detection for toggle failure warnings in database access configuration. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Saxon FletcherandJoshen Lim
|
3b756e4d9f |
Chore/project secure (#45108)
<img width="2652" height="830" alt="image" src="https://github.com/user-attachments/assets/3c3921e7-c255-4e59-a9c3-c5f97da87788" /> Adds a full screen alert behind a feature flag `projectNeedsSecuring` that prompts for fixing RLS issues. Adjusts a few other small styles to add more prominence to critical advisor issues. To test: - Enable the flag - Make sure you have a table with RLS disabled - Open project home and note the fade in of full page review - Click "copy prompt" or "fix" and note the prompt - Click skip to home and refresh the page, note it doesn't appear anymore <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Project-level security gate on project home with AI assistant prompts, table details, per-project dismissible notice, and a new telemetry event for CTA interactions. * **Improvements** * Stronger visual treatment for critical advisor items and advisor CTA when critical issues exist. * Assistant dropdown supports a copy-prompt callback; added local-storage key and utilities/types to support project security workflows. * **Tests** * Added tests covering gate behavior, navigation, and dismissal logic. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Alaister YoungandAlaister Young
|
ad331c5813 |
[FE-3081] fix(studio): remove false "schema not exposed" warning in Realtime policies editor (#45325)
The Realtime policies editor was showing a warning banner on `realtime.messages` saying the schema isn't exposed through PostgREST. This is incorrect — the `realtime` schema is intentionally excluded from PostgREST (it's in `INTERNAL_SCHEMAS` and filtered out of the exposed schema picker), so the warning is always false in this context. **Changed:** - Removed `useProjectPostgrestConfigQuery` from `RealtimePolicies` — it was only used to derive `exposedSchemas` - Hardcode `exposedSchemas` as `['realtime']` since this editor is for Realtime auth, not PostgREST access ## To test - Go to the Realtime policies editor (`/project/_/realtime/policies`) - Confirm the yellow "schema not exposed" warning banner no longer appears on `realtime.messages` - Confirm policy rows still render correctly and other admonitions (e.g. publicly-readable if RLS is off) still show as expected <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved stability of Realtime Policies schema handling by simplifying configuration logic to consistently use the realtime schema. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Ali Waseem
|
2930b9b6cd |
feat(studio): wire up database advisor rule 12 (auth_allow_anonymous_sign_ins) (#45343)
## Summary Wires up database advisor rule `0012_auth_allow_anonymous_sign_ins` in the Studio Linter so it shows up with the right title, icon, action link, and docs link instead of falling back to a generic display. The rule entry navigates to `/auth/providers` (where the "Allow anonymous sign-ins" toggle lives), modeled after rule 0019 (`auth_otp_long_expiry`) which uses the same target. ## Test plan - [x] Trigger rule 0012 on a test project (enable anonymous sign-ins on a project with RLS-protected tables) - [x] Verify the lint appears in Security Advisor with title "Anonymous Sign-Ins Allowed" and User icon - [x] Verify the "View settings" CTA navigates to `/project/<ref>/auth/providers` - [x] Verify the "Learn more" link points to the 0012 docs section <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a new authentication lint rule that identifies anonymous sign-in configuration issues and provides integrated guidance to the auth providers settings page with relevant documentation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
89d08a2505 |
Remove feature flag for RLS tester (#45332)
## Context As per PR title - will make the RLS tester available for CLI / self-host (still as a feature preview) ## To test - [x] Verify briefly locally that the RLS tester is available for use, and works as expected <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved user search error handling to display appropriate failure messages when search encounters issues. * **Refactor** * Simplified RLS Tester feature availability logic by consolidating enablement checks across components and removing redundant feature flag dependencies. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi EnricandClaude Opus 4.7
|
fe928ad76d |
feat(studio): link edge function errors to troubleshooting docs (#45326)
## Summary Improve the "Errors since last deploy" panel on the new edge function overview page. - **Error column**: stop showing the function URL. Pull the actual error from the related runtime logs, trim the stack trace to a one-line summary, and use that for the cell text and tooltip. - **Troubleshoot column**: rename "Assistant" to "Troubleshoot" and add a "View troubleshooting guide" item to the dropdown that opens `supabase.com/docs/guides/troubleshooting` prefilled with `edge function <ErrorType> <statusCode>`. - **Runtime log block**: restyle the expanded per-row log section. Monospace rows with structured timestamp / level badge / count / message, a divider between entries, and destructive tinting only on error rows. The previous layout ran text together with no separation. ## Test plan - [x] `pnpm test:studio` for `EdgeFunctionRecentErrors.utils.test.ts` (10 passing, including new cases for `summarizeErrorMessage`, `getDisplayErrorMessage`, and `buildTroubleshootingDocsUrl`) - [x] `pnpm typecheck` clean - [x] `eslint` clean for changed files - [ ] Visual check of the panel: Error cell shows the runtime error summary, Troubleshoot dropdown opens docs in a new tab, log rows render with the new structure 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a "View troubleshooting guide" action that opens a status-code-specific docs page for each recent error. * Errors now show level badges and repetition counts in the logs for clearer scanning. * **Bug Fixes** * Error text is summarized and normalized for concise, single-line display with clearer per-line styling. * **Tests** * New tests validate error-summary, display-fallback, and troubleshooting-URL behaviors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
Ali Waseem
|
42b431a270 |
feat(studio): add keyboard shortcuts to the table editor (#45178)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — a set of new keyboard shortcuts for the table editor, along with infrastructure to register, gate, and surface them. ## What is the current behavior? Clicking into the grid "traps" the keyboard: Escape doesn't pop out, there are no shortcuts for row selection / deletion / navigation, and the search-tables input grabs focus on page load. ## What is the new behavior? ### New shortcuts (all scoped to the table editor) | Keybind | Action | Surface | |---|---|---| | `Esc` | Exit grid selection — clears the highlighted cell and drops focus back to the page | hotkey | | `↑` / `↓` | Start grid navigation from the first cell when no cell is selected | hotkey | | `Shift+Space` | Toggle selection on the current row | hotkey + checkbox tooltip | | `Mod+A` | Toggle selection on all displayed rows (matches Excel) | hotkey + header-checkbox tooltip + Cmd+K | | `Mod+Shift+A` | Toggle selection on all rows in the table | hotkey + "Select all rows in table" button tooltip + Cmd+K | | `Mod+Backspace` | Delete selected rows | hotkey + delete-button tooltip + Cmd+K | ### Infrastructure - **Split registry** — table-editor shortcuts moved to `state/shortcuts/registry/table-editor.ts`, spread into `SHORTCUT_IDS`. Makes it easy to scope a runtime check to a specific surface. - **`eventMatchesAnyShortcut`** (`state/shortcuts/matchEvent.ts`) — queries the hotkey library's live `SequenceManager` so gated shortcuts (`enabled: false`) are correctly excluded. Covered by `matchEvent.test.ts`. - **`handleCellKeyDown`** now calls `event.preventGridDefault()` whenever the keystroke matches an active table-editor shortcut, so rdg's "start editing on key press" default doesn't compete with shortcut actions (e.g. typing `Shift+X` no longer opens edit mode with `X` as input). - **`<Shortcut>` / `<ShortcutTooltip>`** used on the header checkbox, the per-row checkbox, the "Select all rows in table" button, and the delete button — keybinds show up on hover (Linear-style) so users can discover them without reading docs. - **CSS** — `.rdg:not(:focus-within) .rdg-cell[aria-selected='true']` drops the selected-cell outline whenever focus leaves the grid, reinforcing the "you're out" feedback after `Esc`. - **`useShortcut`** wraps the Cmd+K-registered action to close the command menu after firing (previously menu stayed open after selecting an action). - **Search-tables input** no longer auto-focuses on load, so arrow shortcuts work immediately without clicking out first. ## Additional context Linear: FE-3057 ### Test plan - [x] Open any table → `↓` selects the first cell; subsequent arrows navigate rows - [x] `Esc` drops focus out of the grid and re-enables `↓` to re-enter - [x] Click a cell → `Shift+Space` toggles that row's selection (checkbox) - [x] `Mod+A` toggles all displayed rows - [x] With pagination + some rows selected → `Mod+Shift+A` toggles "Select all rows in table" - [x] With rows selected → `Mod+Backspace` deletes them (existing confirmation flow) - [x] Hover the header checkbox / per-row checkbox / delete button → keybind tooltip after ~500ms - [x] Cmd+K with selection → the relevant action shows up; selecting it closes the palette and runs <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added table editor keyboard shortcuts for navigation, row selection, and cell actions, with command-menu integration and visible shortcut tooltips. * **Improvements** * Better keyboard handling in grid cells allowing external shortcuts to override default behavior. * Select-all/deselect-all toggle and improved select-row UX; selected-cell styling no longer shows when grid loses focus. * Command menu now reliably closes before executing shortcut actions. * Removed autofocus on the table editor search input for consistent focus behavior. * **Tests** * Added unit tests covering shortcut matching and command-menu shortcut behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Francesco Sansalvadore
|
072006ba0f | chore(studio): remove mobile toolbar flag (#45317) | ||
|
Gildas Garcia
|
718021fc7b |
chore: migrate Listbox to Shadcn components (#45279)
## Problem We want to reduce the code we ship and maintain. ## Solution Migrate old `<Listbox />` usage to the new Shadcn component. ## Screenshots ### Billing Before: <img width="536" height="458" alt="image" src="https://github.com/user-attachments/assets/c8883bd8-cbbd-47cd-84a4-e37a36c05cd6" /> After: <img width="541" height="451" alt="image" src="https://github.com/user-attachments/assets/9c848b1b-e72a-413c-b264-48340ce0c7ef" /> ### Foreign Key Editor Before: <img width="463" height="995" alt="image" src="https://github.com/user-attachments/assets/4debeeeb-94bd-439d-8f57-a84a2ed5230a" /> <img width="428" height="241" alt="image" src="https://github.com/user-attachments/assets/81a21d58-c023-445a-a6e8-c9be22b53075" /> After: <img width="451" height="1007" alt="image" src="https://github.com/user-attachments/assets/18c781c0-4f52-4ca2-99e6-1fc34dc857e3" /> <img width="434" height="240" alt="image" src="https://github.com/user-attachments/assets/13fbb3ad-ef3c-499d-a27e-26cfae89ae44" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Replaced legacy dropdowns with a unified Select component and consistent form layout across payment method, org transfer, foreign-key/column selectors, region selection, and other dropdowns. * **Chores** * Removed the legacy listbox implementation and its public exports from the UI package. * **Tests** * Removed old listbox unit tests and updated e2e selectors to target the new Select-based controls. * **Style** * Deleted obsolete listbox-specific styles. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
65365213af |
feat(studio): logs header improvements (#45275)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? A little bit of tidy up here so the header area of unified logs isn't so dominant. Moved actions to the same line as search bar and made other parts a little more subtle, so the focus reamains on the logs themselves. | Before | After | |--------|--------| | <img width="980" height="213" alt="Screenshot 2026-04-27 at 11 47 37" src="https://github.com/user-attachments/assets/ae22e7dd-272f-4433-a270-67b550a00536" /> | <img width="893" height="153" alt="Screenshot 2026-04-27 at 12 27 17" src="https://github.com/user-attachments/assets/87b8cfc9-66a4-4634-a3c6-c45e4b8fc486" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Keyboard shortcut to toggle filter visibility in logs. * Consolidated top bar with refresh, view options, download, and live controls—desktop and mobile optimized. * **Style** * More compact, organized header with tooltips showing live status and shortcut hints. * Reduced filter input typography and streamlined mobile filter trigger. * **Other** * Side panel sizing and logs area layout refined for clearer visuals and consistent header/body styling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
202c085cf7 |
Merge rls tester callouts (#45312)
## Context Just merging the callouts - only show one at a time, instead of both ### Before <img width="610" height="518" alt="image" src="https://github.com/user-attachments/assets/58567f7e-99bf-4c84-8392-35573c646af6" /> ### After <img width="605" height="428" alt="image" src="https://github.com/user-attachments/assets/975a5a30-2b36-4602-af8f-b79c2383f38b" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced RLS Tester to prevent conflicting policy status messages from appearing simultaneously. The interface now properly displays only the relevant message about policy configuration and evaluation status, improving clarity when reviewing row-level security results. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan Vasilov
|
308cd791a2 |
chore: Prep work for migrating to Tailwind v4 (#45285)
This PR preps the monorepo for a migration to Tailwind v4: - Bump all Tailwind dependencies and libraries to the latest possible version, while still compatible with Tailwind 3. - Cleans up obsolete Tailwind 3 specific options and configs. - Cleans up unused CSS files and fixes the CSS imports. - Migrates all `important` uses in `@apply` lines to using the `!` prefix. - Move `typography.css` to the `config` package and import it from the apps. - Migrated all occurrences of `flex-grow`, `flex-shrink`, `overflow-clip` and `overflow-ellipsis` since they're deprecated and will be removed in Tailwind 4. - Make the default theme object typesafe in the `ui` package. - Migrate all `bg-opacity`, `border-opacity`, `ring-opacity` and `divider-opacity` to the new format where they're declared as part of the property color. - Bump and unify all imports of `postcss` dependency. |
||
|
Danny WhiteandJoshen Lim
|
2d92563b57 |
fix(studio): add resume project flow to project settings (#45078)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix. Resolves DEPR-511. ## What is the current behavior? Paused projects in `Project Settings > General > Project availability` still present restart/pause maintenance controls, but no resume affordance. That makes the resume path hard to discover from Settings and pushes users back to the project dashboard to find the correct action. The paused state also keeps showing a redundant disabled `Pause project` row, and the pause confirmation uses a more flexible modal than this flow needs. DEPR-519 already covered the unhealthy-project restart guard, but not this paused-project discoverability path. ## What is the new behavior? Project Settings is now paused-project aware. It shows a shared `Resume project` action when the project can still be restored, falls back to the project dashboard when the restore window has expired or pause status cannot be confirmed, and reuses the same resume flow, permission checks, and free-tier guardrails as the paused dashboard. While a project is already paused, the redundant `Pause project` row is hidden so the section stays focused on the real next action. For active projects, the pause row remains in place, including the useful disabled tooltip states for plans that cannot pause. The pause confirmation now uses `AlertDialog` with shorter, more accurate copy about the restore window, and the restart controls now behave more consistently on smaller breakpoints. The Project Settings command-menu entry is also searchable via `resume project`. | Before | After | | --- | --- | | <img width="1602" height="566" alt="CleanShot 2026-04-24 at 18 05 25@2x" src="https://github.com/user-attachments/assets/bd8f4095-0360-443c-a179-185da69eb9e8" /> | <img width="1538" height="408" alt="CleanShot 2026-04-24 at 18 06 12@2x" src="https://github.com/user-attachments/assets/7ac26529-4b54-460e-89c3-927891d873d8" /> | | <img width="1524" height="524" alt="CleanShot 2026-04-24 at 18 08 53@2x" src="https://github.com/user-attachments/assets/f3c49c46-b389-4324-b982-f557b159623e" /> | <img width="1528" height="550" alt="CleanShot 2026-04-24 at 18 08 30@2x" src="https://github.com/user-attachments/assets/4021e2bb-f22f-40db-be43-de6d0fb571b3" /> | | <img width="896" height="558" alt="CleanShot 2026-04-24 at 17 41 40@2x" src="https://github.com/user-attachments/assets/31569aec-89a6-4984-8011-39d8b102c90f" /> | <img width="912" height="502" alt="CleanShot 2026-04-24 at 18 10 34@2x" src="https://github.com/user-attachments/assets/f19dcd27-12e6-4a2f-8eed-ca709e77dfa1" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a tooltip-enabled "Resume project" button that handles permissions, free-plan member gating, optional Postgres version selection, and navigates to the project after restore. * **UX** * Pause confirmation migrated to an alert-style dialog with updated copy and disabled controls during pausing. * Restart controls updated for improved responsive layout and refreshed button visuals. * Project settings now show appropriate resume/dashboard actions based on pause/restore eligibility. * **Tests** * Added tests for active, resumable-paused, and non-resumable-paused states. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Joshen Lim
|
dab1512fe9 |
Add callout for feature preview rls tester (#45307)
## Context Adds a banner on the auth policies page for the new RLS tester feature preview <img width="307" height="310" alt="image" src="https://github.com/user-attachments/assets/6864c2cb-c3b8-4c1f-8dce-57411425e17d" /> Also adds a Give feedback button in the RLS Tester sheet footer <img width="616" height="73" alt="image" src="https://github.com/user-attachments/assets/64755f56-4e27-4b54-92b2-a894badc0b88" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * RLS Tester preview banner added to the policies page with animated content and a locally persisted dismissed state. * Enabling the RLS Tester via the preview also dismisses and records the banner dismissal. * New feedback link added to the RLS Tester UI that opens in a new tab. * **Layout/Providers** * Banner stack context moved so banner state is available more broadly across the app. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
bedb2efb87 |
chore(studio): JIT access UI improvements (#44161)
## What kind of change does this PR introduce? UI and copywriting improvements for temporary access. ## What is the current behavior? The temporary access UI still used older JIT/ephemeral naming in some places, did not clearly explain the setup requirements, and had to infer unavailable states from Platform error message text. ## What is the new behavior? The settings UI now uses temporary access naming consistently, explains that temporary access uses short-lived tokens for manual database connections, and renders clearer unavailable states for projects that require either a Postgres upgrade or a platform migration. The Studio query now consumes Platform’s structured `unavailableReason` contract instead of parsing human-readable error strings, so the UI owns the copy while Platform owns the eligibility reason. Validation: - `pnpm eslint components/interfaces/Settings/Database/JitDatabaseAccess/JitDbAccessConfiguration.tsx data/jit-db-access/jit-db-access-query.ts` - `pnpm tsc --noEmit --pretty false` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * IP range input now supports one CIDR range per row with add/remove rows and form integration. * **Documentation** * Replaced “JIT” wording with “Temporary” / “Ephemeral token-based” access across UI, dialogs, toasts, and help links. * Added minimum PostgreSQL version requirement (17.6.1.081+). * **Improvements** * Per-row CIDR validation with precise nested error messages. * Refined layout spacing and moved the temporary-access configuration earlier in Database settings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Etienne Stalmans <etienne@supabase.io> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Saxon FletcherandJoshen Lim
|
96939829bc |
change to useFlag not usePHFlag (#45265)
Just replace PH flag with ConfigCat flag for edge functions index error rates <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Switched how the feature flag for edge functions request metrics is read, affecting whether last-hour metrics columns are displayed. * **Bug Fix** * Fixed table layout so the "No results found" row correctly spans the appropriate number of columns depending on whether last-hour stats are shown, preventing misaligned table rows and improving display consistency. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Raminder Singh
|
a1cdfaeca1 |
feat: open oauth apps in new tab to avoid losing studio context (#45304)
Currently when a user clicks the **Install integration** button on an OAuth integration like Grafana, they are redirected to the partner website in the same tab in which they clicked the button. This makes them lose context in the Supabase Studio. This PR changes the behaviour such that the partner website will be opened in a new tab. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * OAuth integration installation now opens the redirect URL in a new browser tab instead of redirecting the current window, allowing users to remain in the application while completing the integration process. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
5f867e5f6c |
Feature Preview: RLS Tester (#45121)
## Context Resolves FE-3077 Related discussion: https://github.com/orgs/supabase/discussions/45233 Verifying the correctness of your RLS policies set up has always been a gap, as highlighted by a number of GitHub discussions like [here](https://github.com/orgs/supabase/discussions/12269) and [here](https://github.com/orgs/supabase/discussions/14401). As such, we're piloting a dedicated UI for RLS testing (using role impersonation as the base), in which you'll be able to - Run a SQL query as a user (not logged in / logged in - this is the role impersonation part) - See which RLS policies are being evaluated as part of the query - And hopefully be able to debug which policies are not set up correctly Changes are currently set as a feature preview - and we'll iterate as we get feedback from everyone 🙂 🙏 <img width="613" height="957" alt="image" src="https://github.com/user-attachments/assets/83c37f8a-28fc-43b3-b0ff-e28571d8710c" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * RLS Tester: run queries as anon or authenticated users, view inferred SQL, per-table policy summaries, and data previews of accessible rows. * UI preview: new RLS Tester preview card and modal with opt-in toggle; RLS Tester sheet with role/user selector and query editor. * SQLEditor: “Explain” tab is always visible. * **Chores** * Added supporting API endpoints, background checks for table RLS status, and a local-storage flag to persist the preview opt-in. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
aa674dd536 |
fix(studio): unused credit card expiry label in test (#45300)
## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? PR #44965 introduced an unused `cardExpiryLabel` constant in `CreditCard.tsx`, which causes `studio#typecheck` to fail with `TS6133` after the branch is merged into `master`. ## What is the new behavior? Removes the unused constant so Studio typecheck passes again without changing payment method behaviour. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Removed unused code to improve code quality and maintainability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
9e3a10d557 |
feat(studio): payment method states for Stripe Projects orgs (#44965)
## What kind of change does this PR introduce? UI changes for Stripe-managed billing surfaces. - Resolves DEPR-537 - Related to DEPR-538 ## What is the current behaviour? Stripe-connected organisations still look too self-serve in Studio. - Payment Methods still reads mostly like ordinary Supabase card management, even though billing is handled through a Shared Payment Token via Stripe Projects - invoice messaging still implies support is the path to changing payment methods, even for Stripe-managed orgs - the Subscription Plan flow still needs Stripe-specific guardrails so users are redirected to the correct upgrade path rather than trying to self-serve everything in Studio - the base branch now correctly separates `integration_source` from `billing_partner`, but this stacked work still needs to carry that split through the Stripe billing-token surfaces ## What is the new behaviour? This PR makes the Stripe-managed billing surfaces behave like Stripe-managed billing surfaces, while leaving AWS and Vercel on the existing `billing_partner` path. - Payment Methods now keeps the familiar saved-card row, but augments Stripe-managed rows with Shared Payment Token context, token status, and Stripe Projects affordances - Stripe-managed invoice messaging now points users to Stripe Projects rather than to support for payment-method changes - the Subscription Plan flow keeps the existing managed-billing shape, with Stripe-specific guardrails layered in where plan changes should be handled outside Studio - AWS and Vercel continue to use the existing partner-managed alerts and CTAs driven by `billing_partner` / `billing_via_partner` | Subscription plan sheet | | --- | | <img width="1780" height="448" alt="CleanShot 2026-04-24 at 17 21 43@2x" src="https://github.com/user-attachments/assets/34c0f3ba-fc42-4d07-97a2-0e4f4cefc55e" /> | | _Upgrade instructions_ | | <img width="1786" height="460" alt="CleanShot 2026-04-24 at 17 20 12@2x" src="https://github.com/user-attachments/assets/bb67c835-b9b2-4648-b0e1-9c2f8d2317d3" /> | | _Downgrade instructions_ | > [!NOTE] > The below screenshots are outdated. The _Shared Payment Token_ terminology has been removed in favour of more generic copy such as _Stripe Projects token_. | Stripe payment method states | | --- | | <img width="1436" height="234" alt="CleanShot 2026-04-23 at 19 03 49@2x" src="https://github.com/user-attachments/assets/52ed7a00-dfba-4b66-9a07-a6346692d3c8" /> | | _Healthy_ | | <img width="1434" height="224" alt="CleanShot 2026-04-23 at 19 04 50@2x" src="https://github.com/user-attachments/assets/94efd943-b7bf-4da2-9e1b-1828aae97126" /> | | _Card expiring soon_ | | <img width="1436" height="236" alt="CleanShot 2026-04-23 at 19 06 51@2x" src="https://github.com/user-attachments/assets/272cb707-c724-4629-890e-853972e53a18" /> | | _Card expired_ | | <img width="1308" height="238" alt="CleanShot 2026-04-23 at 19 07 21@2x" src="https://github.com/user-attachments/assets/3eadd2a9-def3-4f43-850e-7d82adfb0b57" /> | | _Token expired_ | ## Dependencies This PR is stacked on: - #44328 It also depends on the private platform work that exposes Stripe project connection state and SPT details: - https://github.com/supabase/platform/pull/31874 - https://github.com/supabase/platform/pull/31940 ## Platform dependency status Most of the remaining platform work for this stack is now covered by the private dependency below: - https://github.com/supabase/platform/pull/31940 That PR is expected to provide the SPT details and paid-flow fixes this Studio work depends on. In practice, the main caveat here is less “Studio still needs a bunch of new platform work” and more “do not merge this until `platform#31940` has landed and the end-to-end Stripe-managed flow has been rechecked”. ## Local testing Use the same local Stripe setup as the base branch, with `integration_source: 'stripe_projects'` returned consistently for: - `/platform/organizations` - `/platform/organizations/:slug/projects` - `/platform/projects/:ref` For payment method demos, the temporary local mock currently lives in private `platform` on: - `/platform/organizations/:slug/payments` That mock can be flipped between: - healthy token + healthy underlying card - healthy token + card expiring soon - healthy token + expired card - expired token Then verify: - the org and project connection affordances from #44328 still render correctly - Payment Methods shows Stripe-managed token context rather than implying ordinary self-serve card management - regression test ordinary non-Stripe payment methods too, to confirm the standard saved-card row still renders with the existing `Expires:` copy and no Shared Payment Token affordances - invoice messaging points Stripe-managed orgs to Stripe Projects rather than support - Subscription Plan keeps the managed-billing guardrails for Stripe - AWS and Vercel orgs still show the existing partner-managed messaging rather than the Stripe-specific notices <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Stripe-managed organizations show Stripe Projects billing guidance, replace in-app payment management with Stripe links, and adjust billing copy. * Payment methods support Shared Payment Tokens (SPTs): token expiry/status badges with tooltips, “Handled via Stripe Projects” indicator, token last4/expiry display, and disabled local update/delete actions for SPTs. * **API** * Payments response now includes optional shared payment token details for payment methods. * **Documentation** * Added links to Stripe Projects billing docs in relevant flows. * **Tests** * Updated and added tests covering Stripe-managed and SPT behaviors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Raúl Barroso <code@raulb.dev> |
||
|
Ignacio Dobronich
|
98211ed3dc | feat: update CreditTopUp to mention pre-tax credits (#45255) | ||
|
Ignacio Dobronich
|
4763ac8374 |
fix: show plan name on empty orgs (#45247)
## Summary - Show the plan name row in the monthly invoice estimate tooltip even when the organization has no projects, so the section no longer appears headerless next to the tax line. ## Test plan - [ ] Open an org with no projects → Subscription plan update dialog → hover the "Monthly invoice estimate" tooltip → verify the plan name + price row is visible. - [ ] Repeat on an org with projects → verify plan, Compute row, and project breakdown all still render as before. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved rendering of the Monthly invoice estimate table in the subscription plan update dialog, with reorganized display logic for plan and project billing rows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ignacio Dobronich
|
7dcf677a95 |
feat: add loading indicator and ChargeBreakdown in NewOrgForm (#45236)
## Summary - Show a `ShimmeringLoader` skeleton in the new-org form while the creation preview is fetching for the first time, so users see feedback after entering their billing address. - Disable the **Create organization** button while the preview is refetching, to prevent submitting on stale totals. - Replace the inline charge summary with the shared `ChargeBreakdown` component, extending it with an optional `subtotalLabel` prop (defaults to `"Subtotal"`, `"Plan price"` here) to preserve the existing copy. ## Test plan - [ ] Navigate to `/new` → pick Pro/Team → enter a billing address → confirm shimmer shows until the first preview resolves. - [ ] Change address/tax ID → confirm existing totals fade to 50% while refetching and the submit button is disabled during the fetch. - [ ] Confirm the breakdown still renders "Plan price", "Tax (x%)", and "Total due today" correctly - [ ] FREE plan path unaffected — no preview request, submit button behaves as before. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Organization creation form now displays loading placeholders while billing preview data is being fetched, providing clearer visual feedback during the calculation process * Submit button is now properly disabled during billing information retrieval * Billing breakdown display has been refined for improved consistency <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
43e437140b |
feat(studio): add disable action for custom OAuth providers (#45221)
## Summary - Adds an Enable/Disable dropdown action in each row of the custom OAuth providers list. - Disabling opens a confirmation modal that calls the existing update API with `enabled: false`; enabling is immediate (restorative, no confirmation). - Removes the hardcoded `enabled: true` from the edit sheet's update payload so editing a disabled provider no longer silently re-enables it. Closes [FE-3067](https://linear.app/supabase/issue/FE-3067/add-disable-button-for-custom-oauth-providers). ## Test plan - [x] Create a custom OAuth provider — it is enabled by default. - [x] Click the row menu → "Disable". Confirm in the modal. Row shows `Disabled` badge. - [x] Click the row menu → "Enable". Row immediately flips back to `Enabled`. - [x] Edit a disabled provider via the "Update" action, save. Verify it remains `Disabled` (no silent re-enable). - [x] Delete action still works. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added enable/disable toggle controls for individual custom OAuth providers in the provider list * Added confirmation dialog when disabling a provider to prevent accidental changes <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alaister YoungandAlaister Young
|
5f6060197e |
[COM-205] feat(studio): add logs:all flag to hide all logs (#45202)
Adds a top-level `logs:all` flag (default `true`) so self-hosted and local setups can hide the logs pages in Studio when Logflare isn't configured — no separate Studio build required. The flag itself works everywhere; the additional `ENABLED_FEATURES_LOGS_ALL` env-var override (from FE-3036) is the self-hosted escape hatch so deployers can flip it without a custom build — that part is a no-op on `IS_PLATFORM` because hosted feature gating flows through `profile.disabled_features` instead. Addresses [COM-205](https://linear.app/supabase/issue/COM-205/add-feature-flag-to-disable-all-logs-in-studio). **Added:** - `logs:all` feature flag in `enabled-features.json` + schema **Changed:** - Sidebar "Logs" nav entry is hidden when `logs:all` is off (same pattern as `reports:all` / `billing:all`) - Cmd-K "Logs Explorer" / "Auth Logs" / etc. routes are hidden when the flag is off - `LogsLayout` renders `<UnknownInterface />` (soft-404) when the flag is off — covers all ~18 logs pages in one spot - `/logs/index.tsx` applies the same soft-404 for the unified-logs entry point ## To test Needs to be tested locally (preview doesn't let you flip the flag — hosted gating is profile-driven, not env-driven). Two ways: - Temporarily edit `"logs:all": false` in `packages/common/enabled-features/enabled-features.json` and run `pnpm dev:studio`, or - Run Studio locally with `ENABLED_FEATURES_LOGS_ALL=false` (env-var path, same as how self-hosted deployers would use it) With the flag **off**: - Sidebar "Logs" entry is hidden - Cmd-K search for "Logs" / "Auth Logs" / "Postgres Logs" etc. returns nothing - Direct navigation to `/project/<ref>/logs`, `/project/<ref>/logs/explorer`, `/project/<ref>/logs/auth-logs`, `/project/<ref>/logs/postgres-logs` (etc.) all render the "Looking for something?" soft-404 with a Head back button With the flag **on** (default): everything works as it does today. **Check on the preview deploy too** — nothing should change, no behaviour difference on hosted. Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Gildas Garcia
|
049909632e |
fix: remove unused import (#45281)
#45232 reintroduced an unused variable <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Cleaned up unused code dependencies to improve code quality and maintainability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
bc3dc73240 |
chore: migrate old <Select /> usage to the new Shadcn component (#45232)
## Problem We want to reduce the code we ship and maintain. ## Solution Migrate old `<Select />` usage to the new Shadcn component. ## Screenshots ### `www` Pricing Before: <img width="637" height="697" alt="image" src="https://github.com/user-attachments/assets/b6f261de-e587-411b-9408-faf94d709f1c" /> After: <img width="644" height="756" alt="image" src="https://github.com/user-attachments/assets/8cc4894c-64da-4e6a-960c-77cd162ac71d" /> ### Observability Before: <img width="1015" height="452" alt="image" src="https://github.com/user-attachments/assets/3d7e8613-e7a6-461d-a50d-e66c7c85fef1" /> After: <img width="833" height="467" alt="image" src="https://github.com/user-attachments/assets/98ace34f-25ec-48b5-aad3-fe812307b01d" /> ### Docs Realtime Used in pages: - https://supabase.com/docs/guides/realtime/postgres-changes - https://supabase.com/docs/guides/realtime/benchmarks Before: <img width="578" height="437" alt="image" src="https://github.com/user-attachments/assets/22fa0048-be07-42e0-9153-65171fa3ccb9" /> After: <img width="571" height="423" alt="image" src="https://github.com/user-attachments/assets/e0adbde9-0c6f-48da-b377-516392185fb0" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Updated dropdown/select controls across the app to a consistent, composable implementation * Replaced advanced JWT generator in docs with a simplified JWT generator component * **Chores** * Removed legacy select component, associated styles and exports * Updated theme and tests to align with the new select implementation <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
dfd3eec8e9 |
feat(studio): compute metrics on project diagram Primary Database card (#45274)
## Problem The Primary Database card in the project homepage diagram showed region and instance size, but no live health data. Users had no quick way to spot a high-disk or high-CPU situation without navigating to the database report. ## Fix Added a clickable metrics row at the bottom of the Primary Database card showing CPU, Disk, and RAM as percentages, plus active/max connections when available. Each metric is color-coded (warning at 80%, destructive at 90%). Clicking the row navigates to the database observability report. The metrics are powered by a new \`useComputeMetrics\` hook that wraps the existing \`useInfraMonitoringAttributesQuery\` and \`useMaxConnectionsQuery\`, reusing the parse utilities already used by the database infrastructure section. The \`metricColor\` threshold logic is extracted into a separate util with unit tests. ## How to test - Open the project homepage for a running project - The Primary Database card should show a new bottom row: "CPU X% · Disk X% · RAM X% · Y/Z conns" - Values above 80% should appear in amber, above 90% in red - Click the metrics row and confirm it navigates to \`/project/<ref>/observability/database\` - While metrics are loading, a spinner should appear in the row - If the infra monitoring API is unavailable, the row should show "Metrics unavailable" instead of zeroes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Infrastructure configuration page now displays real-time compute metrics (CPU, disk, memory usage) with color-coded usage indicators based on thresholds. * Connection information is displayed when available. * Includes loading states and error handling for metric retrieval. * **Tests** * Added test coverage for metric color-coding logic. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
67deabf67e |
fix: create etl publication as postgres (#45043)
## What kind of change does this PR introduce? Bug fix ## What is the current behavior? Creating a schema only branch fails because ETL publication is owned by `supabase_etl_admin` which users have no access. ## What is the new behavior? Since ETL supports user managed publications, create them through pgmeta so it's owned by `postgres` role instead. ## Additional context mirrors [upstream etl](https://github.com/supabase/etl/blob/main/etl-api/src/db/publications.rs#L22-L51) implementation <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Added guards to prevent creating publications when project or connection info is missing, with clearer error logging. * Ensure the project connection string is explicitly passed so publications target the correct database. * **Refactor** * Publication creation now executes generated SQL directly against the database, with correct handling of empty or selected table lists and proper identifier quoting for reliability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai> |