Refactor authorize page to move Next.js dependencies into the page shell
and have Next.js-agnostic code for the core logic. Add unit tests for
authorize screen.
## Summary by CodeRabbit
* **New Features**
* New end-to-end API authorization UI: loading, error, invalid,
approved, and main approval screens.
* Organization selector with preselection, create-organization link, MCP
warning, expiration handling, and approve/decline actions.
* Improved page title handling via layout/head provider.
* **Tests**
* Added comprehensive component tests covering loading, error, approval
flows, organization states, validation, and side effects.
Bug fix & feature
## What is the current behavior?
Customers with large schemas have trouble running:
pg-meta/{ref}/tables?include_columns=false
## What is the new behavior?
In the webhooks view some users with large schemas could not click a
table name as the underlying query times out. This just adds a light
weight query and fetches the table name
## Additional context
Add any other context or screenshots.
## Summary by CodeRabbit
* **Refactor**
* Optimized table name fetching in the database interface by introducing
an enhanced query mechanism that streams table metadata more efficiently
from the database.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Remove queue operations from feature preview into settings
- Refactor dashboard settings
- Resolves DEPR-434
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Dashboard settings panel in Account preferences with toggles for
Inline Editor and Queue Operations; “Dashboard” added to project
Configuration.
* **Removed**
* Old Inline Editor settings UI and the Queue Operations feature-preview
UI removed.
* **Refactor**
* Consolidated dashboard preferences into a single settings surface;
banners and actions now navigate to preferences; account/preferences
layouts and back-navigation behavior adjusted for platform vs
self-hosted.
* **Tests**
* Added tests for settings UI, menu generation, redirects, and
local-storage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds a tooltip for the account settings button
## What is the current behavior?
It has no tooltip
Closes#44524
## What is the new behavior?
Has Tooltip
## Additional context
<img width="552" height="167" alt="Screenshot 2026-04-03 at 22 21 35"
src="https://github.com/user-attachments/assets/e41caee7-e688-4bd9-8823-0c47133c5470"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Improved interface usability by adding descriptive tooltips to
dropdown menu triggers in the studio. The settings dropdown trigger now
displays a "Settings" tooltip, while the user account dropdown trigger
displays "Account settings" to provide clearer guidance, help users
navigate key interface controls, and enhance the overall user
experience.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ali Waseem <waseema393@gmail.com>
* **Refactor**
* Updated internal module import paths to use standardized alias
conventions across the codebase.
* Reorganized import statement ordering for improved code consistency.
Follow-up to #44562 – the org prop wasn't actually being passed in, so
`NoProjectsOnPaidOrgInfo` was always returning null. Switched to
`useSelectedOrganizationQuery` hook instead.
## To test
- Go to an org on a paid plan with no projects
- Verify the admonition banner appears on the general settings page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Simplified component architecture by replacing prop-based organization
retrieval with hook-based approach, reducing component coupling and
improving maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When high availability is enabled during project creation, automatically
switch to AWS (Revamped) and disable other cloud providers –
multigres/HA is only supported on v3.
<img width="778" height="390" alt="Screenshot 2026-04-06 at 5 09 55 PM"
src="https://github.com/user-attachments/assets/c458f345-497e-4963-9c2f-b4b1eafd030b"
/>
**Changed:**
- Cloud provider selector now watches `highAvailability` form state
- Non-`AWS_K8S` providers (Fly.io, AWS, AWS Nimbus) are disabled when HA
is on
- Warning description shown in orange when HA restricts the provider
choice
**Added:**
- `useEffect` in project creation form to auto-switch cloud provider to
`AWS_K8S` when HA is toggled on
## To test
- Enable the HA toggle on the new project page (requires
`instances.high_availability` entitlement)
- Verify cloud provider auto-switches to AWS (Revamped)
- Verify other providers are greyed out in the dropdown
- Verify orange warning text appears below the cloud provider label
- Toggle HA off and confirm all providers become selectable again
- Ensure project creation still works for both HA and non-HA projects
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* When high availability is enabled, cloud provider selection is
restricted to AWS.
* A warning appears when high availability is enabled, noting AWS-only
support.
* The cloud provider selection automatically switches to AWS if high
availability is toggled on.
* **Bug Fixes**
* Improved form validation to prevent incompatible high-availability and
provider combinations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Platform orgs can have very high project cardinality (>1M projects),
making the project count query expensive. This disables the query across
all count-only usages for platform plan orgs.
**Changed:**
- `OrgSelector` — disable query, show "Platform" label instead of count
- `OrganizationCard` — disable query, hide project count for platform
orgs
- `NoProjectsOnPaidOrgInfo` — disable query (component already returned
null for platform orgs)
**Not changed:**
- `TeamSettings` — also uses the count, but the warning it powers is
specifically relevant for orgs with a lot of projects, and it's tucked
away on the team settings page rather than on every page load.
## To test
- On a platform org, verify no `/organizations/{slug}/projects` requests
fire from the org selector, org cards, or billing info
- For regular orgs, verify the project count still displays normally
everywhere
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Organization selector now shows a dedicated "Platform" label for
platform organizations instead of a project count.
* Reduced unnecessary network activity by skipping project fetching when
a platform organization is selected, improving load performance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor
## What is the current behavior?
Storage explorer preferences (`view`, `sortBy`, `sortByOrder`,
`sortBucket`) are managed inline within the Valtio proxy state in
`storage-explorer.tsx`, which reads/writes localStorage directly.
## What is the new behavior?
Preferences are extracted into a dedicated `useStoragePreference` hook
backed by `useLocalStorage`. A companion `getStoragePreference` function
allows the Valtio state to read sort options imperatively for API calls
without holding preference data itself. Consumers import the hook
directly instead of reading preferences from the snapshot.
## Additional context
No behavioral or visual changes — localStorage key and data shape are
unchanged.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Storage view and sorting preferences now persist per project and drive
the explorer UI.
* Changing view or sort preferences refreshes folder contents and clears
the open file preview.
* **Chores**
* Centralized preference handling for consistent behavior across the
storage explorer.
* **Tests**
* Updated tests to exercise the new preference-backed behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
INDATA-193
BACKEND: <https://github.com/supabase/platform/pull/30575>
<img width="1199" height="1005" alt="Screenshot 2026-04-03 at 11 54 29"
src="https://github.com/user-attachments/assets/38e9d676-449f-45c0-9e07-f273312a812f"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Consolidated read replica limit configuration to provide more
consistent behavior across different compute tiers.
* **Tests**
* Added comprehensive test coverage for read replica eligibility checks
and replica limit calculations based on compute tier.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Show Vercel/AWS partner badge on organization selection cards, matching
the existing behaviour in the org dropdown switcher. Uses the existing
`PartnerIcon` component.
**Added:**
- `PartnerIcon` to `OrganizationCard` – renders alongside the MFA lock
icon on the right side of each card
<img width="626" height="275" alt="Screenshot 2026-04-03 at 5 36 54 PM"
src="https://github.com/user-attachments/assets/f3cd2eb4-bf9d-4b42-b94c-e4636ebf7303"
/>
## To test
- Verify Vercel-managed orgs show the Vercel triangle badge
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Partner icon now appears in the organization card header next to the
MFA/security indicator.
* **Style**
* Improved alignment and spacing of header elements; MFA tooltip now
appears alongside the icon with consistent sizing.
* Cleaner grouping of header metadata for easier scanning and visual
clarity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature and docs.
## What is the new feature?
Adds a toggle to enforce current password checks for updating a user's
password (auth)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added configurable option to require the current password when
changing passwords.
* Added configurable option to require recent reauthentication before
allowing password changes.
* **Documentation**
* Added "Password security" guide sections documenting current-password
verification and reauthentication safeguards, with usage examples.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
## Summary
- Coerces `before`/`after` cost values to `Number()` in
`QueryPanelScoreSection` and `calculateImprovement` before any
comparison or arithmetic
- Fixes contradictory index advisor display where correct cost numbers
showed 0% improvement and wrong arrow direction
## Root Cause
When `index_advisor_result` is prefetched from the Reports SQL query
(via `json_build_object`), cost values can arrive as strings instead of
numbers. JavaScript string comparison is lexicographic, producing wrong
results:
| Expression | Numbers | Strings |
|---|---|---|
| `after > before` (arrow) | `50 > 100` → `false` ✅ | `"50" > "100"` →
`true` ❌ |
| `costBefore <= costAfter` (improvement calc) | `100 <= 50` → `false` ✅
| `"100" <= "50"` → `true` ❌ |
The direct fetch path (`retrieve-index-advisor-result-query.ts`)
validates through Zod and is unaffected. Only the prefetched path lacks
validation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved numeric value handling in query performance calculations to
ensure more accurate and reliable improvement metrics.
* **Refactor**
* Enhanced type safety and numeric coercion for query performance score
comparisons, resulting in more consistent and robust metric
calculations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
When enabling Apple Sign-in in Studio, the form requires a valid JWT
secret key whenever a client ID is provided. This blocks users who only
use Apple native sign-in (iOS, macOS, watchOS, tvOS), where only the
client ID (bundle ID) is needed and no secret is required.
Resolves AUTH-1138
## What is the new behavior?
The secret key field is now optional, matching Google's provider
behavior. JWT format validation still applies when a secret is provided,
but leaving it empty is allowed. This supports native-only Apple sign-in
configurations.
## Additional context
The validation was simplified from two `.when` clauses (dependent on
both `ENABLED` and `CLIENT_ID`) to a single `.when` (dependent only on
`ENABLED`), matching the pattern used by the Google provider.
## What kind of change does this PR introduce?
Design system and validation consistency update.
## What is the current behaviour?
`KeyValueFieldArray` already renders per-cell form messages, but each
consumer still decides its own validation rules. At the moment, some
consumers allow partially filled rows to submit silently, while Log
Drains now treats them as inline validation errors.
## What is the new behaviour?
This PR standardises the recommended partial-row behaviour for the
current `KeyValueFieldArray` consumers by introducing a shared
validation helper and using it from each form schema.
- adds `getKeyValueFieldArrayValidationIssues` alongside
`KeyValueFieldArray`
- keeps `KeyValueFieldArray` presentation-only and leaves validation in
consumer schemas
- shows inline errors when one side of a key/value row is filled and the
other is empty
- keeps fully empty rows as draft rows
- keeps duplicate-key validation in Log Drains, where it already applies
- updates the design-system docs and examples to describe the validation
pattern explicitly
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added reusable key/value validation utilities and public export; forms
now trim header/key/value inputs, show inline errors for partially
filled rows, and remove fully empty draft rows on submit.
* **Documentation**
* Clarified the field-array is rendering-only and added guidance for
placing validation in form schemas and handling draft rows.
* **Tests**
* Added unit and integration tests covering validation rules, duplicate
keys, trimming, draft-row stripping, and payload behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Chore that resolves FE-2785.
## What is the current behavior?
The Log Drains headers section still uses a bespoke add-header mini form
and stores headers directly as a record in form state.
That makes it inconsistent with the shared `KeyValueFieldArray` pattern
already adopted elsewhere in Studio.
## What is the new behavior?
- reuses the shared `KeyValueFieldArray` in the Log Drains destination
sheet
- keeps the external submit contract unchanged by converting between:
- form-only `headerEntries: { key, value }[]`
- submitted `headers: Record<string, string>`
- preserves type-specific defaults:
- webhook starts with `Content-Type: application/json`
- OTLP starts with `Content-Type: application/x-protobuf`
- moves header validation into standard form errors for:
- max 20 headers
- duplicate header names
- partially filled rows, while still allowing fully empty draft rows
- adds focused utility and sheet tests for the new adapter and
validation behaviour
| Before | After |
| --- | --- |
| <img width="1728" height="997" alt="Log Drains Settings Mallet
Toolshed Supabase-027E4669-8B02-4C43-8771-794E13799FA3"
src="https://github.com/user-attachments/assets/43ed6334-28ef-4d47-9747-dfb3221462ec"
/> | <img width="1728" height="997" alt="Log Drains Settings Mallet
Toolshed Supabase-68477EA1-6F56-4BE2-9355-C121896F11E4"
src="https://github.com/user-attachments/assets/9391bccd-3a50-4468-91e7-05059d41543c"
/> |
## Additional context
This is PR 4 of the DEPR-394 field-array stack.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Enhanced header validation with specific error messages for duplicate
headers and missing values.
* Improved form behavior for edge cases in header entry management.
* **New Features**
* Added destination-specific default headers for clearer initial
configuration.
* **Tests**
* Added comprehensive test suite validating header management and form
submission behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Bug fix / UX improvement for long-running project transitions. Resolves
DEPR-362.
## What is the current behaviour?
- `PausingState` does not preserve elapsed time across refreshes, so the
stuck escalation can disappear for the same user.
- `RestoringState` relies on weaker frontend heuristics and always
showed a support CTA in the footer even before the restore was clearly
long-running.
## What is the new behaviour?
- `PausingState`
- Persists a per-project pause start time in local storage so the stuck
CTA survives refreshes in the same browser.
- Escalates after 10 minutes.
- Clears the stored timer when pausing succeeds or fails.
- `RestoringState`
- Persists a per-project restore start time in local storage so the
stuck CTA survives refreshes in the same browser.
- Removes the always-visible footer CTA and only escalates once
restoration is genuinely long-running.
- Computes the long-running threshold from volume size using a shared
restore estimate: `max(10, ceil(estimateRestoreTime(sizeGb) * 1.5))`.
- Clears the stored timer when restoration succeeds or fails.
- Shared changes
- Extracts reusable transition timing helpers and restore estimate
helpers with unit tests.
- Reuses the same restore estimate formula for branch restore timing and
restore escalation, so the two do not drift.
| `PausingState` | `RestoringState` |
| --- | --- |
| <img width="1570" height="906" alt="Krosno Toolshed
Supabase-C6D7E29F-C38D-43E1-8AF9-C612B6A2FD8D"
src="https://github.com/user-attachments/assets/e0bd9434-09b6-4cf6-bffa-07a0ddcdf5db"
/> | <img width="1570" height="906" alt="Krosno Toolshed
Supabase-51F4763D-B798-4B41-A92D-43B3CF8ECDAF"
src="https://github.com/user-attachments/assets/d0e47356-dcc3-42aa-b602-802a35249a16"
/> |
## Additional context
- This PR intentionally stays frontend-only.
- We are not exposing backend lifecycle timestamps here; local storage
is the stopgap to improve the same-browser experience now.
- If you need to test the frontend blocker states locally, use
[`dnywh/chore/depr-362-blocker-preview-mocks`](https://github.com/supabase/supabase/tree/dnywh/chore/depr-362-blocker-preview-mocks)
and append one of the following query params to a project URL:
- `?mockProjectBlockingState=pausing`
- `?mockProjectBlockingState=pausing-long-running`
- `?mockProjectBlockingState=restoring`
- `?mockProjectBlockingState=restoring-long-running`
- I know these two views are quite differently stylistically, and will
consolidate later
- References DEPR-434
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
We had some bugs where webhooks were not able to be turned on for
projects. This is to ensure that doesn't happen again
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added UI tests for integration overview and installation flows: verify
action enablement/disablement (aria-disabled and visual opacity)
depending on required extensions, ensure the "Install integration"
button is disabled when no installation command or required extensions
are missing, and confirm the installation command is invoked (without
executing SQL) when appropriate.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Problem
- The legacy jwt settings still uses `formik` and we want to remove it
in favour of `react-hook-form` to keep only one form library
- The legacy jwt settings does not follow the design system guidelines
## Solution
- Migrate to `react-hook-form`
- Apply the design system guidelines
## How to test
To test the custom JWT secret, I haven't found a better way than
inverting the condition at L337 (`!legacyKey` to `legacyKey`). This
allowed me to ensure the process worked at least up to the API call
which fails with my local instance as legacy tokens aren't supported
anymore.
## Screenshots
Before:
<img width="1199" height="599" alt="image"
src="https://github.com/user-attachments/assets/1c6e0bb1-0698-4238-847f-d2c72adf3462"
/>
After:
<img width="1228" height="646" alt="image"
src="https://github.com/user-attachments/assets/3b2a45a9-aa43-4c3e-9653-2b2610616889"
/>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
## Summary
- Adds 6 Playwright E2E tests for queue integration: view page, create
basic queue, create unlogged queue, delete queue, purge messages, and
send test message
- Adds `aria-label` to icon-only Purge and Delete buttons in
`QueueTab.tsx` for reliable test selectors
- Follows existing `cron-jobs.spec.ts` patterns for setup/teardown and
API helpers
## Test plan
- [x] All 6 queue integration tests pass locally against self-hosted
Supabase
- [x] Tests run stably in parallel (3 workers)
- [x] Cleanup via `withSetupCleanup` ensures no leftover test queues
## Problem
Project cards on the home page showed resource exhaustion warnings
twice: once as a badge in the card header, and again as an alert in the
card footer. This created a confusing, redundant UI as seen when a
project has disk IO, CPU, or other resource warnings active.
## Fix
Removed `resourceWarnings` from the footer `ProjectCardStatus` render in
`ProjectCard.tsx`. Resource exhaustion state now only appears as the
header badge (which already shows a tooltip with the description on
hover). Project status indicators such as paused or restarting still
appear in the footer since those do not depend on resource warnings.
Also removed the dead `showResourceExhaustionWarnings = false` flag from
`ProjectCardStatus.tsx`, which was hardcoded to false and only gated
description text that was no longer reachable.
## How to test
- Navigate to the org home page with a project that has an active
resource warning (disk IO, disk space, CPU, memory, or read-only mode).
- Confirm the warning badge appears in the card header with the correct
color (warning or critical).
- Confirm no duplicate alert appears in the card footer area.
- Confirm that paused or restarting projects still show the status alert
in the footer.
- Confirm the table view still shows the badge correctly in the status
column.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
**Style**
- Project status information now displays exclusively in the project
card footer, removing redundant header display for a cleaner interface.
- Simplified resource warning notification logic for more consistent and
straightforward warning presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Updates the tooltip copy for `public` pills in Storage. More accurate
description.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Unified the tooltip text for "Public" buckets across the storage
interface so the same explanatory message appears consistently on bucket
listings, badges, and bucket pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Release Notes
* **New Features**
* Added project acknowledgement flow when deleting organizations. Users
with 10 or fewer projects must confirm each project individually; users
with more than 10 projects can confirm all at once.
* Organizations now display project counts and compute sizes during
deletion confirmation to help users understand what will be deleted.
## What kind of change does this PR introduce?
**Improvements to the delete organization workflow:**
* Added a checklist that requires users to acknowledge each project
before deleting organizations with up to 10 projects, and a single bulk
acknowledgement for organizations with more than 10 projects. This helps
prevent accidental deletion of projects.
* Extracted acknowledgement UI into dedicated sub-components
(`DeleteOrganizationButton.ListAck.tsx` and
`DeleteOrganizationButton.SingleAck.tsx`).
**Error handling and validation:**
* Acknowledgement state (`checkedProjects`/`acknowledgedAll`) is reset
synchronously in the button's click handler before the modal opens,
preventing any stale checked state from briefly appearing on re-open.
* Acknowledgement state is also reset when the organization changes
(`orgSlug` effect), ensuring a fresh confirmation when switching orgs.
* Deletion is blocked while projects are loading **or fetching**
(including background refetches triggered by `refetchOnMount:
'always'`), preventing deletion from proceeding on stale or incomplete
project data.
* Added error handling for project loading failures, and prevented
deletion if projects are not fully acknowledged or if there is a
loading/error/fetching state.
## What is the current behavior?
No explicit confirmation from the user to acknowledge all the projects:
<img
src="https://github.com/user-attachments/assets/68840781-467b-41ef-a821-50e471e93cc5"
width="500">
## What is the new behavior?
Small org (≤10): all projects load and checklist works
<img
src="https://github.com/user-attachments/assets/9869e94c-6a6f-4d65-8550-55da58a388f2"
width="500">
Large org (>10): show one checkbox
<img
src="https://github.com/user-attachments/assets/8420dfd1-814a-4656-acad-7fa00b088e83"
width="500">
## Additional context
* Projects are fetched lazily (`enabled: isOpen`) so no unnecessary
network requests occur until the delete modal is opened.
* The delete guard now checks both `isLoading`, `isProjectsDataPending`
and `isFetching` to cover background refetch scenarios where cached data
may be stale.
* Added explicit handling for the “pending but not loading” case to
avoid misleading users with acknowledgement errors before projects are
loaded.
* Limited project fetch size to MAX_PROJECT_ACKNOWLEDGEMENTS + 1 to
reduce payload and improve modal load performance.
* Acknowledgement state is reset both on modal open and when the
organization changes (orgSlug), ensuring consistent behavior across org
switches.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
search is passed in un-escaped
## What is the new behavior?
escapes to ensure correct query format
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
- Enhanced query safety and reliability in performance monitoring with
improved parameter handling
- Fixed query condition handling for edge cases with non-finite values
## Refactor
- Simplified query generation logic and streamlined internal
implementation
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
This PR introduces some visual indicators when a Nano project is
exhausting resources on Pro plus plans. The indicator tells the user a
free upgrade to Micro is available via a flashing Nano badge that guides
them to Upgrade and a global banner that notifies them resources are
near exhaustion, please upgrade for free.
| Project List | Project View |
|--------|--------|
| <img width="412" height="223" alt="Screenshot 2026-03-31 at 16 11 19"
src="https://github.com/user-attachments/assets/0d0e7727-e4eb-4ade-9024-528a2501596c"
/> | <img width="1256" height="618" alt="Screenshot 2026-03-31 at 16 11
10"
src="https://github.com/user-attachments/assets/b664e020-2b18-4842-8e64-4e49fac69eef"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Free Micro Upgrade banner appears for nano-tier projects near compute
exhaustion with animated visuals and an “Upgrade for free” CTA.
* Compute badge highlights near-exhaustion with glow/shimmer and an
animated upgrade indicator; optional icon support added.
* Per-project banner dismissal is saved locally; dismissed banners
remain hidden.
* **Tests**
* Added tests covering banner display and dismissal scenarios.
* **Chores**
* Added local-storage keys and telemetry events for banner and upgrade
interactions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The Compute and Disk settings page shows all 12+ instance sizes (Nano
through >16XL) in a grid, which requires scrolling on smaller screens
like a 13" MacBook. This makes it impossible to see all three sections
(compute size, disk size, advanced settings) in a single view. Free tier
users have no need to see 8XL, 12XL, or 16XL options.
## Fix
Show only the first 6 compute sizes (Nano through XL) by default,
cutting the grid from 4 rows to 2 rows. Larger sizes (2XL and above,
plus the >16XL contact card) are revealed via a "Show all sizes" toggle
button below the grid. The grid auto-expands if the project is already
running on a large instance size so the selected option is always
visible.
## How to test
- Go to Settings > Compute and Disk on a project
- Verify only 6 cards are visible by default (Nano, Micro, Small,
Medium, Large, XL)
- Verify the Disk size and Advanced settings sections are visible
without scrolling on a 13" screen
- Click "Show all sizes" and verify the remaining sizes appear (2XL
through 16XL plus the >16XL contact card)
- Click "Show fewer sizes" and verify the grid collapses back to 6 cards
- On a project running 4XL or larger, verify the grid opens expanded by
default so the selected card is visible
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Compute size options now display in a compact view with a toggle to
expand and show all available sizes
* Auto-expands to reveal the currently selected compute size when it's
not visible in the initial view
* Enhanced loading state for improved visual clarity
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
### Summary
This PR refactors the billing address form to use Stripe AddressElement
on both the org billing page and the missing-address modal, adding
Google Maps autocomplete and country-aware state/province inputs.
### Testing
- Address element renders on org billing page, autocomplete works, and
state/province options update per country.
- Existing billing address data loads correctly into the form.
- Need to verify this with invalid country/state as well.
- Save enables only when the form is dirty after editing address or tax
ID fields.
- Cancel restores both address and tax ID to the original values.
- Submitting with missing required address fields shows a validation
toast.
- Tax ID options are filtered by the selected billing country.
- Tax-ID-only edits submit successfully without interacting with the
address form.
- Without billing write permission, address fields are read-only.
- Update billing address modal behaves the same as the org billing page.
- Address element appearance looks correct in both light and dark mode.
- Payment method form remains unchanged and still uses floating labels.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Billing form now uses Stripe Address Element via Stripe Elements with
an embedded custom font and theme-aware appearance; tax-ID entry remains
separate.
* **Bug Fixes**
* Stronger address validation and submit gating, improved dirty-state
tracking, explicit save confirmation and reset behavior, and clearer
error toasts on update failures.
* **Tests**
* Expanded tests covering hook behavior, address element validation,
submit gating, payloads, reset, and permission scenarios.
* **Style**
* Adjusted billing email form spacing/layout.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
For database extensions, previously dashboard would fire a separate call
just to retrieve the "default schema" for an extension via
`useDatabaseExtensionDefaultSchemaQuery` from the
`pg_available_extension_versions` table (the `schema` from this table
implies where the extension will be installed in)
## Changes involved
Am updating the `useDatabaseExtensionsQuery` to use a custom studio SQL
that will fetch this data in one request via a `LEFT JOIN`, so dashboard
no longer needs to fire a request to `pg_available_extension_versions`
each time we open the `EnableExtensionModal` since all the info we need
is loaded up front.
Have also validated that the cost of the custom studio SQL is low (6.8,
via explain analyze) so performance wise on the project's DB should be
okay.
This will then also allow us to correctly render the "default schema" of
the extensions in the new Install Integration Sheet now that we have
that information up front.
## Misc fix
Also fixed a small issue on the database extensions page whereby if you
searched for an extension that's hidden (e.g pg_tle), there's no "No
results" UI state showing up
<img width="1112" height="319" alt="image"
src="https://github.com/user-attachments/assets/eb488117-2a24-4317-ad73-1d636f9b1bc8"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Per-extension default schema detection surfaced across install flows;
default schema options added to selectors when applicable.
* **Bug Fixes**
* Hidden extensions filtered out earlier so they no longer appear in
lists.
* Install button now correctly disables when required extensions are
missing.
* **Refactor**
* Consolidated extensions metadata retrieval and simplified schema
selection/validation logic; UI text formatting standardized.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds the following badge for Multigres projects:
<img width="716" height="377" alt="Screenshot 2026-03-27 at 4 54 40 PM"
src="https://github.com/user-attachments/assets/b8d7b3a5-4d6d-4b17-b18d-7f58c2e2b81c"
/>
<img width="688" height="392" alt="Screenshot 2026-03-27 at 4 54 48 PM"
src="https://github.com/user-attachments/assets/853a0ba7-de69-4476-b2ba-d596740e28ab"
/>
To test:
- ensure the badge doesn't show on non-multigres projects
- create a project with HA enabled and check the badge is visible
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a High Availability badge indicator to the project home view
that displays when a project has high availability enabled
* Hovering over the badge reveals detailed information about the high
availability configuration, including an animated server grid
visualization and a link to the high availability documentation
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ali Waseem <waseema393@gmail.com>
The Fly login/auth endpoints were removed from the management API
(supabase/platform#30987). This cleans up the associated studio code and
regenerates the API types.
Note: existing Fly projects are still running, so all `cloud_provider`
guards and Fly-specific UI (disk management, billing, pg_cron warnings,
etc.) are intentionally kept in place.
**Removed:**
- `sign-in-fly-tos.tsx` page
- `organization-by-fly-organization-id-mutation.ts`
- `project-by-fly-extension-id-mutation.ts`
**Other:**
- Regenerated API types to reflect removed endpoints
- Removed stale Fly-related comments in `InstanceConfiguration`,
`ObservabilityMenu`, `ReportsMenu`
- Fixed unrelated optional chaining bug in `SSOConfig.tsx`
## To test
- Check project creation flow still works
- Verify `/sign-in-fly-tos` no longer resolves
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
<img width="1575" height="1134" alt="image"
src="https://github.com/user-attachments/assets/994b1113-717f-44a2-89a4-13bc0182db20"
/>
Attempts to improve our edge function overview pages to provide stronger
insights into the health of a function, including reliability (error
rates), performance (execution times) and usage (cpu and memory).
As part of this work it refactors existing charts to use our new chart
components.
main consideration is the collective performance of error queries
https://github.com/supabase/supabase/pull/44009/changes#diff-2a79cf61c5397a8ef363c333229fa7729a2efc90a4d8e0806e49c212d5aa97e7
## To test:
1. Create an edge function that errors out randomly across requests. You
can use cron to poll this function every second.
2. View the edge function and on the overview page confirm that errors
are showing and grouped correctly in recent failed invocations sections.
---------
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## What kind of change does this PR introduce?
Chore that resolves DEPR-394.
## What is the current behavior?
This stack is consolidating RHF field-array patterns in smaller
reviewable steps.
After the key/value work lands, repeated single-value inputs are still
implemented separately across auth and SSO forms, and the design-system
docs only document the key/value pattern.
## What is the new behavior?
- adds a shared `SingleValueFieldArray` component in `ui-patterns`
- migrates repeated single-value inputs in:
- Redirect URL allow-list modal
- OAuth app redirect URIs
- SSO domains
- SSO attribute mapping
- documents the single-value pattern in the design system with:
- a dedicated fragment page
- updated forms guidance
- updated form pattern demos
- adds focused redirect URL modal coverage
## Additional context
This is PR 3 of a 3-PR stack for DEPR-394.
Base PR: #44058
Bug fix
## What is the current behavior?
Cron jobs using pg_cron's `$` syntax (representing 'last day of month')
show 'Unable to parse next run for job' in the dashboard's Next run
column, even though these are valid pg_cron schedules.
## What is the new behavior?
The dashboard now correctly parses schedules using `$` and displays the
proper next run time.
## Root Cause
pg_cron uses `$` for 'last day of month', but the `cron-parser` library
used by Studio uses `L` for the same purpose. The `$` character was
causing the parsing to fail.
## Fix
Normalize pg_cron's `$` syntax to cron-parser's `L` syntax before
parsing. Both represent 'last day of month' - it's just a syntax
difference between the two systems.
Fixes#42176
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved cron job scheduling to correctly calculate next-run times for
pg_cron-compatible schedule expressions.
---------
Co-authored-by: Charis <26616127+charislam@users.noreply.github.com>
## Summary
- Fixes the "Enable webhooks" button being greyed out in the
non-marketplace UI
- PR #44277 added `requiredExtensions: ['pg_net']` for the new UI, which
inadvertently caused the old UI's actions area to get disabled via
`hasToInstallExtensions`
- Skips the disabled styling when `hideRequiredExtensionsSection` is
set, since webhooks handles `pg_net` installation server-side
Companion to #44402 which fixed the same issue in the new (V2) UI.
## Summary
- The "Install integration" button in `InstallIntegrationSheet` was
unconditionally disabled when required extensions were missing from the
DB image (`hasMissingExtensions`)
- For webhooks, the installation goes through `installationCommand`
(platform API `/database/{ref}/hook-enable`) which handles `pg_net`
setup server-side — the client-side extension check is unnecessary
- Now only disables the button for missing extensions when there is no
custom `installationCommand`
## How this happened
PR #44277 migrated Database Webhooks to the new marketplace integrations
UI. The `InstallIntegrationSheet` already had a
`disabled={hasMissingExtensions}` guard from its original implementation
(for extension-only integrations like queues). When webhooks was added
with its `installationCommand` + `requiredExtensions: ['pg_net']`, the
guard wasn't updated to account for the command-based install path.
## Test plan
- [ ] With marketplace flag enabled, verify the "Install integration"
button is clickable for webhooks even if `pg_net` is not pre-installed
- [ ] Verify clicking it successfully enables webhooks via the platform
API
- [ ] Verify that extension-only integrations (e.g. queues) still
correctly disable the button when extensions are unavailable
Fixes FE-2928
## Problem
On self-hosted Supabase instances where the `pg_stat_statements`
extension is not installed, the Observability Overview page
automatically queries the extension on every page load. This produces
"relation pg_stat_statements does not exist" errors in Postgres logs for
all projects without the extension. Additionally, if a user navigated to
the Query Performance page, they received a generic error with no
actionable guidance. A secondary issue allowed malformed sort URL params
(e.g. `?sort=created_at:asc&order=asc`) to be interpolated directly into
SQL ORDER BY clauses.
## Fix
- Wrapped the `useSlowQueriesCount` SQL in a `CASE WHEN EXISTS (SELECT 1
FROM pg_extension WHERE extname = 'pg_stat_statements')` guard. The
query now returns 0 silently instead of erroring when the extension is
absent.
- Added a `VALID_SORT_COLUMNS` whitelist in
`generateQueryPerformanceSql`. Invalid column names from URL params are
rejected and the query falls back to the preset default ORDER BY.
- When the Query Performance page fails because `pg_stat_statements`
does not exist, a `warning` admonition now appears with "Enable it in
Database -> Extensions" guidance instead of a generic destructive error.
The Sentry capture is skipped for this expected configuration state.
- Extracted `buildSlowQueriesCountSql` as a testable function and added
unit tests for both fixes.
## How to test
**Extension not installed (self-hosted):**
1. Run a self-hosted Supabase instance without the `pg_stat_statements`
extension enabled.
2. Navigate to the Observability Overview page.
3. Check Postgres logs -- no "relation pg_stat_statements does not
exist" errors should appear.
4. Navigate to the Query Performance page.
5. Expected: a yellow warning admonition appears saying the extension is
not enabled, with a link to Database -> Extensions. No red error.
**Extension installed (normal flow):**
1. With `pg_stat_statements` installed, navigate to Observability
Overview.
2. Expected: slow queries count loads as normal.
3. Navigate to Query Performance -- data loads as normal.
**Invalid sort URL param:**
1. Navigate to
`/project/<ref>/observability/query-performance?sort=created_at:asc&order=asc`.
2. Expected: the page loads and falls back to the default sort order
(total time descending). No SQL error in logs.
**Unit tests:**
```
node apps/studio/node_modules/vitest/dist/cli.js run --no-coverage \
apps/studio/components/interfaces/Observability/useSlowQueriesCount.test.ts \
apps/studio/components/interfaces/QueryPerformance/useQueryPerformanceQuery.test.ts
```
All 28 tests should pass.
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
When importing a CSV file, empty cells were always imported as empty
strings with no way to import NULL values instead. This adds a "Treat
empty cells as NULL" checkbox to the import configuration panel.
When enabled, PapaParse's transform option converts empty strings to
null before the data is parsed and previewed, so the imported rows
correctly contain NULL rather than empty strings.
Fixes#43258.
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
Empty cells in a CSV file are always imported as empty strings with no
way to import NULL values instead. Fixes#43258.
## What is the new behavior?
"Treat empty cells as NULL" checkbox is added to the import
configuration panel. When enabled, empty cells are imported as NULL
instead of empty strings. Toggling the checkbox instantly re-parses the
preview.
## Additional context
The fix uses PapaParse's transform option to convert empty strings to
null before parsing. Applies to both file uploads and pasted text.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
## Summary
Remove the privacy policy update notification banner that was added for
the March 2026 policy update. The effective date has passed and users
have had sufficient notice.
## Changes
- Remove `PrivacyUpdateBanner` component from `AnalyticsSettings.tsx`
and its unused imports
- Remove banner usage from the organizations list page and org projects
page
- Remove `PRIVACY_NOTICE_ACKNOWLEDGED` localStorage key
## Testing
No setup needed - this is a removal of UI elements.
Tested on Vercel preview:
- [x] Organizations page loads without the banner
- [x] Org projects page loads without the banner
- [ ] No console errors on either page
- [x] Analytics settings page still renders correctly
## Linear
- fixes GROWTH-692
Charis