mirror of
https://github.com/supabase/supabase.git
synced 2026-10-14 13:49:09 +03:00
chore/function-recent-errors
5505
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Jordi EnricandClaude Opus 4.7
|
c595a22eb3 |
fix(studio): unified logs status color consistency DEBUG-113 (#46450)
## Problem
In the unified logs UI, the status badge for a Postgres row showed a
different color in the detail view than in the table view. The table
view colors by the row's pre-computed `level` (derived in SQL from
`severity_text`), so a Postgres ERROR row's SQL state code (e.g.
`42P01`) renders red. The detail view re-derived the level via
`getStatusLevel(value)` which only handles HTTP numeric codes.
`Number('42P01')` is `NaN`, every branch fell through, and the badge
always rendered neutral regardless of severity.
## Fix
Color the status badge in the detail view by `data.level`, the same
canonical row level the table view uses. Threaded `level` through
`FieldValue` and used `data.level` directly in `BlockField`.
`getStatusLevel` is still used by the Webhooks platform views, where
`responseCode` is always a numeric HTTP status, so those callers stay
correct.
## How to test
- Open the dashboard and navigate to a project's unified logs page.
- Filter to `log_type: postgres` and find an ERROR row.
- Confirm the status code (a SQL state like `42P01`) is colored red in
the table.
- Click the row to open the detail pane and confirm the Status field in
the Postgres block is also red.
- Repeat with a WARNING-severity Postgres row, confirming both views
render warning color.
- Sanity check a 5xx HTTP row (PostgREST or Storage) still shows red in
both views, and a 2xx row stays neutral in both.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved consistency in how log level context is propagated through
logging interface components, enabling more uniform formatting and
rendering behavior across the unified logs display.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46450?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
|
||
|
Alaister YoungandAlaister Young
|
b0d023bd04 |
fix(studio): remove default DataGrid borders across studio surfaces (#46448)
Follow-up to #46413, which fixed an unwanted top border on the Auth Users grid by upgrading `border-t-0` → `border-t-0!` so the Tailwind rule actually wins over react-data-grid's `.rdg { border: 1px solid var(--rdg-border-color); }` shorthand. The same issue exists on every other DataGrid in Studio — this applies the fix consistently. **Changed:** - `border-t-0! border-b-0!` applied to all `<DataGrid>` call sites in Studio (11 in total) Fixes this issue everywhere: <img width="609" height="223" alt="Screenshot 2026-05-28 at 3 40 02 PM" src="https://github.com/user-attachments/assets/f49d8849-dd58-4675-ade4-a2656aadb8f9" /> ## To test Spot-check that the top/bottom borders look right (no doubled border under the page chrome, no extra line at the bottom of the table) on each route below. Use any project ref for `[ref]`: - `/project/[ref]/observability/query-performance` — main grid + the WithStatements grid inside - `/project/[ref]/observability/query-insights` — both modes (explorer + triage) - `/project/[ref]/advisors/security` - `/project/[ref]/advisors/performance` - `/project/[ref]/integrations/cron/jobs` — jobs list - `/project/[ref]/integrations/cron/jobs/<jobName>` — previous runs tab - `/project/[ref]/integrations/queues/queues` — queues list - `/project/[ref]/integrations/queues/queues/<queueName>` — single queue messages - `/project/[ref]/integrations/vault/secrets` - `/project/[ref]/sql/new` — results pane at the bottom - `/project/[ref]/realtime/inspector` - `/project/[ref]/logs/explorer` — and the preview pages: `auth-logs`, `edge-logs`, `postgres-logs`, `cron-logs`, `pg-upgrade-logs`, `postgrest-logs`, `realtime-logs`, `replication-logs`, `pgcron-logs`, `storage-logs`, `edge-functions-logs`, `pooler-logs`, `dedicated-pooler-logs` - `/project/[ref]/functions/[functionSlug]/logs` and `/invocations` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Refined border styling on data grids across multiple features including integrations, query tools, and logs for improved visual consistency. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46448?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Alaister YoungandAlaister Young
|
29af5308f3 |
[FE-3493] fix(studio): respect role impersonation when copying truncated rows (#46442)
Copy/export of selected rows in the Table Editor refetches full values for cells truncated in the grid (via `getCellValue`), but that refetch was bypassing role impersonation. The main grid query respects the impersonated role; the truncated-cell hydration didn't, so the copy could fetch as the service role even when "View as <role>" was active – an inconsistency, since the UI still indicates the impersonated role is in effect. Threads `roleImpersonationState` through `hydrateTruncatedRows` → `getCellValue`, and wraps the SQL in `wrapWithRoleImpersonation` (matching how `getTableRows` does it). Addresses FE-3493. **Changed:** - `getCellValue` accepts an optional `roleImpersonationState` and wraps its SQL with `wrapWithRoleImpersonation` + flags `isRoleImpersonationEnabled` on `executeSql` - `hydrateTruncatedRows` threads `roleImpersonationState` through to `getCellValue` - `Header.tsx`'s `onCopyRows` passes the in-scope `roleImpersonationState` into `hydrateTruncatedRows` ## To test 1. Open the Table Editor on a table with a row containing a large/truncated string value and a primary key 2. Enable role impersonation → "View as role" → pick any role with read access to the table 3. Select the row, then `Copy → Copy as JSON` (also try CSV / SQL) 4. The copy should succeed and contain the full (non-truncated) value 5. Inspect the SQL request – it should now be wrapped with the impersonation context, matching how the main grid query is wrapped Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
|
a45776ecb9 |
feat(studio): restrict auth email template editing for free projects (#45396)
## What kind of change does this PR introduce? Feature / abuse-prevention update. Resolves DEPR-198. ## What is the current behaviour? Free projects using Supabase's built-in email service can edit raw Auth email template subjects and HTML in Studio. That is the risky cohort this project is trying to constrain. ## What is the new behaviour? ### Template editing restrictions For free projects using Supabase's built-in email service, Studio keeps Auth email templates viewable and previewable but disables subject/body editing and saving. Editing is unlocked by setting up Custom SMTP, configuring a send-email hook, or upgrading to a paid plan. **Grandfathering:** projects created before `2026-06-01T00:00:00Z` (the platform enforcement cutoff) are exempt; their editing UI stays unlocked. This mirrors `FREE_TIER_TEMPLATE_BLOCK_CUTOFF_DATE` in the platform PR exactly. | After | | --- | | <img width="1024" height="759" alt="Emails Authentication Fizz Test Supabase-173BB09B-0FB9-4133-8202-9E310DDB347A" src="https://github.com/user-attachments/assets/c966212d-ed0c-443b-8197-440cc2937ef6" /> | | <img width="1024" height="759" alt="Emails Authentication Fizz Test Supabase-CD5845EB-0E45-4779-8989-44E775B2411A" src="https://github.com/user-attachments/assets/055a64d6-b5e8-4d37-a261-6e280f04536a" /> | ### Warning dialogs on transitions that reset templates Two flows now surface a warning before the user commits to a state change that resets their custom email templates to defaults: 1. **Disabling custom SMTP** (SMTP settings page): a confirmation dialog warns that templates will be reset to defaults and the email rate limit reduced to 2 per hour. On confirm, Studio resets all 13 templates via the existing per-template reset endpoint (`Promise.allSettled`). The "won't be able to edit" sentence is shown only for post-cutoff projects; grandfathered projects skip it. The corresponding server-side enforcement is in the Platform PR: https://github.com/supabase/platform/pull/33129 2. **Downgrading to the Free plan** (billing settings): an admonition in the existing downgrade confirmation modal warns that custom templates will be reset to defaults and won't be editable without custom SMTP. The admonition is shown only when the org has at least one post-cutoff project; orgs whose projects are all grandfathered skip it. | Custom SMTP | Downgrading | | --- | --- | | <img width="862" height="586" alt="66764" src="https://github.com/user-attachments/assets/6470c8a6-2f79-40a5-ad3b-bfe5b0ba9c54" /> | <img width="1268" height="1552" alt="CleanShot 2026-05-22 at 17 28 37@2x-FEB1901E-38E6-42DF-8C27-0A036D8A1B94" src="https://github.com/user-attachments/assets/e8caa9e6-c3ed-4787-b771-af77a43eb854" /> | ### Informational admonition when enabling SMTP When a user enables custom SMTP for the first time, a sandwiched admonition above the save footer informs them that the email rate limit will be increased to 30 per hour and can be adjusted. _This is just a minor cosmetic change, unrelated to the email template disabling. Sorry._ | Before | After | | --- | --- | | <img width="1024" height="759" alt="Emails Authentication Chisel Toolshed Supabase-54317D18-803C-4A58-8211-2359355D083B" src="https://github.com/user-attachments/assets/29eff649-02dc-40f3-a379-0b4d484a76c7" /> | <img width="1024" height="759" alt="Emails Authentication Chisel Toolshed Supabase-9E12399E-E9FB-4F9A-B029-A08008EA4B50" src="https://github.com/user-attachments/assets/e542ed86-4da6-407e-8293-0f4c0f071e18" /> | ## How to test All existing projects pre-date the enforcement cutoff (`2026-06-01T00:00:00Z`) and are grandfathered, so the restriction UI won't appear by default. To force the restricted state locally, back-date the cutoff in one file: In `apps/studio/components/interfaces/Auth/EmailTemplates/EmailTemplates.utils.ts`, temporarily change: ```ts export const FREE_TIER_TEMPLATE_BLOCK_CUTOFF_DATE = '2026-06-01T00:00:00Z' ``` to: ```ts export const FREE_TIER_TEMPLATE_BLOCK_CUTOFF_DATE = '2025-01-01T00:00:00Z' ``` Revert before committing. With the cutoff back-dated, use a free-plan project and: - **Template restriction + admonition:** navigate to Authentication > Emails with no custom SMTP configured. Subject/body fields should be read-only and the "Set up SMTP" admonition should appear, with its dropdown offering upgrade and send-email hook options. - **SMTP disable warning:** enable custom SMTP on a project, then disable it via Authentication > SMTP Settings. The confirmation dialog should warn that templates will reset to defaults and that editing will be restricted after disabling. - **Downgrade warning:** in billing settings, initiate a downgrade to the Free plan. The downgrade modal should include an admonition warning about template reset and restricted editing (only if the org has at least one post-cutoff project). ## Additional context The default Auth email template copy was also improved across docs, examples, and UI library snippets (separate prior commits). The per-template reset button (`ResetTemplateDialog`) was migrated to the async `AlertDialogAction` pattern introduced in #45960; the dialog stays open and shows a loading state while the reset is in-flight, closes on success, and stays open on error. Closes PRODSEC-183 --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com> Co-authored-by: Stephen Morgan <stephen@doublethink.co.nz> |
||
|
Joshen Lim
|
5f4153d9e0 |
Adjust auth log detail pane in unified logs (#46372)
## Context Currently when opening an auth log, the log details panel is seemingly very empty Auth logs are pretty empty by their nature unlike the other logs so am opting to adjust the detail panel for them slightly ### Changes involved - Fixing passing `host` and `path` when rendering auth log details - Opting to only show "Network" + "Authentication" segments for auth (The other fields do not apply for auth logs) <img width="434" height="476" alt="image" src="https://github.com/user-attachments/assets/cf8bb128-2332-424a-a10e-a7e836acb7d5" /> - Make each section collapsible, allow users to adjust themselves how they want to consume the information <img width="421" height="474" alt="image" src="https://github.com/user-attachments/assets/e842bc79-edff-4ec6-ae38-a9249966881d" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Postgres connection and session info now appear in separate expandable sections for easier browsing * Auth-related fields (ID, status, path, referer) now extract and present richer, more accurate values * Request path and host resolution improved across service flow/network views * **Bug Fixes / Improvements** * Safer parsing of auth event messages and more robust fallbacks for missing fields * Cleaner row styling and section rendering for consistent visuals <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46372?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
42f1f19fdd |
feat(logs): brand SharedAPIReport SQL with SafeLogSqlFragment (#46405)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Security / refactor — migrates `SharedAPIReport.constants.ts` to the proven-authorship model (`SafeLogSqlFragment`). ## What is the current behavior? All seven SQL builders in `SHARED_API_REPORT_SQL` return plain `string` and interpolate filter values via `generateRegexpWhere`, which performs manual quoting without sanitization. The source table name (`edge_logs` / `function_edge_logs`) is also interpolated as a raw string. Queries are executed via a local `fetchLogs` function that calls `get()` directly, bypassing the `executeAnalyticsSql` wire boundary. ## What is the new behavior? - Each SQL builder is rewritten with the `safeLogSql` template tag and returns `SafeLogSqlFragment`. - Filter keys route through `quotedIdent` (predicates with invalid identifiers are dropped); values route through `analyticsLiteral` (single quotes and backslashes are escaped). - A `SOURCE_TABLE` branded map covers the two possible source tables; `sourceTable()` looks up the branded fragment instead of interpolating a raw string. - `fetchLogs` is removed; `useQueries` calls `executeAnalyticsSql` directly with `method: 'get'`, routing through the shared wire boundary. - The `queryFn` wraps the call in a try/catch that also checks `data?.error`, preserving the original Sentry capture behaviour (`'Shared API Report Error'`) for both network and API-level errors. ## Additional context |
||
|
Charis
|
0ab0106758 |
feat(logs): brand Reports logs presets with SafeLogSqlFragment (#46403)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / security hardening (part of a stacked series applying compile-time SQL provenance tracking to analytics call sites). ## What is the current behavior? The `queryType: 'logs'` presets in `PRESET_CONFIG` (API ×8, Storage ×2) build BigQuery SQL by splicing filter keys and values via plain string interpolation through `generateRegexpWhere`, with no compile-time guarantee that the output is injection-safe. `ReportQueryLogs.sql` returns `string` and `getLogsSql` returns `string`. ## What is the new behavior? - `generateRegexpWhereSafe` added to `Reports.constants.ts`: routes filter keys through `quotedIdent` (dropping predicates whose identifier fails the `[A-Za-z_][A-Za-z0-9_]*` regex) and values through `analyticsLiteral`. Values must be raw/unquoted — the function handles all quoting and escaping itself. - All ten `queryType: 'logs'` presets migrated to use the `safeLogSql` template tag and `generateRegexpWhereSafe`. - `ReportQueryLogs.sql` return type tightened from `string` to `SafeLogSqlFragment`; `getLogsSql` return type updated to match. - Manual pre-quoting of the `identifier` filter removed in `useApiReport` and `useStorageReport` (`value: \`'${identifier}'\`` → `value: identifier`), since `analyticsLiteral` now handles quoting. ## Additional context Smoke test: `/observability/api-overview`, `/observability/storage`. To exercise the replica `identifier` filter, select a replica on `/observability/database` first, then navigate to those pages. |
||
|
Alaister YoungandAlaister Young
|
d6835c4b42 |
[FE-3483] fix(studio): redirect OAuth callback errors to /sign-in (#46414)
OAuth/SSO callback failures (e.g. GitHub returning an email that collides with gotrue's `users_email_partial_key` constraint) were stranding users on `/sign-in-mfa` with the raw error rendered under the "Two-factor authentication" heading. They now redirect to `/sign-in`, where the error surfaces above the email form under "Welcome back" and the form stays interactive so users can fall back to email/password without refreshing. Addresses FE-3483. **Changed:** - `pages/sign-in-mfa.tsx`: redirect to `/sign-in` when `auth.initialize()` returns an error, instead of stopping the loader and rendering the error on the MFA page. The error is already captured in the shared `AuthProvider` state by `gotrueClient.initialize()` before the redirect, so it survives the navigation via `useAuthError()`. - `components/interfaces/SignIn/SignInForm.tsx`: render `useAuthError()` as an inline `AlertError` above the email/password fields. Form stays interactive so users hitting the duplicate-email case can use email sign-in inline. This is the "surgical" option from the ticket — option 3 (point the OAuth callbacks at `/sign-in` directly) is still the right long-term cleanup. ## To test 1. Visit `/sign-in-mfa#error=server_error&error_description=Database+error+saving+new+user` — should redirect to `/sign-in` with the error rendered above the email form under "Welcome back". 2. Type into the email/password fields — form should be interactive (this is the part the "replace the form" alternative would have broken). 3. Hard-reload `/sign-in` — no `AlertError`, normal form. 4. Sign in with a real email/password account that has MFA enabled — `/sign-in-mfa` should load normally with the "Two-factor authentication" heading and verification form. No redirect, no `AlertError`. 5. Try `/sign-in-mfa?returnTo=%2Forganizations#error=server_error&error_description=test` — after redirect the URL should be `/sign-in?returnTo=%2Forganizations` (query preserved, hash consumed by gotrue). Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Gildas Garcia
|
a6bfa0478c |
chore: migrate auth Modal to Dialog (#46392)
## Problem We still uses the deprecated `Modal` for: - Banning a user - Inviting a user - Adding a redirection URL - Removing a redirection URL ## Test Hard to test the JWT. I had to force its display by settings its `open` prop to `true` in `apps/studio/components/interfaces/JwtSecrets/jwt-settings.tsx` ## Solution - use `Dialog` instead <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Modernized authentication UI components (user management, redirect URL configuration) with updated dialog structures for improved consistency and state handling * Enhanced async operation handling in redirect URL deletion workflows to ensure proper synchronization and state management <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46392?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
9155357d82 |
chore: migrate Integrations Modal to Dialog (#46380)
## Problem We still use the deprecated `Modal` for: - Deleting a wrapper - Updating a vault secret - Sending a queue message ## Solution - use `Dialog` instead <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Replaced several modal dialogs with updated dialog/alert patterns for sending messages and confirming deletions, improving visual consistency and content structure. * **Bug Fixes** * Prevent duplicate/accidental actions by disabling buttons and showing loading states during pending operations; confirmation dialogs now display relevant item details and close on success. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46380?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
e26303cf9c |
chore: migrate billing Modal to Dialog (#46385)
## Problem We still use the deprecated `Modal` for: - Adding a new payment card - Deleting a payment a card - Changing the payment method - Displaying the spend cap details when creating a new org ## Solution - use `Dialog` instead <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Updated billing dialogs (add/change/delete payment methods and spend cap) to use a newer dialog/alert dialog system. * Result: more consistent dialog behavior, clearer confirmation flows, and improved handling of loading/confirmation states for payment actions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46385?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
ed921f36f7 |
feat(studio): streamline status health visual (#46274)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Just a little bit of design polish for the observability overview status health. | Before | After | |--------|--------| | <img width="963" height="714" alt="Screenshot 2026-05-22 at 14 15 03" src="https://github.com/user-attachments/assets/3d67d175-434b-48a6-b87b-15e074d2cc27" /> | <img width="1068" height="846" alt="Screenshot 2026-05-26 at 13 26 55" src="https://github.com/user-attachments/assets/c3f728ef-309c-42ec-9810-37bf6564a470" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added option to hide date range in logs bar charts. * **Improvements** * Redesigned service health table to a responsive card/grid layout with richer status indicators, improved charts, loading and empty states, and clearer per-service CTAs. * Chart empty state now renders title/description only when provided. * **Style** * Adjusted footer top padding for improved spacing. * **Chores** * Reordered import and service configuration entries (rendering order updated). <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46274?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Vaibhav
|
ec1b778ed8 |
fix: close log details (#46345)
- closes https://github.com/supabase/supabase/issues/46343 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed logs explorer to clear previously selected logs when running new queries, changing date ranges, or clicking chart elements, ensuring the selected log remains synchronized with the current search context. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46345?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
bde6a5e745 |
fix: auth users list design (#46413)
## Screenshots Before: <img width="856" height="1140" alt="image" src="https://github.com/user-attachments/assets/d1e04a6f-d3ed-43b3-84f1-3000f2ecac17" /> After: <img width="398" height="107" alt="image" src="https://github.com/user-attachments/assets/6b41663b-31ee-4556-b2e4-6847f705aa38" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Increased CSS specificity in the Users view to reliably remove the top border, ensuring consistent visual rendering across layouts and themes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46413?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
28eb347032 |
feat(studio): small modification to logs drawer rows (#46396)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Removes the `└` shaped character before each property. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated detail row layout in service flow display with refined spacing and removed visual connectors for improved readability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46396?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Pamela Chia
|
47c084e51d |
refactor(studio): migrate telemetry to useTrack (#46140)
## Summary
I migrated every `useSendEventMutation` call site in `apps/studio` to
`useTrack`, deleted the legacy hook, and added a lint guardrail so it
can't return. `useTrack` is the type-safe replacement: it auto-injects
`groups: { project, organization }` from the selected project/org and
types `action` + `properties` against `TelemetryEvent`. Existing call
sites built groups manually and were not type-checked at the action
level. The migration covers 81 files (60 trivial swaps, 9 org-only, 3
pre-auth, 5 bespoke, 4 test mocks).
## Changes
- Migrated trivial call sites across `pages/project/[ref]`,
`components/interfaces/*` (Reports, Storage, Realtime/Inspector,
SQLEditor, Functions, EdgeFunctions, Integrations, ProjectAPIDocs,
Branching/BranchManagement, TableGridEditor, Connect, Docs, Auth,
Support, Home, ProjectHome, App), `components/layouts/*`, and
`components/ui/*`.
- Migrated org-only sites (`Organization/Documents/*`,
`Organization/BillingSettings/Subscription/*`,
`Organization/SecuritySettings.tsx`,
`Account/Preferences/DashboardSettingsToggles.tsx`) by dropping the
manual `groups: { organization: ... }` and letting `useTrack`
auto-inject. Verified `useSelectedProjectQuery` is disabled on org
routes (gates on URL `[ref]`).
- Migrated pre-auth sites (`SignInForm.tsx`, `sign-in-mfa.tsx`,
`profile.tsx`) where neither project nor org is resolved.
- Bespoke handling:
- `execute-sql-mutation.ts` and `table-row-create-mutation.ts`: pass `{
project: projectRef }` via `groupOverrides` since the mutation can
target a non-selected project ref.
- `useStudioCommandMenuTelemetry.ts`: kept a direct `sendTelemetryEvent`
call because studio groups must override pre-built event groups
(opposite of `useTrack`'s override direction).
- `AIAssistantOption.tsx`: passes sentinel-aware `groupOverrides` so
`NO_PROJECT_MARKER`/`NO_ORG_MARKER` continue to suppress group emission.
- `SidePanelEditor.utils.tsx`: utility functions `createTable` and
`updateTable` now take a `track: Track` parameter (threaded from
`SidePanelEditor.tsx`); dropped the `organizationSlug` arg since groups
are no longer assembled manually.
- Branch-event attribution: preserved `parentProjectRef` overrides on
`branch_updated`, `branch_merge_completed`, `branch_merge_failed`,
`branch_merge_submitted`, `branch_delete_button_clicked`,
`branch_review_with_assistant_clicked`, and
`branch_*_merge_request_button_clicked`. Original code grouped these
under the parent (production) project, not the branch ref;
auto-injection would have shifted them onto the branch.
- Switched 4 test mocks from `@/data/telemetry/send-event-mutation` to
`@/lib/telemetry/track`. Removed obsolete tests around manual groups and
`try/catch` on telemetry rejection.
- Deleted `apps/studio/data/telemetry/send-event-mutation.ts`. The
deleted module is its own guardrail: any reintroduction of the import
fails at TypeScript module resolution before lint runs.
## Testing
Tested on preview deploy:
- [x] SQL editor `CREATE TABLE` fires `table_created` with method
`sql_editor` and `groups.project` set to the mutation's `projectRef`.
- [x] Table editor creates a table from the side panel; `table_created`
fires from `SidePanelEditor.utils` via threaded `track`.
- [x] Help button (`/project/[ref]/...`) fires `help_button_clicked`
with auto-injected project + org groups.
- [x] Sign-in form fires `sign_in` with empty groups (pre-auth,
expected).
- [x] Org documents page (`/org/[slug]/documents`) fires
`document_view_button_clicked` with org group only, no stale project
ref.
- [x] Command menu (`Cmd+K`) inside a project still fires
`command_menu_opened` with studio's project/org overriding any
event-supplied groups.
- [x] Support form "Ask the Assistant" without selected org fires
`ai_assistant_in_support_form_clicked` with no project/org groups
(sentinels suppress).
- [x] On a branch, "Update branch" / "Merge branch" / "Close merge
request" events fire with `groups.project` set to the parent project
ref, not the branch ref.
Local checks:
- [x] 22/22 tests pass across the 4 updated test files
(`SidePanelEditor.utils.createTable`, `EdgeFunctionRenderer`,
`LayoutSidebar`, `PlanUpdateSidePanel`).
- [x] `rg useSendEventMutation apps/studio` returns 0 hits.
## Linear
- fixes GROWTH-860
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Standardized telemetry across the Studio to a unified tracking system;
events now send simplified payloads with less contextual/grouping data.
* No user-facing flows changed; UI behavior, permissions, and
interactions remain the same.
* **Tests**
* Updated telemetry mocks and tests to align with the new tracking
approach.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46140?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Joshen Lim
|
67997f088d |
Reduce z index on row selection header (#46360)
## Context `RowSelectionHeader` was unnecessarily using a 99 z-index value which was conflicting with the tooltips, so reducing it down to 2 which should be all that we need ### Before <img width="558" height="280" alt="image" src="https://github.com/user-attachments/assets/362be2df-aca7-4cb9-9bfb-84e77dac06ab" /> ### After <img width="374" height="161" alt="image" src="https://github.com/user-attachments/assets/118c8411-f25c-4513-9cce-2d24dcc71759" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated the z-index layering of the selected-rows overlay header component. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46360?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ignacio Dobronich
|
1c7af66fc7 |
fix: omit branching params when org lacks entitlement (#46388)
## Summary - On the Free plan the GitHub integration form disables the branching section, but the create/update payloads still included `branch_limit`, `new_branch_per_pr`, and `supabase_changes_only`. - These three fields are now only sent when the org has the `branching_limit` entitlement. ## Manual testing - [ ] As a Free plan org, open Project Settings → Integrations → GitHub and connect a repository. In the network tab, verify the `POST /platform/integrations/github/connections` request body does **not** include `branch_limit`, `new_branch_per_pr`, or `supabase_changes_only`. - [ ] Still on a Free org, edit the working directory / production branch on an existing connection. Verify the `PATCH` body also omits those three fields. - [ ] As a Pro (or higher) plan org with branching enabled, repeat both flows and confirm the three branching fields are still sent with the values from the form. - [ ] Confirm the UI itself is unchanged: the branching controls remain disabled on Free and editable on Pro+. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed GitHub integration to conditionally send branching-related configuration fields based on user access permissions, preventing unnecessary data transmission for users without branching access. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46388?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
a7d51cdf52 |
feat(logs): brand legacy analytics SQL stack with SafeLogSqlFragment (#46351)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / type safety improvement ## What is the current behavior? The legacy log query stack (`genDefaultQuery`, `genCountQuery`, `genChartQuery`, `genWhereStatement`, `useLogsPreview`, `useSingleLog`) builds SQL from raw strings with no type-level guarantee that values are safely interpolated. Identifier helpers (`bqIdent`, `bqDottedIdent`, `clickhouseIdent`, `clickhouseDottedIdent`) are duplicated across BigQuery and ClickHouse variants, and `bqDottedIdent` wraps the entire dotted path in one backtick pair (`` `request.pathname` ``), which BigQuery treats as a literal column name rather than a UNNEST alias field — causing runtime query failures on dotted filter keys. ## What is the new behavior? - All gen functions return `SafeLogSqlFragment` and all callers route through `executeAnalyticsSql`, enforcing compile-time SQL provenance tracking across the legacy stack. - `bqIdent` / `bqDottedIdent` / `clickhouseIdent` / `clickhouseDottedIdent` are replaced by a single `quotedIdent` function that backtick-quotes each segment individually (e.g. `` `request`.`pathname` ``). ClickHouse natively accepts backticks, so one function serves both engines and the dotted-path quoting bug is fixed. - `SQL_FILTER_TEMPLATES` entries are converted to `SafeLogSqlFragment` (static via `safeSql`, dynamic via `safeSql` + `analyticsLiteral`). - `buildWhereClauses` is extracted as a private helper returning `SafeLogSqlFragment[]` so the pg_cron path can merge clauses without unsafe slice-and-cast. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Logs query generation migrated to safer, engine-agnostic SQL fragments, typed filter templates, and unified identifier quoting for stronger injection protection and more consistent queries. * Logs preview and single-log retrieval now execute analytics SQL end-to-end using the unified executor. * **New Features** * Analytics SQL executor can call the backend via GET or POST and accepts method selection. * **Tests** * Updated tests to validate unified identifier quoting and safe-SQL helper behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46351?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
95a38ef9a5 |
fix(studio): guard priceMonthly lookup on new project page (#46395)
## Summary Switches the two `instanceSizeSpecs[instanceSize]!.priceMonthly` lookups (on the New Project page and its footer) to the existing `monthlyInstancePrice` helper, which has a defensive fallback. Fixes a render crash that fires when users switch between organizations of different plan tiers via the OrganizationSelector dropdown. Sentry: [SUPABASE-APP-EJT](https://supabase.sentry.io/issues/SUPABASE-APP-EJT) — 339 occurrences, 312 users impacted. Fixes FE-3481 ## Test plan - [x] On `/dashboard/new/<freeOrgSlug>`, open the org dropdown and switch to a paid org — no crash - [x] Verify the "Additional costs" total renders correctly once form state syncs - [x] `pnpm typecheck` passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Refactored pricing calculation logic across project creation components for improved code organization. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46395?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
hasithasandun
|
108a7c2c11 |
chore: migrate auth policy editor modal to dialog (#46374)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor ## What is the current behavior? The Auth policy editor flow still uses the deprecated `Modal` component and `Modal.Content` / `Modal.Separator` helpers. ## What is the new behavior? The Auth policy editor flow now uses `Dialog` primitives instead: - `Dialog` - `DialogContent` - `DialogHeader` - `DialogTitle` - `DialogSection` - `DialogSectionSeparator` Behavior is intended to remain unchanged. ## Additional context - Fixes #46375 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Updated the policy editor and review flows to a unified dialog layout for a cleaner, more consistent UI. * Sections and footer controls were reorganized for clearer grouping and improved button placement. * Existing behaviors (viewing templates, review/save flow, and close confirmation) are preserved. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46374?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
498d051d88 |
feat(studio): add project settings shortcuts (#46352)
## What kind of change does this PR introduce? Feature. Resolves FE-3417. ## What is the current behavior? Project Settings has a top-level `G then ,` shortcut, but its subnavigation and repeated key/log drain actions do not have scoped keyboard shortcuts or visible shortcut tooltips. | Area | Current behaviour | | --- | --- | | Project Settings sidebar | Routes are click-only once users are inside Settings. | | API/JWT keys | Creation buttons do not expose keyboard shortcuts. | | Log Drains | Add/save destination actions do not expose keyboard shortcuts. | ## What is the new behavior? Adds scoped Project Settings navigation chords, shortcut tooltips on the sidebar rows, and page/action shortcuts for API keys, JWT standby keys, and Log Drains. | Area | New shortcut coverage | | --- | --- | | Project Settings sidebar | `S then G/C/I/N/W/K/J/L/A/D` for eligible in-section routes. | | API Keys | `Shift+P` and `Shift+S` open the publishable/secret key dialogs; `Mod+Enter` submits the open dialog. | | JWT Keys | `Shift+N` opens Create standby key; `Mod+Enter` submits the open dialog. | | Log Drains | `Shift+N` adds a destination when the primary action is available; `Mod+Enter` saves the open destination sheet. | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added keyboard shortcuts for Project Settings navigation and for actions in API Keys, JWT Keys, and Log Drains (open, create/submit). * **Improvements** * Dialogs and forms now support keyboard-triggered open and submit actions with improved enable/disable gating and updated settings menu composition; shortcuts appear in the shortcuts reference. * **Tests** * Added tests covering shortcut wiring and shortcut-driven open/submit behaviors across dialogs and action panels. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46352?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Jordi EnricandClaude Opus 4.7
|
5c85ec9035 |
feat(studio): format Logs Ingest and Logs Query usage as GB FE-3400 (#46387)
- adds new log ingestion billing metrics Linear: FE-3400 Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
Terry SuttonandClaude Opus 4.7
|
fc7f7f105a |
fix(studio): use public support link on MFA sign-in error (#46382)
Fixes: https://x.com/acgfbr/status/2058995058167185731 The default `<AlertError>`appends a `<ContactSupportButton>` that opens the support form. It requires an authenticated session and `projectRef`. On the pre-auth MFA error, neither exists, so the button doesn't work. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced error messaging in multi-factor authentication sign-in with improved navigation options, allowing users to quickly return to sign-in or contact support directly from error states. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46382?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
810b395888 |
feat(studio): hide Postgres connection logs by default in unified logs (#46371)
## Problem The unified logs view shows Postgres connection lifecycle events (connection received, connection authenticated, connection authorized) alongside application logs. These messages are emitted on every database connection and make it hard to spot meaningful log entries. ## Fix Adds a SQL-level filter that excludes Postgres connection messages by default. A toggle in the filter sidebar lets users opt in to seeing them when needed. The preference is stored in the URL so it persists across navigation. **Changes:** - `SEARCH_PARAMS_PARSER` gets a new `hide_connection_logs` boolean param (default `true`) - `buildBaseWhere` in the query builder emits a `NOT (source = 'postgres_logs' AND event_message LIKE 'connection %...')` predicate when the param is true, filtering at the query level - New `ConnectionLogsToggle` component renders a labeled switch in the filter sidebar - `FilterSideBar` gains a `beforeFilters` slot so the toggle can be injected without coupling the generic component to log-specific logic ## How to test 1. Open a project in Studio and navigate to the unified logs page 2. Confirm that connection log messages (e.g. "connection received: host=...", "connection authorized: user=...") are not visible by default 3. In the left filter sidebar, find the "Connection logs" toggle near the top and switch it on 4. Confirm that connection log messages now appear in the list 5. Toggle it back off and confirm they disappear again 6. Reload the page with the toggle on (URL will contain `hide_connection_logs=false`) and confirm the setting is preserved <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a "Connection logs" toggle in the filter sidebar to hide Postgres connection lifecycle messages by default (default = hidden); changing it updates the logs view and the logs chart. * Filter sidebar now supports placing extra controls so the toggle is available alongside existing filters. * **Behavior** * Facet/count queries remain unaffected by this toggle to preserve existing counts. * **Tests** * Added tests verifying default hide behavior and explicit show behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46371?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Ali Waseem
|
722fe85c16 |
feat(studio): keyboard shortcuts for integrations (#46348)
## Summary Adds keyboard shortcuts to the Integrations Marketplace landing and per-integration detail pages. Introduces a `useDynamicShortcut` hook since per-integration tab counts/labels can't be pre-declared in the static registry. ## Shortcuts | Page | Keys | Action | |---|---|---| | Marketplace landing | `Shift+F` | Focus the integrations search input | | Marketplace landing | `F` then `C` | Clear search + category/type/source filters | | Marketplace landing search | `Esc` | Clear value (1st press), blur (2nd press) | | Integration detail | `1`–`9` | Jump to the Nth tab (label adapts per integration, e.g. "Go to Queues", "Go to Jobs") | Linear: [FE-3416](https://linear.app/supabase/issue/FE-3416) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Use number keys 1–9 to jump to integration detail tabs. * Marketplace search shortcuts: focus/select the search field and reset filters via keyboard; Escape now clears the search input. * Shortcuts now appear in the command menu under a dedicated integrations navigation group. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46348?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alex Hall
|
90653b2948 |
fix: use backend api for all integration URLs (#46290)
Replaces the in-dashboard logic to manually construct the redirect URL with a backend API call, as these are now routed through server-side processing to do Posthog events and status tracking in the marketplace DB. Fixes INT-109 |
||
|
Ali Waseem
|
908f92d885 |
feat(studio): keyboard shortcuts for integration tabs (#46350)
## Summary Adds search / clear / new shortcuts to each integration tab. Search inputs honor the staged-Escape pattern per the studio-shortcuts skill. ## Shortcuts | Tab | Shortcuts | |---|---| | Queues | `Shift+F` search · `F C` clear · `Shift+N` Create queue | | Cron jobs | `Shift+F` search · `F C` clear · `Shift+N` Create cron job | | Webhooks | `Shift+F` search · `F C` clear · `Shift+N` Create webhook | | Vault secrets | `Shift+F` search · `F C` clear · `Shift+N` Add new secret | | Wrappers | `Shift+N` Add new wrapper | All search inputs: `Esc` clears value (1st press), blurs (2nd). Permission-gated "new" entries are hidden from Cmd+K when the user lacks the permission. Follow-up to #46348. Linear: [FE-3416](https://linear.app/supabase/issue/FE-3416) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added keyboard shortcuts across studio list pages for enhanced productivity: focus and manage search filters, and open creation dialogs for webhooks, cron jobs, queues, secrets, and wrappers using keyboard commands for faster navigation and item creation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46350?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
2da5e69a4f |
chore: migrate Modal to Dialog (JWT, PITR) (#46366)
## Problem Some pages still uses the deprecated `Modal` for: - Legacy JWT new secret - PITR recovery confirmation ## Test Hard to test the JWT. I had to force its display by settings its `open` prop to `true` in `apps/studio/components/interfaces/JwtSecrets/jwt-settings.tsx` ## Solution - use `Dialog` instead <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved database restore (PITR) confirmation: replaced modal flow with an alert dialog, reorganized review sections (timing, warnings), and made the restore action await completion for clearer feedback. * Redesigned JWT secrets dialog: replaced modal with dialog primitives, centralized form and state reset on open/close, moved confirmation into dialog footer, and disabled confirm during submission. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46366?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
barcofourie
|
85be44aab0 |
feat: adds verify support email page (#46331)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature. Adds a page to verify support email. This is part 4 of a 4 part PR. ## What is the current behavior? https://linear.app/supabase/issue/TOOLING-748/investigation-provide-support-option-for-users-unable-to-login ## What is the new behavior? <img width="1505" height="853" alt="Screenshot 2026-05-25 at 10 19 24" src="https://github.com/user-attachments/assets/98fb0c8a-ae25-46ba-b03a-f35861f6d136" /> ## Additional context Add any other context or screenshots. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added email verification flow. Users can verify addresses via tokenized links and receive real-time feedback: loading state, success confirmation, expired-link warning, and clear error messaging for failures. A dedicated verification page and UI guide users through the process. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46331?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alaister YoungandAlaister Young
|
293eef83e6 |
[FE-3408] fix(studio): allow project overview stat values to grow vertically (#46370)
The Compute card's "High Availability" badge was overflowing the cell horizontally in 2-column layouts and bleeding vertically into adjacent cards when the badges wrapped onto a second line in narrow/vertical layouts. Root cause was in `SingleStat`: the value row used `h-[34px]` + `truncate` (overflow: hidden), so the inner `flex-wrap` couldn't grow the row, and the flex column lacked `min-w-0` so it couldn't shrink to its grid track. **Changed:** - `SingleStat` outer flex gets `min-w-0` so the grid item is constrained by its track - Right column swapped from `truncate` to `min-w-0 flex-1` (takes remaining space, can shrink) - Value row swapped from `h-[34px]` to `min-h-[34px]` with `py-0.5` — keeps the 34px baseline for single-line text values, but lets the row grow when badges wrap Closes [FE-3408](https://linear.app/supabase/issue/FE-3408) ## To test - Open the project overview on a project with `high_availability` enabled - At 2-column widths: the "HIGH AVAILABILITY" badge should sit fully inside the Compute card alongside the compute size badge — no clipping at the right edge - At narrow / 1-column widths: when the two badges need to wrap, the Compute card should grow vertically rather than letting the second-line badge overlap the cards above/below - Spot check the other stat cards (GitHub, Recent branch, Last migration, Last backup) — long text values should still truncate with an ellipsis as before <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated stat card layout and inner spacing to improve responsiveness and prevent overflow. * Improved text truncation and minimum-width behavior for stat values and labels. * Standardized spacing, truncation and color handling across activity stats for more consistent display. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46370?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Joshen Lim
|
94834752b2 |
Improve unified logs formatting for auth logs (#46365)
## Context Improved formatting for auth logs in unified logs - their metadata are seemingly all hidden within "event_message" so the changes here bring them up - Fix detecting status, pathname, and method for auth logs from `event_message` - None were showing originally, status was mostly defaulting to `200` - Improve formatting of `event_message` by prioritising errors + floating up the auth action - Currently only shows "request completed" ## Before <img width="1449" height="955" alt="image" src="https://github.com/user-attachments/assets/f0c7f166-06ab-4bfc-8653-6f5638bf1ae7" /> ## After <img width="1449" height="956" alt="image" src="https://github.com/user-attachments/assets/cdf49bd8-c33a-4f40-a6b7-8783dc38d174" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * More robust parsing of auth log messages to extract error/status/method/path values and fall back to the original text when parsing fails. * Fixed cases where displayed status/method/pathname could be incorrect for auth logs. * **Improvements** * Normalized auth error text (underscores → spaces) and optional auth-action prefixes for clearer messages. * Conditional sentence-capitalization for auth event messages. * **New Features** * Centralized log metadata extraction for unified log display. * **Tests** * Added tests covering auth and non-auth log parsing and metadata extraction. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46365?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Saxon Fletcher
|
033daf223c |
Support form Assistant Streamdown (#46248)
Re-adds support form Assistant response using a lighter weight Streamdown component vs the more heavy `Message` component. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * AI Assistant follow-up card after ticket submission for project-scoped requests. * In-chat support request preview panels showing submitted subject and message. * **Improvements** * Smarter project selection when opening the support form via route/context. * Success screen: cleaner layout, project-name messaging, optional finish action, and a "Join Discord" button. * Category prompt text updated to "What issue are you having?" * New success/feedback section for consistent layouts. * **Tests** * Added tests covering support prompt serialization/parsing and UI previews. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46248?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Raminder Singh
|
2f24238fd9 |
fix: missing install integration button (#46368)
The install integration button on stripe sync engine page was missing entirely when the marketplace feature preview was disabled. Now we hide only when the feature preview is enabled. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced Stripe integration installation prompt handling based on marketplace configuration. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46368?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alaister YoungandAlaister Young
|
3da6116b78 |
[FE-3442] fix(studio): include /rest/v1 in Data API access table URL (#46367)
The Data API Access section on the new-table panel was showing `https://<ref>.supabase.co/<table>` instead of the correct `https://<ref>.supabase.co/rest/v1/<table>`. The bug was duplicated endpoint-resolution logic in `ApiAccessToggle.tsx` that omitted `/rest/v1`. Replaced it with the existing `getApiEndpoint` utility from `DataApi.utils.ts`, which already handles this correctly (and is unit-tested). Addresses [FE-3442](https://linear.app/supabase/issue/FE-3442/data-api-access-shows-incorrect-table-url). **Changed:** - `ApiAccessToggle.tsx` now uses `getApiEndpoint` for URL construction, ensuring `/rest/v1/` is always included. ## To test 1. Open the dashboard, go to Table Editor, click "New table". 2. Scroll to the "Data API Access" section, enter a table name (e.g. `test_table`). 3. Confirm the URL shown is `https://<ref>.supabase.co/rest/v1/test_table` (not `https://<ref>.supabase.co/test_table`). 4. Try the same with a non-public schema — URL should be `.../rest/v1/<schema>.<table>`. 5. With read replicas / load balancer selected via the database selector, confirm the URL still resolves to `<replica-or-lb-host>/rest/v1/<table>`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Optimized Data API endpoint computation in the table editor interface to improve performance and code maintainability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46367?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Jordi Enric
|
4a7a540268 |
fix(studio): hide disk IO burst balance charts on 4XL+ compute (#46327)
## Problem On 4XL and larger compute sizes, Supabase disk IO is sustained rather than burst-budget based. Baseline equals max, so there is no extra burst balance to track (the instance can still be throttled if it hits its configured IOPS or throughput limit, but that is unrelated to a burst credit pool). The "Disk IO Burst Balance" / "Disk IO % Remaining" / "Disk IO % Consumed" charts in custom reports are therefore meaningless on 4XL+, yet they are currently still offered in the picker and rendered as empty/misleading charts. Custom reports persist their layout, so a report created when a project was on a smaller compute and later upgraded to 4XL+ can still contain a saved burst chart that we need to handle gracefully. ## Fix - Add a shared \`hasBurstableIO(infra_compute_size)\` helper in \`DiskManagement.utils.ts\` (replaces the local \`BURSTABLE_IO_VARIANTS\` set previously defined inline in \`database-charts.ts\`). - Filter \`disk_io_budget\` and \`disk_io_consumption\` out of the custom report chart picker (\`MetricOptions\`) when the project is on a non-burstable compute size. - In \`ReportBlock\`, detect saved burst charts on a 4XL+ project and render a new \`UnavailableChartBlock\` that explains the chart no longer applies and can be removed. - The database observability burst balance chart already gated on \`hasBurstableIO\`; updated to use the shared helper. - Infrastructure activity page already has equivalent handling via the dedicated-IO admonition, so no change needed there. Linear: FDBKPRI-1404 ## Test plan - [ ] On a project below 4XL, the custom report picker still lists "Disk IO % Remaining" and "Disk IO % Consumed", and they render normally - [ ] On a 4XL+ project, neither metric appears in the picker - [ ] Open an existing custom report that contains a saved burst balance chart on a 4XL+ project, and confirm the placeholder block renders with a clear explanation and a remove action - [ ] Database observability page on 4XL+: the burst balance chart remains hidden, all other charts render <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Disk IO metrics are now filtered based on your project’s compute size so only relevant charts appear. * Metrics tied to burstable IO are hidden when the current instance does not support burstable IO; deprecated metrics remain excluded. * When a disk IO chart isn’t available for your instance, the UI shows an explanatory unavailable-chart block with text about burst-balance limits for very large instances and optional actions to remove the unavailable chart. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46327?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
239825e9a3 |
fix(studio): clarify RLS disable destructiveness (#46357)
## What kind of change does this PR introduce? UI fix ## What is the current behavior? RLS disable dialog is just plain prose. ## What is the new behavior? RLS disable dialog better communicates the high-risk action. | Before | After | | --- | --- | | <img width="866" height="536" alt="CleanShot 2026-05-26 at 11 31 47@2x" src="https://github.com/user-attachments/assets/9ae061aa-edf5-45e8-b866-4d59a035a597" /> | <img width="860" height="534" alt="CleanShot 2026-05-26 at 11 29 42@2x-584E1768-6ACD-4873-9477-A8FA7D017C67" src="https://github.com/user-attachments/assets/00b485dd-485a-4c28-825c-6c0460e3428d" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved RLS toggle dialog component logic. * **Tests** * Enhanced RLS policies test assertions for better accuracy. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46357?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
3c2255c27c |
chore: migrate database settings Modal to Dialog (#46270)
## Problem Database settings still uses the deprecated `Modal` for: - readonly toggle - password reset - disk size configuration - network restrictions ## Solution - use `Dialog` instead - use `AlertDialog` when it makes sense <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Replaced various Database settings modals with unified Dialog/AlertDialog components for a consistent look and behavior. * Confirmation flows now await async submit actions; confirm/cancel controls are disabled and show loading while operations are pending. * Validation, loading/disabled states, and user-facing success/error messaging remain intact. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46270?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Saxon Fletcher
|
e13486e358 |
Storage file bucket design (#46184)
<img width="1285" height="654" alt="image" src="https://github.com/user-attachments/assets/10074f07-3ac0-4f1f-b920-4255c67968d6" /> Updates file storage buckets to make use of new page components and follow more standard full width pages as recommended in our design system. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Search input now always visible with dynamic placeholder and cancel control. * “Go up one level” navigation button shown in list view when not at bucket root. * **Style** * Thinner icon strokes and smaller button/icon sizing across the Storage Explorer and preview. * Header, breadcrumbs, and page container spacing/layout refined; explorer outer container simplified. * Selection count UI made compact/monospaced; new layout tokens for header and bulk-action rows. * **Tests** * Unit and e2e tests updated; added e2e helper for rename/create inputs. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46184?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
1470c51021 |
fix(studio): align rls confirmation dialogs (#45961)
## What kind of change does this PR introduce? Studio UI cleanup and docs update. Resolves FE-3217. ## What is the current behavior? The table RLS confirmation dialogs differ across the Policies page and Table Editor surfaces. The table editor disable flow also uses a verbose confirmation modal with admonitions and repeated warning copy. | Policies | Table Editor | | --- | --- | | <img width="852" height="448" alt="25125" src="https://github.com/user-attachments/assets/baa9fafa-752c-4701-bf54-40da4e32030b" /> | <img width="1108" height="1016" alt="57354" src="https://github.com/user-attachments/assets/b1b88355-be39-49b9-aed2-a60f20c25104" /> | | <img width="866" height="434" alt="CleanShot 2026-05-15 at 18 01 15@2x" src="https://github.com/user-attachments/assets/d67f69ee-0a49-4dbd-939e-ca968361fc33" /> | <img width="840" height="426" alt="CleanShot 2026-05-15 at 18 01 52@2x" src="https://github.com/user-attachments/assets/a0b5f390-abeb-453f-8636-ad097f22308b" /> | ## What is the new behavior? Table RLS enable and disable confirmations now use one shared concise Alert Dialog treatment across the Policies page, Table Editor header, and Table Editor side panel. The server-backed toggles use the async Alert Dialog action behaviour from the stacked base branch, and the design-system docs now clarify when to start with Alert Dialog versus Confirmation Modal. This PR is stacked on #45960. | Before | After | | --- | --- | | <img width="852" height="448" alt="25125" src="https://github.com/user-attachments/assets/baa9fafa-752c-4701-bf54-40da4e32030b" /> | <img width="864" height="518" alt="CleanShot 2026-05-15 at 18 07 21@2x" src="https://github.com/user-attachments/assets/bda53246-164b-4d5b-81a1-25d3bc661eb3" /> | | <img width="1108" height="1016" alt="57354" src="https://github.com/user-attachments/assets/b1b88355-be39-49b9-aed2-a60f20c25104" /> | <img width="864" height="518" alt="CleanShot 2026-05-15 at 18 07 21@2x" src="https://github.com/user-attachments/assets/bda53246-164b-4d5b-81a1-25d3bc661eb3" /> | | <img width="866" height="434" alt="CleanShot 2026-05-15 at 18 01 15@2x" src="https://github.com/user-attachments/assets/d67f69ee-0a49-4dbd-939e-ca968361fc33" /> | <img width="860" height="488" alt="CleanShot 2026-05-15 at 18 08 41@2x" src="https://github.com/user-attachments/assets/4c67f797-e2cd-4d56-a49d-e6c6fc0edff3" /> | | <img width="840" height="426" alt="CleanShot 2026-05-15 at 18 01 52@2x" src="https://github.com/user-attachments/assets/a0b5f390-abeb-453f-8636-ad097f22308b" /> | <img width="860" height="488" alt="CleanShot 2026-05-15 at 18 08 41@2x" src="https://github.com/user-attachments/assets/4c67f797-e2cd-4d56-a49d-e6c6fc0edff3" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Refined guidance and wording for dialog usage, clarifying when to use Alert Dialog, Confirmation Modal, and modal modality. * **New Features** * Reworked RLS confirmation flow with a streamlined toggle dialog, clearer messaging, and a “Learn more” link to docs. * **Tests** * Updated end-to-end tests to cover the updated RLS dialog flows and explanatory content. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45961?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny WhiteandClaude Sonnet 4.6
|
1e354209aa |
fix(design-system): fix last table cell showing independent hover state (#46251)
## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? On pages where the table has horizontal overflow (e.g. Database Tables with its 7 columns), `ShadowScrollArea` unconditionally applies `!bg-surface-200` to `td:last-child` on row hover. Since `TableCell` has `transition-colors`, this gives the last cell an explicit animated background change — making it visually distinct from every other cell, which simply inherit the row's hover bg transparently. This manifests as the last cell appearing to have its own independent hover state, separate from the row hover. ## What is the new behavior? The `!bg-surface-200` override on `td:last-child` is moved inside the `stickyLastColumn` block, since that's the only case where an explicit background is actually needed (sticky cells require a solid bg to avoid showing scrolled content behind them). Non-sticky tables no longer get the spurious cell-level hover. Also reverts the MoreVertical dropdown trigger in `TableList` back to `type="default"` (undoes the workaround from #46247). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed hover styling behavior in horizontally scrollable tables to apply only when appropriate. * **Style** * Updated the visual appearance of the row action dropdown button. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46251?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Gildas GarciaandAli Waseem
|
ba46170b66 |
fix: disable automatic branching for free projects (#46347)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where the branch-per-PR setting in GitHub integration connections could have an undefined value. The setting now defaults to a valid state when creating or updating connections, ensuring consistent and predictable behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46347?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Ali Waseem
|
493fc166c9 |
chore: remove any type to let ratchet rules pass (#46349)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Remove any type for hard definition |
||
|
Gildas Garcia
|
838fe7f976 |
chore: migrate Organization settings Modal to Dialog (#46332)
## Problem Organization settings still uses the deprecated `Modal` for: - downgrading subscription - requesting feedback after downgrading - showing an alert about members limit - requesting feedback after upgrading - deleting a published OAuth app - showing preview of a new OAuth app - Revoking an OAuth app ## Solution - use `Dialog` instead <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Replaced legacy modal UI with the app's modern dialog/alert-dialog components across billing and OAuth settings (upgrade/downgrade, exit survey, members-limit, delete/revoke, preview), keeping existing content and flows. * Confirm/cancel flows updated for more reliable async handling and clearer loading/disabled states during actions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46332?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Coenen Benjamin
|
71775c368e |
refactor(replication): remove useless expire snapshot configuration (#46341)
Remove useless expire snapshot configuration > This is an alpha feature not already deployed to any of our customers so breaking changes are not an issue. Signed-off-by: Benjamin <5719034+bnjjj@users.noreply.github.com> |
||
|
Gildas Garcia
|
6b7f2f27de |
chore: migrate realtime Modal to Dialog (#46284)
## Problem Realtime still uses the deprecated `Modal` for: - sending a message ## Solution - use `Dialog` instead - Fix `ChooseChannelPopover` ## Screenshots Before: <img width="379" height="289" alt="image" src="https://github.com/user-attachments/assets/d0389aef-e00e-463d-b994-3ef495ff2baa" /> After: <img width="340" height="289" alt="image" src="https://github.com/user-attachments/assets/75e5d982-6f26-4e92-beea-dcc136a75bd1" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Message-sending modal redesigned to use a dialog layout with a clear header, body and footer; confirm/cancel actions and inline JSON validation behave as before. * Channel-join form updated to a compact grouped input-and-button layout for more consistent, space-efficient entry. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46284?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
1d2817da9b |
feat(logs): brand ServiceFlow.sql.ts with SafeLogSqlFragment (#46336)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / security hardening (part 3 of stacked analytics safe-SQL series; stacks on top of PR 2: "feat(logs): route unified-logs hooks through executeAnalyticsSql") ## What is the current behavior? `ServiceFlow.sql.ts` interpolates `logId` and `serviceType` as raw template-literal strings directly into SQL (e.g. `` `WHERE el.id = '${logId}'` ``). The legacy BigQuery branch of `unified-log-inspection-query.ts` calls `post()` directly with a plain `string`-typed SQL value, bypassing the `executeAnalyticsSql` wire-boundary. ## What is the new behavior? - Add `SAFE_SERVICE_LITERAL: Record<EdgeServiceType, SafeLogSqlFragment>` — pre-branded SQL string literals for each service type, built with `analyticsLiteral`. - Rewrite `getBaseEdgeServiceFlowQuery`, `getEdgeFunctionServiceFlowQuery`, and `getPostgresServiceFlowQuery` to use `safeSql` template tag with `analyticsLiteral(logId)` and `SAFE_SERVICE_LITERAL[serviceType]`. Return types changed to `SafeLogSqlFragment`. - Update the four thin wrappers (`getPostgrestServiceFlowQuery`, `getAuthServiceFlowQuery`, `getStorageServiceFlowQuery`) to return `SafeLogSqlFragment`. - Replace `let sql = ''` + direct `post()` call in `unified-log-inspection-query.ts`'s legacy BigQuery branch with `let sql: SafeLogSqlFragment` + `executeAnalyticsSql`, eliminating the last direct `post()` call to the analytics endpoint in this file. `pnpm typecheck` passes cleanly. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Secured analytics and log inspection queries through parameterized SQL execution, preventing potential SQL injection vulnerabilities. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46336?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
b00e5688ab |
fix: remove pointer events logic as its not needed (#46338)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? We used to hide pointer events when someone hovered over this banner. That logic is no longer needed and caused issues on mobile. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Simplified banner component styling logic. Bottom banner styling is now fixed and consistently applied, removing conditional CSS class logic that previously adjusted behavior based on hover interactions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46338?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
42c0cb7171 |
feat(studio): keyboard shortcuts for observability pages (#46277)
## Summary Wires Linear-style keyboard shortcuts across all observability pages — refresh, time picker, filters, and sub-page navigation — with hover tooltips surfacing each binding. | Page | Shortcut | Action | | --- | --- | --- | | Overview | `Shift+R` | Refresh report | | Overview | `Shift+P` | Open time picker | | Query Performance | `Shift+R` | Refresh report | | Query Performance | `R` then `C` | Reset report (`pg_stat_statements_reset`) | | Query Performance | `Shift+F` | Search queries | | Query Performance | `F` then `C` | Reset filters | | API Gateway | `Shift+R` | Refresh report | | API Gateway | `Shift+P` | Open time picker | | API Gateway | `Shift+F` | Add filter | | API Gateway | `F` then `C` | Reset filters | | API Gateway | `Shift+S` | Filter requests by service | | Database | `Shift+R` | Refresh report | | Database | `Shift+P` | Open time picker | | Auth | `Shift+R` | Refresh report | | Auth | `Shift+P` | Open time picker | | Data API | `Shift+R` | Refresh report | | Data API | `Shift+P` | Open time picker | | Storage | `Shift+R` | Refresh report | | Storage | `Shift+P` | Open time picker | | Realtime | `Shift+R` | Refresh report | | Realtime | `Shift+P` | Open time picker | | Edge Functions | `Shift+R` | Refresh report | | Edge Functions | `Shift+P` | Open time picker | | All observability pages | `U` then `O/Q/G/D/P/A/F/S/L` | Jump to sub-page | ## Test plan - [ ] Each shortcut fires on its page; tooltip on hover shows the binding - [ ] Picker shortcut toggles the popover open/closed without leaving the tooltip visible - [ ] Reset-report on Query Performance opens the confirm modal - [ ] `Escape` on the query search clears the value, then blurs - [ ] No "Shift+R already registered" / Tooltip controlled-uncontrolled warnings in the console <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Keyboard shortcuts to navigate Observability pages and perform common actions (refresh, toggle date picker/interval, focus search, reset filters, create reports). * Shortcut hints shown on relevant buttons and controls; date pickers and interval dropdowns can be controlled via shortcuts. * Global shortcut groups/registries added for Observability navigation and page actions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46277?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrey A.
|
c1b473e472 | fix: adjust connect sheet for cli and self-hosted (#46217) |
