mirror of
https://github.com/supabase/supabase.git
synced 2026-10-15 06:09:08 +03:00
chore/function-recent-errors
5505
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Danny WhiteandJoshen Lim
|
4a5db160be |
feat(studio): extract shared zod number input helpers (#50102)
## What kind of change does this PR introduce? Refactor. Extracts zod number input preprocessing into a shared Studio helper and migrates existing call sites. ## What is the current behavior? Number input clearing logic for controlled `type="number"` fields is duplicated across Studio forms. The pipeline destination form had local helpers, while Auth and settings forms inline the same `z.preprocess` pattern. ## What is the new behavior? Adds `apps/studio/lib/forms/zod-number-input.ts` with: - `requiredNumberInputSchema` for required `z.number()` fields (`''` → `NaN`) - `optionalNumberInputSchema` for optional number fields (`''`/`null` → `undefined`) - `preprocessEmptyNumberInput` for `z.coerce.number()` schemas Migrates: - Pipeline destination form - Connection pooling settings - Auth provider validation (email and SMS OTP fields) - SMTP settings - MFA settings - Protection settings ## To test 1. Open **Authentication > Providers > Email**, clear **Email OTP expiration** or **Minimum password length**, and confirm the field stays empty and shows validation on save. 2. Open **Authentication > Providers > Phone**, select a provider, clear **SMS OTP Expiry**, and confirm validation still works. 3. Open **Authentication > Emails > SMTP settings**, clear **Port** or **Rate limit**, and confirm validation on save. 4. Open **Authentication > Multi-factor authentication**, clear **Max enrolled factors** or **Phone OTP length**, and confirm validation on save. 5. Open **Database > Replication**, start a new pipeline, select **BigQuery**, expand **Advanced settings**, clear a required numeric field, and confirm it stays empty until filled. 6. (Optional, hosted non-HA projects only) Open **Database > Settings**, scroll to **Connection pooling**, clear **Connection pool size**, and confirm the value does not snap back before save. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved handling of empty numeric fields across authentication, SMTP, database replication, and connection pooling settings. * Optional numeric settings can now be cleared without triggering unnecessary validation errors. * Required numeric fields continue to display appropriate validation errors when left incomplete. * Standardized validation behavior for OTP settings, password requirements, SMTP limits, replication configuration, and pool sizing. * Refined protection settings to focus on CAPTCHA and leaked-password options. * **Tests** * Added coverage for empty and optional numeric input behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Joshen Lim
|
db0e6b761b |
Joshenlim/fe 4304 bring database connections out of feature preview (#50107)
## Context
As per PR title - we're bringing Database Connections out of feature
preview and it'll live on the dashboard by default 🙂
Also deprecating the existing Ongoing queries panel which Database
Connections now supercedes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Database Connections is now available without feature-preview
activation.
* The SQL editor’s “View running queries” option now links directly to
Database Connections.
* **Bug Fixes**
* Query cancellation and session termination now refresh database
activity data.
* **Removed**
* Removed the in-editor ongoing queries panel and its termination
controls.
* Removed the Database Connections promotional banner, preview
messaging, settings, and related telemetry.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
CharisandJoshen Lim
|
2ac052752a |
fix(pg-meta): fix invalid SQL when setting column default to NULL (#50097)
## Summary
- Fixes invalid SQL generation when setting a column's default value to
NULL through Studio's Table Editor
- The bug occurred because raw `null` values bypassed literal
serialization in the SQL builder
- Added special case handling in both `create()` and `update()`
functions to use `literal(null)` regardless of format
## Details
Setting a column's default to NULL via the "Set as NULL" suggestion in
Studio generated invalid SQL: `ALTER TABLE ... ALTER COLUMN ... SET
DEFAULT ;` (missing the NULL keyword). This was caused by
`default_value` being JS `null` and bypassing the literal()
serialization function when `default_value_format === 'expression'`.
The fix ensures that when `default_value === null`, we always use
`literal(null)` to produce the correct `SET DEFAULT NULL` clause.
## Test plan
- New regression test in `packages/pg-meta/test/columns.test.ts`
("update column default value to NULL via expression format") verifies
the fix by:
- Creating a text column with a literal default
- Updating it using `default_value_format: 'expression', default_value:
null` (exact payload from Studio)
- Asserting the column's default value is null
- All 58 tests in `packages/pg-meta/test/columns.test.ts` pass
- TypeScript check (`tsc --noEmit`) passes
Fixes FE-4343
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Fixed column creation and updates so explicitly setting a default
value to `NULL` correctly preserves the `DEFAULT NULL` clause.
- Ensured setting a column default to `NULL` through expression-based
editing is reflected accurately when column details are retrieved.
- **Style**
- Improved the column editor’s suggestion menu layout and spacing for
clearer readability.
- **Tests**
- Added coverage for updating a column default to `NULL`.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
|
||
|
Gildas Garcia
|
bfb0737d14 |
Fix to ensure labels, descriptions and validation errors are correctly linked to their inputs (#50080)
## Problem `FormItemLayout` does not correctly binds inputs descriptions and validation messages to their inputs. This is because the input ids are generated and not correctly propagated to the `FormMessage` and `FormDescription` components. Besides, we still pass `name` or `id` directly to the inputs or `FormItemLayout` in some places. ## Solution - Fix `FormItemLayout` to correctly binds inputs descriptions and validation messages to their inputs - Fix incorrect usages - Fix Design System documentation ## How to test The issue is visible in production: - Open https://supabase.com/design-system/docs/ui-patterns/forms - Open the devtool and check the labels `for`, the description `id` and the input `id` or `aria-describedby` attributes. You'll see they often don't match Do the same on staging: - Open https://design-system-git-fix-a11y-form-input-descriptions-supabase.vercel.app/design-system/docs/ui-patterns/forms - Open the devtool and check the labels `for`, the description `id` and the input `id` or `aria-describedby` attributes. They now match Dashboard fixes: - https://studio-staging-git-fix-a11y-form-input-descriptions-supabase.vercel.app/dashboard/account/tokens: _Expires in_ select button is now correctly linked to its label - https://studio-staging-git-fix-a11y-form-input-descriptions-supabase.vercel.app/dashboard/account/me: the switches are now correctly linked to their label - In Database/Indexes: the select buttons when creating an index are now correctly linked to their label - All other changes are the same things |
||
|
Danny White
|
66a748cdd1 |
fix(ui): restore accordion trigger layout (#50114)
## What kind of change does this PR introduce? Bug fix. Follow-up to #49660. ## What is the current behavior? `AccordionTrigger` adds horizontal padding at the shared primitive level. This shifts content at call sites that already own their spacing. In the Studio Advanced settings sections, padding around the whole accordion also constrains the trigger and its hit area instead of letting it fill the row. ## What is the new behavior? The shared trigger no longer adds horizontal padding and its header explicitly fills its container. Both Studio Advanced settings sections now apply their padding inside the full-width trigger and content, keeping the text aligned while extending the focus outline and hit area across the row. The inset focus treatment from #49660 is unchanged. | Before | After | | --- | --- | | <img width="1334" height="286" alt="CleanShot 2026-09-08 at 16 18 57@2x" src="https://github.com/user-attachments/assets/3a057b45-1eb4-4928-ae69-2d636b0c4678" /> | <img width="1302" height="278" alt="CleanShot 2026-09-08 at 16 18 12@2x" src="https://github.com/user-attachments/assets/0454493e-4fbc-4ad2-a9fd-1b9dc1d486dc" /> | ## To test ### Studio replication destination 1. Open the [Studio staging preview](https://studio-staging-git-dnywh-fixaccordion-trigger-width-supabase.vercel.app) and select a project with Pipelines enabled. 2. Go to **Database > Replication**. Under **Destinations**, click **Add destination**. 3. Tab to **Advanced settings** and press Enter to expand it. 4. Confirm the text aligns with the form content, the focus outline spans the full row between the sheet edges, and clicking near the far right of the row toggles it. ### Studio access-token permissions 1. In the [Studio staging preview](https://studio-staging-git-dnywh-fixaccordion-trigger-width-supabase.vercel.app), go to **Account > Access Tokens**. 2. Click **Generate new token** and scroll to **Permissions**. 3. Tab to any permission category, then click near the far right of its row. 4. Confirm the focus outline fills the category row, the label keeps its existing inset, and the full row toggles the category. ### Pricing FAQs 1. Open the [Pricing preview](https://zone-www-dot-com-git-dnywh-fixaccordion-trigger-width-supabase.vercel.app/pricing) and scroll to **Frequently asked questions**. 2. Tab to any question, then click near the far right of its row. 3. Confirm the question has not gained extra horizontal inset and the full row remains interactive. ### Design-system Accordion 1. Open the [design-system Accordion preview](https://design-system-git-dnywh-fixaccordion-trigger-width-supabase.vercel.app/docs/components/accordion). 2. Tab through the three accordion triggers and toggle each one. 3. Confirm each focus outline fills its row, with no extra horizontal padding around the label. |
||
|
Danny White
|
3418975b70 |
feat(studio): configure publication partition handling (#49845)
## What kind of change does this PR introduce? Small Pipelines feature. Stacked on #49844. ## What is the current behavior? New publications always publish changes from partitioned tables through their parent table. The creation sheet does not expose the v2 API option that controls this behavior. ## What is the new behavior? Adds a default-on Publish partitions as the parent table checkbox to the publication sheet. Turning it off submits publish_via_partition_root as false so each partition can appear as a separate destination table. ## To test 1. Open the pipeline creation sheet and choose to create a publication. 2. Confirm Publish partitions as the parent table is selected by default. 3. Create a publication and confirm publish_via_partition_root is true. 4. Repeat with the option cleared and confirm publish_via_partition_root is false. 5. Confirm the selected tables and publication name are unchanged by the option. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a “Publish partitions as the parent table” option when creating publications. - The option is enabled by default and can be turned off before submitting the publication. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny WhiteandClaude Opus 5
|
d0dd81ba62 |
fix(studio): point the Warehouse table picker at the v2 publication API (#50105)
## What kind of change does this PR introduce? Bug fix. Master is currently red, so this needs to land before anything else can go green. ## What is the current behavior? `WarehouseSchemaTablePicker` still imports `@/data/replication/publications-query`, which #49844 removed. Studio does not typecheck on master, which takes typecheck, knip, unit tests, E2E, the Studio Docker build and both Studio Vercel deployments down with it. ``` WarehouseSchemaTablePicker.tsx(20,49): error TS2307: Cannot find module '@/data/replication/publications-query' WarehouseSchemaTablePicker.tsx(87,8): error TS7006: Parameter 'publication' implicitly has an 'any' type ``` ## What is the new behavior? The picker reads the `supabase_warehouse` publication through `useReplicationPublicationQuery`, matching how `TableCopySelection` and `DestinationForm` were migrated. It only ever needed that one publication, and it needs the publication's tables, which the v2 list endpoint no longer returns. Behavior is unchanged. A missing publication still resolves to an empty selection during first-time setup, and a failed lookup still only blocks when editing an already-enabled Warehouse. ## To test - Confirm CI goes green here. - On the Studio deploy preview, open a project's Connect sheet and pick the Warehouse mode. - With Warehouse not yet enabled, the schema and table list renders with nothing checked. - With Warehouse already enabled, reopen the picker and confirm the previously replicated tables come back checked. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved warehouse schema table selection by loading the Warehouse publication directly. - Table selections now initialize correctly from the returned publication. - Preserved loading and error handling for publication retrieval. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Danny WhiteandJoshen Lim
|
8dd97d75aa |
refactor(studio): use v2 replication publication APIs (#49844)
## What kind of change does this PR introduce? Studio data-layer migration. ## What is the current behavior? Studio loads complete publication details through the original bulk endpoint and creates publications by executing SQL against the source database. Publication and source-table data use names where stable table IDs are available. ## What is the new behavior? Uses the v2 publication-name, publication-detail, publication mutation, and source-table endpoints. The existing creation sheet continues to behave the same, including publishing partition changes through the parent table by default. Initial-sync selection and Analytics Bucket associations now consume the selected publication detail. Generated platform API types and their required nullability updates are included. The generated Platform contract accounts for roughly 10,000 changed lines in this PR. ## Dependency Depends on the v2 source table, table column, and publication endpoints from [supabase/platform#37505](https://github.com/supabase/platform/pull/37505), which are deployed to production. ## To test 1. Open the pipeline creation sheet and select an existing publication. 2. Create a publication with mixed-case schema and table names, then confirm the table names are shown while stable IDs are submitted. 3. Exercise all four initial-sync policies, including selecting individual tables. 4. Reopen the publication and table selectors and confirm they refresh without replacing populated options. 5. Edit and delete a publication. 6. Open an Analytics Bucket associated with a pipeline and confirm its publication tables resolve correctly. 7. Confirm unlimited WAL retention renders as Unlimited on pipeline status. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Improved replication publication setup with on-demand table loading, refresh controls, clearer table labels, and streamlined publication selection. - Publication creation and updates now use the latest replication API and table-based configurations. - Added clearer handling for tables removed from publications, including stale-selection warnings. - **Bug Fixes** - Prevented table selections from carrying over when switching publications. - Improved replication status displays when lag or WAL metrics are unavailable. - Updated replication deletion and table management for the latest API behavior. - **Tests** - Expanded coverage for publication creation, table selection, stale tables, loading states, and replication metrics. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Danny WhiteandJoshen Lim
|
282a2a22cf |
fix(studio): allow pipeline number inputs to be cleared (#50078)
## What kind of change does this PR introduce? Bug fix for the pipeline destination form. ## What is the current behavior? Clearing a numeric field under Advanced settings restores its previous value immediately, so users cannot replace the value normally. ## What is the new behavior? Numeric fields use an empty string as their controlled blank value while editing, so users can clear an existing value before entering its replacement. Existing field-specific validation messages are preserved for invalid or empty required values. Maximum staleness remains optional and can be left blank. Adds component and schema coverage for all five numeric Advanced settings fields, including the BigQuery-only fields. ## To test 1. Open Database > Replication and start a new pipeline. 2. Select BigQuery and expand Advanced settings. 3. Clear each numeric field and confirm it can be edited without reverting to its previous value. Required fields may show their existing validation message while empty. 4. Enter a replacement value such as `5` and confirm the field accepts it. 5. Leave a required numeric field blank and confirm the existing field-specific validation message appears. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved validation for replication destination settings, with clearer errors when required numeric fields are left empty. - Validation now updates immediately when numeric values are cleared or corrected. - BigQuery connection pool size must be greater than zero. - Empty maximum staleness values are accepted and handled correctly. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Marouane SoudaandCharis Lam
|
0e35cbf4a4 |
Security definer materialized view (#40800)
Fixes #40799 Now, the correct error will be shown for materialized views accessible to `anon` and `authenticated` roles via Data API, instead of the unrelated "Security Definer view" error. For convenience, users can immediately fix the issue by running the correct SQL query to revoke select from `anon` and `authenticated`, just by clicking on "confirm" on the confirmation modal I just created. https://github.com/user-attachments/assets/f3ce9353-4ad0-4063-bf33-0b403f5fa87a Before <img width="958" height="440" alt="materialized" src="https://github.com/user-attachments/assets/89047c91-da35-4b9f-b7e3-82e877bcf2c6" /> Edit: Thanks to the review by @saltcod, I now realise that revoking access from `anon` and `authenticated` users might not be the optimal solution since it would break many projects relying on the access to materialized views. After pondering on the possible solutions, I figured there isn't an easy one, so I did away with the autofix button, and instead created a dialog explaining three possible options for the user, with a sample query under each one for convenience. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added clearer warnings when materialized views are accessible through the API. * Added a dialog explaining how to review and revoke API access for materialized views. * Added guidance and code examples for restricting access to API roles. * Added a link to the Security Advisor for additional information. * **Improvements** * Updated materialized view tooltips to accurately describe API accessibility. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com> |
||
|
Jordi Enric
|
be030229bf |
feat(studio): add workers to unified logs FE-4281 (#49682)
## Problem Unified Logs does not expose Workers logs, so users cannot search Workers ingress, runtime, or build events alongside other services. ## Fix Add a Workers log type that classifies all three Workers OTEL streams. Gate the option and any persisted Workers filters with the existing Workers feature flag. ## How to test - Enable the Workers feature flag and open Unified Logs. - Select Workers from the Log Type filter. - Expected result: Unified Logs shows ingress, runtime, and build events with the Workers icon. - Disable the Workers feature flag and load a URL containing `log_type:eq:workers`. - Expected result: the Workers option and filter are removed, and Workers logs are not queried. - Run `./node_modules/.bin/vitest --run components/interfaces/UnifiedLogs/UnifiedLogs.queries.test.ts components/interfaces/UnifiedLogs/UnifiedLogs.utils.test.ts data/workers/worker-logs-query.test.ts` from `apps/studio`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Workers as a selectable log type in Unified Logs. * Unified Logs now combines worker ingress, guest, and API streams under the Workers category. * Added a dedicated Workers icon and worker log filtering. * **Improvements** * Worker filters and URL parameters respect feature availability. * Worker details show relevant metadata while omitting unavailable HTTP fields. * Improved handling of worker log levels, statuses, and raw data. * Added stronger validation for unified log data. * **Tests** * Added coverage for worker routing, filtering, feature visibility, parsing, and metadata redaction. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alaister YoungandAlaister Young
|
ec1029dff0 |
chore: migrate from clsx + tailwind-merge to shadcn-ui/cn (#49938)
Migrates the repo off `clsx` + `tailwind-merge` to [shadcn-ui/cn](https://github.com/shadcn-ui/cn). Every app and package already gets `cn` from `packages/ui`, so the swap happens in that one helper and flows through to Studio, docs, www, and the rest. **Changed:** - `packages/ui` `cn` helper now uses `createCn` from `cn/config`, keeping the custom `card`/`content` spacing scale so `p-card` still overrides `p-4`. It has an explicit signature and re-exports `ClassValue`. - The four www Launch Week files that imported the `ClassValue` type from `clsx` now import it from `ui`. - `blocks/vue` local `lib/utils.ts` re-exports `cn` from the package. - Comments/README that referenced tailwind-merge. **Removed:** - Direct `clsx` and `tailwind-merge` deps from `ui`, `ui-patterns`, `www`, and `blocks/vue`. `ui-patterns` and `www` declared them without importing. **Added:** - `packages/ui/src/lib/utils/cn.test.ts` covering clsx-style joining, conflict resolution, the custom spacing scale, and variant handling. Not migrated: the standalone apps under `examples/`. They're outside the workspace and mostly on Tailwind v3, which `cn` doesn't support. Lockfile note: after merging master, the lockfile diff is only the intended swap (`clsx` and `tailwind-merge` out, `cn@0.2.5` in). `tailwind-merge` stays in the lockfile as a transitive dep of a third-party package. Release-age note: this sat in draft with a temporary `minimumReleaseAgeExclude` entry for `cn` while `cn` was inside the workspace's 3-day `minimumReleaseAge` window. That window has closed, so the exclusion is gone and nothing bypasses the release-age gate. ## To test - `pnpm install --frozen-lockfile` succeeds with no `minimumReleaseAgeExclude` entry for `cn`. - `pnpm --filter ui test` – new `cn.test.ts` passes, including `cn('p-4', 'p-card')` → `p-card`. - Typecheck passes for studio, ui, ui-patterns, vue-blocks. www typecheck panics under tsgo on master already (pre-existing, unrelated); it passes with the JS `tsc` binary. - Spot-check Studio locally: class overrides still win in the usual places (e.g. `CodeEditor` height, `Button` variants with a custom `className`). https://claude.ai/code/session_01MkAt16tsPRDTm9oB5Jr8Ub <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Standardized Tailwind class merging across shared UI utilities while preserving conditional classes, custom spacing classes, and variant behavior. * Updated related components and examples to use the standardized class-merging utility. * **Tests** * Added coverage for conditional class handling, conflicting utility resolution, custom spacing classes, and variant separation. * **Documentation** * Updated usage guidance to reflect the standardized Tailwind class-merging approach. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Francesco SansalvadoreandClaude Sonnet 5
|
b0601f9ab7 |
feat(storage): add object versioning feature flag and feature preview (#49202)
| # | Branch | Base |
| - | ------ | ---- |
| 1 | `feat/storage-versioning-private-alpha` ◀ | `master` |
| 2 | `feat/storage-versioning/002-bucket-form-fields` | 1 |
| 3 | `feat/storage-versioning/003-bucket-modals` | 2 |
| 4 | `feat/storage-versioning/004-object-versions-data` | 3 |
| 5 | `feat/storage-versioning/005-file-preview-versions` | 4 |
| 6 | `feat/storage-versioning/006-billing-storage-retention` | 5 |
### PR 01
Adding feature flag for versioning.
- `UI_PREVIEW_STORAGE_VERSIONING` local storage key, allowlisted
- Feature preview entry gated on
`useFlag('storageVersioningPrivateAlpha')`
- `useIsStorageVersioningEnabled()`, following the existing
`useIsSqlEditorManualSaveEnabled` shape
<img width="910" height="604" alt="Screenshot 2026-08-19 at 11 33 45"
src="https://github.com/user-attachments/assets/5c51c3fa-6100-48e5-914d-63a9948a5024"
/>
Note: will improve the feature preview with an image once we approach
release.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added a Storage Versioning feature preview in the dashboard.
- Preview access is controlled by feature flags and is disabled by
default.
- Added descriptive information about Storage Versioning and its Private
Alpha availability.
- Added support for remembering the Storage Versioning preview setting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
|
||
|
Coenen BenjaminandCharis Lam
|
11289328e5 |
add support for warehouse connection string (#49914)
Add support for connection string for warehouse. This PR gives the ability to enable warehouse on a project and also get the connection string to connect to. > This project is only available in staging for now and gated behind a feature flag <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a Warehouse connection option to the Connect dialog. - Select schemas and tables to replicate, with setup progress, error recovery, and retry support. - View copyable Warehouse connection details, credentials guidance, command-line instructions, and DuckLake setup scripts. - Warehouse availability is controlled by feature configuration. - **Tests** - Added coverage for Warehouse table selection, setup script generation, URL parsing, and connection configuration utilities. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Benjamin <5719034+bnjjj@users.noreply.github.com> Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com> |
||
|
|
c086fe0d3f |
fix(studio): stop duplicating access_token_creation_sheet_dismissed on Done (#50077)
<!-- ccr-slack-attribution --> _Requested by **Pam Chia** · [Slack thread](https://supabase.slack.com/archives/C076KTY11DF/p1788743741768969?thread_ts=1788743741.768969&cid=C076KTY11DF)_ ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix (telemetry). ## What is the current behavior? `access_token_creation_sheet_dismissed` (added in #49965) fires on every close of the "Generate token" sheet in `/account/tokens`, including a successful completion. The "Token created" step closes the sheet through a "safe" path (clicking **Done**), but `handleOpenChange` tracked the dismissed event on that path too: a 1:1 duplicate of the already-tracked `access_token_done_button_clicked` event, with `step: 'success'`. The event's `tokenType` property was also never meaningful: it is derived from a variable that is only set after a token is actually created and never reset, so on a first-attempt abandonment it is always `'none'` by construction, and on a later abandonment in the same session it carries the *previous* token's type. The sheet also force-closes when the permissions map fails to load. That close was indistinguishable from a user abandonment. Linear: [GROWTH-1196](https://linear.app/supabase/issue/GROWTH-1196/fix-access-token-creation-sheet-dismissed-duplicate-on-done) ## What is the new behavior? - The event no longer fires on **Done**. The token-created step already blocks Escape, outside click, and Cancel, so the event now only reflects the sheet closing before a token exists. - Dropped `tokenType` (never described the abandoned attempt, see above) and `step` (a constant `'form'` once Done stops firing it; it was also typed Numeric project-wide in PostHog, so its string values read as NULL in HogQL). - New properties, read from the live form at close time through a small `useImperativeHandle` ref on `NewScopedTokenForm` (`useForm` ownership stays inside the form component): - `resourceAccess` (`project` | `organization` | `account`): the in-flight scope selection. `account` is the classic-token path, so this carries what `tokenType` was meant to. It is the default `project` when the form is untouched, so filter on `isFormTouched` before reading it as intent. - `formStep` (`form` | `review`): which screen the user was on. The sheet-level `step` never captured this. - `isFormTouched`: whether any field was changed from its default. - `trigger` (`user` | `permissions_load_error`): the forced close on a failed permissions load now fires with its own trigger, so an endpoint regression shows up in the funnel instead of silently lowering `access_token_created`. - Fixed a double-fire on the load-error path: the form's error effect depended on the `onCancel` callback identity and re-ran on the sheet's close re-render (double toast, and a double event). It now reads the callback through a ref and depends only on `isError`, matching the existing `isReducedMotionPreferredRef` pattern in the same file. ## Additional context `NewScopedTokenSheet.test.tsx` asserts: Done does not emit the dismissed event; Cancel and Escape emit it with `trigger: 'user'` and the in-progress `resourceAccess` and `isFormTouched`; dismissing from the review screen reports `formStep: 'review'`; a 500 from the permissions endpoint emits exactly one event with `trigger: 'permissions_load_error'` and closes the sheet. `step` being typed Numeric in PostHog affects every event that sends a string `step`. That is a PostHog data-management fix handled separately, not in this PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01XW73umv73LrrKxFwwymSaH --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Pamela Chia <pamelachiamayyee@gmail.com> |
||
|
Danny WhiteandJoshen Lim
|
a351a36e9b |
refactor(studio): centralise replication payload builders (#49842)
## What kind of change does this PR introduce? Studio data-layer refactor. ## What is the current behavior? Pipeline creation, editing, and validation build similar destination and pipeline payloads separately. The duplicated mappings rely on type assertions and can drift between actions. ## What is the new behavior? Uses shared typed builders for create, update, and validation payloads across the existing destinations. Update payloads continue to omit blank secrets, while create payloads preserve their current values. This PR does not add table partitioning configuration. ## To test This is a data-layer refactor. No visible behaviour should change. 1. Open **Database > Replication** and click **Start a new pipeline**. 2. Select **BigQuery**, or any other enabled destination. 3. Edit a few non-secret fields and expand **Advanced settings**. 4. Confirm the form remains usable and no runtime errors appear. Create, update, validation, and secret-handling behaviour is covered by the focused tests and CI. Deploy previews and fresh local projects do not have the existing destinations or credentials needed to exercise those paths manually. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved replication destination configuration handling during creation, updates, and validation. * Applied consistent configuration mapping across supported destination types. * Ensured blank secret values are omitted during updates while retained when creating destinations. * Standardized table synchronization defaults when no specific setting is provided. * **Tests** * Added coverage for BigQuery configuration mapping and secret handling. * Updated DuckLake tests for destination updates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Saxon FletcherandCursor
|
c365549ab8 |
feat(studio): resizable query/results split in the Explorer query editor (#49984)
## What's changed Stack 1/2 (next: https://github.com/supabase/supabase/pull/49985). - `QueryEditor` (`viewport` variant, e.g. Explorer query tabs and assistant query cells) now renders the SQL editor and results in a vertical `ResizablePanelGroup` instead of a fixed `h-[45%]` editor. The split is persisted under `LOCAL_STORAGE_KEYS.EXPLORER_QUERY_SPLIT_SIZE`. The `embedded` variant (notebooks) is unchanged. - Editor and results JSX are extracted into `querySql` / `queryResults` so the two layouts share one definition. - `isRunDisabled` now hides the toolbar run button instead of rendering it disabled (editor shortcuts are still disabled). `AssistantQueryCell` only sets it while an approval is pending, so the run button comes back once the tool call has resolved. - `QueryRunButton`: "Run selected" → "Run selected SQL", plain `DropdownMenuItem` instead of `DropdownMenuItemTooltip`. - `QueryResultError` no longer paints its own table-header background. ## How to test 1. Explorer → open a query tab. Drag the handle between the editor and results; reload — the split size is restored. 2. Toggle "Hide query" / "Show query" — results fill the tab when the editor is hidden. 3. Open a notebook — cells still render with the fixed-height editor (no resizable handle). 4. In the AI Assistant, ask for a query that needs approval. While the approval footer is shown there is no run button in the cell toolbar; after "Run query" / "Skip", the run button appears and works. 5. `pnpm --filter studio exec vitest --run components/interfaces/Explorer` passes. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **User Interface** - Query results now appear in a resizable vertical split view, allowing users to adjust the space allocated to the editor and results. - Updated query result styling provides a cleaner background presentation. - Query result panels are better centered when appropriate. - **Query Execution** - The menu option is now labeled **“Run selected SQL.”** - The run button is hidden when query execution is unavailable. - **AI Assistant** - Query execution is disabled only during the relevant confirmation states. - Assistant query panels now use a wider, full-width layout. - Debugging a query now updates the assistant’s initial input. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Gildas Garcia
|
50a6ebbe6d |
Scoped PAT: improve error handling when showing a token details (#49997)
We already have proper error handling on: - the token list query - token creation/deletion with toasts We had custom error handling on the token permissions sheet. Replaced it with an `AlertError`: <img width="798" height="371" alt="image" src="https://github.com/user-attachments/assets/24145308-b1cd-491f-8f54-0c628dd185ce" /> Question: should we do something about the sheet header when the token couldn't be loaded? <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved the access token loading error state with a clearer, consistent error display and “Please try again” guidance. * Added a fallback label of “Unknown” when an access token name is unavailable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
1308a1d0d0 |
fix(studio): close popover menu when dragging block (FE-4301) (#49912)
## Summary * Closes the block options popover (grip dropdown menu) when a drag operation starts on that block * Fixes the issue where the menu would remain visible during the drag if it was already open <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Section action menus now remain closed when dragging begins, preventing delayed reopening and keeping the editing interface clear and focused. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
CharisandJoshen Lim
|
2ee0108928 |
studio: increase gp3 max size to new aws limit (#45611)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Increased GP3 disk limits to support up to 64 TB of storage, 80,000 IOPS, and 2,000 MB/s throughput. * **Documentation** * Updated the disk comparison table to reflect the expanded GP3 limits. * **Bug Fixes** * Improved disk-size validation and recommendation messaging for clearer wording. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Charis
|
a4d925c230 |
fix(studio): write debug prompt into current chat when assistant is already open (#49911)
## Summary * Query blocks embedded inside an active assistant conversation (`AssistantQueryCell`) reused the same "Debug with Assistant" handler as standalone query blocks (Explorer Query tab, notebook cells), which always opens a brand-new chat and navigates away. * Clicking Debug on a block that's already part of the open conversation silently abandoned it for an unrelated new chat, which read as the button doing nothing. * Added an optional `onDebug` override threaded through `QueryEditor` → `QueryResultRenderer` → `QueryResultError`; `AssistantQueryCell` now uses it to write the debug prompt into the currently active chat's composer (`ai-assistant-state`'s new `setInitialInput`) instead of creating a new chat. Standalone query blocks keep the existing "open a new chat" behavior since no `onDebug` override is passed there. * `ExplorerChatTab` now wires `composerContext` into `AssistantChat` (it wasn't before), so the pre-filled prompt actually reaches the visible textarea on the Explorer chat route. Fixes [FE-4319](https://linear.app/supabase/issue/FE-4319/debug-with-ai-assistant-does-seemingly-nothing-if-query-is-already). ## Test plan - [X] `pnpm vitest run` on `QueryResultError.test.tsx` / `QueryResultError.selfhosted.test.tsx` / `ExplorerChatTab.test.tsx` / `AssistantQueryCell.utils.test.ts` — all pass, including new test asserting `onDebug` is called instead of `createChat`. - [X] `pnpm exec eslint` on touched files — clean (only pre-existing unrelated warnings). - [X] Manual check: run a query inside an assistant chat that errors, click "Debug with Assistant" on that block, confirm the debug prompt appears in the current chat's composer rather than opening a new chat. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a “Debug with Assistant” workflow that sends SQL error details to the AI Assistant as its initial input. * Preserved the existing behavior of opening a new debug chat when the Assistant panel is unavailable. * **Tests** * Added coverage confirming that debugging invokes the Assistant callback without creating an additional chat. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earthandGildas Garcia
|
8654991847 |
feat(studio): additional events for scoped pat telemetry (#49965)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Adds PostHog tracking to the final step of the scoped PAT creation flow, after `access_token_created` fires. The token value is only ever shown once, so this measures whether users actually leave with a usable token. Three new events on the "Token created" step: | Event | Properties | | --- | --- | | `access_token_copied` | `tokenType` | | `access_token_stored_checkbox_clicked` | `tokenType`, `isChecked` | | `access_token_done_button_clicked` | `tokenType`, `hasCopiedToken` | - `isChecked` is the resulting state, so unticking the acknowledgement is captured too. - `hasCopiedToken` records whether the Copy button was used before finishing. Done is gated on the checkbox, not on copying, so this separates "copied it" from "ticked the box and left." - `tokenType` is threaded through from the sheet, which creates a classic token when resource access is `account` and a scoped one otherwise. It matches the existing `access_token_created` / `access_token_removed` property. ## Changes - `packages/common/telemetry-constants.ts` — three event interfaces, added to the `TelemetryEvent` union - `NewScopedTokenSuccess.tsx` — `useTrack()` plus a new `tokenType` prop; copy/acknowledge/done routed - `NewScopedTokenSheet.tsx` — `createdToken` state now holds `{ token, tokenType }` so the success step knows which - `NewScopedTokenSheet.test.tsx` — extended the two tests that already walk the full success flow with assertions and classic paths) ## Testing `pnpm test:studio` on `NewSco16 passing. Typecheck clean. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Analytics** * Added tracking for key access-token creation interactions, including copying tokens, selecting storage options, and completing the flow. * Tracking distinguishes between classic and scoped access tokens and records whether a token was copied before completion. * Added tracking when the access-token creation sheet is dismissed, including the current step. * **Behavior** * Existing copy, storage-selection, notification, and completion actions continue to work as expected. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Alaister YoungandAlaister Young
|
0ddf2006d3 |
[FE-4337] feat(studio): block pause, restore, and add-ons on High Availability projects (#49990)
Studio-side guard for Multigres (`high_availability`) projects, mirroring the platform API guard from supabase/platform#37527. Pause, restore/PITR, and add-on affordances now show a clear "unavailable on High Availability projects" state instead of failing with a 400 after the click. <img width="1195" height="632" alt="Screenshot 2026-09-04 at 2 03 11 PM" src="https://github.com/user-attachments/assets/718c09f2-d92b-49dc-90ed-5d9ff810b03d" /> **Added:** - Pause project button is disabled on HA projects with a tooltip - Scheduled backups tab short-circuits to an HA empty state (matches the existing PITR tab). Per-row Restore buttons are also disabled with a tooltip as defense in depth, since BackupItem is reusable - Restore to new project shows an HA admonition ahead of the permission / PG15 / physical-backup checks - Add-ons page shows a page-level HA notice, all three rows are locked with a tooltip, and the side panels are not mounted on HA so `?panel=pitr|ipv4|customDomain` deep links are inert - Component tests for `PauseProjectButton` and `BackupItem`, plus unit tests for the new `isHighAvailability` branch in `Addons.utils.ts` **Changed:** - Add-ons rows are now consistent: the IPv4 row uses the same padlock tooltip as PITR and custom domain instead of a tooltip on the badge. Same disabled-reason strings as before, just surfaced via the padlock on non-HA projects too - `BackupItem` tooltip text extracted into a `getTooltipText()` function (mirrors `PauseProjectButton`) - `HighAvailabilityDisabledSectionNotice` accepts a `className` Detection reuses the existing `useIsHighAvailability()` hook, which the rest of Studio already treats as the Multigres signal. ## To test Use an HA project (`project.high_availability === true`) and a normal project. HA project: - Settings > General: "Pause project" is disabled, tooltip reads "Pausing is unavailable on High Availability projects" - Database > Backups > Scheduled backups: HA empty state, no "No backups yet" / daily backup copy - Database > Backups > Restore to new project: HA admonition, no restore controls - Settings > Add-ons: notice at the top, padlock on all three rows with per-row tooltip, clicking rows does nothing, and `?panel=pitr` / `?panel=ipv4` / `?panel=customDomain` open nothing Normal project (regression): - No "High Availability" strings on any of the above pages - Pause button enabled (or disabled only for its usual reasons, e.g. paid plan) - Add-on rows open their side panels on click and via `?panel=pitr` - Scheduled backups tab shows its normal list / empty state <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Features** - High Availability projects now clearly indicate when scheduled backups, backup restoration, project pausing, IPv4, PITR, and custom domains are unavailable. - Added explanatory notices, disabled controls, and tooltips throughout affected settings and backup screens. - Restore-to-new-project workflows now provide guidance to contact support when unavailable. - **Bug Fixes** - Improved consistency of availability messaging across High Availability project settings and database backup actions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Danny White
|
887279ec2a |
fix(studio): align remaining platform auth labels (#49879)
## What kind of change does this PR introduce? Copy fix in Studio platform UI. ## What is the current behavior? Studio still uses mixed auth wording outside nav dropdowns: in-app API docs use "Log in", account email change uses "Log out of", forgot-password uses title-case "Sign In", and org invites use "Create an account". ## What is the new behavior? Aligns remaining Studio surfaces with **Sign in / Sign out / Sign up**. Related to [#49874](https://github.com/supabase/supabase/pull/49874) and [#49877](https://github.com/supabase/supabase/pull/49877). CLI copy in `GeneratingTypes.tsx` is unchanged (`supabase login`). ## To test - Account → change email (GitHub identity): instructions say **Sign out of** - `/forgot-password`: footer link says **Sign in** - Org invite (signed out): secondary button says **Sign up** - Project → API docs → User Management: section titles use **Sign in** / **Sign out** <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated authentication terminology across user management guidance and GitHub email-change instructions for consistency. * **Improvements** * Changed the organization invitation link label to “Sign up.” * Standardized the forgot-password page link capitalization to “Sign in.” * **Tests** * Updated invitation view coverage to reflect the revised “Sign up” label. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
e0280cb650 |
docs: restructure observability navigation and overview (#49505)
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Stack Draft stack extracted from `docs/monitoring`. Merge bottom-up. The troubleshooting *catalog* rewrite (`content/troubleshooting` and the Diagnosing UI) stays out of scope. 1. #49503 move inspect and advisors 2. #49501 split Studio logs from ClickHouse queries 3. #49500 treat reports as signal dashboards 4. #49502 add Observe the data hub 5. #49506 add agent setup components 6. #49504 add hire-an-agent templates 7. **#49505** restructure observability nav, overview, Detecting, and flatten Observe the data ← **this PR** ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. Top layer in the observability stack. ## What is the current behavior? The section is still titled Monitoring and Debugging, with a Debugging / Monitoring split that does not match the new pages. The debugging guide is still the master layer-isolation + symptom table. Observe the data is split into “what data” vs “where to observe it,” which duplicates the source pages. ## What is the new behavior? - Section title is Observability - Overview groups Observe the data, Detect and resolve, Hire an agent, and Export - **Observe the data is flattened by source.** Logs, Metrics API, Database, Advisors, and Reports each list where to read that source. There is no separate MCP/API/CLI/Studio nav group. - **Observe vs Detecting:** Observe is the catalog (what exists, how to access it). Detecting is how to *use* those sources to pick up a Health / Security / Performance / Usage signal. Named errors skip to Diagnosing. - Studio Logs sits under Logs. Reports sits beside the other sources. - Troubleshooting stays in the global menu and also appears as Diagnosing under Detect and resolve ## Additional context This is the last PR in the stack. Together the seven PRs reconstruct the `docs/monitoring` observability IA and guide content, without shipping the troubleshooting catalog overhaul. <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com> Co-authored-by: Nik Richers <nik@validmind.ai> |
||
|
|
0bbd64743c |
docs: move inspect and advisors into observability (#49503)
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Stack Draft stack extracted from `docs/monitoring`. Merge bottom-up. Troubleshooting / debugging-guide rewrite is out of scope. 1. **#49503** move inspect and advisors ← **this PR** 2. #49501 split Studio logs from ClickHouse queries 3. #49500 treat reports as signal dashboards 4. #49502 add Observe the data hub 5. #49506 add agent setup components 6. #49504 add hire-an-agent templates 7. #49505 restructure observability nav and overview ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. First layer in the observability stack. ## What is the current behavior? Inspect and advisors live under Database (`/guides/database/inspect`, `/guides/database/database-advisors`). Observability readers have to leave the monitoring section to find them. ## What is the new behavior? - Moves inspect into `/guides/monitoring-and-debugging/inspect` - Adds `/guides/monitoring-and-debugging/advisors` (replaces the Database Advisors page) - Adds redirects and updates Studio/docs links so old URLs keep working - Adds both pages to the existing Monitoring nav so they are discoverable before the later IA PR ## Additional context Inspect and advisors pages render as standard MDX. Redirects cover `/docs/guides/database/inspect`, `/docs/guides/database/database-advisors`, and `/docs/guides/database/database-linter`. Debugging-guide content is unchanged except the inspect URL. ## Self-review - No leftover `/guides/database/inspect` or `/guides/database/database-advisors` links in docs guides or Studio linter/AI surfaces (historical blog posts left as-is) - Smoke test path updated to `/docs/guides/monitoring-and-debugging/advisors` <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-a3cb5ece-925b-4046-b58a-5d69e9a9d794&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a centralized Advisors guide for security and performance checks. - Updated database inspection guidance with live Postgres statistics, cache hit-rate context, and query-analysis resources. - **Documentation** - Reorganized Advisors and database inspection content under Monitoring and Debugging. - Updated navigation, cross-references, in-product help links, and CLI documentation links. - Added permanent redirects from previous documentation URLs to preserve access. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com> Co-authored-by: Nik Richers <nik@validmind.ai> |
||
|
Gildas Garcia
|
95ca302439 |
OAuth Apps Scoped Grants: refactor to ease future implementation (#49958)
## Problem We're working on OAuth Apps Scoped Grants and want to display an alternative UI for Authorized apps depending on a feature flag. However, the `/apps` page currently contains the code of both the _Publishable apps_ and _Authorized apps_ sections. ## Solution No functional nor design changes. - Extract both sections into their own components to ease the introduction of the alternative UI - Improve a11y <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added separate views for managing publishable and authorized OAuth applications. - Users can publish, update, and delete applications, with convenient credential-copy controls. - Authorized applications can be sorted and revoked through a confirmation dialog. - **User Experience** - Added clear loading, empty, error, and permission-denied states for OAuth application lists. - Improved organization settings layout for OAuth app management. - Added consistent sorting behavior when selecting and toggling table columns. - Improved accessibility for credential notifications and dismissal controls. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
6181e27b93 |
Scoped PAT: ensure innaccessible resources are distinguishable (#49948)
## Problem When users don't have access to some resources targeted by a token, we show those resources slugs or refs. However, they are not distinguishable enough. ## Solution - Make them distinguishable by applying the _destructive_ color - Cleaned up unused code (`isInaccessible` prop wasn't used anymore after last refactoring but we forgot to remove it) ## How to test 1. Invite another user to one of your projects 2. As this other user, create a scoped pat targeting the project 3. As the initial user, remove the invited user from the project 4. As the invited user, check the token permissions: you should see an admonition at the top and the project should be displayed in red with only its ref (not its name) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Access token resource indicators now accurately show when an organization or project is inaccessible. - Inaccessible resources are clearly labeled as “revoked,” reducing ambiguity about their access status. - **Style** - Organization and project access indicators now use consistent badge styling, spacing, and icon treatments. - **Accessibility** - Revoked status messages are now announced more clearly to assistive technologies. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
357d6cd3eb |
add github discussion link to explorer preview (#49918)
Adds the GitHub discussion link for Explorer feature preview. Resolves FE-4256 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated the Explorer & Notebooks feature preview with a working link to its GitHub discussion. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
6738dded80 |
feat(studio): add Health Advisor page (#49663)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature ## Summary - Add a Health Advisor page at `/project/[ref]/advisors/health` - Put Health Advisor first in the Advisors left nav (above Security), platform-only - Register `V` then `H` and a command-menu entry Stacked on #49662. Top of the stack. ## To test 1. Open any project in Studio. 2. Click **Advisors** in the main nav (or go to `/project/<ref>/advisors/security`). 3. In the left nav, confirm the order is **Health Advisor**, then Security Advisor, then Performance Advisor, then Query Performance. 4. Click **Health Advisor**. You should land on a page titled “Health Advisor” with Errors / Warnings / Info tabs, same layout as Security Advisor. 5. If the project is healthy, Errors should say no errors were detected. If it is not, the failing checks should list here (database down, connection limit, and so on). 6. Click **Refresh** (or Shift+R) and confirm the list reloads. 7. Click a row and confirm the detail panel opens with a link through to logs, connections, or infrastructure. 8. While still in Advisors, press **V** then **H**. You should jump back to Health Advisor. 9. Open the command menu and search **Health Advisor**. Choosing it should navigate to this page. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a Health Advisor page for reviewing project health findings by severity and category. - Added Health Advisor navigation in the advisor menu and a keyboard shortcut (`V`, then `H`) on supported platforms. - Added refresh, filtering, selection, and lint detail navigation for health findings. - **Bug Fixes** - Added validation for linter severity values, safely handling unsupported or missing inputs. - **Documentation** - Updated migration and shortcut documentation to include the Health Advisor. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
|
b5daafd264 |
feat(studio): add health category to the advisor panel (#49662)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature ## Summary - Replace advisor panel tabs with multi-select category filters, including Health - Load health lints in the advisor panel (without blocking other categories on the slower health request) - Rename item `tab` to `category` and add empty-state copy for health Stacked on #49661. ## To test 1. Open any project in Studio. 2. Open Advisor Center from the toolbar (the advisor / lightbulb control). 3. Confirm the old All / Security / Performance / Messages **tabs are gone**. You should see **Category**, **Status**, and **Severity** filters instead. 4. Open Category and confirm **Health** is in the list with Security, Performance, and Messages. 5. Select only **Health**: - If the project is healthy: empty state “No health issues detected” / “Your database, instance and services are all responding normally”. - If it is not: only health issues in the list. 6. Clear Health, then filter **Security** and **Performance** separately. Those lists should still match what you expect from before. 7. With Health selected, also filter Severity to **Info** only. If nothing matches, you should get “No items found” and a way to clear filters — not a false “no health issues” message. 8. From project home, click an advisor card. Advisor Center should still open on that same item. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added category-based filtering for Advisor recommendations, including Security, Performance, Health, and Messages. - Added Health issue recommendations and category-specific icons, labels, and empty-state messaging. - Advisor results now load according to the selected categories. - Added clearer project requirements and hidden-item controls for filtered results. - **Bug Fixes** - Invalid category and severity filter values are safely ignored. - Improved categorization and telemetry for Advisor items, including health and security recommendations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Saxon FletcherandCursor
|
ad33b16f8c |
feat(studio): show health advisors on the project home (#49661)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature ## Summary - Add a `useProjectHealthLintsQuery` that runs the live health checks (database down, unreachable, connection limit, service error rate, infrastructure alerts) - Surface those results on the project home advisor row alongside security and performance errors - Register health lint metadata (titles, docs links, entity icon) so homepage cards can render them Bottom of the stack. The advisor sidebar still uses tabs; health items show under All until #49662. ## To test 1. Open any project home in Studio. 2. Find the Advisor row (the cards under “Advisor found N issues”). 3. If the project has a real health problem, you should see a **HEALTH** card (for example “Database process is down” or “Database connection limit reached”), not only SECURITY / PERFORMANCE. 4. If the project is healthy, you should **not** see a HEALTH card. Existing security and performance cards should still appear as before. 5. Click a HEALTH card (or any advisor card). Advisor Center should open on that item. 6. In Advisor Center on this PR, health items only show under the **All** tab — Health is not its own tab yet. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a Health category to Advisor, with a dedicated tab and activity icon. - Added health checks for database availability, connection limits, service errors, and infrastructure alerts. - Health issues now appear alongside security and performance recommendations with relevant troubleshooting links. - **Bug Fixes** - Health-related advisor findings are now correctly categorized and displayed. - **Tests** - Added coverage for health checks, categorization, filtering, and project health query behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Gildas Garcia
|
6e8b43d7b4 |
fix: improve useRefreshOnOpen hook (#49886)
## Problem The `useRefreshOnOpen` returns a new object each time it runs, making the `useCallback` useless. ## Solution Wrap the function content in `useMemo` instead <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved refresh handling for the replication destination form when it is opened. * Existing refresh behavior remains consistent and reliable. * No user-visible changes to functionality, controls, or configuration options. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
59af339b8f |
fix(ui): standardise nav logout label to "Sign out" (#49874)
## What kind of change does this PR introduce? Copy fix across nav dropdowns. ## What is the current behavior? Authenticated nav dropdowns use mixed logout wording: Studio shows "Log out", while www, docs, and learn show "Logout". Studio error flows already use "Sign out". | Before | | --- | | <img width="482" height="670" alt="CleanShot 2026-09-02 at 13 07 46@2x" src="https://github.com/user-attachments/assets/d87b7c18-94c0-4c1c-917e-e17e4cb16dd3" /> | ## What is the new behavior? All four nav dropdowns use **Sign out**, matching the Sign in / Sign up standard and the direction in [DOCS-1328](https://linear.app/supabase/issue/DOCS-1328). Related: [Slack thread](https://supabase.slack.com/archives/C0429V78ACX/p1787081498302919) ## To test Only Studio is possible to test (before merge) given how authentication works across apps on staging: 1. **Studio** (`/dashboard`): open the account avatar dropdown. Confirm the bottom item reads **Sign out**. 2. **www** (`supabase.com`): open the account avatar dropdown. Confirm **Sign out**. 3. **docs** (`supabase.com/docs`): open the account avatar dropdown. Confirm **Sign out**. 4. **learn** (`supabase.com/learn`): open the account avatar dropdown. Confirm **Sign out**. |
||
|
Danny White
|
442e40a30b |
refactor(studio): simplify pipeline advanced settings (#49841)
## What kind of change does this PR introduce? Small Studio UI refactor. ## What is the current behavior? BigQuery-only fields are already conditionally rendered, but repeat that scope in badges. Number inputs also convert non-empty invalid values directly with Number(). ## What is the new behavior? Removes the redundant badges, keeps number fields empty instead of storing NaN, and gives the invalidated-slot menu consistent viewport collision spacing. | Before | After | | --- | --- | | <img width="1238" height="364" alt="CleanShot 2026-09-02 at 14 40 02@2x" src="https://github.com/user-attachments/assets/8c9b0c30-250e-422f-af3b-70f84e439459" /> | <img width="1252" height="358" alt="CleanShot 2026-09-02 at 14 40 22@2x" src="https://github.com/user-attachments/assets/8b3c6837-2c84-4c0d-ae07-b6b8b7a50cfe" /> | ## To test 1. Open the pipeline creation sheet and expand Advanced settings. 2. Confirm connection pool size and maximum staleness appear only for BigQuery, without BigQuery-only badges. 3. Clear and re-enter the numeric advanced settings. 4. Open Invalidated slot behavior near the viewport edge and confirm the menu remains visible. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved handling of numeric input in advanced replication settings, including empty and invalid values. * Adjusted the invalidated slot menu positioning for better display. * **UI Improvements** * Simplified labels for connection pool size and maximum staleness settings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Saxon Fletcher
|
4ee43f3585 |
chore(studio): refine Explorer query UI (#49895)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? UI refinements for Explorer query surfaces. ## What is the current behavior? - The assistant chat textarea uses a tighter radius than the Run SQL / Create a notebook cards on Explorer home. - Chart results sit unevenly in the results pane because axis gutters stack on card padding, and long Y labels can clip. - Selecting SQL in the editor changes the primary Run button to Run selected, which is easy to trigger by accident. - The Prettify SQL icon in notebook query cells uses Lucide's default size, so it doesn't match other toolbar actions. ## What is the new behavior? - Assistant chat form uses `rounded-lg` so it matches the home action cards everywhere the form is used. - Query result charts collapse unused axis space, add a little padding when labels are on, and size the Y axis from formatted ticks so longer labels fit. - Run is a default split button that always executes the full query. Run selected is a secondary menu item, disabled until SQL is selected. - Notebook cell Prettify SQL icons use `size={16}` and `strokeWidth={2}` like the rest of the Explorer toolbar. ## Additional context Cmd+Enter in the editor still runs the current selection when there is one. ## Test plan - [ ] Open Explorer home and confirm the assistant chat radius matches the Run SQL and Create a notebook cards. - [ ] Run a query, switch to chart view, and check spacing with labels off and on, including large Y values. - [ ] With no selection, click Run and confirm the full query runs. Open the split menu and confirm Run selected is disabled. - [ ] Select SQL, click Run, and confirm the full query still runs. Use Run selected from the menu to run only the selection. - [ ] In a notebook query cell, confirm Prettify SQL matches the size and stroke of nearby toolbar icons. Made with [Cursor](https://cursor.com) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a split Run control in the query editor, with separate actions for running all content or only selected text. - Added support for customizing chart X-axis display settings. - Improved chart Y-axis sizing, scaling, and tick formatting for clearer results. - **Bug Fixes** - The “Run selected” action is unavailable when no text is selected. - **Style** - Updated toolbar icon sizing and added rounded corners to the assistant chat input. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi Enric
|
55706ca61b |
fix(workers): support private deployments FE-4328 (#49902)
## Problem The dashboard's Workers snippets said that the CLI could only deploy public Workers and generated the obsolete access configuration field. ## Fix Use the CLI and backend exposure field in generated config, CLI, and AI snippets so private Worker deployments are supported. ## How to test - Run: pnpm --filter studio test components/interfaces/Workers/workerSnippets.test.ts - Expected result: all 11 tests pass, including private Worker snippets using --exposure private. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Improvements** - Worker deployment snippets now pass the selected exposure setting directly to the CLI. - Generated `config.toml` files now use the `exposure` setting. - AI deployment guidance now documents the exposure flag, helping clarify deployment configuration. - **Changes** - Removed the previous private-worker warning and public-only deployment note from deployment guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi Enric
|
a46170aa76 |
feat(workers): add log filters FE-4322 (#49893)
## Problem Workers log views were limited to the most recent 24 hours and could not be narrowed by event text or HTTP method. ## Fix Adds selectable time ranges, event-message search, and an HTTP-method filter for invocation logs. Filters are applied in the analytics query and included in the cache key. ## How to test - Open a worker and select the Invocations tab. - Change the time range, enter an event message, and select a method. - Expected result: only matching invocation logs are shown. - Open Logs or Activity. - Expected result: message and time filters are available; the method filter is hidden. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added worker log filtering by date range and event message. * Applied a default 24-hour time range to log searches. * Improved filter controls and updated empty-state messaging to reflect the selected range. * **Bug Fixes** * Improved filtering accuracy and safer handling of special characters in event messages. * **Tests** * Added coverage for date-range and message-filter query behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
e7d91dbd06 |
fix(studio): display diff for view-only notebook cell edits (#49901)
## Summary Fixed a bug in the AI Assistant notebook-update proposal preview where a `replace_cell` operation that only changed a cell's view (table ↔ chart) or chart parameters (type, x/y columns, cumulative, scale, labels) would show as a "Replaced" row but the expanded diff would appear empty. **Root cause:** The diff editor only compared the cell's SQL text; view and chart configuration were never considered, so changes to those aspects showed no diff. **Solution:** * Refactored `getCellMetadata` to return structured `NotebookCellFields` with separate `source` (database/time range) and `view` (table/chart) fields instead of a single concatenated string * Added `formatChartConfig` and `formatCellView` helpers to describe chart cells * Updated `getEntryMetadata` to diff source and view independently, showing only the fields that actually changed (e.g., "Table → Chart (bar, ...)" when only the view changed, with the unchanged database omitted) * If neither field changed, metadata is hidden entirely ## Test plan * Added test cases for: chart-view cells reporting a `view` field, view-only changes surfacing without the unchanged database, chart-parameter-only changes surfacing without the unchanged database, database-only changes surfacing without the unchanged view, and fully-unchanged replacements hiding metadata entirely * All 43 tests in the touched test file pass * `tsc --noEmit` on apps/studio shows no new type errors ## Summary by CodeRabbit * **Enhancements** * Improved AI Assistant notebook previews with clearer cell details, including source content and table or chart views. * Chart previews now show key configuration details, such as chart type and selected dimensions * Replacement previews highlight only the fields that changed and hide entries with no visible changes. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Notebook previews now distinguish cell content from its view, including table and chart details. * Chart previews display relevant configuration, such as chart type and axes. * Log previews include their formatted time range. * Replacement previews now show only the fields that changed. * **Bug Fixes** * Unchanged replacements are now hidden instead of displaying misleading content. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
9aaa753306 |
feat(studio): add telemetry for explorer/sql editor temporary switch buttons (#49898)
## Summary Add PostHog event tracking for the two new buttons introduced in PR supabase/supabase#49698 that allow users to temporarily switch between the Explorer and SQL Editor: * **Explorer button**: "Back to SQL Editor" button in the Explorer sidebar title bar now fires `explorer_temp_access_sql_editor_clicked` event * **SQL Editor button**: "Back to Explorer" button in the SQL Editor title bar (shown during temporary visits) now fires `sql_editor_back_explorer_clicked` event Both event interfaces follow the repo's telemetry-standards conventions, carrying only `groups: TelemetryGroups` property with no additional custom properties. ## Test plan - [X] Verify `explorer_temp_access_sql_editor_clicked` event fires in PostHog when clicking "Back to SQL Editor" button in Explorer - [X] Verify `sql_editor_back_explorer_clicked` event fires in PostHog when clicking "Back to Explorer" button in SQL Editor - [X] Run typecheck: `pnpm typecheck` passes without errors - [X] Run lint: `pnpm lint --filter=studio` passes ## Issue Resolves [FE-4213](https://linear.app/supabase/issue/FE-4213/explorer-set-up-telemetry-for-metrics-where-appropriate) ## Summary by CodeRabbit * **Analytics** * Added tracking for navigation from the Explorer to the SQL Editor. * Added tracking for returning from the SQL Editor to the Explorer. |
||
|
Jordi Enric
|
abb7f3ede2 |
fix(workers): refresh Workers view FE-4323 (#49887)
## Problem The Workers view can remain stale after a worker is deployed through the CLI, because the dashboard has no deployment mutation to invalidate its list query. ## Fix Add a manual Refresh action to the Workers header and force the Workers list query to refetch whenever the browser regains focus. ## How to test - Open a project’s Workers view and select Refresh. - Expected result: the list requests current worker data and renders it. - Deploy a worker through the CLI, then return focus to the Workers view. - Expected result: the Workers list refreshes even when its cached data is fresh. Closes FE-4323. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added Refresh buttons to the Workers page and worker list. - Refreshing displays the latest worker information and shows a loading state while data is retrieved. - Worker data now automatically refreshes when the browser window regains focus. - Added a Refresh action to unexpected-error messages, allowing failed requests to be retried without leaving the page. - **Bug Fixes** - Improved recovery from failed worker data requests through in-page retry support. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Pamela Chia
|
5db8a0e960 |
feat(studio): instrument sign-in attempts and failures (#49853)
The /sign-in page emitted only a pageview on entry and the success-side `sign_in` event on exit: failed or abandoned attempts were invisible, so "never interacted" and "tried and failed silently" could not be told apart in the sign-in funnel. I added an unsampled `sign_in_submitted` event at every initiation point and classified failure capture via `dashboard_error_created` with a new `signin` origin. **Changed:** - **Submit attempts observable**: `sign_in_submitted` (method: `email`, provider id, `sso`, or partner) fires from the DOM submit handler on the password and SSO forms (so submits that fail client-side validation still count), and from the OAuth, custom-provider, and partner initiation handlers. - **Failures classified**: each sign-in error path feeds the existing funnel-error pipe with origin `signin` and a controlled reason slug (`invalid_credentials`, `email_not_confirmed`, `captcha_failed`, `sso_provider_not_found`, ...). GoTrue auth errors now classify via their numeric `status`, guarded so transport failures (`status: 0`) stay `network_error`. - **Attempt events survive the OAuth redirect**: the telemetry event POST sends with `keepalive` (scoped to `sign_in_submitted`, since keepalive requests share a per-page in-flight body quota), so a dispatched request is no longer aborted by the provider navigation; send rejections are caught centrally instead of surfacing as unhandled rejections. The fetch still dispatches after an async token lookup, so preview testing verifies the GitHub-path event actually lands on the wire. - **Captcha rejection is no longer silent**: a rejected hCaptcha challenge resolves the stuck loading toast with an error message, emits `captcha_challenge_failed` (distinct from `captcha_failed`, which stays reserved for the auth server rejecting a submitted token), reports to error monitoring, and resets the captcha widget (previously: unhandled promise rejection and a spinner that never resolved). - **Partner method validated**: the partner sign-in page resolves the URL-hash value against the provider registry and forwards the canonical provider id into `method` on both `sign_in_submitted` and `sign_in`; anything unregistered records as `unregistered_partner`, so a crafted link can't poison the breakdown on either event. **Note:** failure events stay on the shared 10% `dashboard_error_created` sampling rate (a per-origin carve-out would break cross-source volume comparability); the unsampled attempt event carries the tried-vs-never-interacted signal at full volume. ## To test Tested on Vercel preview (studio-staging, wire-level network capture + staging ingestion check): - [x] On `/sign-in`, submit a bogus email + password: expect a `POST */platform/telemetry/event` request with `action: sign_in_submitted`, `method: email` in the network tab, plus an error toast. Observed: 201, auth returned 400 as expected. - [x] Submit with an empty password: expect `sign_in_submitted` to still fire (validation failures count as attempts). Observed: event fired with 201 and no auth call followed. - [x] Click "Continue with GitHub": expect `sign_in_submitted` with `method: github` on the wire before the provider redirect. Observed: the POST completed (201) before the browser landed on github.com, so the keepalive path holds. - [x] Negative case: fresh page load with no interaction fires no `sign_in_submitted`. - [x] Ingestion: all fired events (methods `email`, `github`, plus organic `sso` submits from a real login on the same preview) arrived in the staging project with the expected properties. - [x] Re-ran the email and GitHub paths on the scoped-keepalive build (`129bf8d`): both `sign_in_submitted` POSTs returned 201 (the GitHub one completed despite the provider redirect), and both events ingested into the staging project with the expected `method`/`category` properties. ## Linear - GROWTH-1165 (no `fixes` keyword on purpose: the evidence checks run on prod data post-deploy, and the issue closes manually after they pass) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved sign-in protection with more reliable invisible CAPTCHA handling. * Added sign-in submission tracking across password, SSO, partner, custom OAuth, and external-provider flows. * Added detailed classification for authentication, validation, CAPTCHA, provider, and network errors. * **Bug Fixes** * Sign-in now stops safely and resets CAPTCHA when verification fails. * Improved error reporting for failed sign-in attempts, including redirects and OAuth flows. * Ensured sign-in telemetry is delivered reliably during OAuth redirects. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
cecb328120 |
feat(studio): clean up free tier upgrade box (#49851)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Small update of the Projects overview UI to resolve the competing CTA's as well as alignment. Open to tweak a little more here. | Before | After | |--------|--------| | <img width="1287" height="346" alt="Screenshot 2026-09-01 at 15 08 33" src="https://github.com/user-attachments/assets/a0911d8c-7be9-4a70-ab37-8842093423c9" /> | <img width="1252" height="430" alt="Screenshot 2026-09-01 at 15 05 40" src="https://github.com/user-attachments/assets/cd75a8bd-9378-483b-96b8-2272a9990b4c" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Refined the plan usage card layout with larger metric values and cleaner labels. * Added dividers between usage metrics for improved readability. * Simplified card and loading-state styling by removing unnecessary borders, backgrounds, and padding. * Updated the upgrade button’s visual treatment. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
d088ec6259 |
fix(studio): project selector fetch on scoped pat (#49865)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? The scoped-access-token project selector fetched a single page of the user's projects across all orgs and filtered client-side, so switching to an org whose projects weren't in that page left the list empty with no way to load more. Use the org-scoped projects query instead, keyed on the selected org, and fix project search to match by name. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Project selection now displays projects belonging to the currently selected organization. * Switching organizations refreshes the available project list, preventing projects from another organization from appearing. * **Tests** * Added coverage for organization-specific project loading, organization switching, pagination, and empty project lists. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
924b3f5793 |
feat(ui-patterns): add async selection feedback (#49843)
## What kind of change does this PR introduce? Shared UI pattern and Studio UX improvement. ## What is the current behavior? Async selectors use bespoke loading and error layouts. Some replace the entire field while fetching, and opening a selector does not consistently refresh its options. ## What is the new behavior? Adds shared loading, error, and empty states for Select, command, and MultiSelector lists, including a persistent polite live region and reduced-motion support. Analytics Bucket and DuckLake selectors keep their controls in place, retain populated options during background refreshes, and refresh when reopened. ## To test Open the [Replication preview](https://studio-staging-git-dnywh-featasync-selection-feedback-supabase.vercel.app/dashboard/project/_/database/replication?destinationType=Analytics%20Bucket). The destination sheet should already be open on **Analytics Bucket**. You do not need to create a bucket, configure a destination, or start a pipeline. Open **Select a bucket**, then review these outcomes: 1. **The trigger stays put.** Opening the picker must not replace the form field with a full-width loading placeholder. 2. **Loading belongs inside the menu.** While options are fetched, the open menu shows a compact skeleton list. 3. **No resources has a clear explanation.** If the project has no Analytics Buckets, the menu says **No buckets available**. It still offers **Create a new bucket** beneath that message. 4. **Existing options do not disappear on refresh.** If the project does have buckets, close and reopen the picker. Its current options remain visible while the refresh happens in the background, rather than flashing back to skeletons. 5. **The pattern is consistent.** If convenient, select a bucket and open the namespace or access-key picker. The same in-menu loading, empty, and error treatment applies there too. The deterministic request-error and reduced-motion cases are covered by focused unit tests because the deploy preview cannot reliably force those states. |
||
|
Saxon FletcherandCursor
|
9b17ce8f2c |
chore(studio): default assistant to GPT-5.6 Luna (#49749)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature / chore: hide assistant model selection in the UI and default chats to GPT-5.6 Luna. ## What is the current behavior? The assistant composer exposes a model picker. Paid orgs default to `gpt-5.3-codex`; everyone else defaults to `gpt-5.4-nano`. ## What is the new behavior? - The model picker is hidden in the assistant composer and Explorer home. - Chats default to `gpt-5.6-luna` with `reasoningEffort: medium`. - Model selection plumbing is kept (registry, entitlements, `setModel`, generate-v4 request body) so a requested model can still be honored when provided. - Other completion endpoints still use `gpt-5.4-nano`. ## Additional context Model selector UI can be re-enabled by passing `selectedModel` / `onSelectModel` to `AssistantChatForm`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for the GPT-5.6 Luna model with medium reasoning capability. * Made GPT-5.6 Luna the default assistant model. * **Improvements** * Simplified assistant chat by removing model selection from the primary chat experience. * Updated model fallback behavior to use the standard assistant model. * Chat forms can now optionally display model selection when configured. * **Tests** * Updated model coverage and assistant chat tests for the new defaults and behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
ChloeGarciaMillerandandGildas Garcia
|
8d4a16beea |
fix: ESLint errors relating to accessibility in database section (#49638)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Improving accessibility by adding `aria-label` and associating the switches with their labels in database section. Adding `Tooltip` for icon only buttons. ## What is the current behavior? `Switch` components are not connected with their labels, `aria-label` and some `Tooltip` are missing. ## What is the new behavior? Icon-only buttons have now buttons and `aria-label` have been added. `Switch` components are connected to their labels. ## Additional context No visual changes have been made. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Accessibility Improvements** - Added descriptive labels and tooltips to database management actions, including remove, delete, and “More options” controls. - Improved screen reader support for function editor maximize/minimize controls, privilege switches, publication switches, and column actions. - Connected privilege labels with their corresponding controls for clearer navigation. - Clarified permission-related messaging when deleting columns. - Reduced duplicate announcements from tooltips and accessible descriptions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Charis
|
17d15ee1e2 |
fix(studio): confirm destructive notebook queries (#49658)
## What - add a second notebook-level confirmation for destructive SQL before forced batch execution - reuse the shared SQL safety detector for stored and live cell SQL - cover destructive confirmation, cancellation, non-destructive mutations, and live SQL ## Testing - pnpm --filter studio exec vitest run components/interfaces/Explorer/ExplorerNotebookTab.utils.test.ts components/interfaces/Explorer/__tests__/ExplorerNotebookTab.test.tsx --coverage.enabled=false - pnpm --filter studio exec eslint components/interfaces/Explorer/ExplorerNotebookTab.tsx components/interfaces/Explorer/ExplorerNotebookTab.utils.ts apps/studio/components/interfaces/Explorer/ExplorerNotebookTab.utils.test.ts apps/studio/components/interfaces/Explorer/__tests__/ExplorerNotebookTab.test.tsx Closes FE-4284 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Simplified notebook execution into a single confirmation step for mutating queries. * Destructive queries, including operations such as `DROP` or `TRUNCATE`, are clearly marked with a **Destructive** badge. * The confirmation dialog lists affected queries and lets you proceed or cancel. * Detection uses the latest SQL from the editor and ignores destructive keywords in comments. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Monica Khoury
|
39c39a9e47 |
feat: add 'Other' option to support form category dropdown (#49846)
## What is the current behavior? The "What issue are you having?" dropdown in the contact support form has a fixed set of categories. There's no catch-all option, so users with an issue that doesn't cleanly match any category are forced to pick an inaccurate one. Fixes [FE-4145](https://linear.app/supabase/issue/FE-4145/add-other-to-what-issue-are-you-having-in-contact-support-form) — reported case: a user had to select "Database Unresponsive" for an issue that only affected one user's connection, not the database itself. ## What is the new behavior? Added an "Other" option to the category dropdown. ## Additional context - Category value must stay `Others` (plural) rather than `Other` — Front's `Type` custom field is a fixed, case-sensitive enum that only contains`others`; sending `Other` would silently fail to set the field in Front (ticket still submits, but shows as `unknown` category). - Traced end-to-end (frontend zod → network call → backend DTO → controller → Front custom field mapping) to confirm no fixed enum or switch statement elsewhere breaks on an unrecognized category value. - Open item, not blocking this PR: following up with Front admin access to confirm no routing rule explicitly lists `Type` values in a way that would leave `others` unmatched (worst case is a missed auto-route, not a lost ticket). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Clarified the handling of the “Other” support category for improved internal reference. * Documented that the category’s value is normalized consistently during processing. * No changes were made to the category’s behavior or the end-user support experience. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Pamela Chia
|
3338be76f0 |
fix(studio): emit sign_in on totp challenge (#49755)
The dashboard's `sign_in` event never fires when a user completes a TOTP challenge: `SignInForm` only tracks when no MFA challenge is needed, and the /sign-in-mfa page only tracks on mount when the assurance level is already satisfied (OAuth/SSO returns). Sign-ins that go through the actual MFA form were invisible to analytics, and the login audit event was missing on the same path. **Changed:** - **MFA-challenged sign-ins now tracked**: `SignInMfaForm` fires `sign_in` (reading the same `method` query param the page mount site reads) plus the login audit event on successful TOTP verification, in the sign-in context only. The forgot-password flow stays untracked: it is a reset, not a sign-in. - **Password+MFA sign-ins report `method: email`**: `SignInForm` now passes `?method=email` when routing to /sign-in-mfa instead of falling through to `unknown`. - **Partner TOTP sign-ins carry their provider**: `SignInPartner` now passes `?method=<partner>` when routing to /sign-in-mfa, matching the raw-provider-name convention the other entry points use. - **Join caveat documented**: the `SignInEvent` doc comment now notes the event is captured server-side and races the identify call, so it is not a valid funnel join key across the auth boundary. ## Linear - fixes GROWTH-1156 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added sign-in method details to MFA redirects for email and partner authentication, improving sign-in flow tracking. * Added telemetry and login auditing for successful MFA sign-ins while keeping forgot-password flows untracked. * **Documentation** * Clarified sign-in event tracking coverage, including OAuth providers, server-side capture, anonymous identifiers, and the sign-in page. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
