dima/supabase
1
0 Fork 0
mirror of https://github.com/supabase/supabase.git synced 2026-10-10 20:05:06 +03:00
Code Issues Packages Projects Releases Wiki Activity
36,460 Commits 1,799 Branches 62 Tags
chore/github-integration-wording-2
Commit Graph
615 Commits
Author SHA1 Message Date
Danny WhiteandJoshen Lim 38e09e1754 chore(studio + docs + ui library): update auth email template copy docs (#45706) 
## What kind of change does this PR introduce?

Docs update. Part of DEPR-198.

## What is the current behaviour?

Auth email template examples and Studio template labels still reflect
older default copy in a few places.

## What is the new behaviour?

Updates Auth docs, local development docs, related snippets, Studio
template labels, and UI Library examples to [match the updated default
Auth email
copy](https://linear.app/supabase/document/email-template-copywriting-updates-04bba460fd2a).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Updated authentication email template names and descriptions across
guides, replacing "Magic link" with "Sign-in link or code" terminology
* Revised security notification email naming from "Identity
linked/unlinked" to "Sign-in method linked/removed" and "MFA method" to
"Verification method"
* Updated email template example content with improved wording (e.g.,
"Confirm your email address" instead of "Confirm your signup")

* **UI Updates**
* Refined authentication-related UI text labels and descriptions in the
dashboard

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45706)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-05-22 11:47:36 +10:00
Cemal Kılıç 02d7454ac9 fix: allow email rate limit editing when send email hook is enabled (#46104) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

bug fix: allow email rate limit editing when send email hook is enabled

## What is the current behavior?

when send email hook is enabled, users can't customize the send email
rate limit.

## What is the new behavior?

when send email hook is enabled, users _can_ customize the send email
rate limit.

## Additional context
backend changes are already in place.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Expanded email rate limit configuration to support Send Email hooks in
addition to SMTP providers.
* Enhanced user guidance with updated messaging and navigation options
for configuring email delivery methods.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46104?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-21 18:47:44 +02:00
Gildas Garcia 03a9f51b61 chore: migrate storage policies Modal to Dialog (#46222) 
## Problem

Storage policies edition still uses the deprecated `Modal`

## Solution

- use `Dialog` instead
- improve accessibility of the templates selection _back_ button
- extract the dialog title component in its own file

## Screenshots

The only difference is the title font which is larger with `Dialog`

Before:
<img width="542" height="504" alt="image"
src="https://github.com/user-attachments/assets/46a078da-db77-4a14-a7f7-fad20f5b45e5"
/>

After:
<img width="550" height="523" alt="image"
src="https://github.com/user-attachments/assets/80c9c6ec-25cd-445a-ad65-f9b659cdfd72"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Modernized policy editing interfaces with updated dialog structure and
consistent section separation across policy selection, templates,
editor, and review flows for clearer layout and spacing.
* **New Features**
* Added a unified, context-aware modal header that adapts titles, back
action, docs link, and close controls for different policy workflows.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46222?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-21 17:30:13 +02:00
Gildas Garcia 243e079a2c chore: remove _Shadcn_ suffix from Command components (#46153) 
## Problem

The `_Shadcn_` suffix isn't needed anymore on `Command` components

## Solution

- Remove the `_Shadcn_` suffix
- Simplify UI package exports
- Apply prettier

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Simplified command component imports and exports across the UI library
by removing internal naming aliases and adopting direct component
references. Updated the public UI package barrel export to use wildcard
re-exports for cleaner API surface.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46153?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-20 15:45:32 +02:00
fadymak ee64f0abc0 fix: update link for OAuth client registration documentation (#46098) 
Updates broken link for OAuth client registration
 2026-05-19 14:31:49 +02:00
Danny White 4c148ea060 chore(studio): move short Admonitions to descriptions (#46049) 
## What kind of change does this PR introduce?

Chore. Follow-up to DEPR-551, #45302, #45535, and #45618.

## What is the current behaviour?

Some short Studio Admonitions still put their entire message in `title`
or legacy `label`, so body-copy callouts render as headings.

## What is the new behaviour?

Moves selected single-message Studio Admonitions to `description`,
keeping the follow-up deliberately limited to Studio callsites.

This PR does not touch Docs content, shared Alert styling, ui-patterns,
design-system registry/docs, or Tailwind config.

| Before | After |
| --- | --- |
| <img width="1818" height="388" alt="Image"
src="https://github.com/user-attachments/assets/283a1853-348a-4d74-a408-013957350e5e"
/> | <img width="1380" height="462" alt="Image"
src="https://github.com/user-attachments/assets/e5761e8e-3697-423b-805b-45110205099a"
/> |
| <img width="1640" height="716" alt="CleanShot 2026-04-28 at 15 17
25@2x"
src="https://github.com/user-attachments/assets/a5be4d5f-2bf7-4dc2-b396-56129fe64ec9"
/> | <img width="1630" height="716" alt="CleanShot 2026-04-28 at 15 16
00@2x"
src="https://github.com/user-attachments/assets/0d589252-aaf8-4efc-9d81-15ec4f99ec61"
/> |


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Refined message displays and admonition styling across settings,
database, dashboard, and admin interfaces for improved visual
consistency and clarity.

* **UI Updates**
* Updated search input layouts and form element styling in publications
tables and other admin pages.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46049?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-19 10:20:54 +10:00
Joshen Lim 9dc3998fa0 RLS Tester sandbox environment (#45839) 
## Context

Resolves FE-3221

Heavily inspired by what @filipecabaco has done previously here:
https://github.com/supabase/supabase/pull/45360

This PR explores the use of pglite to set up a sandbox for RLS testing,
which will pave the way for testing mutation based queries so to ensure
no disruption to the actual database. Sandbox can be set up within the
RLS tester panel as such:
<img width="500" alt="image"
src="https://github.com/user-attachments/assets/0cfdf8e4-dd99-4dee-ac00-39a32b375c07"
/>

Which the sandbox will mimic the project's database to the bare minimum
required
- entities from the `public` schema are copied over (types, tables,
functions, policies)
- `auth` schema is pseudo setup with `SANDBOX_SETUP_STATEMENTS`
- Enough to support role impersonation + querying tables with references
to the auth schema (e.g users table)
- data is seeded up to 100 rows for each table
- More info RE limitations in the last section below

Once sandbox is ready, you'll see this UI where you can either leave the
sandbox, or re-sync the sandbox from the actual database
<img width="500" alt="image"
src="https://github.com/user-attachments/assets/d07ce55f-5bc8-4722-8ce9-898b9b458f9b"
/>

Changes are currently feature flagged, so won't be available publicly
just yet until things are ironed out and ready

## To test
- [ ] Verify that setting up sandbox works
- [ ] Verify that you can query your sandbox, and queries do not touch
the actual database (can verify that we're not sending HTTP requests to
the /query endpoint)
- [ ] Verify correctness of RLS tester as well, should match correctness
with testing against actual DB
- [ ] Verify that re-syncing sandbox picks up changes
- Can test by updating your policies that will affect the output of your
select query
  - e.g SELECT for `authenticated`, change from just `true` to `false`
- [ ] RLS tester should work as per normal (against actual DB) with the
feature flag off with no additional overhead

Let me know of any edge cases you might run into while testing

## Known quirks that will be addressed subsequently
Leaving these for now just to not bloat this PR further
- Pglite schema needs to be re-synced if updating RLS policies while
testing, to ensure that pglite gets the updated policies. Will think
about how to make this more seamless
- Sandbox has its own limitations, will need to add a dialog to inform
users how the sandbox works and what limitations to note of
- e.g only the auth schema is mimicked - so policies that reference
storage helpers won't work (although i think auth is probably the main
use case and the rest might be niche)
  - We can slowly expand tho where required
- Eventually we'll also move forward with figuring out testing mutation
queries with this sandbox

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* RLS tester gains an isolated Postgres sandbox with schema/seed import,
start/refresh/exit controls, and pre-populated auth data.
* Sandbox management UI with setup, loading, active, and error states;
refresh and destroy actions.

* **Bug Fixes**
* Role impersonation now keeps the PostgREST role set to anon while the
tester sheet is open.

* **Chores**
* Content Security Policy updated to allow sandbox/connectivity
endpoints.

* **Style**
  * Minor sheet styling adjustment (top border).

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45839)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-18 16:22:12 +07:00
Danny WhiteandJoshen Lim f45a6085f4 feat(studio): add auth email template reset flow (#45572) 
## What kind of change does this PR introduce?

Feature. Resolves AUTH-879.

## What is the current behavior?

Studio does not provide a way to reset an Auth email template back to
the default subject and body once it has been customised.

## What is the new behavior?

Studio shows a `Reset template` action when Platform reports that the
selected Auth email template subject or body has been customised. The
action opens a confirmation dialog, calls the dedicated Platform reset
endpoint, and refreshes the editor with the default subject and body
returned by the API.

The Auth config save/reset mutations now run their user-facing success
handling before refreshing Auth lint data, so the success toast and
local editor cleanup are not delayed by lint refetches.

## Additional context

Depends on supabase/platform#32417.



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Reset email templates to defaults via a confirmation dialog; button
appears when custom content is detected and respects update permissions.
* Typed email-template definitions and improved template variable
display and descriptions.

* **Tests**
* Added tests covering template reset visibility, confirmation flow,
state updates, permission handling, and toast notifications.

* **Documentation**
* Example email template placeholders updated for internationalization
and provider snippets.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45572)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-05-18 14:33:26 +10:00
Charis e925385415 studio,pg-meta: SafeSql for functions/policies/triggers (3/7) (#45990) 
## Summary

Third PR in the SafeSql migration stack. Flips the input/output types on
`pgMeta.functions/policies/triggers`'s `.create/.update/.remove` to use
`SafeSqlFragment`, and updates every Studio consumer atomically.

### pg-meta
- `pgMeta.functions/policies/triggers` `.create/.update/.remove` now
return `{ sql: SafeSqlFragment }` and accept branded input parameters
(`PGFunctionCreate`, `PGSavedFunction`, `PolicyCreate/UpdateParams`,
`PGTriggerCreate` with branded condition).
- `QueryModifier.toSql()` returns `SafeSqlFragment`.

### Studio consumers updated to the new branded API
- `data/database-functions/*` (query, create/update/delete mutations)
- `data/database-policies/*` (create, update mutations)
- `data/database-triggers/database-trigger-update-transaction-mutation`
- `components/Database/Triggers/TriggerSheet`
- `components/Database/Functions/CreateFunction`
- `components/Auth/Policies/PolicyEditorPanel`

These consumers land atomically with the pg-meta API change because the
input-type strictness flip (string → `SafeSqlFragment` for SQL fields)
forces every call site to update together.

## Stack

- 1/7: #45897 (merged)
- 2/7: #45903 (merged)
- 3/7: this PR
- 4/7–7/7: upcoming

## Test plan

- [x] `pnpm typecheck` passes
- [x] `pnpm --filter @supabase/pg-meta test` passes
- [x] Dev-server smoke test: function editor, policy editor, trigger
sheet

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Strengthened SQL safety across policy, function, and trigger workflows
by converting raw SQL strings to typed SQL fragments and safer
composition
* Updated editor behavior to handle policy conditions/checks as typed
SQL fragments with improved initialization and template handling
* Aligned query and modifier interfaces to return typed SQL fragments
for safer composition

* **Tests**
* Updated tests to use typed SQL fragments and synchronous builders
where applicable

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45990)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 12:08:20 -04:00
Gildas Garcia 5d97339d41 chore: remove <Select> _Shadcn_ suffix (#45988) 
## Problem

The `_Shadcn_` suffix isn't needed anymore on `Select` components

## Solution

Remove it. No other changes

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Updated internal component architecture to standardize and simplify
the codebase. These changes improve code maintainability and consistency
across the application without affecting existing functionality or user
experience.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45988)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 16:39:57 +02:00
Gildas Garcia 86a3f8b03d chore: upgrade to react-19 (#45886) 
- Most changes are related to either types or `useRef` usages (it now
requires an initial value).
- also updated `vaul` to its latest version and haven't noticed any
change ([design-system
demo](https://design-system-git-react-19-supabase.vercel.app/design-system/docs/components/drawer))

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Upgraded workspace to React 19.

* **Bug Fixes**
* Improved null-safety and ref handling across editors, UI components,
shortcuts, and markdown/image rendering to reduce runtime errors.
* Safer event/timeout/interval cleanup and more robust command/context
handling.

* **Chores**
  * Bumped vaul dependency versions.

* **Documentation**
* Type and TypeScript accuracy improvements for clearer developer
feedback.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45886)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 16:04:41 +02:00
Gildas Garcia 8c6d5036ea chore: remove <Label> _Shadcn_ suffix (#45986) 
## Problem

The `_Shadcn_` suffix isn't needed anymore on label component

## Solution

Remove it. No other changes

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Standardized Label usage across the codebase by removing the legacy
alias and using the direct Label export from the UI package
consistently.
* **Documentation**
* Updated component examples and docs to use the standardized Label
component in usage snippets and demos.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45986)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 15:55:33 +02:00
ChloeGarciaMillerand 590ec2bbd4 fix: improve accessibility for icon buttons (#45981) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Improving accessibility for icon-only buttons

## What is the current behavior?

Icon-only buttons do not have explicit accessible names for screen
readers.

## What is the new behavior?

All icon-only buttons now have explicit accessible names using visually
hidden text (sr-only), ensuring proper screen reader support.

## Additional context

Tooltip text is preserved for visual users.
No visual changes were introduced.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Added/updated aria-labels across refresh buttons, sidebar controls,
dropdown triggers, and navigation links for better accessibility.
* Added conditional aria-labels for the “Create with Assistant” control
to reflect permission states.
* Improved screen-reader descriptions for sidebar toggle and other
stateful controls to better convey status changes.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45981)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 15:32:14 +02:00
Gildas Garcia d0fd4478c0 chore: migrate Popover usages to Shadcn components (#45980) 
## Problem

We have multiple Popover components

## Solution

- [x] migrate Popover usages to Shadcn components
- Migrated JSON and text editor in the `TableEditor` (inline row
edition)
  - Migrated the template popover in the logs explorer templates page
- [x] remove `_Shadcn_` suffix from Popover components (renaming +
prettier)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Unified popover implementation across the app and design system;
dropdowns, calendars, menus and tooltips now use a consistent popover
API with no visual or interaction changes.

* **Chores**
* Minor prop typing update for the logs date-picker to align with the
consolidated popover content type.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45980)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 15:20:28 +02:00
Gildas Garcia 4e86c39ea1 chore: remove <ContextMenu> _Shadcn_ suffix (#45971) 
## Problem

The `_Shadcn_` suffix isn't needed anymore on `<ContextMenu_Shadcn_>`
and related components

## Solution

Remove it. No other changes

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Replaced legacy context-menu component variants with the unified UI
context-menu components across the app for consistent rendering and
imports; behavior and menu content remain unchanged.
* **Tests**
* Updated a test mock to track the unified context-menu component mount
count.
* **Chores**
* Simplified UI package re-exports to expose the canonical context-menu
symbols.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45971)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 15:09:25 +02:00
Gildas Garcia 0713a1efc1 chore: remove shadcn suffix for Input, Textarea, Alert and Collapsible (#45867) 
## Problem

Now that we migrated old components to their new shadcn alternatives, we
don't need the `_Shadcn_` suffix anymore.

## Solution

Remove it

<img width="659" height="609" alt="image"
src="https://github.com/user-attachments/assets/2d7271a9-066a-4dcc-92fe-729b106d2c2f"
/>
 2026-05-15 14:55:37 +02:00
Illia Basalaiev 4195b9af27 chore: update leaked password button in attack protection (#45975) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES

## What kind of change does this PR introduce?
Frontend improvement

## What is the current behavior?
"Configure email provider" button in the Authentication > Attack
Protection: the title doesn't change, only the label on the left
depending on whether it's enabled or disabled.
 
<img width="1512" height="148" alt="CleanShot 2026-05-15 at 12 15 57@2x"
src="https://github.com/user-attachments/assets/b2069333-6f1a-4503-9b3b-d75c005e4522"
/>

## What is the new behavior?
"Configure in email provider" - to clarify that this feature is managed
in the email provider settings, and not refer to the whole email
provider setup.
<img width="1668" height="172" alt="CleanShot 2026-05-15 at 12 19 10@2x"
src="https://github.com/user-attachments/assets/35fd5b35-8b31-4912-875d-cc9fc7b1968e"
/>

## Additional context
Relevant ticket where the button title was confusing for the customer:
https://supabase.frontapp.com/open/cnv_1mtka5ni?key=-r6o8zPz-3XzuiQ7eh5FfCZBjTuKg78n
 2026-05-15 13:57:46 +02:00
Joshen Lim 88c43b31b9 Support optionally remove custom domain addon when deleting custom domain after activated (#45880) 
## Context

Related BE PR: https://github.com/supabase/platform/pull/32693

Add support to remove the custom domain add-on when deleting a custom
domain after the custom domain is activated.

<img width="411" height="310" alt="image"
src="https://github.com/user-attachments/assets/23d57fc0-f760-42d4-8383-480ff2b2ec5a"
/>

We previously had this behaviour by default to address some customer
feedback RE confusion that they were still being charged for custom
domain add-on despite deleting the custom domain, but not removing the
add-on.

However this was a bit of confusing UX (RE deleting the add-on
implicitly), so this makes the deleting of the custom domain add-on an
explicit action instead.

## To test

- [ ] Set up custom domain on a project
- [ ] Trying deleting the custom domain after activating _without_
removing the add-on
- [ ] Trying deleting the custom domain after activating _with_ removing
the add-on
 2026-05-15 16:41:58 +08:00
Charis d79a276824 studio: ColumnTypeRef cascade + FK type comparison fixes (2/7) (#45903) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Refactor + bug fixes (part of the SafeSql migration stack — PR 2 of 7,
stacks on top of #45897).

## What is the current behavior?

- `pgMeta.columns.create` and the table-editor SQL builder take column
type as a string with array suffix and schema baked in (e.g.
`'private.test_enum'`, `'int4[]'`).
- The studio table-editor SQL emits the legacy schema-embedded `format`
string for enums in non-public schemas, while the pg-meta columns SQL
already returns the new shape (bare `format` + separate
`format_schema`). The two queries disagree on how to represent the same
column, surfacing as a false-positive type mismatch in the FK selector
when both ends are an enum from a non-public schema.
- The FK selector compares column types by `format` alone — same-named
enums in different schemas appear equal, and arrays vs. scalars of the
same base type pass the family check.
- `displayColumnType` renders arrays as the raw `_typname` pg-meta emits
(e.g. `_int4` instead of `int4[]`).

## What is the new behavior?

**pg-meta**

- Introduce `ColumnTypeRef` (`{ schema?, name, isArray? }`) for column
type input, replacing the legacy string-with-array-suffix format.
`pgMeta.columns.create` and the table-editor SQL builder consume the new
shape.
- Add `format_schema` to the column zod schema; pg-meta SQL emits the
type's schema for the table editor's ColumnType dropdown.
- `pgMeta.columns.create` returns a `SafeSqlFragment`.
- Studio table-editor SQL now emits bare `format` + `format_schema`,
matching pg-meta's columns SQL.

**Studio**

- `SafePostgresColumn`/`SafePostgresTable` extend the new `PG*` types
(master dropped postgres-meta).
- Pipe `ColumnTypeRef` through `SidePanelEditor` → `ColumnEditor` →
`TableEditor`, along with the column-create mutation, table
retrieve/list queries, and the `TableList`/`ColumnList` surfaces.
- `displayColumnType` helper renders arrays as `type[]` (or
`schema.type[]`) and handles non-implicit schemas.
- FK selector now carries `sourceIsArray`/`targetIsArray` and compares
the full `(format, format_schema, isArray)` triple. Family checks for
numeric/text/uuid skip when either side is an array (FKs across array
boundaries are never compatible).
- Type-mismatch and type-notice alerts pass `isArray` to the display
helper.
- Bundle `Policies.utils` + `Policies.types` + `sql-policy-mutation`,
`PolicyEditorModal`, and `SchemaGraph` here because `SidePanelEditor`
consumes `acceptGeneratedPolicy`/`AcceptedGeneratedPolicy` — splitting
requires temporary overloads with no architectural payoff.

## Additional context

Part of the SafeSql migration stack. Stacks on top of #45897.

### Manual test checklist

Surfaces touched by this PR — please exercise each:

**Table editor**
- [x] Create a new table with a mix of column types (scalar, array,
enum, foreign key)
- [x] Add a column to an existing table; verify the type dropdown lists
scalars + arrays separately and shows schema-qualified names for
non-public enums
- [x] Edit an existing column's type (scalar ↔ array, switch between
enums in different schemas) and save
- [x] Verify enum types from a non-public schema (e.g.
`private.my_enum`) display as `private.my_enum` in the column list

**Foreign key selector**
- [x] Open the FK selector for a column and pick a target column with a
matching type — no mismatch warning
- [x] Pick a target column whose type differs only by schema (two
same-named enums in different schemas) — should show a type-mismatch
alert
- [x] Pick a target column where one side is an array and the other is a
scalar of the same base type — should show a type-mismatch alert (no
auto-cast across array boundary)
- [x] When FK target sets the column type, verify `format_schema` and
`isArray` are preserved on the source column
- [x] Type-mismatch and type-notice alert messages render array types as
`type[]` (not `_type`)

**Column list / table list**
- [x] Schema-qualified type names display correctly for columns whose
type lives in a non-public schema
- [x] Array columns display as `type[]` (or `schema.type[]`)

**Policies (bundled due to import dependency)**
- [x] Open the Policies page; create/edit/delete a row-level policy via
the modal
- [x] Generate a policy via the AI assistant and accept it through
`SidePanelEditor` — verify the accepted policy lands in the editor
correctly

**Schema visualizer**
- [x] Open the Schemas → Schema Visualizer page; verify it renders
without type errors and shows tables/relationships

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Support for column types in non-public schemas and richer column type
presentation (includes schema and array info).
* Stronger SQL safety around policies and constraints; draft policy SQL
is now promoted explicitly on save.
* Improved foreign-key type validation and compatibility checks using
enhanced type metadata.

* **Tests**
* Updated snapshots and tests to reflect new column metadata and SQL
fragment handling.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45903)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 15:12:08 -04:00
Charis d4079083fc chore(studio): drop @supabase/postgres-meta in favor of @supabase/pg-meta (#45844) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Refactor / dependency cleanup.

## What is the current behavior?

`apps/studio` lists both `@supabase/pg-meta` (workspace package) as a
runtime dep and `@supabase/postgres-meta` (external npm package,
`^0.64.4`) as a devDependency. The external package is used only for
type imports across 44 files — there is no runtime usage and no codegen
pipeline that needs it.

## What is the new behavior?

Every `Postgres*` type import (`PostgresTable`, `PostgresColumn`,
`PostgresPolicy`, `PostgresTrigger`, `PostgresView`,
`PostgresMaterializedView`, `PostgresForeignTable`, `PostgresSchema`,
`PostgresPublication`, `PostgresRelationship`, `PostgresPrimaryKey`) is
replaced with its `PG*` counterpart from `@supabase/pg-meta`, and the
external dep is removed from \`apps/studio/package.json\`. Top-level
type re-exports were added to \`packages/pg-meta/src/index.ts\` so
consumers can import directly from the package root.

Two latent issues surfaced by the stricter pg-meta types are also fixed:
- \`data/foreign-tables/foreign-tables-query.ts\` was casting
foreign-table results as \`PostgresView[]\`; corrected to
\`PGForeignTable[]\`.
- \`pg-meta\`'s \`PGTrigger\` Zod schema declared
\`orientation\`/\`activation\` as \`z.string()\`, inconsistent with
pg-meta's own \`getDatabaseTriggerUpdateSQL\` helper that requires the
narrow literal unions; tightened to \`z.enum\`.

## Additional context

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated internal TypeScript type definitions across the codebase to
use the latest type system from `@supabase/pg-meta`.
  * Removed `@supabase/postgres-meta` dependency.
* Enhanced type validation for database triggers and schemas to enforce
stricter constraints.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45844)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 16:07:10 +00:00
Joshen Lim 2d47836f39 Joshen/fe 3213 make rls tester feedback callout more obvious (#45820) 
## Context

Minor nit to adjust the "Give feedback" button at the bottom to use
default type + external link icon
<img width="612" height="68" alt="image"
src="https://github.com/user-attachments/assets/e74370cb-d284-4552-a69d-8c838f565af7"
/>

Also added telemetry for the "Run query" button

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added analytics tracking for RLS Tester query runs to better
understand how the feature is used.

* **Style**
* Updated the "Give feedback" button in the RLS Tester to use the
default button style and display an external-link icon for clarity.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45820)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 21:08:41 +08:00
Vaibhav ef2d21b9bf fix: restore rls check (#45723) 
## TL;DR

Policies created with a `WITH CHECK` clause in sql editor still reopen 
with the that section hidden and the checkbox unmarked

this fixes that by restoring the saved check block when editing the
policy

## Before
<img width="667" height="408" alt="image"
src="https://github.com/user-attachments/assets/0a859172-2ab2-444a-968c-49325505786f"
/>

## After

<img width="602" height="462" alt="image"
src="https://github.com/user-attachments/assets/a7f5799a-e073-4b2c-807b-2997ac76edfd"
/>

## ref:
- Closes https://github.com/supabase/supabase/issues/45720


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed the policy editor to properly display and enable the "with
check" section when loading existing policies that contain check
conditions.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-11 06:59:54 -06:00
Ali Waseem c5666f8e76 fix(auth): toggle shortcut repeats (#45728) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Remove unneeded checks and its handled by the shortcut

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved the empty state interface in the Third Party Auth integration
form, enhancing the display and alignment when no integrations are
available.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-08 22:16:24 +02:00
Ali WaseemandJoshen Lim f06b877ac6 feat(auth-users): add keyboard shortcuts to users page (#45650) 
Closes
[FE-3173](https://linear.app/supabase/issue/FE-3173/add-keyboard-shortcuts-to-auth-users-page)

## Shortcuts

| Key | Action |
|---|---|
| `Shift+F` | Focus search input |
| `F C` | Reset filters |
| `Shift+R` | Refresh users |
| `S C` | Reset sort to default |
| `Mod+A` | Toggle selection on all loaded users |
| `Mod+Backspace` | Open bulk-delete confirm modal |
| `Esc` | Clear row selection + cell focus |
| `Esc` (panel open) | Close user details panel |
| `↑` / `↓` | Move focus into the grid; native arrow nav after |
| `Enter` (row focused) | Open user details panel |
| `I U` | Open Create user modal |
| `I I` | Open Send invitation modal |

## Test plan

- [ ] `Shift+F` focuses the search input
- [ ] `F C` clears keywords, user type, providers
- [ ] In the search input: Esc clears value, Esc again blurs
- [ ] `Shift+R` refreshes
- [ ] `S C` resets sort; no-op at default
- [ ] `Mod+A` toggles all loaded users when ≤ 20 are loaded
- [ ] `Mod+Backspace` opens the delete confirmation when a selection
exists
- [ ] `↑` / `↓` from cold load enters the grid; subsequent arrows
navigate cells
- [ ] `Enter` on a focused row opens the panel
- [ ] `Esc` with panel open closes it; without panel, clears selection +
cell focus
- [ ] `I U` opens the Create user modal
- [ ] `I I` opens the Send invitation modal
- [ ] All shortcuts appear in `Cmd+K`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Comprehensive keyboard shortcuts for user management (focus search,
refresh, reset filters, bulk select, open delete modal, close panel).
* Improved keyboard navigation in the user list with cell-level movement
and Enter-to-select behavior.
* Search input: Escape clears search/keywords and it can be focused
programmatically.
* Shortcut hint badges added to "Send invitation" / "Create new user"
dropdown items.

* **Chores**
  * Centralized refresh behavior for consistent interaction.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-05-08 08:49:53 -06:00
Ali WaseemandDanny White 0278672102 feat(studio): add Auth sub-page navigation chords (#45696) 
## Summary
- Adds contextual `A + <letter>` chord shortcuts for jumping between
Authentication sub-pages while `AuthLayout` is mounted, mirroring the
existing database-nav chord pattern.
- Wires the shared `LIST_PAGE_*` shortcuts (focus search, create new,
reset filters, schema selector) onto the Auth list pages so they behave
like the Database list pages.
- Fills in the previously-missing `A + U` chord for the **Users** page
so every entry in the Auth menu has a chord.

Resolves
[FE-3187](https://linear.app/supabase/issue/FE-3187/add-a-u-keyboard-shortcut-for-auth-users-page).

## Auth navigation chords

Active anywhere under `/project/<ref>/auth/*`. Press `A` then the listed
letter.

| Page | Chord |
| --- | --- |
| Overview | `A` `O` |
| Users | `A` `U` |
| OAuth Apps | `A` `A` |
| Email | `A` `E` |
| Policies | `A` `P` |
| Sign In / Providers | `A` `I` |
| Passkeys | `A` `K` |
| OAuth Server | `A` `V` |
| Sessions | `A` `S` |
| Rate Limits | `A` `R` |
| Multi-Factor | `A` `M` |
| URL Configuration | `A` `L` |
| Attack Protection | `A` `T` |
| Auth Hooks | `A` `H` |
| Audit Logs | `A` `G` |
| Performance | `A` `F` |

## Auth list-page shortcuts

Each Auth list page opts into the shared `LIST_PAGE_*` registry — same
chords as the Database list pages (`Shift+F`, `Shift+N`, `F` `C`, `O`
`S`). Coverage matches the controls each page actually exposes:

| List page | Search (`Shift+F`) | New (`Shift+N`) | Reset filters (`F`
`C`) | Schema selector (`O` `S`) |
| --- | :---: | :---: | :---: | :---: |
| Custom Auth Providers | ✓ | ✓ | ✓ | — |
| OAuth Apps | ✓ | ✓ | ✓ | — |
| Policies | ✓ | — | ✓ | ✓ |
| Auth Hooks | — | ✓ | — | — |
| Redirect URLs | — | ✓ | — | — |
| Third-Party Auth | — | ✓ | — | — |

## Test plan
- [x] While anywhere under `/project/<ref>/auth/*`, every chord in the
navigation table jumps to the corresponding page.
- [x] On each list page in the second table, the marked shortcuts focus
the search input / open the create flow / reset filters / open the
schema picker as expected.
- [x] Chords are not active outside of `/project/<ref>/auth/*` and do
not trigger while typing in inputs (where `ignoreInputs` applies).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Global keyboard shortcuts for Auth pages: navigate auth sections,
focus/search inputs, reset filters, and open "Add" flows (providers,
OAuth apps, hooks, URLs, policies).
* "Add" controls in lists respond to shortcuts and show appropriate
disabled/tooltip states when unavailable.
* Product menu and shortcuts reference now include an "Auth Navigation"
section and per-item shortcut hints.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
 2026-05-08 07:13:25 -06:00
Joshen Lim 94851d1f8f Add assistant CTA for query errors in RLS tester (#45628) 
## Context

Adding an "Ask Assistant" CTA in the RLS tester if the query executed
returns an error
<img width="618" height="375" alt="image"
src="https://github.com/user-attachments/assets/8b0a5069-3ec5-44aa-aa0b-f1cd8041960d"
/>

Which will open the Assistant panel with the following prompt (attaches
the query as well)
<img width="427" height="281" alt="image"
src="https://github.com/user-attachments/assets/16debd7b-9447-4b84-bef5-05debd0062ee"
/>

Theres a chance that the error might be just from the query and not
related to the policy hence the last sentence in the prompt


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Integrated AI assistant into the RLS tester so users can open the
assistant prefilled with a debug prompt and relevant SQL to troubleshoot
policy issues.
* Added an "Ask Assistant" action on execution error messages to quickly
start guided debugging.
* Streamlined error display to prioritize parse errors, then client-code
parse errors, then execution errors for clearer diagnostics.

* **Chores**
* Added telemetry source identifier for the RLS tester to track
assistant usage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-08 18:50:48 +08:00
Joshen Lim e6b81c465a Some problems with RLS editor (#45662) 
## Context

Addresses some issues found with the RLS editor from recent changes
- Creating a "SELECT" or "INSERT" policy via templates wasn't working
(might have been [this
PR](https://github.com/supabase/supabase/pull/45560)) that introduced
the bug)
- SELECT -> SQL error as we were incorrectly adding a with check
statement in the query
- INSERT -> UI issue, there's a bit of complexity as we're using 1 code
editor for `using` and `check` statements
- Badge color for "UPDATE" based templates is off
<img width="446" height="114" alt="image"
src="https://github.com/user-attachments/assets/66fd0c1a-c20c-406d-983e-2c02680bb235"
/>
- Renaming a policy, the initial alter query statement shouldn't be
using the new name
<img width="596" height="288" alt="image"
src="https://github.com/user-attachments/assets/0b6822d5-e5f5-440e-8942-8e19bd7bf4c3"
/>

## To test
- [ ] Verify that you can create a policy for all templates in the Auth
policies page + Realtime policies page (as long as no SQL error - some
templates are using tables as examples that might not exist in the DB)
- [ ] Likewise, verify that you can manually create + update policies as
well

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Updated UPDATE template badge styling to a darker blue color scheme
with reduced opacity.

* **Bug Fixes**
* Fixed policy name display logic to correctly show the selected
policy's existing name during renaming operations.
* Improved SQL fragment loading and check expression handling for INSERT
command policy templates.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-08 15:39:34 +08:00
Joshen Lim 5d155df42b RLS Tester needs to consider policies for 'ALL' operation (#45623) 
## Context

Missed another case here - RLS tester when retrieving policies
associated with query needs to consider policies with the `ALL`
operation

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Tests**
* Added comprehensive tests for Row-Level Security policy filtering,
covering schema/table matching, role handling (including
public/service-role cases), command/operation semantics, and combined
filter behavior.

* **Refactor**
* Centralized and clarified RLS policy filtering logic used by the
tester for improved maintainability and consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-08 15:18:51 +08:00
Ivan Vasilov 35905e70d5 feat: Add a logo picker for OAuth app creation sheet (#44995) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Logo field now accepts/editable logo URL, plus a new storage-based
Logo Picker to select or remove images from project storage.
* Full storage picker: browse buckets, columns/list views, search,
drag‑and‑drop uploads, file previews (image/audio/video), and
single-file selection with responsive mobile/desktop layouts.

* **Refactor**
* Logo submission streamlined to send the provided URL directly (legacy
file-read/upload flow removed).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-06 16:44:18 +02:00
Charis 3f97eeea5a feat(studio): extend safe SQL model to policy editor and related interfaces (#45560) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Refactor / security improvement

## What is the current behavior?

SQL fragments across Studio are built from plain `string` values with no
type-level distinction between developer-authored SQL, DB-sourced
identifiers, and user-typed or externally-influenced content.

## What is the new behavior?

Extends the safe SQL model to additional Studio interfaces, using
`SafeSqlFragment`, `safeSql`, `ident()`, `literal()`, `untrustedSql()`,
and `acceptUntrustedSql()` from `@supabase/pg-meta/src/pg-format`:

- **Policy editor**: template constants typed as `SafeSqlFragment` via
`safeSql` tagged literals; Monaco editor `onInputChange` emits
`untrustedSql()`; `acceptUntrustedSql()` called only at the Save
gesture; roles selector emits a composed `SafeSqlFragment` via `ident()`
+ `joinSqlFragments()`
- **Auth hooks**: grant/revoke SQL statements use `ident()` for schema
and function names
- **Docs description editor**: `COMMENT ON` queries use `ident()` and
`literal()` for table/column/function names and values
- **Cron jobs**: `cron.schedule()` call and HTTP request builder use
`literal()` for all user-provided values
- **GraphQL linter CTA**: `REVOKE` statement uses `ident()` for schema,
table, and role
- **Storage public bucket warning**: `DROP POLICY` uses `ident()` for
policy name
- **View security autofix modal**: `ALTER VIEW` uses `ident()` for
schema and view name
- **API settings**: `CREATE SCHEMA` mutation uses `safeSql` tagged
literal
- **Database event trigger delete**: `DROP EVENT TRIGGER` uses `ident()`
for trigger name
- **Database queues query**: queue list query uses `safeSql` tagged
literal
- **Role impersonation**: function invocation SQL uses `ident()` and
`literal()`

## Manual testing checklist

- Authentication > Policies
- Authentication > Hooks
- Integrations > Queues
- Database > Event Triggers
- Integrations > Cron Jobs
- Table Editor > View entity security autofix
- API Settings > expose schema
- Linter > GraphQL exposure CTA
- Docs > table/column description editor
- Role impersonation (user impersonation panel)

## Additional context

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Replaced ad-hoc SQL string building with a safer, fragment-based SQL
construction across auth, policies, integrations, storage, and DB
operations to improve SQL safety while preserving behavior.

* **Bug Fixes / UX**
* Policy editor and code editor now propagate role and input changes
more reliably, improving editor responsiveness and policy handling
without UI changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-05 12:02:52 -04:00
Gildas Garcia fe93df7d6b chore: migrate Input usages to Shadcn component in auth and policies screens/components (#45590) 
## Screenshots

### Auth: Create or edit custom Auth provider

See the callback URL input at the bottom.

Before:
<img width="1179" height="1309" alt="image"
src="https://github.com/user-attachments/assets/b15d38fd-6e32-489e-8ef6-bff519d38123"
/>

After:
<img width="1176" height="1318" alt="image"
src="https://github.com/user-attachments/assets/dedc72cc-7756-4995-af9a-5f7a4554f76f"
/>

### Custom Auth provider list search input

Before:
<img width="1135" height="236" alt="image"
src="https://github.com/user-attachments/assets/ced8538a-91ca-428b-8d90-544962c1eb5b"
/>

After:
<img width="1147" height="227" alt="image"
src="https://github.com/user-attachments/assets/695a5c87-f371-4d90-91a8-761266526345"
/>

### Auth hooks

Before:
<img width="1150" height="301" alt="image"
src="https://github.com/user-attachments/assets/20341d7b-6a2f-491a-b23f-74d92398192f"
/>

After:
<img width="1143" height="305" alt="image"
src="https://github.com/user-attachments/assets/95d73950-eb55-459d-9cb9-3077bcd10985"
/>

### OAuth App list search input

Before:
<img width="1147" height="371" alt="image"
src="https://github.com/user-attachments/assets/be935f9d-1b32-4488-bf37-6153f7d39262"
/>

After:
<img width="1146" height="365" alt="image"
src="https://github.com/user-attachments/assets/628b77c8-074b-455a-94ea-b8e20b4da2db"
/>

### New policy sheet template search input
Before:
<img width="536" height="268" alt="image"
src="https://github.com/user-attachments/assets/d5ea6ee9-02fa-48fc-a727-cb56e5f57f8f"
/>

After:
<img width="534" height="260" alt="image"
src="https://github.com/user-attachments/assets/34ac4c40-5613-47f1-b724-0780499afa26"
/>

### Storage new policy dialog

Before:
<img width="1180" height="660" alt="image"
src="https://github.com/user-attachments/assets/afb4b1d3-f42b-4379-9197-c47a97340eaa"
/>

After:
<img width="1175" height="646" alt="image"
src="https://github.com/user-attachments/assets/427e2f0f-553b-4ea8-a8ae-f1835c1c791b"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Updated search input design across authentication interfaces for
improved consistency.
  * Standardized input control layout in auth configuration forms.

* **Bug Fixes**
  * Corrected webhook configuration field behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-05 17:56:42 +02:00
Cemal Kılıç 019d10aab6 feat(studio): add token_endpoint_auth_method field to OAuth app (#45519) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## Summary

- Added token_endpoint_auth_method field to the OAuth app create/update
sheet, visible only when client type is set to "Confidential"
- Supports client_secret_basic (HTTP Basic Auth header) and
client_secret_post (request body) options; public clients automatically
use none
- Wired the field into both create and update API payloads

## Test plan

- Create a confidential OAuth app -> Token Endpoint Auth Method selector
should appear and submit correctly for both options
- Create a public OAuth app -> selector should not appear; none is sent
in the payload
- Edit an existing confidential app -> selector should pre-populate from
the saved value


## What is the new behavior?

<img width="1244" height="1660" alt="image-KvVBmAG6@2x"
src="https://github.com/user-attachments/assets/76ab2687-6be4-4b74-a830-e670a2bb4be2"
/>

<img width="1264" height="1652" alt="image-gLARAPwt@2x"
src="https://github.com/user-attachments/assets/fd5770d5-acfd-4edb-bd5e-af582108f092"
/>


related: https://github.com/supabase/supabase/pull/43128

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added token endpoint authentication method configuration for OAuth app
creation and updates
* Authentication method automatically adjusts based on client type
(public clients use 'none')
* Token endpoint auth method field conditionally displayed for
confidential clients only

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-05 12:02:31 +02:00
Joshen Lim 4c70efb562 RLS Tester to include policies that are applied to public (#45574) 
## Context

For a table that has RLS enabled, but a policy with just `true` for the
role `public`
The RLS tester was incorrectly reporting that `anon` doesn't have access

Was happening as we weren't considering policies that apply to the
`public` role (which applies to _all_ roles)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* RLS tester now treats explicitly-public policies as applicable
regardless of the impersonated role, improving policy coverage accuracy.
* **Refactor**
* Consolidated RLS test state computation to improve consistency of
access badges and policy messaging.
* **Tests**
* Added comprehensive tests validating RLS scenarios, badge states, and
policy/role messaging.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-05 17:02:41 +08:00
oniani1 91f1d95a02 fix(studio): escape SQL identifiers in policy create query (#45181) 
Closes #45179.

## Summary

`generateCreatePolicyQuery` in `PolicyEditorPanel.utils.ts` builds a
`CREATE POLICY` statement with raw double-quote interpolation for
name/schema/table, then executes it via `useExecuteSqlMutation` from
`PolicyEditorPanel/index.tsx:192`. Any of those values containing a `\"`
character breaks out of the identifier quoting in the executed
statement.

Applies `ident()` to the three identifier interpolations. Same pattern
as #44555 (queue), #44589 (index), #44721 (view autofix), #44723 (auth
hooks). The helper is already used at `Policies.utils.ts:319`.

## Scope

The preview-only SQL in `Policies.utils.ts`
(`createSQLStatementForCreatePolicy` /
`createSQLStatementForUpdatePolicy`) has the same pattern but is not
executed. That string is only rendered in the review modal while the
mutation uses a structured payload. Tracking separately.

## Test plan

- [ ] Create a policy with a name containing a double quote. Verify it
applies correctly with the fix (and produces broken SQL without).
- [ ] Create a policy on a table/schema name containing a double quote.
Same check.
- [ ] Regression: create a plain-named policy. Works as before.
 2026-05-04 18:52:25 +00:00
Charis 0433eeb5f5 feat(studio): mark sql provenance for safety (#45336) 
Mark provenance of SQL via the branded types SafeSqlFragment and
UntrustedSqlFragment. Only SafeSqlFragment should be executed;
UntrustedSqlFragments require some kind of implicit user approval (show
on screen + user has to click something) before they are promoted to
SafeSqlFragment.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Editor and RLS tester show loading states for inferred/generated SQL
and include a dedicated user SQL editor for safer edits.

* **Refactor**
* Platform-wide SQL handling tightened: snippets and AI-generated SQL
are treated as untrusted/display-only until promoted, improving safety
and consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-04 13:08:06 -04:00
Jeremias Menichelli c49eb8bb7d Revert "chore(studio + design-system): more flexible Admonition" (#45535) 2026-05-05 00:18:27 +08:00
Vaibhav aeda6a88a8 fix: third-party auth layout (#45470) 
## before
<img width="1278" height="397" alt="image"
src="https://github.com/user-attachments/assets/ba57eca0-81cc-4fa4-929a-8d42933e66e1"
/>

## after
<img width="1265" height="492" alt="image"
src="https://github.com/user-attachments/assets/c09e081e-bcfd-43ea-960a-eedef0494c7d"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Style**
* Improved the integration card layout for better content visibility and
status badge positioning.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-01 19:23:00 +00:00
Danny White 5bfbae22a9 chore(studio + design-system): more flexible Admonition (#45302) 
## What kind of change does this PR introduce?

Feature and design-system cleanup. Resolves DEPR-551.

## What is the current behavior?

Admonition supports several overlapping content shapes, but it
previously did not support a first-class success state or
description-only usage cleanly. Title-only usage was also possible,
which made some callouts read like floating headings without body copy.

Docs MDX Admonitions could also pick up prose spacing around rich
children, while the design-system Tailwind config emitted an
ESM/CommonJS warning in the design-system app.

## What is the new behavior?

Adds a `success` Admonition type, description-only support, and a
stricter content contract: `title` or legacy `label` now requires either
`description` or `children`. Existing title-only Studio callsites have
been converted to description-only callouts.

The design-system docs now include examples for description-only and
success Admonitions, plus guidance for `title`, `description`,
`children`, and legacy `label` usage.

This also tightens Admonition body spacing so rich MDX children keep
docs link/code styling without inheriting excessive prose margins, and
renames the design-system Tailwind config to `tailwind.config.cjs` so it
matches its CommonJS syntax.

Warning and destructive alerts now explicitly set `text-foreground`,
preventing nested Admonition titles from inheriting muted
form-description colour after the Tailwind v4 cascade changes.

| Before | After |
| --- | --- |
| <img width="1818" height="388" alt="Image"
src="https://github.com/user-attachments/assets/283a1853-348a-4d74-a408-013957350e5e"
/> | <img width="1380" height="462" alt="Image"
src="https://github.com/user-attachments/assets/e5761e8e-3697-423b-805b-45110205099a"
/> |
| <img width="1398" height="550" alt="CleanShot 2026-04-28 at 15 12
41@2x"
src="https://github.com/user-attachments/assets/982694d9-5461-4362-8bae-a6e2b4c60e8b"
/> | <img width="1402" height="450" alt="CleanShot 2026-04-28 at 15 13
09@2x"
src="https://github.com/user-attachments/assets/0b1257c4-6b58-4c39-a182-4861a9e378ee"
/> |
| <img width="1640" height="716" alt="CleanShot 2026-04-28 at 15 17
25@2x"
src="https://github.com/user-attachments/assets/a5be4d5f-2bf7-4dc2-b396-56129fe64ec9"
/> | <img width="1630" height="716" alt="CleanShot 2026-04-28 at 15 16
00@2x"
src="https://github.com/user-attachments/assets/0d589252-aaf8-4efc-9d81-15ec4f99ec61"
/> |

| Design System Docs |
| --- |
| <img width="1646" height="1864" alt="CleanShot 2026-04-28 at 14 59
15@2x"
src="https://github.com/user-attachments/assets/12d13595-8972-4fb2-a04a-fb916388ebb6"
/> |


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a "success" admonition variant and new example previews
demonstrating success and description-only usages.

* **Documentation**
* Clarified admonition guidance: when to use title vs description vs
children; added example sections for short callouts and success
messages.

* **Refactor**
* Standardized UI by moving short/advisory text into description across
the app and harmonized trailing punctuation.

* **Style**
* Ensured warning/destructive admonitions use consistent foreground text
styling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-01 07:15:00 -06:00
Joshen Lim 7f8ae81d64 Clean up table editor header (#45452) 
## Context

Resolves FE-3126

Just cleaning up the table editor header with a bit of refactors
(pre-req to investigating collapsing filter bar and table editor header
actions into a single row)

## Non-visual changes involved
- Break down components within `GridHeaderActions` into smaller ones
  - `IndexAdvisorPopover`
  - `SecurityDefinerViewPopover`
  - `RealtimeToggle`
- Deprecate use of `useUrlState` in `GridHeaderActions` to use
`useQueryState` instead
- Improve types for `TwoOptionToggle`

## Visual changes involved
- Collapse realtime button toggle into a button icon, with no text (just
tooltip)
- Adjust layout of buttons a little

### Before
<img width="796" height="118" alt="image"
src="https://github.com/user-attachments/assets/436bca94-4d91-471a-a184-487c6f78dc04"
/>

### After
<img width="731" height="132" alt="image"
src="https://github.com/user-attachments/assets/5fd30982-a1fc-4f92-a590-146d1e69d52a"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Index Advisor popover with recommendations.
  * Realtime toggle to manage realtime table publication.
  * Security Definer view popover with optional autofix.
  * Insert menu for adding rows/columns and CSV import.

* **Bug Fixes**
  * Adjusted filter bar input sizing for improved readability.

* **Refactor**
* Header layout updated and insert/import actions moved into dedicated
components.

* **Tests**
  * Updated end-to-end selectors for the Insert row menu item.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-01 18:45:21 +08:00
Joshen Lim 50eea124e7 Small tweaks to feature preview badge (#45409) 
## Context

Small improvements from this PR:
https://github.com/supabase/supabase/pull/45373

- Fix feature preview badge alignment
  - Before:
<img width="341" height="75" alt="image"
src="https://github.com/user-attachments/assets/e6e2f727-fc75-4f70-b9cd-94d67aed8c5d"
/>
  - After:
<img width="365" height="64" alt="image"
src="https://github.com/user-attachments/assets/3d6e5e5d-c285-48f4-8f8f-251c23101e41"
/>
- Shift feature preview badge for policies into tester side panel
<img width="640" height="93" alt="image"
src="https://github.com/user-attachments/assets/3efb73a7-f7f5-4ae0-8560-d1e0ba989626"
/>
- Realised that advisor settings wasn't set up to be behind the feature
preview
  - Fixing that in this PR

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added preview badge indicator to the RLS Tester feature

* **Style**
* Improved spacing and layout alignment across authentication, database
access, webhook, logging, and advisor interface components
  * Enhanced badge component styling for better vertical alignment

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-01 10:18:20 +08:00
Joshen Lim 87e8c59405 Add view data as user in auth users + refactor UI for role impersonation (#45358) 
## Context

As part of RLS testing, adding @awaseem's idea for having "View data as
user" CTAs in the Auth Users's table
<img width="348" height="190" alt="image"
src="https://github.com/user-attachments/assets/855c8f54-0aba-478c-982b-1d9d29e419bd"
/>

## Other changes

Similar from @awaseem's suggestions, am also refactoring the Role
Impersonation UI a little, mainly from a copy writing POV to improve the
clarity of the UI.
- More action-oriented and contextual header for the role impersonation
popover
- e.g Table Editor -> "View data as a role", or SQL Editor -> "Run SQL
query as a role"
- Updated labels to be bit more intuitive from a builder's POV
- The actual database role is still mentioned in the option's
description (so we aren't obfuscating the actual postgres logic)
- Add label descriptors to elaborate what each role implies
  - e.g Anon -> "Not logged in"
- Add docs button which points to
[here](https://supabase.com/docs/guides/database/postgres/row-level-security#authenticated-and-unauthenticated-roles)
that explains which roles Supabase uses
- (Nit) Refactor to use Card component

### Before
<img width="647" height="277" alt="image"
src="https://github.com/user-attachments/assets/9ebae084-38b7-4e21-886b-f609bd71976e"
/>

### After
<img width="604" height="309" alt="image"
src="https://github.com/user-attachments/assets/4d797309-1b6b-4fd0-aab3-63d5e144c53c"
/>

<img width="630" height="297" alt="image"
src="https://github.com/user-attachments/assets/ca748635-c5da-4426-a9c3-8cb5aeef47a6"
/>



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added "View data as user" and "Run SQL as user" actions to user rows
to impersonate a user and jump to table or SQL views.
* Impersonation now surfaces an identity card in new tabs showing the
impersonated identity and a Stop button.

* **UI/UX Improvements**
* Impersonation panels accept customizable headers, show clearer role
labels (Postgres), richer role descriptions, condensed RLS copy,
in-panel docs link, simplified "Stop" labels, and adjusted
typography/padding for consistent styling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-01 00:43:15 +08:00
Ivan Vasilov 13df106d89 chore: Fix the Auth hook card CSS (#45415) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Refined layout styling in the authentication hook interface to
optimize flex container behavior for improved responsiveness and visual
alignment.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-30 13:06:17 +00:00
Ivan VasilovandJordi Enric 56de26fe22 chore: Migrate the monorepo to use Tailwind v4 (#45318) 
This PR migrates the whole monorepo to use Tailwind v4:
- Removed `@tailwindcss/container-queries` plugin since it's included by
default in v4,
- Bump all instances of Tailwind to v4. Made minimal changes to the
shared config to remove non-supported features (`alpha` mentions),
- Migrate all apps to be compatible with v4 configs,
- Fix the `typography.css` import in 3 apps,
- Add missing rules which were included by default in v3,
- Run `pnpm dlx @tailwindcss/upgrade` on all apps, which renames a lot
of classes
- Rename all misnamed classes according to
https://tailwindcss.com/docs/upgrade-guide#renamed-utilities in all
apps.

---------

Co-authored-by: Jordi Enric <jordi.err@gmail.com>
 2026-04-30 10:53:24 +00:00
Gildas GarciaandJoshen Lim f4abe3fca7 chore: migrate MultiSelectDeprecated to Shadcn multi-select (#45377) 
## Problem

We want to reduce the code we ship and maintain.

## Solution

- Migrate old `MultiSelectDeprecated` usage to the new Shadcn
`multi-select`
- Fix `multi-select` background color to align it with other inputs
- Fix `multi-select` popover content alignment (now align to its input
start)

## Screenshots

### RLS policies
Before:
<img width="618" height="705" alt="image"
src="https://github.com/user-attachments/assets/098504fc-21a9-4386-9390-e69f929189c1"
/>

After:
<img width="549" height="704" alt="image"
src="https://github.com/user-attachments/assets/06842e31-90bf-4d24-8c19-78f74941cd65"
/>

### Storage policies
Before:
<img width="1177" height="664" alt="image"
src="https://github.com/user-attachments/assets/3cf1afb4-9604-4ee9-b7b6-8371f94bcfcc"
/>

After:
<img width="1170" height="653" alt="image"
src="https://github.com/user-attachments/assets/e3b235d3-5890-45ff-9658-82c6612ac82a"
/>

### Database indexes
Before:
<img width="675" height="496" alt="image"
src="https://github.com/user-attachments/assets/84c0d3b6-45af-49dc-b4f4-274abed4cea7"
/>

After:
<img width="674" height="498" alt="image"
src="https://github.com/user-attachments/assets/697ceafc-256f-4106-9193-8697bc3d9d8e"
/>

### Contact support
Before:
<img width="643" height="534" alt="image"
src="https://github.com/user-attachments/assets/ee7fc790-622d-4c09-afab-269271a31af4"
/>

After:
<img width="645" height="457" alt="image"
src="https://github.com/user-attachments/assets/db0b9a32-95e0-4864-a12a-88828c431aab"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Replaced legacy multi-select controls with a unified selector UI:
dynamic trigger labels, per-item disable support, explicit item
rendering, deletable badges, and improved search/selection behavior.
* **Chores**
* Removed deprecated multi-select badge and legacy picker
implementations; adjusted exports/types to align with the new selector
components.
* **Style**
* Minor UI text and inline code styling improvements and modal spacing
tweaks.
* **Tests**
  * Updated end-to-end flows to wait and interact with the new pickers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-04-30 10:35:01 +02:00
Joshen Lim 89d08a2505 Remove feature flag for RLS tester (#45332) 
## Context

As per PR title - will make the RLS tester available for CLI / self-host
(still as a feature preview)

## To test

- [x] Verify briefly locally that the RLS tester is available for use,
and works as expected

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved user search error handling to display appropriate failure
messages when search encounters issues.

* **Refactor**
* Simplified RLS Tester feature availability logic by consolidating
enablement checks across components and removing redundant feature flag
dependencies.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-28 16:32:10 +00:00
Joshen Lim 202c085cf7 Merge rls tester callouts (#45312) 
## Context

Just merging the callouts - only show one at a time, instead of both

### Before
<img width="610" height="518" alt="image"
src="https://github.com/user-attachments/assets/58567f7e-99bf-4c84-8392-35573c646af6"
/>

### After
<img width="605" height="428" alt="image"
src="https://github.com/user-attachments/assets/975a5a30-2b36-4602-af8f-b79c2383f38b"
/>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Enhanced RLS Tester to prevent conflicting policy status messages from
appearing simultaneously. The interface now properly displays only the
relevant message about policy configuration and evaluation status,
improving clarity when reviewing row-level security results.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-28 17:59:53 +08:00
Ivan Vasilov 308cd791a2 chore: Prep work for migrating to Tailwind v4 (#45285) 
This PR preps the monorepo for a migration to Tailwind v4:
- Bump all Tailwind dependencies and libraries to the latest possible
version, while still compatible with Tailwind 3.
- Cleans up obsolete Tailwind 3 specific options and configs.
- Cleans up unused CSS files and fixes the CSS imports.
- Migrates all `important` uses in `@apply` lines to using the `!`
prefix.
- Move `typography.css` to the `config` package and import it from the
apps.
- Migrated all occurrences of `flex-grow`, `flex-shrink`,
`overflow-clip` and `overflow-ellipsis` since they're deprecated and
will be removed in Tailwind 4.
- Make the default theme object typesafe in the `ui` package.
- Migrate all `bg-opacity`, `border-opacity`, `ring-opacity` and
`divider-opacity` to the new format where they're declared as part of
the property color.
- Bump and unify all imports of `postcss` dependency.
 2026-04-28 11:33:53 +02:00
Joshen Lim dab1512fe9 Add callout for feature preview rls tester (#45307) 
## Context

Adds a banner on the auth policies page for the new RLS tester feature
preview
<img width="307" height="310" alt="image"
src="https://github.com/user-attachments/assets/6864c2cb-c3b8-4c1f-8dce-57411425e17d"
/>

Also adds a Give feedback button in the RLS Tester sheet footer
<img width="616" height="73" alt="image"
src="https://github.com/user-attachments/assets/64755f56-4e27-4b54-92b2-a894badc0b88"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* RLS Tester preview banner added to the policies page with animated
content and a locally persisted dismissed state.
* Enabling the RLS Tester via the preview also dismisses and records the
banner dismissal.
* New feedback link added to the RLS Tester UI that opens in a new tab.

* **Layout/Providers**
* Banner stack context moved so banner state is available more broadly
across the app.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-28 17:14:31 +08:00
Joshen Lim 5f867e5f6c Feature Preview: RLS Tester (#45121) 
## Context

Resolves FE-3077
Related discussion: https://github.com/orgs/supabase/discussions/45233

Verifying the correctness of your RLS policies set up has always been a
gap, as highlighted by a number of GitHub discussions like
[here](https://github.com/orgs/supabase/discussions/12269) and
[here](https://github.com/orgs/supabase/discussions/14401). As such,
we're piloting a dedicated UI for RLS testing (using role impersonation
as the base), in which you'll be able to
- Run a SQL query as a user (not logged in / logged in - this is the
role impersonation part)
- See which RLS policies are being evaluated as part of the query
- And hopefully be able to debug which policies are not set up correctly

Changes are currently set as a feature preview - and we'll iterate as we
get feedback from everyone 🙂 🙏

<img width="613" height="957" alt="image"
src="https://github.com/user-attachments/assets/83c37f8a-28fc-43b3-b0ff-e28571d8710c"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* RLS Tester: run queries as anon or authenticated users, view inferred
SQL, per-table policy summaries, and data previews of accessible rows.
* UI preview: new RLS Tester preview card and modal with opt-in toggle;
RLS Tester sheet with role/user selector and query editor.
  * SQLEditor: “Explain” tab is always visible.

* **Chores**
* Added supporting API endpoints, background checks for table RLS
status, and a local-storage flag to persist the preview opt-in.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-28 15:02:49 +08:00
Ali Waseem 43e437140b feat(studio): add disable action for custom OAuth providers (#45221) 
## Summary

- Adds an Enable/Disable dropdown action in each row of the custom OAuth
providers list.
- Disabling opens a confirmation modal that calls the existing update
API with `enabled: false`; enabling is immediate (restorative, no
confirmation).
- Removes the hardcoded `enabled: true` from the edit sheet's update
payload so editing a disabled provider no longer silently re-enables it.

Closes
[FE-3067](https://linear.app/supabase/issue/FE-3067/add-disable-button-for-custom-oauth-providers).

## Test plan

- [x] Create a custom OAuth provider — it is enabled by default.
- [x] Click the row menu → "Disable". Confirm in the modal. Row shows
`Disabled` badge.
- [x] Click the row menu → "Enable". Row immediately flips back to
`Enabled`.
- [x] Edit a disabled provider via the "Update" action, save. Verify it
remains `Disabled` (no silent re-enable).
- [x] Delete action still works.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **New Features**
* Added enable/disable toggle controls for individual custom OAuth
providers in the provider list
* Added confirmation dialog when disabling a provider to prevent
accidental changes

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-04-27 17:34:59 +02:00