## Summary
Resolves [GROWTH-865](https://linear.app/supabase/issue/GROWTH-865) on
the Studio side. Companion backend PR:
[supabase/platform#33086](https://github.com/supabase/platform/pull/33086).
Resource-exhaustion advisories (CPU, Disk IO, Memory) currently give
users a list of identical-looking messages with no project context. This
PR makes the affected project visible in the advisor panel and hardens
the "Check consumption" deep-link.
### Changes
**Advisor list view** — `AdvisorPanel.utils.ts`,
`AdvisorPanel.types.ts`, `AdvisorPanel.tsx`, `AdvisorPanelBody.tsx`
- `AdvisorNotificationItem` now carries `project_ref`.
- `getAdvisorItemSecondaryText` accepts an optional `projectNameByRef`
map and returns the resolved project name (falling back to the ref if
the lookup hasn't loaded). Falls through to the existing date string for
notifications without a project.
- `AdvisorPanel.tsx` builds the map from `useProjectsInfiniteQuery` and
threads it through `AdvisorPanelBody`.
**NotificationDetail** — `NotificationDetail.tsx`
- `[ref]` / `[slug]` substitution in action URLs falls back to
`data.project_ref` / `data.org_slug` before the `_` literal. This fixes
the universal-link bug Tim reported where "Check consumption" sometimes
resolved to `/project/_/...` while `useProjectDetailQuery` was still
loading.
The companion backend PR updates the notification copy so the
title/message also name the project. Both PRs degrade gracefully if
landed independently.
## Test plan
- [x] `pnpm test:studio -- AdvisorPanel.utils.test.ts` — 6/6 pass (4 new
tests cover the notification branch of `getAdvisorItemSecondaryText`)
- [x] `pnpm typecheck` passes for apps/studio
- [x] `pnpm exec eslint components/ui/AdvisorPanel/` passes
- [ ] Local Studio smoke test: open Advisor → Messages, confirm project
name shows under each notification and "Check consumption" deep-links to
the correct project even if the project detail query is slow
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Advisor Panel notifications now display resolved project names when
available for clearer context.
* **Bug Fixes**
* Notification action URLs now prefer stored project and organization
refs/slugs with improved fallbacks, making action links more reliable.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46203?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Feature. Resolves DEPR-430.
## What is the current behaviour?
The homepage Advisor summary, shared Advisor panel, and top-nav Advisor
indicator only surface lints and notifications. Banned IPs are not
represented as dismissible Advisor items, so network bans are easy to
miss unless a user visits Database Settings directly.
The `public bucket allows listing` warning is no longer part of this PR.
That warning will move to a follow-up Splinter `WARN` lint so it can
flow through the standard lint surfaces instead of a bespoke Studio
signal path.
## What is the new behaviour?
- adds a new Advisor `signal` source for banned IPs on the platform
homepage, in the shared Advisor panel, and in the top-nav Advisor
indicator
- keeps dismissals client-side only for now, scoped by project and exact
IP fingerprint
- keeps banned IP signals at `warning` severity because they still
indicate suspicious traffic and remain actionable if a user wants to
review or remove a ban
- leaves `/project/[ref]/advisors/security` as follow-up work because
that surface is still lint-native, and banned IPs are management-plane
signals rather than Splinter lints
| After |
| --- |
| <img width="1728" height="997" alt="Mallet Toolshed
Supabase-65A60B4A-107E-4D79-B9A8-23F754BEAB08"
src="https://github.com/user-attachments/assets/c08ecbbb-c302-43bd-81bb-6ba7eb18b7b3"
/> |
## Reviewer testing notes
1. Use a throwaway project.
2. Get the database connection string for that project.
3. Attempt to connect with the wrong password 3-4 times until you hit an
`ECONNREFUSED`-style error, which should mean your IP has been banned.
4. Refresh Studio and confirm the project overview shows the new `Banned
IP address` signal.
5. Open the Advisor Center and confirm:
- the top-nav Advisor dot turns warning yellow
- the signal detail shows `Entity`, `Issue`, and `Resolve`
- `Edit network bans`, `Dismiss`, and `Learn more` are present
6. Open Database Settings > Network bans and confirm your banned IP
appears there and can be unbanned.
7. Note that `/project/[ref]/advisors/security` will not show this item.
That page is still lint-only, and this banned IP work is a short-term
client-side signal rather than a true lint.
Longer term, we likely want a more durable event model here so banned
IPs can power notifications, webhooks, emails, and other project-level
alerts.
---------
Co-authored-by: kemal <hello@kemal.earth>
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Mert YEREKAPAN
