## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix - config hardening
## What is the current behavior?
CORS is applied at the global level in a permissive mode
## What is the new behavior?
Self-hosted envoy config should apply CORS to the `/pg` routes. These
should only be called from the studio dashboard (when called via a
browser).
uses `SUPABASE_PUBLIC_URL`, which should mean this isn't a breaking
change.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security & Access**
* Added stricter CORS controls for the `/pg/` route.
* Requests are limited to the configured public URL and localhost
origins.
* Standard HTTP methods and headers are supported, with preflight
responses cached for one hour.
* **Documentation**
* Updated self-hosting guidance to describe the `/pg/` route’s CORS
policy.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updates the self-host Edge Functions template to use `@supabase/server`,
matching the CLI's `supabase functions new` templates (part of SDK-1150,
follows up on #45635 which exposed `SUPABASE_JWKS` to the functions
container). The `hello` example function now wraps its handler in
`withSupabase({ auth: 'none' })` and resolves the package through a
per-function `deno.json` import map, which the runtime auto-discovers,
so no dispatcher changes are needed. The self-hosted functions guide is
updated to match: the create-a-function snippet, a `ctx.supabaseAdmin`
example replacing the manual esm.sh `createClient` wiring, and a note
that `auth: 'user'` requires `SUPABASE_JWKS`. Verified on
`supabase/edge-runtime:v1.74.0` with the compose environment variables:
`curl /functions/v1/hello` returns the same response body as before, so
existing docs and troubleshooting pages stay accurate.
The `docker/.gitignore` change: `volumes/functions/**` ignores
self-hosters' own functions, but it also hid the new `deno.json`, which
must ship with the repo for the `hello` import to resolve. The allowlist
entries follow the existing `main/index.ts` pattern.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Edge Functions now support authenticated invocation with publishable
or secret API keys.
* Function handlers can access authenticated and administrative Supabase
clients through the request context.
* Added automatic environment configuration and JWT verification
support.
* **Documentation**
* Updated the self-hosting guide with the new function setup and
authentication workflow.
* Improved local function examples for supported access patterns and
privileged operations.
* **Tests**
* Updated self-hosted smoke tests to validate publishable-key function
access.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Kalleby Santos <kalleby_santos@hotmail.com>
Co-authored-by: Kalleby Santos <105971119+kallebysantos@users.noreply.github.com>
* add routes for local remote mcp
* add additional plugins to kong to restrict mcp
* prohibit access to /api/mcp and /mcp by default
* add comments to warn the user about local access only
* chore: move _analytics to a distinct database
Following: https://github.com/supabase/cli/pull/2707
BREAKING CHANGES:
When migrating from an older version you will need to manually create the new internal _supabase
database and analytics schema the same way the and do.
Via:
* feat: add supavisor to the self-hosted stack
* chore(docs): add docs about supavisor
* chore: fix reviewdog warning
* chore: fix typo
* chore: apply pr comments
Exposes the API routes for Realtime appropriately via Kong configuration.
Also alters the analytics configuration to avoid extra logs due to having only one analytics server instead of a cluster
Co-authored-by: Rodrigo Mansueli <rodrigo@mansueli.com>
Etienne Stalmans