mirror of
https://github.com/supabase/supabase.git
synced 2026-10-05 17:35:10 +03:00
codex/fix-tanstack-e2e
1346
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Monica Khoury
|
123c768de1 |
Warn when authenticator role overrides exposed schemas (FE-4472) (#50982)
## What Adds a warning in Project Settings > API when the `authenticator` role's `pgrst.db_schemas` setting overrides the Dashboard's "Exposed schemas" configuration, plus an inline "Reset override" button to fix it in one click. ## Why `ALTER ROLE authenticator SET pgrst.db_schemas = ...` silently overrides what PostgREST actually exposes, regardless of what's selected in the Dashboard. Users hit a confusing PGRST106 error with no indication that a role-level override is the cause. ## How - New query (`authenticatorRoleConfigQueryOptions`) reads `pg_roles.rolconfig` for the `authenticator` role and parses out any `pgrst.db_schemas` value. Configured to always refetch on mount and window focus, since the fix is often applied outside the Dashboard (SQL editor, another client) with no cache-invalidation event for the app to react to. - `PostgrestConfig.tsx` compares that value against the currently selected schemas and shows an `Admonition` warning naming the actual overriding schemas, with a link to the PGRST106 troubleshooting guide, when they differ. - The warning includes a "Reset override" button that runs `alter role authenticator reset pgrst.db_schemas` after a confirmation step (showing the exact SQL that will run, with a copy button), then refetches so the warning clears immediately without a page reload. ## Testing 1. In the SQL Editor of a test project, run: ```sql alter role authenticator set pgrst.db_schemas = 'public'; ``` 2. Go to Project Settings > API, and select a schema other than (or in addition to) `public` in "Exposed schemas" (e.g. add `api`). 3. The new warning should appear, naming `public` as the schema actually in effect, with a link to the PGRST106 troubleshooting guide. 4. Click "Reset override" in the warning, confirm in the modal, and check that the warning clears immediately without a page reload. 5. Alternatively, clear the override manually from the SQL editor: ```sql alter role authenticator reset pgrst.db_schemas; ``` then navigate away from the API settings page and back (or refocus the browser tab) — the warning should clear without a hard refresh. Fixes [FE-4472](https://linear.app/supabase/issue/FE-4472/warn-when-authenticator-role-overrides-exposed-schemas) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * The API settings page now warns when the authenticator role’s exposed schemas differ from the saved Dashboard configuration. * You can reset the override to restore the saved schema configuration. The reset requires permission and provides success or error feedback. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tanun Turbo Chalermsinsuwan
|
cd305313e4 |
fix(roles): Show only document-defined roles (#51087)
## Problem As part of having `None / No Access` available to customers, we need to start providing this role entry in `/platform/organization/:ref/roles` endpoint. However, when making it available, the role will show up prematurely on all the components that relies on `useOrganizationRolesV2Query` function. ## Solution This change is to allow us to test the behavior of the new role without having to turn the API on/off. The UI will show only the "predefined" entries and ignore the "extras" sent by API. After this is merged, we will do the following 1. Unhide the None role from the API https://github.com/supabase/platform/pull/39137 -- this will not have any effect on the frontend as we already ignore it in this PR 2. Work and continue testing on https://github.com/supabase/supabase/pull/50922 -- which will be easier to verify as we no longer need to change the API side ## Review instructions 1. Modify the items in the `FIXED_ROLE_ORDER` list, remove some roles from there 2. You will see that the role will disappear from the components like the invitation form or managed access form. ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [x] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Bug Fixes** * Organization role lists now show only supported roles, in the expected order. Roles outside the supported set are no longer displayed. This keeps the list consistent and focused on recognized roles, making available organization roles easier to review. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Kamil Ogórek
|
c5b4fbfa11 |
fix: Handle NO_PROJECT_MARKER for projectRef (#51083)
Skip `NO_PROJECT_MARKER` values for projectRef in API validation. |
||
|
Pamela Chia
|
38b74af3f1 |
fix(studio): fall back for framework icons without an asset (#51065)
I made the connected-project framework icons fall back when no shipped SVG exists for a framework. The three icon sites built `/img/icons/frameworks/<framework>.svg` straight from the integration's framework preset, which is an open-ended string. They only fell back when the value was empty, so any preset without an asset (`express`, `hono`, `fastapi`, `tanstack-start` and others) showed a broken image and logged a 404. **Changed:** - **Broken framework icons**: `getFrameworkIconUrl` returns the asset URL only for slugs in a set that mirrors `public/img/icons/frameworks/`. The integration connection row, the org project linker and the marketplace project picker now show their existing fallback icon for any other slug. A test keeps the set equal to the directory listing. - **Framework type**: I deleted the hand-kept `VercelFramework` union. It listed exactly the shipped icon slugs, while the API types the field as `string | null`, and that mismatch is what made the old empty-only check look safe. **Note:** I rejected an `onError` fallback because the browser still sends the 404 request. Adding logos for common presets is left for design. ## To test Tested on Vercel preview (staging): no real connection there uses these presets, so I rewrote the org integrations response in the browser to give one integration four connections. - [x] Open an org's Integrations page with connections whose framework has no shipped icon (`express`, `eve`, `tanstack-start-lovable`). Expect the fallback badge and no request under `/dashboard/img/icons/frameworks/` for those slugs. Observed: all three rows showed the badge and the network log had no request for their SVGs. - [x] Same page with a `nextjs` connection. Expect its framework logo. Observed: `nextjs.svg` loaded with a 200. - [x] Same page with the real, unmodified response (one connection with `framework: null`). Expect the badge, no frameworks requests, and no new console errors. Observed: as expected. ## Linear - fixes GROWTH-1309 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Vercel integration and project views now display framework icons when available and fall back to the Vercel icon when no matching icon exists. * Framework metadata now supports values beyond a fixed list, while unsupported frameworks continue to use the fallback icon. * **Tests** * Added coverage for supported and unsupported framework icons, including base-path handling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
d22702e907 |
refactor(studio): extract user project regions + emergency override hooks (#51033)
## Summary - Extracts `useUserProjectRegions` (org + project region aggregation, fail-open on fetch errors) and `useEmergencyIncidentOverride` (the `ongoingIncident` flag / env var check) out of `useStatusPageBannerVisibility`, so the upcoming incident.io status-page banner can reuse both without duplicating the org/project fan-out logic. - No behavior change for the legacy banner except one intentional fix: `StatusPageBanner.utils.ts` compared the incident's affected regions (lowercased) against the user's regions (not normalized), so a mixed-case region on either side could silently fail to match. Both sides now go through the same `normalizeRegion` helper. - Part of the Linear FE-4057 stack (PR 5a of 6). Base branch is PR 4 (`charis/fe-4057-pr4-project-creation-status-admonition`), not master. Linear: FE-4057 ## Test plan - [x] `pnpm --filter studio run typecheck` - [x] `pnpm --filter studio run lint:ratchet` - [x] `pnpm knip --workspace apps/studio` - [x] `pnpm test:prettier` - [x] `pnpm --filter studio exec vitest run` on the touched test files and the `hooks/misc/` and `components/layouts/AppLayout/` directories (all passing, no regressions) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved status banner targeting by matching incidents against normalized regions across the user’s projects. * Updated banner visibility checks to handle incomplete project or region data, including when project information fails to load. * Improved loading behavior so the banner can be evaluated based on user-region data rather than waiting for separate organization and project requests. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Pamela ChiaandJoshen Lim
|
4a941518e3 |
feat(studio): track Explorer runs and saves (#51004)
I added outcome events for Explorer query runs and successful manual notebook saves. Existing page visits and preview toggles do not show whether users complete queries or persist notebooks. **Changed:** - **Query usage:** Accepted runs from query tabs and notebook cells emit submitted and terminal outcome events with a shared run ID. Canceled confirmations emit no run events. - **Notebook adoption:** Successful manual saves emit created or updated events. Recreated notebooks count as creations. Unsaved drafts and failed saves emit neither. - **Event metadata:** Explorer action events use `Explorer` as their page title. **Note:** Assistant-generated saves are outside this PR. Custom properties omit SQL and notebook content. Page visits still carry the browser title, which can include a notebook name. ## To test Tested on the staging preview: - [x] Run valid and invalid SQL from an Explorer query tab. Each run emits one submitted event and one matching completed or failed event with the same run ID. - [x] Run database and Logs notebook query cells, then add a markdown cell. The query cells emit matching event pairs; the markdown cell emits no query event. - [x] Save a new notebook, then edit and save it again. The successful saves emit created and updated events. - [x] Cancel a guarded query. It emits no query run event. - [ ] Recreate a notebook deleted on the server after local edits. A successful save emits created, not updated. - [x] Inspect an Explorer action event request. Its page title is `Explorer`; page visits still use the browser title. - [ ] Force a notebook save failure. It should emit no save event. This case was not tested manually. ## Linear - fixes GROWTH-1298 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Analytics** * Explorer query runs are tracked for database and log queries, including whether they complete or fail. * Query activity is associated with its location in Explorer, such as a query tab or notebook cell. * Successful notebook saves are tracked as creations or updates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Alaister YoungandAlaister Young
|
995f6f65c7 |
[FE-4483] fix(studio): disable network bans for v3 projects (#50997)
Disables network bans for v3 (`AWS_K8S`) projects and shows a specific unsupported notice. The shared banned-IP query waits for project details and skips unsupported projects, covering both Database Settings and Advisor for v3 and High Availability projects. The hook returns the standard query result and uses `skipToken` to prevent unsupported requests, including manual refetches. Database Settings handles project-detail errors at the call site. Open unban confirmations are cleared when the section becomes disabled, and submission checks eligibility. Addresses [FE-4483](https://linear.app/supabase/issue/FE-4483/disable-network-bans-for-v3-aws-k8s-projects). ## To test - Open Database Settings on a v3 project. Check that Network bans shows the v3 notice, hides the IP list and unban controls, and makes no network-bans retrieval request on initial load or reload, including while Advisor is mounted. - Check that an HA project still shows its existing notice and makes no network-bans retrieval request on initial load or reload. - Navigate from a supported project to a v3 or HA project and check that no banned-IP request is sent for the unsupported project and no banned-IP signals from the previous project appear in Advisor. - If project details fail without cached data, check that Network bans shows an error after retries finish and does not retrieve bans. A successful retry should restore normal behavior. - Open an unban confirmation on a supported project, then navigate to a v3 or HA project. Check that the dialog closes without sending an unban request and stays closed when returning. A newly opened confirmation should still work. - On a supported project, check the empty state and banned IP list. Confirm that users with permission can unban an IP and users without permission see a disabled button with the permissions tooltip. Validation: 17 focused tests passed, covering automatic and manual request suppression, project-detail error display and recovery, and navigation between supported and unsupported projects. Changed-file ESLint, Prettier, and full Studio typecheck (without the incremental cache) passed. Earlier local browser checks on `9912c6c` confirmed no retrieval requests for an HA project on AWS_K8S across reloads and Advisor, and a successful empty state on a supported project. The local failed-project case redirected to the organization after retries, so the inline error remains verified by the component test only. The latest preview, standalone v3 notice, populated bans/unban, and no-permission tooltip still need browser verification. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Banned IP settings now show an unsupported-project notice for AWS Kubernetes projects and hide ban lists and unban actions for AWS Kubernetes and High Availability projects. * Banned IP data loads only after project details are available and only for supported projects; unsupported projects do not display cached ban data. * Project-detail errors are shown separately from ban-list errors. * Unban confirmations close when a project becomes unsupported or an unban succeeds. Unbanning is unavailable when you lack update permission or the project is unsupported. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Manan GuptaandJoshen Lim
|
6a0518dd86 |
fix(studio): forward HA flag to project-creation pre-flight checks (#50902)
## Summary - Fixes MUL-1678: toggling High Availability on in the project-creation wizard 400'd for orgs that are HA-entitled but not enrolled in the "V3 rollout ramp" feature flag on the backend, because two pre-flight endpoints Studio calls before project creation didn't know about HA and hit the ramp check the real create-project call already bypasses. - Threads `highAvailability` through `useOrganizationAvailableRegionsQuery` (`GET /platform/projects/available-regions`, sent as `high_availability=true|false` on the query string) and `useProjectCreationPostgresVersionsQuery` / `useAvailableOrioleImageVersion` (`POST /platform/organizations/:slug/available-versions`, sent as `high_availability` in the body), including their query-key cache keys so HA and non-HA responses for the same org/provider/size don't collide. - Wires the (already form-tracked) `highAvailability` value into every call site: `ProjectCreationForm.tsx`, `RegionSelector.tsx`, and a new `highAvailability` prop on `PostgresVersionSelector.tsx` passed from `InternalOnlyConfiguration.tsx`. ## Problem The project-creation wizard's HA toggle is wired into the actual project-create request, but two pre-flight calls Studio makes before that (available regions, available Postgres versions) had no way to signal HA, so the backend's ramp-flag gate rejected them for HA-entitled orgs outside the ramp. ## Solution Add an optional `highAvailability` field end-to-end on the Studio side: query hook variables, cache keys, request serialization, and the components that already track the toggle via `useWatch`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Available regions and database versions in project creation now reflect the selected high-availability setting. * The Create button remains disabled while available regions are loading. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: GuptaManan100 <guptamanan100@gmail.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Charis
|
8b8569bd1a |
feat(studio): status page client data layer + support form (#50984)
## Summary * Adds the client query layer for `/api/status-page` (`statusPageQueryOptions` in `data/platform/status-page-query.ts`) and a shared normalization module (`lib/status-page/status-page.utils.ts`) that maps the endpoint response into region- and project-creation-aware `StatusItem`s — later PRs in this stack (assistant tool, project-creation admonition, global banner) build on this same module. * Wires the support form's status pill and incident admonition to the new data behind the `incidentIoStatusPage` ConfigCat flag. `useSupportStatus` branches between the new endpoint and the existing `useIncidentStatusQuery`/`processIncidentData` path, both mapped to the same `SupportStatus` shape. * `IncidentAdmonition` becomes purely presentational; the status link now points at the `pageUrl` returned by the endpoint instead of a hardcoded URL. Part of [FE-4057](https://linear.app/supabase/issue/FE-4057/frontend-bannerbot-reconfigured) — see Linear for full design context. ## Test plan - [X] `pnpm --filter studio run typecheck` - [X] `pnpm --filter studio run lint:ratchet` - [X] `pnpm knip --workspace apps/studio` - [X] `pnpm test:prettier` - [X] `pnpm --filter studio exec vitest run` (touched files) — 70 tests passing, including a flag-on case for `SupportFormPage` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Support pages now display current incident and maintenance information, including relevant status descriptions and links to the status page. * Status details can reflect items affecting a user’s region or project-creation services. Upcoming maintenance is excluded from active alerts. * **Bug Fixes** * Status labels and alerts now account for loading, errors, incidents, and maintenance consistently across support pages. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
e3fec137fe |
Joshenlim/fe 4466 audit logs update organization logs as well (#50935)
## Context Follows up from [this PR](https://github.com/supabase/supabase/pull/50799) - updates the Audit Logs UI for organization audit logs. Just differs from Account audit logs slightly with added "Actor" + "Target" column Reuses the same UI components from account audit logs so quite a bit of code clean up 🙂 <img width="1451" height="955" alt="image" src="https://github.com/user-attachments/assets/a1002cee-917f-4d9a-b977-3fab8ecd2d13" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Organization audit logs now use a sortable table with row selection and a resizable details panel. * Actor details show a member’s username when available, otherwise the actor’s email; a dash appears when neither is available. * Logs can be filtered by users and projects, with separate messages for no logs and no matching results. * A refresh control and loading indicators help show audit-log updates. * **Bug Fixes** * Organization project lists stop loading when pagination totals are unavailable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sean GeogheganandJoshen Lim
|
f2ff4ec0e9 |
fix(realtime): display banner when realtime has been suspended by admin (#50497)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? If Realtime's admin_suspended_at is set we display a banner. ## What is the current behavior? REAL-1095 ## What is the new behavior? <img width="1160" height="442" alt="Screenshot 2026-09-17 at 12 06 30 pm" src="https://github.com/user-attachments/assets/f5abe900-a163-48c9-ab55-945fc62df0d1" /> ## Additional context Depends on https://github.com/supabase/platform/pull/38476 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit - **New Features** - Added a notice to Realtime settings when the service is suspended, with instructions to contact support. - **Bug Fixes** - Improved invitation resending and role updates for roles without a linked base role. - **Tests** - Added coverage to verify the suspension notice appears only when applicable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Chris Opland
|
509afd0bf0 | fix(o11y): support partial metric loading (#50867) | ||
|
Jordi Enric
|
f0952fdef8 |
fix(studio): delete only the selected foreign server FE-4462 (#50785)
## Problem The dashboard lists one row per foreign server, but deleting a row dropped its foreign data wrapper with CASCADE. When multiple servers shared a wrapper, deleting one removed all of them. ## Fix Drop the selected server and its foreign tables. Remove the underlying wrapper and Vault secret only when no servers still use it. Edits to a shared wrapper now stop before making changes because the existing edit flow recreates the underlying wrapper. ## How to test 1. Configure two BigQuery foreign servers that use the same foreign data wrapper. Delete one from the dashboard. 2. Confirm the other server and its foreign tables still exist and work. 3. Delete the remaining server. Confirm the foreign data wrapper and its Vault secret are removed. 4. Attempt to edit one of two servers sharing a wrapper. Confirm the edit fails without removing either server. Focused pg-meta tests and typecheck pass. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Shared connections are identified in the integrations list, with guidance for editing them in the SQL Editor. Editing is disabled when a wrapper is shared, with an explanation shown. * Deleting a connection removes its foreign tables and removes the wrapper and Vault secret only when no other connection uses them. * **Bug Fixes** * Connection deletion verifies that the selected server still belongs to the wrapper and reports failures using connection-focused wording. * Attempts to edit a wrapper used by another connection are blocked with a clear explanation. * Connection deletion and confirmation messages now consistently refer to deleting a connection. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan VasilovandClaude Sonnet 5
|
12894ddd2a |
feat(studio): migrate storage infinite-query hook to list-v2 (#50730)
## Problem Storage's `list` (v1) endpoint is being deprecated in favor of `list-v2`, which uses cursor pagination instead of numeric offset (which degrades on large buckets) and fixes folders that differ only by case not both being listable. This is PR 1 of the migration (parent: FE-4423); it covers the shared infinite-query hook and its two consumers. ## Solution Added `listBucketObjectsV2` alongside the existing v1 `listBucketObjects` (still used elsewhere, migrated in a later PR), and replaced the `useBucketObjectsInfiniteQuery` hook with `bucketObjectsInfiniteQueryOptions` built on `infiniteQueryOptions`, following the repo's preferred data-fetching pattern. Pagination now uses `hasNext`/`nextCursor` instead of an offset multiplier, and `queryFn` rejects a response that claims `hasNext` without advancing the cursor so a misbehaving backend can't send `fetchNextPage` into an infinite loop. v2 splits results into separate `folders`/`objects` arrays and has no `search` field, so the two consumers (`BucketFilePickerColumn`, `MoveItemsFolderPicker`) merge/sort those arrays themselves, and search is folded into a `prefix` match instead. Also removed "Time last accessed" from the picker's sort dropdown since v2's `sortBy.column` doesn't support it, with a defensive fallback to `name` in case the shared sort preference (still used by the v1 main file explorer) carries that value over. Added the missing self-hosted `list-v2` API proxy route (`pages/api` + the TanStack `routes/api` wrapper) using storage-js's `listV2()`, since self-hosted Studio only had a v1 route and every v2 request was 404ing there. ## Review instructions 1. Open the bucket file picker (e.g. via an OAuth app logo upload), confirm folders and files both render and paginate correctly, and that searching still filters as expected. 2. Open the "Move items" modal's folder picker, confirm you can navigate into and back out of subfolders, and that folder search still works. 3. Run `pnpm test:studio -- MoveItemsModal`. ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [ ] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which references [WORD_LIST](https://github.com/supabase/supabase/blob/master/apps/docs/WORD_LIST.md) and the docs [CONTRIBUTING](https://github.com/supabase/supabase/blob/master/apps/docs/CONTRIBUTING.md) guide 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Storage browsing loads large bucket listings in pages, helping keep navigation responsive. * Folder pickers display folders and files together across paginated results. * Moving items between folders uses the same paginated browsing experience. * Search remains available in the final folder level, and folder navigation shows the correct contents. * **Updates** * “Time last accessed” is no longer available as a sorting option in storage pickers. Sorting is available by name, creation time, or update time. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> |
||
|
Samir Ketema
|
ad5c4bb879 |
fix: gracefully handle 403s on org invites for project-scoped members (#50876)
## Problem Gracefully handles 403s when getting org invitations as a project-scoped org member. The backend currently returns an empty list with a 200 status, but that will be changing soon - so this PR aims to fix the issue in advance. ## Solution Pretty self explanatory - but here is a before/after (with backend changes) ### Before <img width="2480" height="688" alt="CleanShot 2026-09-24 at 11 02 34 AM@2x" src="https://github.com/user-attachments/assets/13c6ed9e-7580-4962-9920-f49ede9c4592" /> ### After <img width="2466" height="820" alt="CleanShot 2026-09-24 at 11 07 13 AM@2x" src="https://github.com/user-attachments/assets/248f7bb5-1743-41c9-823f-f776a608dd17" /> <!-- ## Preview links If relevant, include links to changed pages for easy review access. Copy the preview base URL from the Vercel bot comment on this PR. Use the following table as an example template. | Site | Live | Preview | Search for | | -------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------- | | WWW | [/blog/your-post](https://supabase.com/blog/your-post) | [/blog/your-post](https://zone-www-dot-com-git-branch-name-supabase.vercel.app/blog/your-post) | unique phrase from the change | | Docs | [/docs/guides/your-page](https://supabase.com/docs/guides/your-page) | [/docs/guides/your-page](https://docs-git-branch-name-supabase.vercel.app/docs/guides/your-page) | unique phrase from the change | | Studio | [/dashboard](https://supabase.com/dashboard) | [/dashboard](https://studio-git-branch-name-supabase.vercel.app/dashboard) | unique phrase from the change | | Design system | [/design-system](https://supabase.com/design-system) | [/design-system](https://design-system-git-branch-name-supabase.vercel.app/design-system) | unique phrase from the change | | UI library | [/library](https://supabase.com/library) | [/library](https://ui-library-git-branch-name-supabase.vercel.app/library) | unique phrase from the change | | Knowledge base | [/kb/guides/your-page](https://supabase.com/kb/guides/your-page) | [/kb/guides/your-page](https://kb-git-branch-name-supabase.vercel.app/kb/guides/your-page) | unique phrase from the change | --> <!-- ## Additional context Optionally add any other context or screenshots. --> ## Review instructions 1. Open the preview 2. Navigate to the `Team` tab in `Organization` 3. Invite a project-scoped member 4. Accept the project-scoped member invite in another browser 5. Navigate to the same `Team` tab as that project-scoped member. ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [x] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which references [WORD_LIST](https://github.com/supabase/supabase/blob/master/apps/docs/WORD_LIST.md) and the docs [CONTRIBUTING](https://github.com/supabase/supabase/blob/master/apps/docs/CONTRIBUTING.md) guide <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Organization member lists now load even when invitation details aren’t accessible. * Missing invitation data no longer prevents member lists from loading. * Invitation errors other than access-denied errors, and errors loading members, continue to be reported. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi Enric
|
881c124301 |
fix(studio): prevent API Gateway report tab crash (#50847)
## Problem The API Gateway report initializes its request range with the Logs Explorer helper, which leaves `iso_timestamp_end` empty. When an OTEL chart returns sparse microsecond timestamps, the time series filler can interpret them as milliseconds while deriving the end of the range and attempt an unbounded fill, freezing or crashing the browser tab. ## Fix Initialize the report with its date range helper so both request bounds are present. Normalize microsecond timestamps before deriving fill bounds, including the single point case. Add regression tests for sparse OTEL data with both empty and explicit end dates. ## How to test - Open Observability → API Gateway on a project with requests spanning two hourly buckets. The page should render without a tab crash, and the analytics requests should include a nonempty `iso_timestamp_end`. - Run `pnpm --filter studio exec vitest run tests/features/logs/Logs.utils.test.ts` and confirm the microsecond timestamp cases pass. - Run the Studio typecheck and lint checks. The Vitest, typecheck, and lint commands could not run in this worktree because Studio dependencies are not installed. The source diff passed `git diff --check` and received a focused code review. |
||
|
Lukas Bernert
|
d51ed9f451 |
Update Studio disk IO burst copy (#50809)
## Problem Studio copy ties disk IO burst behavior to compute size thresholds and says the IO budget "resets". Burst eligibility isn't a single size cutoff EBS burst credits refill continuously while disk usage runs below baseline Docs already use this framing (#50016) Fixes PROD-665 ## Solution Three copy changes: - `UnavailableChartBlock.tsx`: the burst balance chart placeholder no longer names a size. It now describes sustained IO with no burst credit pool - `database-charts.ts`: the Disk IO Burst Balance tooltip describes the EBS burst credit pool without referencing instance size - `ResourceExhaustionWarningBanner.constants.ts`: the warning and critical banners say the budget refills whenever disk usage runs below baseline, instead of "resets" ## Review instructions 1. Read the diff. Copy changes only. 2. Optional: on a project with burstable disk IO, open Reports > Database and hover the Disk IO Burst Balance chart title to see the new tooltip. ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [x] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which references [WORD_LIST](https://github.com/supabase/supabase/blob/master/apps/docs/WORD_LIST.md) and the docs [CONTRIBUTING](https://github.com/supabase/supabase/blob/master/apps/docs/CONTRIBUTING.md) guide <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Documentation * Updated disk I/O chart messaging to explain that some compute types sustain disk throughput without a burst credit pool to track. * Clarified that disk I/O burst budgets refill when demand is at or below baseline, and that throughput remains at baseline until the budget refills. * Updated the burst-balance chart tooltip to describe how compute uses the EBS burst credit pool. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi EnricandJoshen Lim
|
3063679f1b |
feat(auth): restore key last-used timestamps FE-2462 FE-4315 (#50732)
## Problem Studio expected aliased fields from the last-used API-key endpoint, but the live endpoint returns OTEL attribute names. This kept legacy API-key activity unavailable and prevented Studio from showing activity for new JWT signing keys. Tracks FE-2462 and FE-4315. ## Fix Normalize the endpoint response at the data boundary, keep the `showApiKeysLastUsed` feature flag, and show activity from the past 24 hours for new JWT signing keys. Legacy HS256 signing keys remain blank because the analytics response does not provide a stable signing-key record ID for them. The request remains hosted-only, permission-gated, and non-blocking, and the existing last-rotated column remains intact. ## How to test - Make a request with a legacy anon or service-role API key, then open Project Settings > API Keys and verify its last request appears. - Make an Auth request signed by a new JWT signing key, then open JWT Keys and verify the matching key shows a Last used timestamp. - Verify a new key without activity shows No requests in the past 24 hours. - Verify the legacy HS256 signing-key row leaves Last used blank. - Expected result: legacy API keys and new JWT signing keys display activity from the shared endpoint without changing self-hosted Studio. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a **Last used** column for JWT signing keys on supported platforms. * Displays usage timestamps, loading and error states, or when a key has had no requests in the past 24 hours. * Usage tracking now includes both API keys and JWT signing keys. * **Bug Fixes** * Improved handling of usage records for legacy and current keys. * Usage details appear only on supported platforms and for users with the required permissions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Julian Domke
|
3ec2dfca44 | fix(stripe-atlas): guard stripe-atlas page in self-hosted mode (#50780) | ||
|
|
ec574f3a51 |
fix(studio): pass Authorization header to assistant list_policies tool (#50756)
<!-- ccr-slack-attribution --> _Requested by **Saxon Fletcher** · [Slack thread](https://supabase.slack.com/archives/C051L8U2EJF/p1789995309253479?thread_ts=1789995309.253479&cid=C051L8U2EJF)_ Resolves AI-1246 ## Problem **Before:** The Assistant's `list_policies` tool fails in about 70% of traces. It only "succeeds" when the org has AI opt-in disabled, because then it returns the privacy stub and never makes a request. When opt-in is enabled, it runs the pg-meta query server-side with no `Authorization` header, so the request is unauthenticated and fails. The Assistant then falls back to `execute_sql`. **After:** `list_policies` sends the caller's `Authorization` header, the same way `execute_sql` in `studio-tools.ts` already does, so it returns the project's RLS policies. ## Solution `getTools` already receives `authorization` but didn't pass it to `getSchemaTools`. This PR passes it through. `list_policies` builds `{ Authorization }` from it, and `getDatabasePolicies` gets an optional `headersInit` argument that it forwards to `executeSql`, the same pattern `getDatabaseFunctions` uses. Existing client-side callers of `getDatabasePolicies` don't change. Files: `lib/ai/tools/index.ts`, `lib/ai/tools/schema-tools.ts`, `data/database-policies/database-policies-query.ts`, plus tests in `lib/ai/tools/schema-tools.test.ts` (new) and `lib/ai/tools/index.test.ts`. ## Review instructions 1. Read `schema-tools.ts` and compare it with the `authHeaders` handling in `studio-tools.ts` (`execute_sql`). 2. On the preview, use an org with AI opt-in set to at least "schema" and ask the Assistant to list the RLS policies on `public`. `list_policies` should return the policies without falling back to `execute_sql`. Local gates (all passed): - `pnpm typecheck` in `apps/studio` (next typegen + `tsc --noEmit`) - `npx eslint` on touched files: 0 errors. The 2 warnings are on lines this PR doesn't change. - `npx vitest run lib/ai/tools/schema-tools.test.ts lib/ai/tools/index.test.ts lib/ai/tool-filter.test.ts`: 24/24 passed. I also ran the new header test against the old `schema-tools.ts` and it failed, as expected. - `SORT_IMPORTS=false npx prettier --config prettier.config.mjs --check` on touched files Follow-up, not in this PR: `getRlsKnowledge` in `fallback-tools.ts` (self-hosted path) also calls `getDatabasePolicies` without headers, even though a `headers` object is already in scope there. ## AI disclosure Claude Code (agent) wrote this PR from the Slack request. @SaxonF (Saxon Fletcher) is the accountable human owner. A human needs to review it before merge. ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [ ] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill (N/A, no docs changes) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0171Mk7SiKYLDDoAQvbDYfeK --- _Generated by [Claude Code](https://claude.ai/code/session_0171Mk7SiKYLDDoAQvbDYfeK)_ --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Julian Domke
|
f65ee588c1 | feat(stripe-atlas): wire up redemption flow (#50575) | ||
|
Jordi Enric
|
d6ca0e5900 |
feat(studio): migrate API reports to OTEL (#50638)
## Problem The API Gateway and Data API observability reports still send legacy BigQuery SQL to the logs.all endpoint. The Data API shared-report hook also hardcodes logs.all, so the otelReports flag cannot move that report to ClickHouse. ## Fix - Add the ClickHouse requests-by-country query needed by API Gateway. - Select API Gateway SQL and endpoint atomically from otelReports. - Route the Data API PostgREST report through the existing tested OTEL API query builders and logs.all.otel. - Wait for ConfigCat before the Data API sends a request, avoiding an initial legacy request while the flag loads. - Keep logs.all behavior when the flag is disabled and leave other shared reports unchanged. ## How to test 1. Enable otelReports and open API Gateway, then confirm its report requests use logs.all.otel. 2. Open Data API and confirm all report requests use logs.all.otel with a request.path filter for /rest. 3. Change the date range, add a filter, and refresh each report. 4. Disable otelReports and confirm both reports use logs.all. All OTEL query shapes were tested individually against logs.all.otel. The focused query suite and lint pass locally. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - API reports can use OpenTelemetry data when enabled. - Added country-level request reporting, excluding requests without country information. - Added OpenTelemetry-backed PostgREST reports and Storage cache hit/miss metrics. - **Improvements** - Reports wait for required configuration before loading data. - Refreshing reports consistently refetches active metrics. - Improved error handling for analytics query failures. - Improved report accuracy with numeric time buckets and more precise attribute filtering. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi Enric
|
7d3e8fa5a3 |
feat(studio): migrate Storage report to OTEL (#50519)
## Problem
The Storage observability report still sends legacy BigQuery SQL to the
`logs.all` analytics endpoint, so it cannot use the ClickHouse-backed
OTEL logs path.
## Fix
Add ClickHouse query variants for the API and cache metrics used by the
Storage report, and switch SQL plus endpoint together behind
`otelReports`. Keep legacy behavior when the flag is disabled and
prevent requests until feature flags have resolved on platform.
Tested by checking the preview AND running all queries in log explorer
one by one ✅
## How to test
- Run `CI=1 pnpm --filter studio exec vitest run
components/interfaces/Reports/Reports.constants.otel.test.ts
data/reports/storage-report-query.test.tsx`
- Enable `otelReports`, open Project > Observability > Storage, and
verify all charts load.
- Expected result: Storage analytics requests use `logs.all.otel` with
ClickHouse SQL; no legacy request is sent during flag hydration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Reports now support OpenTelemetry-based querying for API and storage
metrics.
* Report filters provide safer numeric comparisons and improved route,
status, timing, traffic, and cache metrics.
* **Bug Fixes**
* Reports now wait for reporting configuration and the project reference
to be ready before querying.
* Invalid numeric filters are safely ignored, and cache-status
calculations are more reliable.
* **Tests**
* Added coverage for OpenTelemetry report queries, filtering,
aggregations, caching, and project readiness.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Ivan Vasilov
|
8422045b86 |
chore: Use @supabase/config for the code configuration page (#50398)
How to test: 1. Connect a project to GH repo 2. Deploy the `config.toml` once 3. Change some setting in Auth 4. You should see a change in `/dashboard/project/_/settings/code-configuration` <img width="1271" height="1186" alt="Screenshot 2026-09-16 at 16 26 39" src="https://github.com/user-attachments/assets/dfc135a4-e495-489e-88fd-b760383793b4" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Configuration drift comparisons now use a consistent project configuration schema. - Drift details display complete current-environment and `config.toml` values, grouped by section. - Matching and unmanaged settings are organized into dedicated sections. - Configuration fields link directly to relevant Studio settings. - Added a warning that GitHub deployments overwrite local changes. - **Bug Fixes** - Configuration updates now refresh project configuration data automatically. - Improved labels and formatting for boolean and redirect URL values. - Drift errors identify invalid configuration paths and provide corrective guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas GarciaandAli Waseem
|
d276f75c89 |
Recovery codes: allow users to use recovery codes to access their account (#50569)
## What kind of change does this PR introduce? Allow users to sign in using a recovery code after being redirected to the MFA verification page. ## Additional context <img width="435" height="373" alt="image" src="https://github.com/user-attachments/assets/968fd15e-3081-4aa2-b645-4e0d2ec2637c" /> <img width="494" height="404" alt="image" src="https://github.com/user-attachments/assets/fd7cee49-dca7-4f1a-873a-293e21c68faa" /> ## How to test - Enable MFA on your account if needed - Generate recovery codes if needed (make sure you actually saved the recovery codes somewhere) - Sign out - Sign in and when redirected to the MFA verification page, click the _Authenticate using a recovery code_ link - Enter one recovery code Check that: - you're signed in - when on [your account security page](https://studio-staging-git-gildasgarcia-auth-1624-dashb-177251-supabase.vercel.app/dashboard/account/security), you have one less code available Then: - Disable the `enableAuthRecoveryCodes` config cat flag - Sign out - Sign in and wait on the MFA verification page Check that: - the _Authenticate using a recovery code_ link is not displayed - Accessing [the recovery code sign in page](https://studio-staging-git-gildasgarcia-auth-1624-dashb-177251-supabase.vercel.app/dashboard/sign-in-recovery-code) redirects you to the MFA page <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added recovery-code authentication as an alternative MFA sign-in method. * Added a dedicated recovery-code sign-in page with validation, visibility controls, cancellation, and sign-out options. * Added a link from the MFA sign-in screen when recovery codes are available. * Added loading and error states while checking recovery-code availability. * **Bug Fixes** * Prevented valid recovery-code sign-ins from being redirected back to the MFA prompt. * Limited recovery-code settings to accounts with exactly one enrolled authenticator. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
|
edec85d1ca |
fix(pipelines): Make pipeline actions and status updates reliable (#50085)
## Summary Make pipeline actions and status feedback reliable while requests are running or fail. Let the backend coordinate table resets and restarts, keep stopped pipelines stopped after resets or settings changes, and refresh the UI from confirmed backend state. ## Pipeline actions and recovery - Reset one table, all errored tables, or all tables through the rollback endpoint without separate frontend stop/start requests. Explain which destination data is deleted, which rows are copied again, initial sync charges, and the skip-initial-sync setting. - Keep pending feedback until the action and a fresh status read finish, including across navigation and polling errors. Prevent overlapping actions and disable start/stop controls when status is unavailable or transitioning. - Close the creation form once the pipeline is created. If its initial start fails, users can retry Start on the existing pipeline without creating a duplicate. - Wait for confirmed shutdown before deletion; a shutdown error or timeout leaves deletion retryable. Keep failed version updates open and avoid reporting success. - Clarify recovery guidance and pending labels, suppress duplicate error toasts, and hide stale table errors during transitions. ## Status updates and shared UI - Poll pipeline status and table metrics one second after each response, share in-flight reads, pause dashboard polling in background tabs, and respect rate-limit backoff. The shutdown waiter continues in the background. - Refresh metadata after mutations even when an older read is in flight, while preserving shared polling requests. Refresh affected data after failures that may follow a committed reset or settings change. - Move pending request state into the shared, project-keyed `DatabaseLayout` so the list, detail page, and diagram stay consistent. The surrounding database-page changes update named imports in both Next.js and TanStack routes. - Simplify action, status, and form rendering; announce status changes to assistive technology; and sort table statuses without mutating cached data. --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> |
||
|
Pamela Chia
|
64ab76262e | feat(studio): exhaustion banner links to metrics (#50276) | ||
|
Jordi Enric
|
6434c48999 |
feat(studio): migrate Auth reports to OTEL (#50469)
## Problem Auth observability charts always queried the legacy logs.all endpoint, even when the OTEL reports rollout was enabled. The existing OTEL SQL also had ClickHouse correctness and parity gaps around timestamp aliasing, JSON types, provider paths, missing values, and error-code attributes. ## Fix Route the ten Auth-specific charts through the OTEL query builders and logs.all.otel endpoint when otelReports is enabled. Preserve the BigQuery fallback, partition React Query caches by backend, and leave the shared API gateway charts on the legacy endpoint. Correct the OTEL queries by qualifying source timestamps, using typed and nullable JSON extraction, preserving missing actor and duration semantics, selecting the right provider path for each event shape, preferring the canonical Auth error-code attribute with a legacy fallback, and applying bounded result limits. Two-minute report intervals now use minute-level SQL buckets instead of falling through to hourly buckets. ## How to test - Run `CI=1 pnpm --filter studio exec vitest run data/reports/v2/auth.config.otel.test.ts hooks/misc/__tests__/useReportDateRange.test.ts` - Run `pnpm --filter studio run lint:ratchet` - Run `pnpm --filter studio run typecheck` - Expected result: all checks pass and generated OTEL SQL preserves legacy report semantics. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Auth observability charts can now use OpenTelemetry data when enabled, while retaining the existing reporting source otherwise. - Switching the data source automatically refreshes the relevant charts. - **Bug Fixes** - Improved Auth observability accuracy for provider, duration, actor, and error-code reporting. - Added safeguards to keep report queries within the supported result limit. - Corrected minute-level grouping for two-minute analytics intervals and three-hour date ranges. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lukas BernertandClaude Fable 5
|
77ee1ec127 |
chore(studio): describe compute CPU by size tier (#50401)
## What kind of change does this PR introduce? Copy/label update in Studio's compute surfaces. ## Description Compute CPU descriptions now branch on the compute size tier: - Sizes below Large read **"Shared compute"** (no core count) - Large and up read **"Dedicated · N vCPUs"** — the unit is always vCPU Changes: - New `lib/compute-labels.ts` helper (`isSharedComputeSize`, `getComputeCpuLabel`) with unit tests - Compute badge hover card, compute size picker, and project-creation selector use the new labels - `new-project.constants.ts` cpu strings updated accordingly - ">16XL" card: "Custom CPU" → "Custom compute"; upsell copy now says "64 vCPUs" - The synthetic Nano/Micro addon `meta` no longer has `cpu_cores`/`cpu_dedicated`; removed the now-unused cpu fields from the hardcoded instance specs - Project-creation sub-text: "Larger, dedicated compute available after creation" ## Tests - New unit tests for the label helper - Infrastructure settings page test now asserts the rendered labels Fixes PROD-663 Related #49998 #49996 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **User Interface** * Updated compute-size labels to use “Shared compute” and vCPU terminology. * Clarified dedicated compute options and availability messaging. * Updated custom instance and upgrade labels, including “Custom compute” and “64 vCPUs.” * **Consistency** * Standardized compute labels across project creation, infrastructure settings, and compute details. * **Tests** * Added coverage verifying shared and dedicated compute classifications and displayed labels. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Danny White
|
3e2d54eccb |
feat(studio): add Warehouse table management and disable (#50195)
## What kind of change does this PR introduce? Feature and UI polish. ## What is the current behavior? Warehouse setup uses a schema accordion for table selection. Once Warehouse is enabled, users cannot remove replicated tables or disable Warehouse from Studio. ## What is the new behavior? - Replaces the schema accordion with one grouped, searchable table selector. - Still allows for **Select all** and **Clear** actions for each schema. - Starts first-time setup with no tables selected and preselects current replicated tables when editing. - Adds support for removing previously replicated tables. - Adds a confirmed **Disable Warehouse** action. - Tracks successful Warehouse enable and disable actions. Disabling Warehouse removes its replication pipeline, publication, catalogue access, and foreign tables. Copied data remains in DuckLake storage until the user deletes it. Re-enabling a table rebuilds its data rather than reusing the retained copy. | Before | After | | --- | --- | | <img width="1024" height="759" alt="Integrations Test US East 1 testdw Supabase" src="https://github.com/user-attachments/assets/bded025b-1d45-41dc-8a35-9159baf8f9b7" /> | <img width="1024" height="759" alt="Integrations test Teamer Supabase" src="https://github.com/user-attachments/assets/69026d94-98a0-4878-ab58-2e9697296d93" /> | | <img width="1280" height="1323" alt="Integrations Test testdw Supabase" src="https://github.com/user-attachments/assets/3f71e754-1a87-4d58-a7b9-dd39d3e0ac5a" /> | <img width="1280" height="1323" alt="Integrations Regular AWS Teamer Supabase" src="https://github.com/user-attachments/assets/758ed48e-9ed6-45d3-ae94-e171147a21d5" /> | | _Feature did not exist_ | <img width="1024" height="759" alt="Integrations Regular AWS Teamer Supabase" src="https://github.com/user-attachments/assets/c977ac57-8b0c-4482-882b-69ad7602b5df" /> | ## Additional context Platform support for updating and disabling Warehouse was added in [supabase/platform#38190](https://github.com/supabase/platform/pull/38190). ### To test 1. Open `/project/{ref}/integrations/warehouse/overview` before setup. 2. Confirm **Tables to replicate** starts at zero and **Enable Warehouse** is disabled until a table is selected. 3. Confirm each schema's **Select all** and **Clear** actions update every table in that schema. 4. Enable Warehouse with a partial selection and wait for setup to complete. 5. Edit the selection, add and remove replicated tables, then confirm the saved selection is reflected in the publication. 6. Disable Warehouse, confirm the retention warning, and verify the integration returns to its initial state. 7. Re-enable Warehouse and confirm selected tables are rebuilt. 8. Trigger a replication pipeline limit error and confirm the inline guidance links to Database Replication. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added the ability to disable Warehouse from the setup panel. - Warehouse setup now starts with no table selections. - Editing a setup preselects replicated tables and supports updating selections, including removing tables. - Added searchable schema and table selection with screen-reader count announcements. - Added telemetry tracking for initial Warehouse enablement. - **Bug Fixes** - Warehouse disable failures now show an error while keeping the confirmation dialog open for retry. - Configuration updates now refresh related data automatically. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
supabase-supabase-autofixer[bot]andivasilov
|
127e21b926 |
Changes by create-pull-request action (#44860)
Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: ivasilov <568291+ivasilov@users.noreply.github.com> |
||
|
|
7fce0a12d9 |
feat(design-system): first pass at db report chart colours (#46787)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? This is a first draft at introducing semantic colours to our Observability charts. This moves away from just random colours being assigned to prop after prop. They're only scoped to the Database reports right now, but if it flows nice, we can open it up to the other reports too. This also aims to tone down some of the harsher colours in our charts, such as the orange which sometimes can look like a warning metric/prop. | Before | After | |--------|--------| | <img width="839" height="336" alt="Screenshot 2026-06-10 at 09 14 56" src="https://github.com/user-attachments/assets/222747c5-973b-4165-aa53-df7b93412ad3" /> | <img width="950" height="341" alt="Screenshot 2026-09-14 at 18 14 47" src="https://github.com/user-attachments/assets/836f3ddd-4a97-4064-b8cf-3a3b435417ac" /> | cc @supabase/design for additional thoughts. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added semantic chart color roles with light and dark theme variants for consistent visualizations. * Standardized colors and fills across database, networking, storage, and connection charts. * Maximum-value lines now use configured chart colors when available. * Added chart palette reference and stress-test examples. * Added stacked bar charts, customizable margins, and gradient-filled line charts. * Improved multi-series bar chart focus and date-range footer alignment. * **Documentation** * Documented the chart palette, theme variants, accessibility guidance, and usage recommendations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Francesco SansalvadoreandClaude
|
92fdb1d3c5 |
feat: update storage move UI (#50346)
Update path selection as destination where to move files in the Storage File Explorer. ## What is the current behavior? Currently you need to write out the entire path by hand, which is error prone and quirky. <img width="727" height="436" alt="Screenshot 2026-09-14 at 15 49 11" src="https://github.com/user-attachments/assets/2bb8fc78-d973-4b17-9343-08df23b67d2a" /> ## What is the new behavior? This PR adds a ui that lets the user select any folder as the destination of the file move. <img width="923" height="606" alt="Screenshot 2026-09-15 at 11 40 00" src="https://github.com/user-attachments/assets/2f4c50f8-3c11-4896-832e-b1e99defc9af" /> https://github.com/user-attachments/assets/261ac24e-ec24-4bcf-ad47-72bc48e27bab To test: - go to Storage File explorer and pick a file to "move" (action in the dropdown menu) - mov file to any other folder in the same bucket selecting destination folder from the ui in the dialog - both empty folder or also a folder with sub-folders can be destinations, as any selected folder becomes the active destination (notice the cta changing when selecting a folder) - batch move multiple items via multi-select (already supported, but using the updated ui now) - only folders should appear in this ui - destination folders can be searched using the search input <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Replaced the move-items path field with an interactive folder browser. - Browse, select, and search folders by name or path, with pagination and loading or empty states. - Navigate using breadcrumbs, including collapsed-path menus for deeply nested folders. - Receive warnings when folder search results are incomplete for very large buckets. - See clearer destination labels and protection against moving items to their current location. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Joshen Lim
|
b1a9e072ec |
Update table editor ilike related comparators to implicitly wrap filter string with % if not provided (#50394)
### Context For table editor - the `ilike` related comparators expect users to input a `%` in the filter string, which for non-developers might not be intuitive. Hence opting to implicitly wrap the filter string with `%` in the query when filtering if non provided <img width="1182" height="755" alt="image" src="https://github.com/user-attachments/assets/819c39f5-fcbf-4213-95b3-3ad1ee901f47" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved pattern-match filters so bare text values perform contains matching by automatically wrapping them with wildcards. * Preserved explicit wildcard patterns using `%` or `_` without adding additional wildcards. * Improved handling of empty values for non-text filters while retaining existing numeric filter validation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
24f89f3967 |
MFA Recovery codes: allow users to regenerate their codes (#50336)
## What kind of change does this PR introduce? Once users have recovery codes generated, allow them to regenerate the codes. This PR also automatically check the _I have copied the codes_ after clicking the _Copy to clipboard button_. > [!NOTE] > The _Delete my recovery codes_ button only appear on local and staging environments ## How to test - On an account that already have recovery codes generated - You should see an admonition showing the remaining codes available and allowing you to regenerate the codes ## Screenshots <img width="706" height="193" alt="image" src="https://github.com/user-attachments/assets/001bfa87-74f5-4867-8564-09cb6f91adb6" /> <img width="425" height="277" alt="image" src="https://github.com/user-attachments/assets/711b139c-f806-4da2-a240-fa7e7fd8acd0" /> <img width="548" height="353" alt="image" src="https://github.com/user-attachments/assets/d6521a09-3a7f-4198-b162-9effc218fee6" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a recovery-code modal with copy-to-clipboard support and confirmation before closing. - Added an option to regenerate MFA recovery codes with a confirmation step. - Recovery-code controls now appear when existing codes are available. - Added loading, success, error, and retry states for recovery-code generation and regeneration. - **Bug Fixes** - Updated the recovery-code generation error message to more accurately describe the failed action. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alaister YoungandAlaister Young
|
3bac7165bd |
chore(studio): move the TanStack Start deploy onto Nitro (#50030)
Moves the Studio TanStack Start build off the hand-rolled Vercel setup (an `api/server.js` function shim, rewrites in `vercel.ts`, a custom `?dpl=` skew-protection Vite plugin, and `scripts/serve.js` for self-hosted) and onto Nitro, which TanStack Start documents as its deployment path. Documents are served from the static SPA shell on the CDN; only `/api/*` and `/_serverFn/*` invoke the function. **Removed:** - `api/server.js`, `scripts/serve.js`, `scripts/smoke-server.mjs` - The `skewProtectionDpl` Vite plugin, `renderBuiltUrl`, and the `vite:preloadError` reload backstop in `router.tsx` (TanStack Router already reloads once on a failed lazy import) - Rewrites, `functions`, `outputDirectory`, and `cleanUrls` from `vercel.ts` (redirects and headers stay) - `magic-string` and `@jridgewell/remapping` devDependencies, the `preview` script **Added:** - `nitro` plugin in `vite.config.ts`. Preset is auto-detected: `.vercel/output` on Vercel, a self-contained node server in `.output` everywhere else. `vercel.immutableStaticFiles` puts hashed chunks under `/_vercel/immutable/` so tabs opened before a redeploy keep loading their chunks; `functions.maxDuration: 300` carries over the old function timeout - `scripts/vercel-spa-routes.ts`: Nitro module that rewrites the generated Build Output routes (documents -> `_shell.html`, allow-list -> `__server`, missing chunk -> 404, base-path prefixes), with a unit test - `server.ts`: TanStack Start server entry that initializes Sentry before the route tree loads and wraps the handler with `wrapFetchWithSentry` **Changed:** - `start:tanstack` runs `.output/server/index.mjs` directly with Node's `--env-file-if-exists` for the `.env` cascade. Node doesn't expand `$VAR` references, so `scripts/generateLocalEnv.js` now writes literal values into `.env.test` - Dockerfile's TanStack stage copies `.output` instead of running `pnpm deploy`; the `server.js` shim loads `.env` and imports the Nitro server - `NEXT_PUBLIC_BASE_PATH` (the platform's `/dashboard`) only sets the router basepath; Vite's `base` stays at the root so chunks can use the immutable store. The routes module emits prefixed rules for `/dashboard/api/*` and `/dashboard/_serverFn/*` and rewrites `public/` files requested under the prefix back to the root - Self-hosted security headers come from a Nitro `routeRules` entry; on Vercel they stay in `vercel.ts` - `tslib` is inlined for the build only: Nitro's dev runner has no interop for its CJS wrapper - Monaco's worker chunks follow the client assets dir so they land in the immutable store too Verified on the `studio-staging` preview (`STUDIO_FRAMEWORK=tanstack` is scoped to this branch there): documents come back as the static shell, `/dashboard/api/*` hits the function, `public/` files resolve under the prefix, a missing immutable chunk 404s. Across two deployments of this branch, the older deployment's chunks still load from the immutable store and requests carrying its `__vdpl` cookie are answered by that deployment. Self-hosted path covered by the TanStack E2E job and the Docker build job. ## To test - On the `studio-staging` preview: `/dashboard/project/<ref>` should show `content-disposition: inline; filename="_shell.html"` and a single-region `x-vercel-id`; `/dashboard/api/get-utc-time` a two-region id - Sign in and click through a few pages, including one that opens Monaco (SQL editor) so the worker chunks load - After the next deploy, a tab left open on the previous one should still navigate (lazy chunks) and call the API without errors - Self-hosted: `STUDIO_FRAMEWORK=tanstack pnpm --filter studio build && pnpm --filter studio start`, then check `/api/platform/profile` and that responses carry the security headers <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Production TanStack deployments now run on Nitro’s self-contained server output. * Vercel routing serves static pages first while directing API and server-function requests appropriately. * Server-function requests can include deployment identification for consistent handling. * Local environment generation now writes resolved configuration values. * **Bug Fixes** * Improved handling of missing static assets and SPA fallback routing. * Server-side error monitoring now captures request errors in the new runtime. * **Refactor** * Replaced the legacy production server and smoke-test workflow with Nitro-based startup. * Removed automatic reload handling for stale client assets. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Jordi Enric
|
fa7c223209 |
fix(studio): use Compute management endpoints FUNC-896 (#50393)
## Problem Studio still called the legacy `/workers` Management API routes and used the old `project_worker` response contract, so Compute instances could not be listed or retrieved after the API rename. The production API type check also detected drift in the v1 and platform declarations. ## Fix - Regenerate the v1, v2, and platform API declarations from the deployed schemas. - Update Studio list and detail queries to `/compute`. - Align typed fixtures with the Compute response schemas and `project_compute_instance` resource type. - Update platform response type references to the generated `_Output` schema names. ## How to test - Run `pnpm api:verify-types`. - Run `pnpm --filter api-types test`. - Run `pnpm --filter studio test data/compute/compute.utils.test.ts "tests/pages/project/[ref]/compute/index.test.tsx"`. - Run `pnpm --filter studio typecheck`. - Run `pnpm --filter common typecheck`. - Run `pnpm --filter studio lint:ratchet`. Expected result: production API declarations are synchronized, and Studio requests the `/compute` list and detail endpoints and renders `project_compute_instance` responses successfully. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Updated API response handling across profiles, backups, notifications, integrations, warehouses, access tokens, payments, and other Studio workflows for more accurate serialized data. * Compute instance pages and queries now use the compute-specific API endpoints and response data. * Improved feature-flag type handling when disabled feature data is unavailable. * **Tests** * Updated automated coverage and fixtures to reflect current compute and API response formats. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
63bedef77f |
MFA Recovery codes: allow users to download their recovery codes (#50267)
## What kind of change does this PR introduce? After users have set up a new MFA (first or not), we must: - check whether recovery codes have already been generated - if there are none, generate recovery codes and display them, "forcing" users to copy them - if already generated, show them how many are still available > [!NOTE] > The _Delete my recovery codes_ button in last screenshot only appear on local and staging environments ## How to test - On an account that doesn't have recovery codes generated yet and has an MFA added - You should see an admonition suggesting to generate the codes ## Screenshots <img width="729" height="306" alt="image" src="https://github.com/user-attachments/assets/79ba3870-4ef8-4571-9fd6-36eed20c9c24" /> <img width="550" height="356" alt="image" src="https://github.com/user-attachments/assets/1632611a-996a-470d-b6cd-a4693b0f4602" /> <img width="719" height="205" alt="image" src="https://github.com/user-attachments/assets/73cef611-05cf-4fac-bbd2-243f9b28e48d" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added support for generating, copying, and confirming MFA recovery codes. - Added recovery-code status visibility, including remaining and exhausted codes. - Added the ability to delete recovery codes with confirmation. - Added clear loading, success, and error states for recovery-code actions. - Recovery-code status refreshes after codes are generated or deleted. - **Bug Fixes** - Recovery-code notices now remain visible when all codes have been used. - Recovery-code dialogs can now be closed after generation errors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny WhiteandJoshen Lim
|
1755580dcf |
feat(studio): move Warehouse setup into Integrations (#50247)
## What kind of change does this PR introduce? Feature and information architecture change. Builds on #50246. ## What is the current behaviour? Warehouse setup, progress, errors, table selection, and connection details all live in the transient Connect sheet. Closing the sheet hides the current replication state, and the integration is absent from the Integrations page. ## What is the new behaviour? Warehouse now has a persistent Overview page at `/project/{ref}/integrations/warehouse/overview`: - Before setup, the existing schema and table picker enables Warehouse. - During setup, the page shows the current phase and per-table backfill state where available. - Setup and status failures remain visible on the page with retry actions where possible. - Once complete, the page shows Status, Tables, then Connect. - The Connect sheet becomes read-only. Before Warehouse is ready, it links directly to the Overview page for setup, progress, or recovery. | Before | After | | --- | --- | | <img width="1200" height="907" alt="Chives Pantry Supabase" src="https://github.com/user-attachments/assets/82dc7fb0-3859-499e-96ab-56f70a5c7325" /> | <img width="1200" height="907" alt="Chives Pantry Supabase" src="https://github.com/user-attachments/assets/7428e301-27f8-48fe-91e0-6880b132920d" /> | | <img width="1200" height="907" alt="Chives Pantry Supabase" src="https://github.com/user-attachments/assets/82dc7fb0-3859-499e-96ab-56f70a5c7325" /> | <img width="1200" height="907" alt="54709" src="https://github.com/user-attachments/assets/0c589e5b-e13c-4554-a6ee-6730d0e95c07" /> | | <img width="1200" height="907" alt="ETL BigTable ETL Team Supabase" src="https://github.com/user-attachments/assets/18ec9f6c-3724-453f-bbbb-c7149758246e" /> | <img width="1200" height="907" alt="Regular AWS Teamer Supabase" src="https://github.com/user-attachments/assets/3819c9fe-e56d-4cec-988d-5e724f8d990a" /> | ## To test Use a project whose organisation is included in the Warehouse allow-list. 1. Open `/project/{ref}/integrations`, filter by **Data platform**, and open Warehouse. 2. Before setup, confirm the existing schema and table picker appears and starts with no tables selected. 3. Start setup and confirm the Status section polls through setup and table backfill phases. 4. Confirm setup failures remain visible and expose Retry when the API returns affected tables. 5. After setup, confirm the section order is Status, Tables, Connect. 6. Confirm existing replicated tables are selected and locked, while additional tables can be added. 7. Open `/project/{ref}?showConnect=true&connectTab=warehouse` and confirm it links to the Overview page before setup, during setup, and after a setup failure. 8. Once setup is complete, confirm the Connect sheet shows the FlightSQL and DuckDB connection controls from #50246. 9. Repeat the Overview checks with **One-Click Integrations** turned off. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Supabase Warehouse to the integrations catalog, with overview documentation and availability-aware display. * Added Warehouse setup and management flows, including schema and table selection, replication progress, status details, connection options, and retry actions. * Added DuckDB and FlightSQL engine selection with Connect sheet URL and preference synchronization. * Added table replication status, lag, timestamps, and size information. * **Bug Fixes** * Warehouse setup status requests no longer retry automatically after failures. * Improved recovery messaging and retry behavior for setup and connection errors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Danny White
|
2e435986c9 |
feat(studio): polish the Replication pipelines list (#50252)
## What kind of change does this PR introduce? Studio UI and interaction polish. This is the second PR in the Pipelines review stack and depends on #50251. ## What is the current behaviour? Pipeline rows require a separate view action, cannot be sorted, and present lifecycle, lag, and destination terminology inconsistently. ## What is the new behaviour? Makes rows navigable with link-like mouse and keyboard behaviour, adds Name and Status sorting, reuses cached status queries, and moves row actions into the overflow menu. It also clarifies pipeline terminology, adds Docs and feedback actions, and standardises state, error, lag, and loading presentation with accessible announcements. | Before | After | | --- | --- | | <img width="1280" height="1323" alt="Replication Database ETL BigTable ETL Team Supabase" src="https://github.com/user-attachments/assets/53a62283-0e58-4408-8409-2b87a38af159" /> | <img width="1280" height="1323" alt="Replication Database Agua Basket Supabase" src="https://github.com/user-attachments/assets/ba4de1e0-4a84-43b4-8975-ca05a3056bcf" /> | ## To test 1. Open `/project/<ref>/database/replication`. 2. Sort by Name and Status, then confirm failed and stopped pipelines surface first when Status is ascending. 3. Click a row, use Enter or Space, and modifier-click or middle-click to verify link behaviour. 4. Open the row overflow menu and confirm it does not navigate. 5. Check loading, initial sync, caught up, numeric lag, unavailable lag, and table-error states where available. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added sortable pipeline lists with clearer loading, empty, and error states. - Pipeline rows now support direct navigation, detail viewing, status indicators, lag progress, and table error summaries. - Added initial-sync progress indicators and accessible status announcements. - Added documentation and feedback links. - Improved pipeline version update and enable/disable dialogs. - **Bug Fixes** - Prevented right-clicks from triggering navigation. - Improved unavailable lag and initial-sync handling. - **Style** - Standardized replication terminology and confirmation messaging around pipelines. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
62fe0fca4a |
fix(studio): guard branches and read-replicas queries against non-array 200 bodies (#50347)
## Summary - `getBranches()` (`apps/studio/data/branches/branches-query.ts`) and `getReadReplicas()` (`apps/studio/data/read-replicas/replicas-query.ts`) cast the raw API response body to an array with no runtime check. - When the endpoint returns a defined-but-non-array 200 body, the `?? []` fallback in each consumer doesn't catch it (the value isn't nullish), and the first `.find`/`.filter` call throws, crashing the whole page via `globalErrorBoundary`. - This is the same known class of bug already fixed elsewhere in the codebase (e.g. `apps/studio/data/lint/lint-query.ts`, and the `api-keys`/`oauthApps`/`secrets` fetchers) — applies the same `Array.isArray(data) ? data : EMPTY_ARR` guard. ## Evidence (Sentry, past week) - [SUPABASE-APP-KA2](https://supabase.sentry.io/issues/7722780387/) — `(m??[]).find is not a function` in `ActivityStats.tsx` (`branchesData.find`), full-page crash on `/dashboard/project/[ref]`. - [SUPABASE-APP-KAE](https://supabase.sentry.io/issues/7729679561/) — `u.filter is not a function` in `AWSPrivateLinkForm.tsx` (`databases.filter`), full-page crash on `/project/[ref]/settings/integrations`. ## Test plan - [ ] Existing query hook tests still pass - [ ] Manually verified `Array.isArray` guard mirrors the established `lint-query.ts` pattern 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01RUrmUfMBpPqkgerh9onNTM --- _Generated by [Claude Code](https://claude.ai/code/session_01RUrmUfMBpPqkgerh9onNTM)_ --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Jordi Enric
|
38e8f12b1b |
fix(studio): gate homepage health advisor (#50328)
## Problem Health Advisor results appear on the project homepage whenever the main `healthAdvisor` flag is enabled, so the homepage cannot be rolled out separately. The existing gates also contain redundant boolean and platform checks. ## Fix Require both `healthAdvisor` and `healthAdvisorInHomepage` before fetching or displaying health advisories on the homepage. Simplify all Health Advisor gates to use the boolean ConfigCat flag directly, including the cleanup requested in the review of #50326. ## How to test - Enable only `healthAdvisor` and verify Health Advisor remains available outside the homepage while health results do not appear or load on the homepage. - Enable both flags and verify health results appear on the homepage. - Disable `healthAdvisor` and verify Health Advisor remains unavailable everywhere. - Existing targeted tests pass: 5 tests across Advisor menu and panel integration suites. - Prettier and whitespace checks pass. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Health Advisor is now available in non-platform environments when enabled. * Navigation, filtering, lint checks, and project pages consistently follow the Health Advisor feature setting. * Self-hosted environments can use the Health Advisor category. * **Bug Fixes** * Homepage Health Advisor visibility now follows both the Health Advisor and homepage-specific settings. * Updated empty states and health lint results to match the configured availability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi Enric
|
519a3a5644 |
fix(studio): gate health advisor behind feature flag (#50326)
## Problem Health Advisor runs checks and displays health alerts without a dedicated rollout flag. ## Fix Gate Health Advisor behind the ConfigCat `healthAdvisor` flag, defaulting to off when missing or loading. This covers the navigation and shortcut, command menu, direct page access, homepage alerts, Advisor panel filters and details, and health-check requests. Cached health results and saved Health filters no longer surface health content when disabled. Existing platform-only restrictions remain. The `healthAdvisor` flag will be created separately in ConfigCat. ## How to test - With `healthAdvisor` off, verify Health Advisor is absent from navigation, command search, homepage alerts, and Advisor panel categories. Opening `/project/<ref>/advisors/health` shows an unavailable message. No health-check POST requests should run. - With the flag on for an active platform project, verify these surfaces return and health checks load. - Disable the flag after loading health results and selecting the Health filter or an alert. Verify cached health alerts disappear and the panel remains usable. - Existing menu tests pass. No new feature flag tests are included. Formatting and whitespace checks passed. - Local lint could not start because the available dependency installation is missing `@eslint/compat`. Full TypeScript validation failed with missing dependencies and incompatible workspace types in the reused local dependency installation; it did not provide a clean validation result. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Health Advisor availability is now controlled by a feature flag on the platform. * When enabled, health advisories appear in advisor menus, filters, project checks, and empty-state messaging. * When unavailable, the Health Advisor page clearly indicates that it isn’t available for the project. * **Bug Fixes** * Health advisory data is no longer requested when the feature is disabled, preventing unavailable health results and errors from appearing. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
2bd67ef91b |
Chore/team members rendering optimizations (#50255)
## Context Follow up to https://github.com/supabase/supabase/pull/50238 which addressed some rendering issues for organization team settings. The changes in 50238 improved the performance of searching members, but there's still a bit of client side latency. There shouldn't be any functional changes from the changes here, just refactoring - `MemberRow` wrapped in `memo` so unaffected rows skip re-rendering - Memoized a number of variables in `MembersView` so they only recompute when filtered members/user/role actually change, not on every render - In `MemberRow`, replaced per-role `.find()` chains with Map-based lookups and memoized the whole per-role derivation - Fixed a mutating in-place `.sort()` in `organization-roles-query.ts`'s select that was silently rewriting the shared RQ cache entry - Added `TeamSettingsDataContext` + reduce prop drilling for `MemberRow` + `MemberActions` - Removed an any cast on member.metadata?.origin in MemberRow, replaced with explicit Boolean(...) coercion Organization team settings page should work as per status quo including searching. The searching was the main issue so these are hoping to alleviate the performance issues. It's quite hard to test unless you've got an organization with a 150 + members though (< 100 you don't really see any issues). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Improvements** - Improved the Team Settings member list for more consistent role and project information. - Member role links now provide more direct navigation to associated projects. - Improved performance when displaying and sorting team members. - Added an accessible label to the member actions menu. - **Bug Fixes** - Prevented organization role data from being unexpectedly changed while it is sorted. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas GarciaandAlaister Young
|
737b8595f2 |
Update API types (#50234)
## Problem platform, v1 and v2 have been already completely migrated and introduced some changes. Some types have been renamed, some outputs and inputs updated. ## Solution - Update the API types - Fix the TS errors ## Update Taking this over to unblock #50134, which needs the new scoped token permission ids from the regenerated types. - Merged `master`. - Regenerated `api-v2.d.ts` from the production spec. The previous files came from a local API that exposed a webhook events endpoint production doesn't have yet. Production has since added standardized 400 error responses on the v2 organization endpoints. `api-v1.d.ts` and `platform.d.ts` already matched production. - Fixed `verify-production-types`. It formatted the regenerated files in a temp directory outside the repository, so Prettier fell back to its defaults and the comparison could never match the committed files. It now passes the repository config explicitly. `pnpm api:verify-types` passes on this branch. - Verified locally: `pnpm typecheck`, `pnpm api:verify-types`, Studio unit tests. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Preserved descriptions when saving, sharing, moving, or unsharing notebooks, reports, SQL snippets, and saved queries. * Improved handling of empty or null values across notebook descriptions, billing usage, pooler settings, and infrastructure fields. * Improved read-replica connection handling, including read-only connection strings. * Updated storage configuration and capability handling to match current settings. * **API and Compatibility** * Updated organization, project, storage, OAuth, billing, and infrastructure data handling to match current API responses. * OAuth app creation and updates now require scopes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Francesco Sansalvadore
|
d513d013c5 |
chore(studio): poll state to keep ui in sync (#50216)
Poll compute data to keep ui in sync - every 3s when state is transitioning - every 10s when idle ## To test - open compute - deploy compute instance via cli - check ui updates automatically while state changes (new -> active -> deleting -> removal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Compute data now refreshes automatically, with faster updates while instances are building or being deleted. * Added clearer manual refresh feedback in the compute interface. * **Improvements** * Improved compute table layout with fixed column sizing and truncated long instance names. * Region and resource columns remain responsive while maintaining consistent widths. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Francesco Sansalvadore
|
0bf22ee6fc |
chore(studio): update product naming (#50208)
workers -> compute <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added the Compute experience for deploying, viewing, managing, and monitoring compute instances. - Added Compute navigation, instance detail pages, secrets, logs, deployment dialogs, generated snippets, and CLI commands. - Added filtering, status, availability, and data-loading support for compute instances. - **Updates** - Updated labels, icons, links, feature controls, unified logs, and secret-deletion messaging to use Compute terminology. - Compute routes now replace the previous Workers routes and pages. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
0bebe50a76 |
fix(studio): serialize SQL folder deletion IDs (#50223)
## Summary * serialize SQL folder IDs as the comma-delimited API query value * add regression coverage for the folder deletion request ## Testing * `pnpm --filter studio exec vitest run data/content/sql-folders-delete-mutation.test.ts` * `pnpm exec prettier --check apps/studio/data/content/sql-folders-delete-mutation.ts apps/studio/data/content/sql-folders-delete-mutation.test.ts` * `pnpm --filter studio exec eslint data/content/sql-folders-delete-mutation.ts data/content/sql-folders-delete-mutation.test.ts` * `pnpm --filter studio exec tsc --noEmit --pretty false` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed SQL snippet folder deletion requests so multiple selected folders are processed correctly. * Improved request handling by formatting folder identifiers consistently when submitting bulk deletions. * **Tests** * Added coverage to verify that deleting multiple SQL snippet folders sends the expected folder identifiers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
1966209483 |
chore(deps): upgrade vitest to v5 (#49994)
Upgrades Vitest from 4.1.4 to 5.0.0 across the monorepo, fixes the handful of things v5 turned into hard errors, and drops the `vi.clearAllMocks()` boilerplate that v5's `clearMocks` default makes redundant. **Changed:** - `vitest`, `@vitest/ui`, `@vitest/coverage-v8` 4.1.4 → 5.0.0 (catalog) - `vi.mock` calls that lived inside `beforeAll`/`beforeEach`/test bodies moved to module scope (v5 throws on nested calls). Affects the Studio and docs setup files and four Studio tests. - `detectBrowser` test restores `navigator` via `vi.unstubAllGlobals()` instead of assigning `global.navigator`, which now reaches jsdom's getter-only property. - `RowEditor.utils.test.ts` restores its `JSON.stringify` spy. It used to leak a throwing mock for the rest of the file, which v5's coverage provider now trips over. A later test in the same file had been asserting the leak's side effect (valid JSON reported as invalid) and now asserts the correct behavior. - `@testing-library/jest-dom` 6.6 → 7.0.1. Its vitest type augmentation resolves through a peer now, so it lands on each package's own `vitest` instead of whichever copy pnpm hoisted. Fixes `toBeInTheDocument` type errors in dev-tools after the reshuffle. - `@testing-library/react` 16.0.0 → 16.3.3 for the React 19 peer range. - `vite: catalog:` added to dev-tools, www, and common. Without it they resolved a newer vite than the catalog pin, which forked a second vitest instance in the lockfile. There's now one. - ai-commands custom matcher types use v5's `Matchers<R, T>` form. - 110 test files: `vi.clearAllMocks()` removed from `beforeEach`/`afterEach` hooks, along with hooks that only did that and the imports they left unused. Calls that also reset/restore mocks are untouched. Second commit, mechanical. **Added:** - `.vitest/` to the root gitignore (v5 writes JSON/JUnit/HTML reporter output there) **Removed:** - `vite-tsconfig-paths` catalog entry and deps. Vitest 5 resolves tsconfig paths itself. Release-age note: this sat in draft with a temporary `minimumReleaseAgeExclude` entry for `vitest` and `@vitest/*` while 5.0.0 was inside the workspace's 3-day `minimumReleaseAge` window. That window has closed, so the exclusion is gone and nothing bypasses the release-age gate. **Perf** (local, medians of 3 runs, same machine): | Suite | v4.1.4 | v5.0.0 | |---|---|---| | studio | 144.1s | 141.7s (-2%) | | studio `--coverage` | 156.9s | 146.4s (-7%) | | ui-patterns | 6.27s | 5.07s (-19%) | | ui `--coverage` | 3.35s | 2.14s (-36%) | | www | 0.89s | 0.47s (-47%) | Studio is dominated by jsdom environment setup per file, which v5 doesn't change. `vitest doctor` recommends keeping the current pool config: the vm pools and `isolate: false` all break tests. ## To test - `pnpm install --frozen-lockfile` succeeds with no `minimumReleaseAgeExclude` entry for vitest. - CI: Studio unit tests, ui, ui-patterns, www, docs, and typecheck/lint should all be green. The lint ratchet was checked locally: warning counts on touched Studio files are identical to master. - `pnpm test:studio` locally passes with coverage (588 files, 6240 tests). - Open a Studio test that uses `toBeInTheDocument` in your editor and confirm no type errors on jest-dom matchers, in Studio and in `packages/dev-tools`. - Known pre-existing failures unrelated to this PR: one dev-tools test (`getEventCountBadge` capped pill) fails on master too. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Tests - Improved test coverage for JSON validation and mobile navigation behavior. - Updated test setup, cleanup, environment configuration, and matcher support across application and shared package suites. - Removed obsolete coverage for alternate MCP transport selection. ## Chores - Streamlined TypeScript path resolution and Vitest reporter output handling. - Updated testing libraries and Vitest tooling across documentation, Studio, website, and shared packages. - Added Vitest reporter output to ignored files. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Joshen Lim
|
a1686025b6 |
Joshenlim/fe 4291 keep unsaved notebooks accessible after page refresh (#49673)
## Context Changes here adds a "Draft" state for notebooks with a new `notebook-drafts` store - similar to how we handle query tabs in the explorer. This implies that if a user refreshes the tab while there's unsaved changes to notebooks, the changes can be persisted locally and the user will be able to continue from where they left off. This also implies that If you create a new notebook (OR open an existing notebook and make some changes) and refresh the browser, we no longer show the native browser confirmation dialog about discarding changes. We also reuse the existing confirmation dialog when saving a notebook if its draft has diverged from the server side content - just updated the language to be more generic rather than saying that the Assistant made changes <img width="429" height="238" alt="image" src="https://github.com/user-attachments/assets/5c392aed-1633-4428-8060-28f495a01f04" /> Also fixes an unrelated issue - renaming a notebook should mark the notebook as having unsaved changes (with the orange indicator) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Unsaved notebook edits are saved locally and restored when reopening Studio. * Drafts are scoped by project and protected from server changes through conflict detection. * Notebook tabs indicate unsaved changes, including drafts from unsaved notebooks. * **Bug Fixes** * Closing a tab with local edits prompts for confirmation and removes its saved draft. * Notebook save state reflects the server-confirmed update time. * Conflict messages clearly describe changes made on the server. * **Style** * Improved keyboard focus behavior for tab controls. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |