## Problem
The `projectCreationEnableRlsEventTrigger` A/B experiment tested showing
an opt-in "Enable automatic RLS" checkbox in the project creation flow,
which sets up a Postgres event trigger to auto-enable RLS on every new
table in the public schema. The test variant passed with a +3.3pp lift.
## Changes
- `SecurityOptions.tsx` — removed PostHog flag check, checkbox is now
always rendered
- `pages/new/[slug].tsx` — removed experiment flag reads, exposure
tracking (`useTrackExperimentExposure`), and the conditional
`rlsOptionVariant` telemetry property
The underlying feature logic (`enableRlsEventTrigger` form field,
`AUTO_ENABLE_RLS_EVENT_TRIGGER_SQL`, submission handling) is unchanged —
we're just removing the scaffolding that was gating it.
## Testing
Verified `pnpm typecheck` passes clean. The "Enable automatic RLS"
checkbox now shows unconditionally in the Security Options section of
project creation.
GROWTH-653
Slightly modifies copy of data api warning during project creation
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified the warning shown during project creation when configuring
the Data API: the message now explicitly states that disabling the Data
API prevents client libraries (e.g., supabase-js and similar) from
querying or mutating your database, making the setup impact clearer for
users.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
<img width="1196" height="427" alt="image"
src="https://github.com/user-attachments/assets/6784b5e9-99c8-4fc9-b9f5-49672ba6e768"
/>
This reworks the security section within our project creation form to
expose two options.
1/ Enable or disable Data API which is essentially the same as we had
previously, just reframed
2/ Enable auto RLS which creates an event trigger that enables RLS on
all tables created via public schema. This is the same as what we do via
the RLS banner in authentication pages.
Note that this also removes the option to disable Data API on public
schema and move to dedicated schema. The user can still do this post
project creation . Assumption is this is rarely changed on project
creation and adds complexity.
To test:
1. Create a new project
2. Enable Data API and enable RLS setting
3. After project creation, go to triggers -> event tab -> notice enable
rls trigger
4. Create project and disable Data API
5. After project creation , go to settings/api and make sure data api is
disabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an optional automatic Row-Level Security (RLS) event trigger
option in project creation (toggleable via experiment).
* **Improvements**
* Security panel simplified to checkbox-based controls for Data API and
RLS.
* Project creation form now includes the enableRlsEventTrigger flag and
applies related setup when enabled.
* Telemetry records RLS experiment exposure, variant, and whether the
RLS trigger was enabled.
* Free-project messaging updated to consider user limits.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
Co-authored-by: Sean Oliver <882952+seanoliver@users.noreply.github.com>
* Break down new project page into smaller components
* Fix types
* Address comments
* Add min length check for project name in project settings
* Fix tests
* basic fixes
* improve form contents
* fix border clipping
* remove redundant animation and classes
* polish confirm org
* improvements
* fix header rounding
* prevent password managers from appearing
* Fix the handling of token when redirecting back. Use nuqs for getting URL params. Simplify some logic.
* Minor fix to the useEffect for org name.
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* some early ideas
* better approach
* fix globe stuff
* add initial step
* reset and submit button for chat
* cleanup
* remove www
* more clean up
* mobile and more cleanup
* fixes
* update advanced and security
* fix project checks
* connect form
* fix reset and tidied up other things
* add layout options
* a/b test
* add offset
* add ab test
* remove www packages
* remove www
* package
* update coordinates
* feat: create ProjectCreationInitialStepSubmittedEvent
* feat: add event for capturing intention of prompting
* fix: bring pnpm-lock up to date
* fix ts errors
* fix globe
* fix globe animation
* fix ts
* remove imports and tools
* update module resolution
* global redirect
* delay rendering
* Update apps/studio/pages/new/[slug].tsx
Co-authored-by: Alaister Young <alaister@users.noreply.github.com>
* take directly to v2 via project create dropdown
* move redirect to useEffect
* feat: distinguish events between initial and second step
* feat: emit an event when create project is clicked on new/v2
* fix: correct event type defs
* remove unused imports
* Various clean ups
* improvements
* Minor refactors
* clean up
* ts fixes
---------
Co-authored-by: Long Hoang <1732217+loong@users.noreply.github.com>
Co-authored-by: Alaister Young <alaister@users.noreply.github.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* Add restrictions for orioledb technical preview
* Add callouts to pgvector and postgis if orioledb
* Restrict restore to new project for orioledb
* Scaffold client side validation for preventing org upgrade if org has oriole db present
* Hook up proper logic for oriole
* Fix
* Remove console log
* Fix type
* Disable version selector if only one version is available
* chore: oriole badges
* UI updates based on requests
* Update copy
* Fix
* Dont open assistant if opt is selected
* Fix
* Fix
* Update badge
* Add feature flag for orioleDB
* Feature flag oriole check in plan update
---------
Co-authored-by: Paul Cioanca <paul.cioanca@supabase.io>
Sean Oliver