mirror of
https://github.com/supabase/supabase.git
synced 2026-10-10 11:55:05 +03:00
docs/debugging-guide
4025
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Gildas Garcia
|
1150d32462 |
fix: number inputs does not allow some editions (#46538)
## Problem Because we have controller inputs and zod validation on numbers, many of them cannot be cleared correctly as deleting their value resets it to `0`. ## Solution Update the `Input` component to allow those editions by always storing and displaying the user entered value ## How to test - Open the webhook page and add/edit one - Clear its timeout value and observe that it is not reset to `0` - Same for: - Database network restrictions - API settings max rows - Disk size modal <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Standardized numeric form input handling across examples, settings, and modals — inputs now rely on form bindings and schema coercion for consistent parsing and simplified behavior. * **Chores** * Added form resolver utilities and a user-event testing library to development dependencies. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sugat Mahanti
|
e874bdbb66 |
feat(disk): enable io2 block express in additional regions (#46559)
## What kind of change does this PR introduce? This PR enables io2 block express in additional regions: `eu-central-2`, `eu-west-3`, and `sa-east-1` as it is [now available](https://aws.amazon.com/about-aws/whats-new/2025/07/amazon-ebs-io2-block-express/) in all the regions as of 22 July, 2025 Depends on platform PR: https://github.com/supabase/platform/pull/33440 ## What is the current behavior? Currently IO2 block express is not available for these regions: `eu-central-2`, `eu-west-3`, and `sa-east-1` ## What is the new behavior? You can use io2 block express in additional regions: `eu-central-2`, `eu-west-3`, and `sa-east-1` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Disk management features are now available in three additional AWS regions: eu-central-2 (Central Europe), eu-west-3 (Western Europe), and sa-east-1 (South America). Users in these regions can now access storage management capabilities. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Raminder Singh
|
4ce3566c48 |
fix: a hydration error due to nested a tags (#46551)
Fixed the following error:
```
[browser] In HTML, <a> cannot be a descendant of <a>.
This will cause a hydration error.
...
<Panel data-slot="resizable-..." className="h-full fle..." id="panel-proj...">
<div data-slot="resizable-..." aria-disabled={undefined} data-panel={true} data-testid="panel-proj..." ...>
<div className="h-full fle..." style={{...}}>
<main className="h-full fle..." ref={function}>
<ContentWrapper isLoading={false} isBlocking={false}>
<ResourceExhaustionWarningBanner>
<IntegrationsPage>
<MarketplaceIndex>
<PageHeaderRoot>
<_c size="large" className="flex flex-...">
<div ref={null} className="mx-auto w-...">
<MarketplaceFeaturedHero integrations={[...]} installedIds={[...]} categoryOptions={[...]}>
<section>
<div>
<div ref={{current:null}} className="overflow-h..." style={{...}}>
<LinkComponent href="/project/c..." className="grid gap-0...">
> <a
> className="grid gap-0 @3xl:grid-cols-[var(--cover-width)_minmax(0,1fr)] hover:bg-selec..."
> ref={function}
> onClick={function onClick}
> onMouseEnter={function onMouseEnter}
> onTouchStart={function onTouchStart}
> href="/project/cywuvygdoclpffkfasvi/integrations/stripe_sync_engine/overview"
> >
<div>
...
<Slot.Slot ref={null} data-size="tiny" type="button" className="relative j..." ...>
<Slot.SlotClone data-size="tiny" type="button" className="relative j..." ...>
<LinkComponent href="/project/c..." data-size="tiny" type="button" ...>
> <a
> data-size="tiny"
> type="button"
> className="relative justify-center cursor-pointer inline-flex items-center s..."
> disabled={undefined}
> tabIndex={0}
> ref={function}
> onClick={function onClick}
> onMouseEnter={function onMouseEnter}
> onTouchStart={function onTouchStart}
> href="/project/cywuvygdoclpffkfasvi/integrations/stripe_sync_engine/overview"
> >
...
...
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **UI Changes**
* Updated the visual presentation of the "Manage/View Integration"
call-to-action in the marketplace featured section. The element now
appears as inline text with an arrow icon instead of a traditional
button, offering a more streamlined design.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Eduardo GurgelandAli Waseem
|
1984de70f1 |
feat(studio): add support to display realtime binary payloads (#46408)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Add support to displaying binary payloads while displaying realtime messages <img width="2073" height="694" alt="Realtime_Inspector___Realtime___29_APR___eduardo_gurgel_supabase_io_s_Org___Supabase" src="https://github.com/user-attachments/assets/fcb5c3d2-f880-484b-97a9-b0ca3b939a3f" /> JSON payloads are untouched: <img width="1744" height="625" alt="Realtime_Inspector___Realtime___29_APR___eduardo_gurgel_supabase_io_s_Org___Supabase" src="https://github.com/user-attachments/assets/8227d0af-21ee-4444-b8ca-4ebeeda11f75" /> How to test on staging: ``` select realtime.send( '\x48656C6C6F2066726F6D205265616C74696D65'::bytea, -- Binary Payload 'event', -- Event name 'main', -- Topic false -- Public / Private flag ); ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Binary payloads in real-time message inspection show compact placeholders with byte counts instead of raw binary. * Added an inline hexdump viewer to inspect binary payload contents with offsets, grouped hex bytes, and ASCII gutter. * Message list and details view now use the placeholder/hexdump behavior for payload rendering. * **Tests** * Added comprehensive tests for binary detection, hexdump formatting, and placeholder substitution. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46408?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Paul CioancaandKevin Grüneberg
|
bc6a459fd2 |
feat(upgrades): prevent upgrades for hibernated projects (#46109)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? * Prevents hibernated projects from undergoing database version upgrades <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for hibernating projects in upgrade warnings. Users will now see a clear message indicating their project is hibernating and will resume on the next supported request. * **Chores** * Extended log drain configuration to support additional destination types. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46109?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Kevin Grüneberg <k.grueneberg1994@gmail.com> |
||
|
Joshen LimandAli Waseem
|
1d203f6c93 |
feat: Support CLI for Vector buckets (#46381)
## Context > [!IMPORTANT] > Will open up for review once CLI PR is merged and deployed so that it's easier to test Related PR: https://github.com/supabase/cli/pull/5230 Adding support for vector buckets for local CLI - will need to be tested locally via `pnpm run dev:studio-local` ## To test There's a bit of testing instructions in the linear ticket [here](https://linear.app/supabase/issue/FE-3474/show-vector-buckets-in-local-admin-studio) as it involves using a branch of CLI - otherwise do reach out to Fabrizio if any help might be needed, but generally: ### Local CLI You might need to manually set `isCli` to `true` in `StorageMenuV2` if the "Vectors" nav item isn't showing up on the storage UI given we're testing via `pnpm run dev:studio-local` - [x] Can create bucket - [x] Can delete bucket - [x] Can create indexes - [x] Can insert data into indexes (via FDW) - [x] Can delete indexes Known issues (that aren't directly solvable from FE end) Reach out to Fabrizio for context as we were both investigating this - PG database needs to be on 17.6 (otherwise there's no S3 vectors FDW) - Storage version needs to be on 1.59.0 ### Self-hosted (This might be tricky to actually test, but just ensure that the code satisfies this) - [x] Cannot see vector buckets ### Hosted - [x] Everything works status quo <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Vector bucket management UI and platform APIs (create/list/delete buckets & indexes) * Local S3 credentials endpoint and client-side hook for self‑hosted/CLI use * **Bug Fixes** * Improved S3 vector setup notifications and clearer error guidance for manual installation * **Refactor** * Deployment-mode gating: platform vs CLI/self‑hosted now controls feature visibility and page behavior * **Tests** * Added suites covering deployment-mode gates and vector bucket error/usage scenarios * **Chores** * Build env updated to expose local S3 credential vars <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46381?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Francesco Sansalvadore
|
8fc7db9478 |
chore(studio): improve markdown rendering in integration overview (#46389)
Use new shared `Markdown` component from ui-patterns to properly render all common markdown tags. ## Before <img width="1451" height="789" alt="Screenshot 2026-05-26 at 19 19 27" src="https://github.com/user-attachments/assets/96857484-c87c-48c1-95e8-7e68b1a729e3" /> ## After <img width="1415" height="770" alt="Screenshot 2026-05-26 at 19 18 57" src="https://github.com/user-attachments/assets/dd980136-a92e-42a1-ad4a-52c0448f4a1a" /> |
||
|
Pamela Chia
|
7f5e3cab93 | chore(studio): remove expired Fly.io deprecation banner (#46535) | ||
|
Pamela Chia
|
9da249135c | fix(telemetry): fix and unify dashboard_error_created tracking (#46537) | ||
|
Gildas Garcia
|
ac59de1f9e |
chore: e2e tests reliability (#46496)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES/NO ## What kind of change does this PR introduce? Bug fix, feature, docs update, ... ## What is the current behavior? Please link any relevant issues here. ## What is the new behavior? Feel free to include screenshots if it includes visual changes. ## Additional context Add any other context or screenshots. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Accessibility** * Improved screen-reader label for table row action menus so table controls are clearer for assistive‑technology users. * **Tests** * Enhanced end-to-end test reliability: tightened selectors, added dialog/toast visibility and API-wait synchronization, scoped lookup fixes, removed redundant cleanup helper, and updated test setup to mark a terms-of-service dismissal to reduce flakiness. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Raminder Singh
|
d691073f02 |
feat: override wrappers in dashboard with those from marketplace db (#46472)
This PR overrides title, description, content, logo, images, docs url, and site url from marketplace db for wrappers. If marketplace doesn't yet publish a wrapper listing, the page falls back to the hardcoded content we show today. It also improves the marketplace listings and categories queries by returning typed results, making the code more type safe. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Studio integrations now surface updated marketplace metadata (name, description, icon, docs, site, author, files) when available. * Marketplace wrapper integrations are consolidated and shown alongside studio integrations. * **Refactor** * Marketplace category and integration fetching rewritten for more reliable loading, cancellation support, and improved menu/category population. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46472?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
a4334a2cc7 |
feat(studio): paginate Schema Designer via useInfiniteTablesQuery (#46402)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Performance improvement / feature ## What is the current behavior? The Schema Designer fetches all tables in a single request via `useTablesQuery`. For schemas with 400+ tables this blocks first paint on a large payload. ## What is the new behavior? `SchemaGraph` uses `useInfiniteTablesQuery` (pageSize: 100) so the first 100 tables paint immediately. A "Load more tables" button appears above the legend whenever more pages remain, letting users load the rest on demand. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a "Find table…" selector and keyboard shortcut to quickly locate and focus tables; supports incremental loading and debounced name search (with literal wildcard handling). * Schema Graph shows a bottom "Load more tables" control with loading state and preserves view after loading more. * **Refactor** * Table listing switched to infinite/paginated retrieval and improved "no tables" logic; server-side name filtering supported. * **Tests** * E2E tests add a schema-visualizer wait helper and update flows to support the paginated visualizer. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46402?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
fd1f437eca |
feat(logs): brand remaining analytics SQL callers with SafeLogSqlFragment (#46476)
## Summary
PR 10 of the analytics SQL safety series. Migrates the last surface of
analytics queries that flowed through plain
`get(.../analytics/endpoints/logs.all, { query: { sql } })` or the
`fetchLogs(projectRef, sql: string, ...)` helper over to
`executeAnalyticsSql` with branded `SafeLogSqlFragment` inputs.
After this PR, every analytics SQL call site builds its query through
the safe-analytics-sql helpers and hits the wire through the single
`executeAnalyticsSql` boundary. User-controlled values (filter
operators, numeric thresholds, function IDs, regions, provider names)
all flow through `analyticsLiteral` / branded operator maps; static
fragments are wrapped in `safeSql`. PR 11 (ESLint / vitest rule
forbidding direct analytics-endpoint POST/GET outside
`executeAnalyticsSql`) is the next and final step.
## Changes
- **`hooks/analytics/useProjectUsageStats.tsx`** — route the
already-branded `genChartQuery` output through `executeAnalyticsSql`
(parallels `useLogsPreview`).
- **`data/reports/report.utils.ts`** — tighten `fetchLogs(sql)` from
`string` to `SafeLogSqlFragment`; the wire boundary is now the same
single `executeAnalyticsSql` wrapper used by the rest of the analytics
path. Adds two pre-branded fragment maps reused by the report configs:
- `SAFE_GRANULARITY_SQL` — closed set returned by
`analyticsIntervalToGranularity`.
- `SAFE_COMPARISON_OPERATOR_SQL` — closed set on
`NumericFilter.operator`.
- **`components/interfaces/Auth/Overview/OverviewErrors.constants.ts`**
— wrap the two static `AUTH_TOP_*_SQL` fragments in `safeSql` (no
interpolation, but the type now flows).
- **`data/reports/v2/edge-functions.config.ts`** — `filterToWhereClause`
and every entry in `METRIC_SQL` now return `SafeLogSqlFragment`.
User-controlled values (`status_code.value`, `execution_time.value`,
function IDs, regions) pass through `analyticsLiteral`; operators look
up the branded map; the granularity uses the branded map. The
wire-format strings are unchanged, so the existing
`edge-functions.test.tsx` exact-string expectations still hold.
- **`data/reports/v2/auth.config.ts`** — same shape applied to all ten
`AUTH_REPORT_SQL` entries. The legacy `whereClause.replace(/^WHERE\s+/,
'')` pattern is replaced by two helpers that emit `AND`-prefixed
predicate fragments directly (`authFiltersToAndPredicates`,
`edgeLogsFiltersToAndPredicates`). Static provider SELECT / GROUP BY
fragments are pre-branded.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Enhanced security for analytics and reporting queries by updating
query construction methods across auth, edge functions, and project
usage reports.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46476?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Ali Waseem
|
5222f31fe3 |
fix: cron job editing was done by name rather than Job ID (#46486)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? - Minor issues here, the validation for creating names is there but users can create crons with empty names through SQL - When they edit the name in the Cron editor, since we use names as the where clause it treats it as a new create - So a duplicate cron is created - Since creating requires a name, the validation is moved to the component rather than zod and disabled when editing mode is on! <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Cron jobs can now be created without requiring a name field. * Improved handling to properly distinguish between creating new cron jobs and editing existing ones. * **Bug Fixes** * Fixed issue where editing unnamed cron jobs would create duplicate entries instead of updating the existing job in place. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46486?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
LennyandChris Chinchilla
|
2a8dc75e3d |
chore(docs): use more restrictive RLS policies for storage in example projects (#46172)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? docs update ## What is the current behavior? Storage RLS polices unintentionally allow list access to buckets potentially setting a bad example for people starting a new project. ## What is the new behavior? Use more restrictive RLS polices that only allow the intended operations <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated Supabase Storage access-control policies and examples across docs and starter projects. * Tightened avatar image access rules to require explicit operation checks for public reads. * Clarified guidance and added explanatory comments in migration and README examples to illustrate the updated access patterns. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46172?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris.ward@supabase.io> |
||
|
kemal.earth
|
196abe702d |
fix(studio): service health charts spruce up (#46483)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? With our bug fix for homepage charts, something got borked with the health services ones on Observability Overview. Fixed the height plus styling. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced observability charts with configurable axis display options for improved data visualization flexibility * **Bug Fixes** * Corrected service health table border styling and layout when displaying odd numbers of services in multi-column grid view <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46483?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
c39bb96d74 |
feat: Context view actions for views and material views (#46383)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Right now material views and views don't have any options on the context menu, they only have a copy name. This adds copy schema, export CSV, export SQL and delete table to that list Added E2E tests to cover the use cases <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Delete views and materialized views via confirmation dialogs with optional cascade * Copy SQL definitions for views and materialized views * Export views and materialized views as CSV and SQL from the entity menu * Confirmation modals now show dependency warnings and cascade toggle consistently * **Tests** * End-to-end tests covering copy, export, and delete flows for views and materialized views in the table editor <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46383?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
edf946ac06 |
refactor(logs): rename Reports logs sql field to safeSql (#46469)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor (naming consistency cleanup). ## What is the current behavior? `ReportQueryLogs` exposed its SQL builder under a `sql:` field while `ReportQueryDb` used `safeSql:`. Both already returned branded fragments (`SafeLogSqlFragment` / `SafeSqlFragment`), so should consolidate on `safeSql`. ## What is the new behavior? Renames `sql:` → `safeSql:` on `ReportQueryLogs` so the two report-query shapes use the same field name. Updates every Logs preset under `PRESET_CONFIG[API|STORAGE]`, every entry and call site in `SharedAPIReport.constants.ts`, and `getLogsSql` in `Reports.utils.tsx`. Part of the analytics SQL safety series; PRs 10 (remaining analytics callers) and 11 (ESLint rules) still to follow. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Enhanced query handling across API analytics reports (requests, top routes, errors, performance metrics) and Storage analytics reports (cache metrics) for improved consistency in query processing. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46469?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
b2b5cba287 |
feat(studio): add organization shortcuts (#46356)
## What kind of change does this PR introduce? Feature. Resolves FE-3470. ## What is the current behavior? Organization surfaces have a `G then ,` shortcut to enter org settings, but once inside there is no keyboard navigation, sidebar tooltips, or action shortcuts for the various org pages. | Area | Current behaviour | | --- | --- | | Org Settings sidebar | Routes are click-only once users are inside Settings. | | OAuth Apps | Publish / confirm actions have no keyboard shortcuts. | | Private Apps | Create app has no keyboard shortcut. | | Team | Invite / send actions have no keyboard shortcuts. | | Integrations | Add project connection has no keyboard shortcut. | | Org Projects | New project and search have no keyboard shortcuts. | | Audit Logs | Refresh has no keyboard shortcut. | ## What is the new behavior? Mirrors the Project Settings shortcut pattern (#46352) across all Organization surfaces. | Area | New shortcut coverage | | --- | --- | | Org Settings sidebar | `S then G/C/S/A/P/W/L/D` for General, Security, SSO, OAuth apps, Private apps, Webhooks, Audit logs, Legal documents. Shortcut badge appears on hover in the sidebar. | | Org Settings entry | `G then ,` (remapped from `G then O`) to match the Project Settings chord. | | OAuth Apps | `Shift+N` opens Publish app panel; `Mod+Enter` confirms the open panel. | | Private Apps | `Shift+N` opens Create app sheet (works in both empty-state and list-state). | | Team | `Shift+N` opens Invite members dialog; `Mod+Enter` sends the invitation(s). | | Integrations | `Shift+N` triggers Add project connection when permitted. | | Org Projects | `Shift+N` navigates to new project; `Shift+F` focuses the search input. | | Audit Logs | `Shift+R` refreshes the log list. | ### Implementation notes - Threads `shortcutId` through the `WithSidebar` pipeline (`SidebarLink` → `SubMenuSection` → `ProductMenuGroup`) so tooltip display is automatic — no new rendering logic. - Layout-scoped chords mount only while `OrganizationSettingsLayout` is active, so `S then G` in org settings does not conflict with `S then G` in project settings. - Cheatsheet reference groups promoted to typed constants with readable labels (was: bare strings like `'org-oauth-apps'`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * System-wide keyboard shortcuts for org areas: project search & new project, private app creation, OAuth app publish/confirm, add GitHub integration, invite members (open/submit), and refresh audit logs. * Sidebar and product menu now show assigned shortcuts for faster navigation; org settings navigation shortcut remapped. * **Tests** * Added coverage for org shortcut registry behavior, sequences, and ordering. * **Chores** * New shortcut reference groups and ordering for improved discoverability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46356?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Alaister YoungandAlaister Young
|
7e9badc6b8 |
chore(studio): migrate useStaticEffectEvent to React 19 useEffectEvent (#46415)
Studio is on `react@^19.2.6`, and `useEffectEvent` shipped stable in React 19.2 with the same signature as the userland polyfill. This drops the local hook in `apps/studio` and `apps/www` in favor of the built-in. **Removed:** - `apps/studio/hooks/useStaticEffectEvent.ts` - `apps/www/hooks/useStaticEffectEvent.ts` - `.claude/skills/use-static-effect-event/` — skill is obsolete **Changed:** - 26 call sites: dropped the `useStaticEffectEvent` import, added `useEffectEvent` to the existing `react` import, renamed call sites - `.claude/CLAUDE.md`: `apps/studio` row updated React 18 → React 19 - `.claude/skills/vercel-composition-patterns/SKILL.md`: removed stale "Studio uses React 18, skip these patterns" warning ## To test - `pnpm typecheck --filter=studio` — passes locally - `pnpm typecheck --filter=www` — passes locally - `grep -rn "useStaticEffectEvent"` returns nothing outside `node_modules` - Smoke-test areas that use the hook: schema visualizer edges (intersection check), spreadsheet import, sign-in/CLI login flows, side panels with unsaved-changes prompts **Out of scope:** pre-existing Tailwind lint warning on `DefaultEdge.tsx:141` (`outline` + `outline-1` conflict) — unrelated to this migration <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Internal event handling migrated to React’s built-in event hooks across the Studio app; no user-facing changes. * **Documentation** * Clarified React 19 compatibility and noted Studio now targets React 19. * Removed obsolete documentation for a deprecated internal hook. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46415?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Joshen Lim
|
abe7e87bba |
Remove unified logs related dead code (#46459)
## Context Just removing unified logs related dead code (Not used, not imported) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Streamlined the Service Flow view by removing legacy timeline, collapsible sections, and some detailed step UI for a cleaner visualization. * Simplified the Unified Logs surface by reducing exposed types, consolidating query logic, and removing an internal event bus. * Removed legacy list/detail and sheet UI pieces to tighten the logs interface and public API surface. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46459?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
ef613f2068 |
Joshen/debug 123 row dropdown appears outside of details panel (#46462)
## Context Addresses DEBUG-126 Making some adjustments to the service flow panel in unified logs - Row action will be via a `...` button instead of the whole row <img width="487" height="207" alt="image" src="https://github.com/user-attachments/assets/cd0f6d41-aace-41c2-872b-60071fd6b986" /> - Fields with no values will show a `-` (previously didn't show anything) <img width="501" height="130" alt="image" src="https://github.com/user-attachments/assets/3b62c44e-7fd9-497b-8261-ca5e1c975bc2" /> - Opting to close the dropdown menu when scrolling to prevent overflow of the dropdown menu content with the parent component - However, IMO this needs to be addressed at the UI component level RE how we want to handle dropdown menu content when scrolling. The content is portalled hence why its happening - (Not user facing) Clean up usage of `FieldValue` and `DataTableSheetRowAction` - Was confusing to be passing `value` as a react node when declaring `DetailRow` from `PostgresFlowDetail` and `Block` - Opting to render the UI inside `DetailRow` instead, which gives us better control on the UI <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Dropdown menus now close when the page is scrolled while open. * **Improvements** * Cleaner, more consistent log value formatting and status code display. * Loading placeholders for log fields are handled more consistently. * Dropdown content area widened for better visibility. * Row actions only appear when a value is present; copy action shown as fallback. * **UI Behavior** * Collapsible section headers receive improved layout, transition, and hover styling. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46462?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
9bdb757b6a |
feat(logs): brand Observability/EdgeFunctions SQL with SafeLogSqlFragment (#8) (#46466)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / security hardening — continues the analytics SQL provenance-tracking series (PR 8). ## What is the current behavior? - `generateRegexpWhere` (unsafe: interpolates user-controlled filter keys/values without escaping) still exists alongside `generateRegexpWhereSafe` and its tests only cover the old function. - `usePostgrestOverviewMetrics` builds a SQL query string with plain string interpolation and calls the analytics endpoint directly via `get()`. - `edge-functions-last-hour-stats-query` builds a SQL query with `functionIds` escaped via Postgres-only `quoteLiteral` and calls the analytics endpoint directly via `post()`. - `executeAnalyticsSql` has no way to pass a `key` query-string param for network-tool identification. - `rawSql('minute')` / `rawSql('hour')` / `rawSql('day')` and `rawSql(value ? 'true' : 'false')` are used for static strings that could be expressed with the `safeSql` template tag. ## What is the new behavior? - `generateRegexpWhere` is deleted; its tests are replaced with `generateRegexpWhereSafe` coverage including injection-attempt cases (`level OR id IS NOT NULL`, `request.method); DROP TABLE edge_logs; --`) that verify predicates are silently dropped rather than emitted. - `usePostgrestOverviewMetrics` returns `SafeLogSqlFragment` from its SQL builder and routes through `executeAnalyticsSql`. - `edge-functions-last-hour-stats-query` uses `analyticsLiteral` (BigQuery/ClickHouse-correct escaping) instead of `quoteLiteral` (Postgres-only) and routes through `executeAnalyticsSql`. - `executeAnalyticsSql` accepts an optional `key?: string` forwarded as a query-string param on both GET and POST requests; `key: 'last-hour-stats'` is restored on the edge-functions query. - Static `rawSql('...')` calls replaced with `safeSql\`...\`` template literals throughout. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes - Removed legacy unsafe SQL-filter utility from Reports ## Chores - Enhanced analytics SQL execution infrastructure with improved error handling - Added optional request identification parameter to analytics query execution - Refined SQL filtering mechanisms in reporting features <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46466?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
cbdd8b9b80 |
Add skeleton loader for unified logs chart (#46460)
## Context Opting for just a loading spinner as the skeleton loader for charts <img width="1468" height="952" alt="image" src="https://github.com/user-attachments/assets/d6c291c8-9151-40c8-bfbe-f838431dd6dc" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a loading spinner to the unified logs view that displays while logs are being fetched, providing clear visual feedback during data retrieval. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46460?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
b281d3fcf5 |
Joshen/fe 3475 add operator to event message filter (#46457)
## Context Original task was to support searching `!=` on `event_message`, but this PR addresses some things regarding searching on `event_message` in unified logs that I found while working on this. ### `=` and `!=` are technically inaccurate We're doing pattern matching when searching on event_message rather than a strict equality check, so a more accurate operator would be `ilike (~~*)` and `not ilike(!~~*)` - both of which would be case insensitive for easier checking. Am thus swapping to use these 2 operators when filtering on `event_message`: <img width="430" height="134" alt="image" src="https://github.com/user-attachments/assets/c8a320b6-e016-44ae-aed0-1e7b6cefbda9" /> ### Filtering on `event_message` was never server side It seems like we have been only doing client side searching on `event_message` which is inaccurate as we're only filtering against rows that are on the current page. The `event_message` filtering was never appended to the URL state as well so the changes in this PR ensures that all search including `event_message` is server side. ### Rework on unified logs filtering via URL params Because we're now supporting more than just `=` in unified logs, the current filter system is insufficient (e.g can't just be `status=x&method=y`). Am opting to use the same system as per how we do filtering in the table editor where search params follow the syntax: `{column}:{operator}:{value}` <img width="521" height="46" alt="image" src="https://github.com/user-attachments/assets/54e72eb2-1581-4c1a-910e-58d993da1766" /> ## To test - [ ] Verify that searching for logs in unified logs still works - [ ] Verify that searching against event_message in unified logs works as expected (both ilike and not ilike) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Repeatable URL-based column filters with operator support (e.g., equals, not-equals, pattern matching). * Expanded pattern-style operators for message searches (case-insensitive/contains, negation). * **Improvements** * Unified filter handling across logs list, charts, and counts for consistent results. * Range/slider filters and pagination remain supported and round-trip via URL parameters. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46457?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
6236ee9ef9 |
POC: bring back MSW to remove the pattern of vi.mock (#46439)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Right now our tests for API mocking is using vi.mock and mocking that query or fetch handler. This is not the right approach IMO, 2 years ago @jordienr added MSW with some very powerful helpers. The idea is to move component test that rely on API using MSW within ViteTest. Principles are simple: - Mock API responses - Mount your component that uses API responses - Tests and assert on UI - Added Skill for Clanker This pattern is 100 times better than what we have <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Expanded and strengthened test suites for secrets, org lookup, support flows, OAuth auth, and onboarding; mocks now use contract-backed responses for more realistic coverage. * **Documentation** * Added a comprehensive guide describing a standardized pattern for component tests that mock network requests. * **Chores** * Improved test helpers, typing for API mocks, and test runner configuration for more reliable and maintainable tests. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46439?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <alaister@users.noreply.github.com> Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Jordi EnricandClaude Opus 4.7
|
c595a22eb3 |
fix(studio): unified logs status color consistency DEBUG-113 (#46450)
## Problem
In the unified logs UI, the status badge for a Postgres row showed a
different color in the detail view than in the table view. The table
view colors by the row's pre-computed `level` (derived in SQL from
`severity_text`), so a Postgres ERROR row's SQL state code (e.g.
`42P01`) renders red. The detail view re-derived the level via
`getStatusLevel(value)` which only handles HTTP numeric codes.
`Number('42P01')` is `NaN`, every branch fell through, and the badge
always rendered neutral regardless of severity.
## Fix
Color the status badge in the detail view by `data.level`, the same
canonical row level the table view uses. Threaded `level` through
`FieldValue` and used `data.level` directly in `BlockField`.
`getStatusLevel` is still used by the Webhooks platform views, where
`responseCode` is always a numeric HTTP status, so those callers stay
correct.
## How to test
- Open the dashboard and navigate to a project's unified logs page.
- Filter to `log_type: postgres` and find an ERROR row.
- Confirm the status code (a SQL state like `42P01`) is colored red in
the table.
- Click the row to open the detail pane and confirm the Status field in
the Postgres block is also red.
- Repeat with a WARNING-severity Postgres row, confirming both views
render warning color.
- Sanity check a 5xx HTTP row (PostgREST or Storage) still shows red in
both views, and a 2xx row stays neutral in both.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved consistency in how log level context is propagated through
logging interface components, enabling more uniform formatting and
rendering behavior across the unified logs display.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46450?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
|
||
|
Alaister YoungandAlaister Young
|
b0d023bd04 |
fix(studio): remove default DataGrid borders across studio surfaces (#46448)
Follow-up to #46413, which fixed an unwanted top border on the Auth Users grid by upgrading `border-t-0` → `border-t-0!` so the Tailwind rule actually wins over react-data-grid's `.rdg { border: 1px solid var(--rdg-border-color); }` shorthand. The same issue exists on every other DataGrid in Studio — this applies the fix consistently. **Changed:** - `border-t-0! border-b-0!` applied to all `<DataGrid>` call sites in Studio (11 in total) Fixes this issue everywhere: <img width="609" height="223" alt="Screenshot 2026-05-28 at 3 40 02 PM" src="https://github.com/user-attachments/assets/f49d8849-dd58-4675-ade4-a2656aadb8f9" /> ## To test Spot-check that the top/bottom borders look right (no doubled border under the page chrome, no extra line at the bottom of the table) on each route below. Use any project ref for `[ref]`: - `/project/[ref]/observability/query-performance` — main grid + the WithStatements grid inside - `/project/[ref]/observability/query-insights` — both modes (explorer + triage) - `/project/[ref]/advisors/security` - `/project/[ref]/advisors/performance` - `/project/[ref]/integrations/cron/jobs` — jobs list - `/project/[ref]/integrations/cron/jobs/<jobName>` — previous runs tab - `/project/[ref]/integrations/queues/queues` — queues list - `/project/[ref]/integrations/queues/queues/<queueName>` — single queue messages - `/project/[ref]/integrations/vault/secrets` - `/project/[ref]/sql/new` — results pane at the bottom - `/project/[ref]/realtime/inspector` - `/project/[ref]/logs/explorer` — and the preview pages: `auth-logs`, `edge-logs`, `postgres-logs`, `cron-logs`, `pg-upgrade-logs`, `postgrest-logs`, `realtime-logs`, `replication-logs`, `pgcron-logs`, `storage-logs`, `edge-functions-logs`, `pooler-logs`, `dedicated-pooler-logs` - `/project/[ref]/functions/[functionSlug]/logs` and `/invocations` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Refined border styling on data grids across multiple features including integrations, query tools, and logs for improved visual consistency. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46448?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
|
a45776ecb9 |
feat(studio): restrict auth email template editing for free projects (#45396)
## What kind of change does this PR introduce? Feature / abuse-prevention update. Resolves DEPR-198. ## What is the current behaviour? Free projects using Supabase's built-in email service can edit raw Auth email template subjects and HTML in Studio. That is the risky cohort this project is trying to constrain. ## What is the new behaviour? ### Template editing restrictions For free projects using Supabase's built-in email service, Studio keeps Auth email templates viewable and previewable but disables subject/body editing and saving. Editing is unlocked by setting up Custom SMTP, configuring a send-email hook, or upgrading to a paid plan. **Grandfathering:** projects created before `2026-06-01T00:00:00Z` (the platform enforcement cutoff) are exempt; their editing UI stays unlocked. This mirrors `FREE_TIER_TEMPLATE_BLOCK_CUTOFF_DATE` in the platform PR exactly. | After | | --- | | <img width="1024" height="759" alt="Emails Authentication Fizz Test Supabase-173BB09B-0FB9-4133-8202-9E310DDB347A" src="https://github.com/user-attachments/assets/c966212d-ed0c-443b-8197-440cc2937ef6" /> | | <img width="1024" height="759" alt="Emails Authentication Fizz Test Supabase-CD5845EB-0E45-4779-8989-44E775B2411A" src="https://github.com/user-attachments/assets/055a64d6-b5e8-4d37-a261-6e280f04536a" /> | ### Warning dialogs on transitions that reset templates Two flows now surface a warning before the user commits to a state change that resets their custom email templates to defaults: 1. **Disabling custom SMTP** (SMTP settings page): a confirmation dialog warns that templates will be reset to defaults and the email rate limit reduced to 2 per hour. On confirm, Studio resets all 13 templates via the existing per-template reset endpoint (`Promise.allSettled`). The "won't be able to edit" sentence is shown only for post-cutoff projects; grandfathered projects skip it. The corresponding server-side enforcement is in the Platform PR: https://github.com/supabase/platform/pull/33129 2. **Downgrading to the Free plan** (billing settings): an admonition in the existing downgrade confirmation modal warns that custom templates will be reset to defaults and won't be editable without custom SMTP. The admonition is shown only when the org has at least one post-cutoff project; orgs whose projects are all grandfathered skip it. | Custom SMTP | Downgrading | | --- | --- | | <img width="862" height="586" alt="66764" src="https://github.com/user-attachments/assets/6470c8a6-2f79-40a5-ad3b-bfe5b0ba9c54" /> | <img width="1268" height="1552" alt="CleanShot 2026-05-22 at 17 28 37@2x-FEB1901E-38E6-42DF-8C27-0A036D8A1B94" src="https://github.com/user-attachments/assets/e8caa9e6-c3ed-4787-b771-af77a43eb854" /> | ### Informational admonition when enabling SMTP When a user enables custom SMTP for the first time, a sandwiched admonition above the save footer informs them that the email rate limit will be increased to 30 per hour and can be adjusted. _This is just a minor cosmetic change, unrelated to the email template disabling. Sorry._ | Before | After | | --- | --- | | <img width="1024" height="759" alt="Emails Authentication Chisel Toolshed Supabase-54317D18-803C-4A58-8211-2359355D083B" src="https://github.com/user-attachments/assets/29eff649-02dc-40f3-a379-0b4d484a76c7" /> | <img width="1024" height="759" alt="Emails Authentication Chisel Toolshed Supabase-9E12399E-E9FB-4F9A-B029-A08008EA4B50" src="https://github.com/user-attachments/assets/e542ed86-4da6-407e-8293-0f4c0f071e18" /> | ## How to test All existing projects pre-date the enforcement cutoff (`2026-06-01T00:00:00Z`) and are grandfathered, so the restriction UI won't appear by default. To force the restricted state locally, back-date the cutoff in one file: In `apps/studio/components/interfaces/Auth/EmailTemplates/EmailTemplates.utils.ts`, temporarily change: ```ts export const FREE_TIER_TEMPLATE_BLOCK_CUTOFF_DATE = '2026-06-01T00:00:00Z' ``` to: ```ts export const FREE_TIER_TEMPLATE_BLOCK_CUTOFF_DATE = '2025-01-01T00:00:00Z' ``` Revert before committing. With the cutoff back-dated, use a free-plan project and: - **Template restriction + admonition:** navigate to Authentication > Emails with no custom SMTP configured. Subject/body fields should be read-only and the "Set up SMTP" admonition should appear, with its dropdown offering upgrade and send-email hook options. - **SMTP disable warning:** enable custom SMTP on a project, then disable it via Authentication > SMTP Settings. The confirmation dialog should warn that templates will reset to defaults and that editing will be restricted after disabling. - **Downgrade warning:** in billing settings, initiate a downgrade to the Free plan. The downgrade modal should include an admonition warning about template reset and restricted editing (only if the org has at least one post-cutoff project). ## Additional context The default Auth email template copy was also improved across docs, examples, and UI library snippets (separate prior commits). The per-template reset button (`ResetTemplateDialog`) was migrated to the async `AlertDialogAction` pattern introduced in #45960; the dialog stays open and shows a loading state while the reset is in-flight, closes on success, and stays open on error. Closes PRODSEC-183 --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com> Co-authored-by: Stephen Morgan <stephen@doublethink.co.nz> |
||
|
Joshen Lim
|
5f4153d9e0 |
Adjust auth log detail pane in unified logs (#46372)
## Context Currently when opening an auth log, the log details panel is seemingly very empty Auth logs are pretty empty by their nature unlike the other logs so am opting to adjust the detail panel for them slightly ### Changes involved - Fixing passing `host` and `path` when rendering auth log details - Opting to only show "Network" + "Authentication" segments for auth (The other fields do not apply for auth logs) <img width="434" height="476" alt="image" src="https://github.com/user-attachments/assets/cf8bb128-2332-424a-a10e-a7e836acb7d5" /> - Make each section collapsible, allow users to adjust themselves how they want to consume the information <img width="421" height="474" alt="image" src="https://github.com/user-attachments/assets/e842bc79-edff-4ec6-ae38-a9249966881d" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Postgres connection and session info now appear in separate expandable sections for easier browsing * Auth-related fields (ID, status, path, referer) now extract and present richer, more accurate values * Request path and host resolution improved across service flow/network views * **Bug Fixes / Improvements** * Safer parsing of auth event messages and more robust fallbacks for missing fields * Cleaner row styling and section rendering for consistent visuals <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46372?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
42f1f19fdd |
feat(logs): brand SharedAPIReport SQL with SafeLogSqlFragment (#46405)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Security / refactor — migrates `SharedAPIReport.constants.ts` to the proven-authorship model (`SafeLogSqlFragment`). ## What is the current behavior? All seven SQL builders in `SHARED_API_REPORT_SQL` return plain `string` and interpolate filter values via `generateRegexpWhere`, which performs manual quoting without sanitization. The source table name (`edge_logs` / `function_edge_logs`) is also interpolated as a raw string. Queries are executed via a local `fetchLogs` function that calls `get()` directly, bypassing the `executeAnalyticsSql` wire boundary. ## What is the new behavior? - Each SQL builder is rewritten with the `safeLogSql` template tag and returns `SafeLogSqlFragment`. - Filter keys route through `quotedIdent` (predicates with invalid identifiers are dropped); values route through `analyticsLiteral` (single quotes and backslashes are escaped). - A `SOURCE_TABLE` branded map covers the two possible source tables; `sourceTable()` looks up the branded fragment instead of interpolating a raw string. - `fetchLogs` is removed; `useQueries` calls `executeAnalyticsSql` directly with `method: 'get'`, routing through the shared wire boundary. - The `queryFn` wraps the call in a try/catch that also checks `data?.error`, preserving the original Sentry capture behaviour (`'Shared API Report Error'`) for both network and API-level errors. ## Additional context |
||
|
Charis
|
0ab0106758 |
feat(logs): brand Reports logs presets with SafeLogSqlFragment (#46403)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / security hardening (part of a stacked series applying compile-time SQL provenance tracking to analytics call sites). ## What is the current behavior? The `queryType: 'logs'` presets in `PRESET_CONFIG` (API ×8, Storage ×2) build BigQuery SQL by splicing filter keys and values via plain string interpolation through `generateRegexpWhere`, with no compile-time guarantee that the output is injection-safe. `ReportQueryLogs.sql` returns `string` and `getLogsSql` returns `string`. ## What is the new behavior? - `generateRegexpWhereSafe` added to `Reports.constants.ts`: routes filter keys through `quotedIdent` (dropping predicates whose identifier fails the `[A-Za-z_][A-Za-z0-9_]*` regex) and values through `analyticsLiteral`. Values must be raw/unquoted — the function handles all quoting and escaping itself. - All ten `queryType: 'logs'` presets migrated to use the `safeLogSql` template tag and `generateRegexpWhereSafe`. - `ReportQueryLogs.sql` return type tightened from `string` to `SafeLogSqlFragment`; `getLogsSql` return type updated to match. - Manual pre-quoting of the `identifier` filter removed in `useApiReport` and `useStorageReport` (`value: \`'${identifier}'\`` → `value: identifier`), since `analyticsLiteral` now handles quoting. ## Additional context Smoke test: `/observability/api-overview`, `/observability/storage`. To exercise the replica `identifier` filter, select a replica on `/observability/database` first, then navigate to those pages. |
||
|
Alaister YoungandAlaister Young
|
d6835c4b42 |
[FE-3483] fix(studio): redirect OAuth callback errors to /sign-in (#46414)
OAuth/SSO callback failures (e.g. GitHub returning an email that collides with gotrue's `users_email_partial_key` constraint) were stranding users on `/sign-in-mfa` with the raw error rendered under the "Two-factor authentication" heading. They now redirect to `/sign-in`, where the error surfaces above the email form under "Welcome back" and the form stays interactive so users can fall back to email/password without refreshing. Addresses FE-3483. **Changed:** - `pages/sign-in-mfa.tsx`: redirect to `/sign-in` when `auth.initialize()` returns an error, instead of stopping the loader and rendering the error on the MFA page. The error is already captured in the shared `AuthProvider` state by `gotrueClient.initialize()` before the redirect, so it survives the navigation via `useAuthError()`. - `components/interfaces/SignIn/SignInForm.tsx`: render `useAuthError()` as an inline `AlertError` above the email/password fields. Form stays interactive so users hitting the duplicate-email case can use email sign-in inline. This is the "surgical" option from the ticket — option 3 (point the OAuth callbacks at `/sign-in` directly) is still the right long-term cleanup. ## To test 1. Visit `/sign-in-mfa#error=server_error&error_description=Database+error+saving+new+user` — should redirect to `/sign-in` with the error rendered above the email form under "Welcome back". 2. Type into the email/password fields — form should be interactive (this is the part the "replace the form" alternative would have broken). 3. Hard-reload `/sign-in` — no `AlertError`, normal form. 4. Sign in with a real email/password account that has MFA enabled — `/sign-in-mfa` should load normally with the "Two-factor authentication" heading and verification form. No redirect, no `AlertError`. 5. Try `/sign-in-mfa?returnTo=%2Forganizations#error=server_error&error_description=test` — after redirect the URL should be `/sign-in?returnTo=%2Forganizations` (query preserved, hash consumed by gotrue). Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Gildas Garcia
|
a6bfa0478c |
chore: migrate auth Modal to Dialog (#46392)
## Problem We still uses the deprecated `Modal` for: - Banning a user - Inviting a user - Adding a redirection URL - Removing a redirection URL ## Test Hard to test the JWT. I had to force its display by settings its `open` prop to `true` in `apps/studio/components/interfaces/JwtSecrets/jwt-settings.tsx` ## Solution - use `Dialog` instead <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Modernized authentication UI components (user management, redirect URL configuration) with updated dialog structures for improved consistency and state handling * Enhanced async operation handling in redirect URL deletion workflows to ensure proper synchronization and state management <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46392?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
9155357d82 |
chore: migrate Integrations Modal to Dialog (#46380)
## Problem We still use the deprecated `Modal` for: - Deleting a wrapper - Updating a vault secret - Sending a queue message ## Solution - use `Dialog` instead <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Replaced several modal dialogs with updated dialog/alert patterns for sending messages and confirming deletions, improving visual consistency and content structure. * **Bug Fixes** * Prevent duplicate/accidental actions by disabling buttons and showing loading states during pending operations; confirmation dialogs now display relevant item details and close on success. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46380?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
e26303cf9c |
chore: migrate billing Modal to Dialog (#46385)
## Problem We still use the deprecated `Modal` for: - Adding a new payment card - Deleting a payment a card - Changing the payment method - Displaying the spend cap details when creating a new org ## Solution - use `Dialog` instead <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Updated billing dialogs (add/change/delete payment methods and spend cap) to use a newer dialog/alert dialog system. * Result: more consistent dialog behavior, clearer confirmation flows, and improved handling of loading/confirmation states for payment actions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46385?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
ed921f36f7 |
feat(studio): streamline status health visual (#46274)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Just a little bit of design polish for the observability overview status health. | Before | After | |--------|--------| | <img width="963" height="714" alt="Screenshot 2026-05-22 at 14 15 03" src="https://github.com/user-attachments/assets/3d67d175-434b-48a6-b87b-15e074d2cc27" /> | <img width="1068" height="846" alt="Screenshot 2026-05-26 at 13 26 55" src="https://github.com/user-attachments/assets/c3f728ef-309c-42ec-9810-37bf6564a470" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added option to hide date range in logs bar charts. * **Improvements** * Redesigned service health table to a responsive card/grid layout with richer status indicators, improved charts, loading and empty states, and clearer per-service CTAs. * Chart empty state now renders title/description only when provided. * **Style** * Adjusted footer top padding for improved spacing. * **Chores** * Reordered import and service configuration entries (rendering order updated). <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46274?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Vaibhav
|
ec1b778ed8 |
fix: close log details (#46345)
- closes https://github.com/supabase/supabase/issues/46343 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed logs explorer to clear previously selected logs when running new queries, changing date ranges, or clicking chart elements, ensuring the selected log remains synchronized with the current search context. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46345?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
bde6a5e745 |
fix: auth users list design (#46413)
## Screenshots Before: <img width="856" height="1140" alt="image" src="https://github.com/user-attachments/assets/d1e04a6f-d3ed-43b3-84f1-3000f2ecac17" /> After: <img width="398" height="107" alt="image" src="https://github.com/user-attachments/assets/6b41663b-31ee-4556-b2e4-6847f705aa38" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Increased CSS specificity in the Users view to reliably remove the top border, ensuring consistent visual rendering across layouts and themes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46413?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
28eb347032 |
feat(studio): small modification to logs drawer rows (#46396)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Removes the `└` shaped character before each property. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated detail row layout in service flow display with refined spacing and removed visual connectors for improved readability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46396?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Pamela Chia
|
47c084e51d |
refactor(studio): migrate telemetry to useTrack (#46140)
## Summary
I migrated every `useSendEventMutation` call site in `apps/studio` to
`useTrack`, deleted the legacy hook, and added a lint guardrail so it
can't return. `useTrack` is the type-safe replacement: it auto-injects
`groups: { project, organization }` from the selected project/org and
types `action` + `properties` against `TelemetryEvent`. Existing call
sites built groups manually and were not type-checked at the action
level. The migration covers 81 files (60 trivial swaps, 9 org-only, 3
pre-auth, 5 bespoke, 4 test mocks).
## Changes
- Migrated trivial call sites across `pages/project/[ref]`,
`components/interfaces/*` (Reports, Storage, Realtime/Inspector,
SQLEditor, Functions, EdgeFunctions, Integrations, ProjectAPIDocs,
Branching/BranchManagement, TableGridEditor, Connect, Docs, Auth,
Support, Home, ProjectHome, App), `components/layouts/*`, and
`components/ui/*`.
- Migrated org-only sites (`Organization/Documents/*`,
`Organization/BillingSettings/Subscription/*`,
`Organization/SecuritySettings.tsx`,
`Account/Preferences/DashboardSettingsToggles.tsx`) by dropping the
manual `groups: { organization: ... }` and letting `useTrack`
auto-inject. Verified `useSelectedProjectQuery` is disabled on org
routes (gates on URL `[ref]`).
- Migrated pre-auth sites (`SignInForm.tsx`, `sign-in-mfa.tsx`,
`profile.tsx`) where neither project nor org is resolved.
- Bespoke handling:
- `execute-sql-mutation.ts` and `table-row-create-mutation.ts`: pass `{
project: projectRef }` via `groupOverrides` since the mutation can
target a non-selected project ref.
- `useStudioCommandMenuTelemetry.ts`: kept a direct `sendTelemetryEvent`
call because studio groups must override pre-built event groups
(opposite of `useTrack`'s override direction).
- `AIAssistantOption.tsx`: passes sentinel-aware `groupOverrides` so
`NO_PROJECT_MARKER`/`NO_ORG_MARKER` continue to suppress group emission.
- `SidePanelEditor.utils.tsx`: utility functions `createTable` and
`updateTable` now take a `track: Track` parameter (threaded from
`SidePanelEditor.tsx`); dropped the `organizationSlug` arg since groups
are no longer assembled manually.
- Branch-event attribution: preserved `parentProjectRef` overrides on
`branch_updated`, `branch_merge_completed`, `branch_merge_failed`,
`branch_merge_submitted`, `branch_delete_button_clicked`,
`branch_review_with_assistant_clicked`, and
`branch_*_merge_request_button_clicked`. Original code grouped these
under the parent (production) project, not the branch ref;
auto-injection would have shifted them onto the branch.
- Switched 4 test mocks from `@/data/telemetry/send-event-mutation` to
`@/lib/telemetry/track`. Removed obsolete tests around manual groups and
`try/catch` on telemetry rejection.
- Deleted `apps/studio/data/telemetry/send-event-mutation.ts`. The
deleted module is its own guardrail: any reintroduction of the import
fails at TypeScript module resolution before lint runs.
## Testing
Tested on preview deploy:
- [x] SQL editor `CREATE TABLE` fires `table_created` with method
`sql_editor` and `groups.project` set to the mutation's `projectRef`.
- [x] Table editor creates a table from the side panel; `table_created`
fires from `SidePanelEditor.utils` via threaded `track`.
- [x] Help button (`/project/[ref]/...`) fires `help_button_clicked`
with auto-injected project + org groups.
- [x] Sign-in form fires `sign_in` with empty groups (pre-auth,
expected).
- [x] Org documents page (`/org/[slug]/documents`) fires
`document_view_button_clicked` with org group only, no stale project
ref.
- [x] Command menu (`Cmd+K`) inside a project still fires
`command_menu_opened` with studio's project/org overriding any
event-supplied groups.
- [x] Support form "Ask the Assistant" without selected org fires
`ai_assistant_in_support_form_clicked` with no project/org groups
(sentinels suppress).
- [x] On a branch, "Update branch" / "Merge branch" / "Close merge
request" events fire with `groups.project` set to the parent project
ref, not the branch ref.
Local checks:
- [x] 22/22 tests pass across the 4 updated test files
(`SidePanelEditor.utils.createTable`, `EdgeFunctionRenderer`,
`LayoutSidebar`, `PlanUpdateSidePanel`).
- [x] `rg useSendEventMutation apps/studio` returns 0 hits.
## Linear
- fixes GROWTH-860
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Standardized telemetry across the Studio to a unified tracking system;
events now send simplified payloads with less contextual/grouping data.
* No user-facing flows changed; UI behavior, permissions, and
interactions remain the same.
* **Tests**
* Updated telemetry mocks and tests to align with the new tracking
approach.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46140?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Joshen Lim
|
67997f088d |
Reduce z index on row selection header (#46360)
## Context `RowSelectionHeader` was unnecessarily using a 99 z-index value which was conflicting with the tooltips, so reducing it down to 2 which should be all that we need ### Before <img width="558" height="280" alt="image" src="https://github.com/user-attachments/assets/362be2df-aca7-4cb9-9bfb-84e77dac06ab" /> ### After <img width="374" height="161" alt="image" src="https://github.com/user-attachments/assets/118c8411-f25c-4513-9cce-2d24dcc71759" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated the z-index layering of the selected-rows overlay header component. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46360?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ignacio Dobronich
|
1c7af66fc7 |
fix: omit branching params when org lacks entitlement (#46388)
## Summary - On the Free plan the GitHub integration form disables the branching section, but the create/update payloads still included `branch_limit`, `new_branch_per_pr`, and `supabase_changes_only`. - These three fields are now only sent when the org has the `branching_limit` entitlement. ## Manual testing - [ ] As a Free plan org, open Project Settings → Integrations → GitHub and connect a repository. In the network tab, verify the `POST /platform/integrations/github/connections` request body does **not** include `branch_limit`, `new_branch_per_pr`, or `supabase_changes_only`. - [ ] Still on a Free org, edit the working directory / production branch on an existing connection. Verify the `PATCH` body also omits those three fields. - [ ] As a Pro (or higher) plan org with branching enabled, repeat both flows and confirm the three branching fields are still sent with the values from the form. - [ ] Confirm the UI itself is unchanged: the branching controls remain disabled on Free and editable on Pro+. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed GitHub integration to conditionally send branching-related configuration fields based on user access permissions, preventing unnecessary data transmission for users without branching access. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46388?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
a7d51cdf52 |
feat(logs): brand legacy analytics SQL stack with SafeLogSqlFragment (#46351)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / type safety improvement ## What is the current behavior? The legacy log query stack (`genDefaultQuery`, `genCountQuery`, `genChartQuery`, `genWhereStatement`, `useLogsPreview`, `useSingleLog`) builds SQL from raw strings with no type-level guarantee that values are safely interpolated. Identifier helpers (`bqIdent`, `bqDottedIdent`, `clickhouseIdent`, `clickhouseDottedIdent`) are duplicated across BigQuery and ClickHouse variants, and `bqDottedIdent` wraps the entire dotted path in one backtick pair (`` `request.pathname` ``), which BigQuery treats as a literal column name rather than a UNNEST alias field — causing runtime query failures on dotted filter keys. ## What is the new behavior? - All gen functions return `SafeLogSqlFragment` and all callers route through `executeAnalyticsSql`, enforcing compile-time SQL provenance tracking across the legacy stack. - `bqIdent` / `bqDottedIdent` / `clickhouseIdent` / `clickhouseDottedIdent` are replaced by a single `quotedIdent` function that backtick-quotes each segment individually (e.g. `` `request`.`pathname` ``). ClickHouse natively accepts backticks, so one function serves both engines and the dotted-path quoting bug is fixed. - `SQL_FILTER_TEMPLATES` entries are converted to `SafeLogSqlFragment` (static via `safeSql`, dynamic via `safeSql` + `analyticsLiteral`). - `buildWhereClauses` is extracted as a private helper returning `SafeLogSqlFragment[]` so the pg_cron path can merge clauses without unsafe slice-and-cast. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Logs query generation migrated to safer, engine-agnostic SQL fragments, typed filter templates, and unified identifier quoting for stronger injection protection and more consistent queries. * Logs preview and single-log retrieval now execute analytics SQL end-to-end using the unified executor. * **New Features** * Analytics SQL executor can call the backend via GET or POST and accepts method selection. * **Tests** * Updated tests to validate unified identifier quoting and safe-SQL helper behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46351?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
95a38ef9a5 |
fix(studio): guard priceMonthly lookup on new project page (#46395)
## Summary Switches the two `instanceSizeSpecs[instanceSize]!.priceMonthly` lookups (on the New Project page and its footer) to the existing `monthlyInstancePrice` helper, which has a defensive fallback. Fixes a render crash that fires when users switch between organizations of different plan tiers via the OrganizationSelector dropdown. Sentry: [SUPABASE-APP-EJT](https://supabase.sentry.io/issues/SUPABASE-APP-EJT) — 339 occurrences, 312 users impacted. Fixes FE-3481 ## Test plan - [x] On `/dashboard/new/<freeOrgSlug>`, open the org dropdown and switch to a paid org — no crash - [x] Verify the "Additional costs" total renders correctly once form state syncs - [x] `pnpm typecheck` passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Refactored pricing calculation logic across project creation components for improved code organization. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46395?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
hasithasandun
|
108a7c2c11 |
chore: migrate auth policy editor modal to dialog (#46374)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor ## What is the current behavior? The Auth policy editor flow still uses the deprecated `Modal` component and `Modal.Content` / `Modal.Separator` helpers. ## What is the new behavior? The Auth policy editor flow now uses `Dialog` primitives instead: - `Dialog` - `DialogContent` - `DialogHeader` - `DialogTitle` - `DialogSection` - `DialogSectionSeparator` Behavior is intended to remain unchanged. ## Additional context - Fixes #46375 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Updated the policy editor and review flows to a unified dialog layout for a cleaner, more consistent UI. * Sections and footer controls were reorganized for clearer grouping and improved button placement. * Existing behaviors (viewing templates, review/save flow, and close confirmation) are preserved. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46374?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
498d051d88 |
feat(studio): add project settings shortcuts (#46352)
## What kind of change does this PR introduce? Feature. Resolves FE-3417. ## What is the current behavior? Project Settings has a top-level `G then ,` shortcut, but its subnavigation and repeated key/log drain actions do not have scoped keyboard shortcuts or visible shortcut tooltips. | Area | Current behaviour | | --- | --- | | Project Settings sidebar | Routes are click-only once users are inside Settings. | | API/JWT keys | Creation buttons do not expose keyboard shortcuts. | | Log Drains | Add/save destination actions do not expose keyboard shortcuts. | ## What is the new behavior? Adds scoped Project Settings navigation chords, shortcut tooltips on the sidebar rows, and page/action shortcuts for API keys, JWT standby keys, and Log Drains. | Area | New shortcut coverage | | --- | --- | | Project Settings sidebar | `S then G/C/I/N/W/K/J/L/A/D` for eligible in-section routes. | | API Keys | `Shift+P` and `Shift+S` open the publishable/secret key dialogs; `Mod+Enter` submits the open dialog. | | JWT Keys | `Shift+N` opens Create standby key; `Mod+Enter` submits the open dialog. | | Log Drains | `Shift+N` adds a destination when the primary action is available; `Mod+Enter` saves the open destination sheet. | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added keyboard shortcuts for Project Settings navigation and for actions in API Keys, JWT Keys, and Log Drains (open, create/submit). * **Improvements** * Dialogs and forms now support keyboard-triggered open and submit actions with improved enable/disable gating and updated settings menu composition; shortcuts appear in the shortcuts reference. * **Tests** * Added tests covering shortcut wiring and shortcut-driven open/submit behaviors across dialogs and action panels. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46352?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Jordi EnricandClaude Opus 4.7
|
5c85ec9035 |
feat(studio): format Logs Ingest and Logs Query usage as GB FE-3400 (#46387)
- adds new log ingestion billing metrics Linear: FE-3400 Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
Terry SuttonandClaude Opus 4.7
|
fc7f7f105a |
fix(studio): use public support link on MFA sign-in error (#46382)
Fixes: https://x.com/acgfbr/status/2058995058167185731 The default `<AlertError>`appends a `<ContactSupportButton>` that opens the support form. It requires an authenticated session and `projectRef`. On the pre-auth MFA error, neither exists, so the button doesn't work. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced error messaging in multi-factor authentication sign-in with improved navigation options, allowing users to quickly return to sign-in or contact support directly from error states. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46382?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
810b395888 |
feat(studio): hide Postgres connection logs by default in unified logs (#46371)
## Problem The unified logs view shows Postgres connection lifecycle events (connection received, connection authenticated, connection authorized) alongside application logs. These messages are emitted on every database connection and make it hard to spot meaningful log entries. ## Fix Adds a SQL-level filter that excludes Postgres connection messages by default. A toggle in the filter sidebar lets users opt in to seeing them when needed. The preference is stored in the URL so it persists across navigation. **Changes:** - `SEARCH_PARAMS_PARSER` gets a new `hide_connection_logs` boolean param (default `true`) - `buildBaseWhere` in the query builder emits a `NOT (source = 'postgres_logs' AND event_message LIKE 'connection %...')` predicate when the param is true, filtering at the query level - New `ConnectionLogsToggle` component renders a labeled switch in the filter sidebar - `FilterSideBar` gains a `beforeFilters` slot so the toggle can be injected without coupling the generic component to log-specific logic ## How to test 1. Open a project in Studio and navigate to the unified logs page 2. Confirm that connection log messages (e.g. "connection received: host=...", "connection authorized: user=...") are not visible by default 3. In the left filter sidebar, find the "Connection logs" toggle near the top and switch it on 4. Confirm that connection log messages now appear in the list 5. Toggle it back off and confirm they disappear again 6. Reload the page with the toggle on (URL will contain `hide_connection_logs=false`) and confirm the setting is preserved <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a "Connection logs" toggle in the filter sidebar to hide Postgres connection lifecycle messages by default (default = hidden); changing it updates the logs view and the logs chart. * Filter sidebar now supports placing extra controls so the toggle is available alongside existing filters. * **Behavior** * Facet/count queries remain unaffected by this toggle to preserve existing counts. * **Tests** * Added tests verifying default hide behavior and explicit show behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46371?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
