mirror of
https://github.com/supabase/supabase.git
synced 2026-10-05 17:35:10 +03:00
docs/functions-auth-structure
14
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Saxon FletcherandClaude Opus 5.5
|
a9c594a820 |
chore(library): rename mcp-server block to mcp (#50999)
Renames the `mcp-server` Library block to `mcp`. Installing it now creates `supabase/functions/mcp`, so the server is served at `/functions/v1/mcp`. - Block, Edge Function folder, and docs page renamed (`/docs/headless/mcp`) - Headless App block now installs its tools into `supabase/functions/mcp` and configures `[functions.mcp]` - Links in the BYO MCP and MCP authentication guides updated - Permanent redirects keep `/r/mcp-server.json` and `/docs/headless/mcp-server` working - `public/r` rebuilt <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * The MCP Server block is now named `mcp` across its documentation, installation links, and setup instructions. * Updated function endpoints and deployment commands to use `/mcp`. * Added permanent redirects from the previous `mcp-server` documentation and install URLs to their new locations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
3f205627e0 |
feat(library): redesign the site around the block catalog (#50372)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — the visual redesign itself. Part 5 of 6 in a stack that splits the library redesign into reviewable pieces. The four PRs beneath it carry the build, content and Markdown work; what's left here is layout, navigation and styling. ## What is the current behavior? The library is laid out like a documentation site: a sidebar tree of framework folders, a homepage that lists links, and a guide page that opens with prose. That shape suits reference material, but the library's job is to help someone find a block and install it — and the sidebar is the only way to discover one. ## What is the new behavior? The homepage is the catalog itself — blocks grouped by what they do (authentication, database, storage, realtime, messaging, AI, foundations) rather than by framework, each with a preview of what it renders, filterable by category. Navigation moves into a site header whose Explore menu opens the same categories, so the catalog is reachable from any page and the per-page sidebar tree is gone. A guide opens with what the reader came for: the block's name, the install command, and a preview pane with tabs — the running component and its files — before any prose. The file tree that used to sit mid-page under "Folder structure" is one of those tabs. Every guide also offers a copy of the agent prompt that points at its Markdown. Getting-started pages get the same treatment: the quickstart is now a framework-tabbed walkthrough rather than a wall of setup links. ## Additional context `BlockOverviewTabs` renders Preview and Files here. #50369, stacked on top of this one, adds the third "What's added" tab — it is the only part of the redesign that depends on the new resource analyzer, which is why it sits above this PR rather than below it. Also removes what the redesign orphaned: the table-of-contents component and its `remark` / `mdast-util-toc` dependencies, and the sidebar nav and command-item configuration the new header replaced. The block source changes are typography only — auth card titles move from `text-2xl` to `font-medium text-lg tracking-normal` — which is what regenerates the auth registry artifacts. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a redesigned Supabase Library catalog with categorized blocks, framework-aware navigation, previews, file views, and installation actions. * Added framework-specific quickstart guides for Next.js, React, Vue, Nuxt, React Router, and TanStack Start. * Added copy-to-clipboard prompts, “Open in v0” actions, starter templates, and richer visual previews. * **Improvements** * Updated documentation layouts, FAQ content, typography, navigation, accessibility, and responsive behavior. * Improved mobile navigation, framework selection, and standardized block installation guidance. * Refined authentication and social-login block presentation with more consistent heading styles. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> |
||
|
|
3e79df3ece |
feat(library): serve the block catalog as Markdown and harden the exporter (#50370)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature, bug fix. Part 3 of 6 in a stack that splits the library redesign into reviewable pieces. ## What is the current behavior? An agent can already fetch any guide as Markdown, but has no way to find out what guides exist: the entry point is a rendered React page. The exporter also fails quietly in ways that ship wrong output rather than failing the build: - An unknown component silently unwraps to its children, so a component rename drops its rendered content. - A registry item that cannot be read produces a page with no file listing. - A link to a missing page produces a 404 URL. - An unrecognized install framework produces a plausible command for the wrong CLI. - Only absolute `/library/docs` links are rewritten, so in-page anchors and sibling links break in the export. ## What is the new behavior? `/library` negotiates Markdown the same way the guides do — `Accept: text/markdown`, or an explicit `/library/index.md` — and returns a categorized catalog with every block, its description, its framework variants, and a link to each guide's Markdown. `config/library.ts` is the single catalog description the generator reads, and a test ties it to the content directory in both directions: a guide cannot be added without a catalog entry, or listed without a guide. Each quiet failure above now throws, and links resolve against the page they appear on and are checked against the set of published documents. ```bash curl -H 'Accept: text/markdown' https://supabase.com/library ``` ## Additional context `config/library.ts` also carries the category and preview metadata the redesigned homepage consumes in the last PR of the stack; here it is exercised by the Markdown index and its test. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a browsable library catalog covering categories, blocks, starter apps, and supported frameworks. - Added Markdown versions of the library homepage and documentation for compatible tools and workflows. - Added framework-aware links and expanded registry information, including dependencies and source details. - Markdown requests now work for the homepage and documentation, while browser requests continue receiving HTML. - **Bug Fixes** - Improved document link handling, metadata validation, slug consistency, and detection of duplicate or missing documentation entries. - **Tests** - Added coverage for catalog routes, Markdown generation, homepage negotiation, document parsing, and framework-specific links. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
|
abbac3b852 |
refactor(library): resolve registry dependencies from one source of truth (#50367)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor, bug fix. Part 1 of 6 in a stack that splits the library redesign into reviewable pieces. This one is the foundation the rest build on and has no visual change. ## What is the current behavior? Three build steps each reimplement "where does this registry file land in the user's project": `process-registry`'s `getDefaultPath`, `registry/utils`' `uniqBy` on `file.path`, and the Markdown exporter. They disagree, which produces real bugs: - A Vue block whose files come from `node_modules/@supabase/vue-blocks/` keeps its package path, so the installer writes the package folder into the user's project. - `registryItemAppend` builds its `docs` string from `(item.docs, items.flatMap(...))` — a comma expression, so the item's own docs are discarded. - A name collision between a block file and its client's file silently keeps one of the two. - Install commands guess the CLI family from substrings in the item name, so `infinite-query-composable` — a Vue block with neither "vue" nor "nuxtjs" in its name — gets the React CLI. - Production Vue installs use `@supabase/<name>`, but the `@supabase` namespace is registered with shadcn, not shadcn-vue. - `build:registry`, `build:content`, `build:markdown` and `build:llms` run in parallel, but the last three read `public/r`. ## What is the new behavior? `lib/registry-resolution.ts` owns installed-path derivation, first-party dependency naming, deduplication, and cycle detection, and every consumer calls it. `build-registry` validates the whole registry against shadcn's schema and resolves every item, so a broken reference fails the build instead of shipping. `clean-registry` throws rather than logging past a failure. Pages declare their install `framework` explicitly instead of it being inferred, and production Vue installs use the absolute registry URL. The build steps are serialized behind `build:prepare`, and a new `library-tests.yml` workflow runs the library's tests, checks the generated registry is committed, and builds the app. ## Additional context Regenerated registry artifacts are the mechanical result of the resolution fix — the Vue client items and the OAuth consent items that gained their client's docs. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added explicit React and Vue framework selection for library blocks and installation commands. * Improved registry resolution, dependency handling, path validation, and Vue file normalization. * Added support for reliable local, preview, and production registry URLs. * **Documentation** * Updated Vue and Nuxt installation documentation to identify the Vue framework explicitly. * **Bug Fixes** * Preserved combined documentation and validated generated registry content more consistently. * **Tests** * Added coverage for installation commands, registry resolution, dependency handling, and generated artifacts. * **Chores** * Added automated pull-request checks for library tests and builds. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
|
19d7233580 |
feat(ui-library): add headless app block for TanStack Start (#49579)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — a new UI Library block. Stacked on #49573 (already in main) Fixes AI-1064 ## What is the new behavior? Adds `headless-app-tanstack`: customers sign in, authorize an MCP client, and use the product through agent tool calls. It composes the existing Password-Based Auth, OAuth Consent, and MCP Server blocks. - `/agents` provides a copyable connection prompt, lists OAuth authorizations, and lets customers revoke access. - The shared MCP runtime exposes `whoami` plus example task CRUD tools. Tools use the caller's Supabase client, with database grants and RLS enforcing ownership. - A root-level `supabase/` directory supplies local Auth/OAuth configuration, a declarative tasks schema, and Edge Function files, including `.env.example`. - Docs cover local setup, signing keys, migrations, environment configuration, deployment, and extending the tools. `/example/headless-app` previews the sign-in, consent, connect, and connected states. Shared block fixes make a fresh install work: - Explicit public URL resolution fixes OAuth discovery in local Edge Runtime when middleware runtime detection fails. Both external OAuth access tokens and ordinary authenticated app session tokens remain supported; embedded agents do not need an additional consent flow. - Registry targets keep backend files outside `src/`, and generated consumer routes omit source-only TypeScript suppressions. - Signup respects `auth.email.enable_confirmations`; sign-in/signup preserve the return destination. Missing consent IDs retain the existing error state without serializing `null` into the URL. ## How to test Use the UI Library on **staging** and follow the block pages' instructions. 1. Open the **Headless App** block page for TanStack Start. Install it into a fresh app and follow the setup instructions through connecting an MCP client. 2. Sign up, open `/agents`, and use the connection prompt to authorize a client. Call `whoami`, then create, list, update, and delete a task. 3. Confirm the client appears on `/agents`. Revoke access and verify it disappears and token refresh fails. An existing access token can continue working until it expires. 4. Follow the **MCP Server** block page's embedded-agent instructions using an authenticated app session. Confirm tools work without another OAuth consent flow and `whoami` returns `client_id: null`. 5. With a second user, confirm each user can only access their own tasks. Check that signup behaves correctly for the configured email-confirmation setting. 6. Check the Headless App preview states and run the installed app's typecheck and production build. ## Validation performed Fresh local installation and browser/SDK verification passed: 26 live MCP/Data API checks, 10 Deno tests, and 7 connection-page component tests. Also passed UI Library typecheck, targeted lint, registry/Markdown builds, and fresh consumer typecheck/production build. Both OAuth and ordinary app session authentication were exercised. Hosted deployment and consuming the confirmation-email link were not tested. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a TanStack Headless App example with sign-in, OAuth consent, MCP connection, and connected-agent screens. - Added task management tools for listing, creating, updating, and deleting tasks through MCP. - Added connected-agent management, including server URL and prompt copying, refresh, and access revocation. - Added a new Headless App registry block and documentation. - **Bug Fixes** - Preserved intended destinations through sign-up, email confirmation, and protected-route login redirects. - Improved OAuth discovery URL handling across forwarded-host deployments. - **Documentation** - Updated setup, environment, deployment, and Supabase CLI guidance for headless apps and MCP servers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: repro <repro@local> Co-authored-by: Raúl Barroso <code@raulb.dev> |
||
|
|
bf60e6cdce |
feat(library): serve agent-readable markdown for each docs page (#49567)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature: agent-readable markdown pages for the UI library docs. ## What is the current behavior? Library docs are HTML-only. `llms.txt` lists page titles, but there is no `.md` body an agent can fetch. ## What is the new behavior? Each docs page is also served as markdown: - Build-time MDX → markdown (`pnpm --filter library build:markdown`) - `GET /library/docs/{slug}.md` (and `Accept: text/markdown`) - HTML pages advertise `rel=alternate` `text/markdown` - `llms.txt` links to the `.md` URLs This is the base of a stack. The prompt-tab PR sits on top: https://github.com/supabase/supabase/pull/49566 ## Additional context Interactive previews are omitted from the markdown. `BlockItem` emits the production `npx shadcn add` command so agents still get an install path. ## To test 1. `pnpm --filter library dev` (generates markdown in `predev`). 2. Open http://localhost:3004/library/docs/nextjs/password-based-auth.md — markdown with the install command, file tree, and setup steps; no interactive previews. 3. Open the same path without `.md` — HTML docs unchanged (no prompt tab in this PR). 4. `curl -H 'Accept: text/markdown' http://localhost:3004/library/docs/nextjs/password-based-auth` should also return markdown. 5. http://localhost:3004/library/llms.txt — links should end in `.md`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Documentation pages are available as Markdown through `.md` URLs and a dedicated endpoint. * Markdown is generated automatically during development and production builds. * Generated content preserves front matter, links, callouts, installation instructions, and supported documentation elements. * Installation commands support npm, pnpm, yarn, and bun for React and Vue projects. * **Bug Fixes** * Improved Markdown file handling, link rewriting, and content negotiation. * **Tests** * Added coverage for Markdown conversion, content negotiation, and installation commands. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Saxon Fletcher
|
cb35e1f98e |
chore(library): update routes, redirects, and naming (#48668)
Our UI Library registry is expanding to include blocks that go beyond UI and in some cases focus purely on back-end. This PR is a precursor to adding more back-end related blocks. This PR includes the `ui-library -> library` rename plus redirects and small UI copy updates. Since this is a rename we'll need to update Vercel configuration. ## Vercel rollout Keep the Library project Root Directory as `apps/ui-library` 1. In the **Library** Vercel project, set: `NEXT_PUBLIC_BASE_PATH=/library` Apply it to Preview and Production, then redeploy the Library project. 2. In the **www** Vercel project, add: `NEXT_PUBLIC_LIBRARY_URL=<current value of NEXT_PUBLIC_UI_LIBRARY_URL>` Apply it to Preview and Production. Keep `NEXT_PUBLIC_UI_LIBRARY_URL` during the migration, then redeploy the www project. 3. Deploy in this order: 1. Library project 2. www project 4. Validate: - `/library` - `/library/docs/nextjs/password-based-auth` - `/ui` redirects to `/library` - `/ui/docs/nextjs/password-based-auth` redirects to `/library/docs/nextjs/password-based-auth` - `/ui/docs/ai-editors-rules/*` still uses its existing Docs redirects No Vercel dashboard redirect rules are needed. Environment-variable changes require a new deployment. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Supabase UI Library has been renamed to **Supabase Library** across navigation, pages, documentation, and resource links. * The Library is now available at `/library`, with updated descriptions covering components, blocks, and developer tools. * **Bug Fixes** * Added permanent redirects from legacy `/ui` URLs to corresponding `/library` paths. * Updated links throughout the site and documentation to prevent broken navigation and references. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tiago Antunes
|
b79a64e301 |
feat: add Realtime Flow component (#44273)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature, docs update ## What is the new behavior? This PR introduces a new `RealtimeFlow` component and hook to the UI library for building collaborative React Flow with Supabase Realtime: - keeps nodes and edges in sync across multiple connected clients in real time - uses Yjs with `@supabase-labs/y-supabase` to propagate flow updates - supports optional persistence, so a flow can be restored from previously saved shared state ## Additional context https://github.com/user-attachments/assets/90d3a381-6f9c-427f-a493-5d91c2141462 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Collaborative "Realtime Flow" diagram editor with syncing overlays and a dual-view demo component * Interactive demo page and registry example for live editing (add/remove/rename nodes) * Framework-ready registry packages for Next.js, React, React Router, and TanStack * **Documentation** * Comprehensive docs added for Next.js, React, React Router, and TanStack (usage, persistence, hook API) * **Chores** * Added runtime dependency for the flow component package [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/44273) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan Vasilov
|
191a291c2d |
feat: Preliminary work for shadcn add @supabase/...block... (#39322)
* Build the current registry. * Export the blocks as JSON and import them into registry.json. * Move the registry.json into public/r. * Fix a prettier error. * Clean up extra files in vue blocks. * Bump shadcn. * Readd shadcn to vue blocks. * Fix the shadcn types. * Remove extra package exclusions. |
||
|
Ivan Vasilov
|
501918857b |
chore: Remove unused code from ui-library (#38374)
* Remove unneeded code. * Remove more unused code. * Update knip.jsonc for ui-library. * Remove unneeded imports. Change the registry generation to only generate what's needed. * Cleanup the rehype middleware (it wasn't used). Clean up the example blocks generation. * Don't show the "show code" button in all dropzone examples. |
||
|
Ivan Vasilov
|
75ead31767 |
feat: polish React Auth in library (#34417)
* Minor updates to tanstack and nextjs auth. * Update the react client. * Update the react auth block. * Fix the clean-registry command. |
||
|
Jonathan Summers-MuirandIvan Vasilov
|
846b470f9d |
chore: uses iframes for UI lib examples. (#34419)
* init * Update component-preview.tsx * please note: changed redirects in block, so need to update the logic to find and replace the redirects * Fix the redirect urls to work when installing and in examples. * Revert some of the changes. * Add a step when building the registry to clean the registry of example code. * Fix the clean registry script. --------- Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Ivan Vasilov
|
0990155ae7 |
feat: more fixes for UI library (#34355)
* Regenerate the registry files. * Regenerate the llms.txt file. * Set the supabase project for testing. * Fix the registryBlock component. * Various fixes. * Add missing deps to satisfy TS build. * Fix the tanstack client. * Add a tanstack block for password-based auth. * Fix the command URL. * Fix the env vars in the React client. * Add missing pages to the nextjs auth. * Simplify the tanstack auth block. * Add success state to the forgot-password form. * Fix the v0 button. Add some more docs. * Revert some changes. |
||
|
Ivan Vasilov
|
33127bb6ab |
feat: Library (#34294)
* Copy the design-system app into a new one for ui-library. * Remove unneeded content. * Add supabase config. * Cleanup the css. * Add bunch of packages. * Cleanup the registry. * Regenerate the registry. * Add needed components for documenting components. * Add the pages for the components. * Fix the RegistryBlock. * Various fixes. * Add a turbo definition for ui-library. * Rename Remix to React Router. * Reorder the pages for all frameworks. * Remove the bottom pager. * Fix the pages and command menu. * Various fixes. * Minor fixes. * Add ai editor rules. * Various fixes. * Add local supabase env vars. * Try to fix a package error. * Bunch of various fixes. * Fix lint errors. |
