479 Commits

Include renames

Author	SHA1	Message	Date
Joshen Lim	d11bd4997e	Revert "Support form Assistant" (#46194) ... Reverts supabase/supabase#45861 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Support form now returns to home view upon completion within the help panel. * Success screen conditionally displays community (Discord) section for specific issue categories. * **Bug Fixes** * Improved project selection logic in support form initialization. * **Style** * Updated support form label text for clarity. * Redesigned success screen layout with updated styling and separators. * **Removed Features** * Removed support assistant follow-up card from success screen. * Removed support request message parsing from AI responses. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46194?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-21 14:28:40 +07:00
Saxon FletcherandGildas Garcia	af7d953f52	Support form Assistant (#45861) ... When a support from is submitted, we believe there is an opportunity to help people before a human receives and responds. Human support is still involved regardless of whether Assistant helps or not, so this is to positioned as a "while you wait" type experience. ## To test: - Enable to `supportAssistantFollowUp` feature flag - Open a project - Open the support form and submit a request - Note the success state and the additional Assistant card - Note text generation in card - Clicking card should open the Assistant conversation <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * AI assistant follow-up card appears after submitting a support ticket to continue the conversation * Support request preview rendered in the assistant panel showing subject/message when present * **Bug Fixes** * Improved project selection fallback during support form initialization * **Improvements** * Refined success layout and messaging; finish action behavior simplified [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45861) <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>	2026-05-21 09:16:48 +10:00
Mert YEREKAPAN	1ef80fec23	chore(studio): remove HeaderUpgradeButton experiment code (#46144) ... ## Summary - Removes the `HeaderUpgradeButton` component, all call sites, and the `HeaderUpgradeCtaClickedEvent` telemetry type. The GROWTH-615 header upgrade CTA experiment ended on Apr 29. - Fixes the `Flag key "headerUpgradeCta" does not exist in PostHog flag store` console errors that were logging on every render. PostHog drops disabled flags from `/feature-flags` responses, so the still-mounted consumer logged a missing-flag warning continuously. Removing the consumer lets the flag be safely disabled again. Context: [Slack thread](https://supabase.slack.com/archives/C07P3AU3J2D/p1779250648219089?thread_ts=1779166940.445709&cid=C07P3AU3J2D) ## Test plan - [x] `pnpm dev:studio`, open the dashboard, confirm no `headerUpgradeCta` warning in the browser console - [x] Desktop header still renders correctly (the button was hidden behind the `test` variant; visually nothing changes for users since rollout was 100/0 control) - [x] Mobile nav bar still renders with `UserDropdown` to the right of the org/project selector <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Removed the upgrade call-to-action button from the navigation header in both desktop and mobile layouts. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46144?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-20 10:38:04 +00:00
3 people	dc986674d9	chore(studio): integrations Marketplace layout (#45856) ... Introducing a new Integrations Marketplace layout - behind feature flag - behind opt-out feature preview (default to true) to easily toggle before and after Doesn't introduce new functionality, only layout change behind ff. ## What changed Nothing if `marketplaceIntegrations` flag is off. ### With flag - New Marketplace index layout - filter via text or by `category`, `integration type` and `source` - Featured Partners Integrations hero (hidden when any filter is active) - toggle between `grid` and `list` view - new integration detail page layout - with top action bar - more consistent fullWidth or narrow content layouts - can access Feature Preview toggle under Account Dropdown > Feature Previews > Marketplace ## How to review and what to test I recommend reviewing file changes from bottom to top in https://github.com/supabase/supabase/pull/45856/changes because it makes more sense from a pr-logic perspective. - [ ] Visit https://studio-staging-git-chore-integrations-ui-refine-fs-supabase.vercel.app/dashboard/project/_/integrations - [ ] Check if new layout doesn't have big layout issues like weird paddings or margins mostly. (We can iterate in upcoming PRs for additional features/fixes) - [ ] Toggle "Marketplace" feature preview to `FALSE` and check that the Integrations layout looks like in prod https://supabase.com/dashboard/project/_/integrations - [ ] Also check individual integration pages and toggle the feature preview on and off to see before and after and check if everything looks good <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Full Marketplace experience: explorer with featured hero, filters/search, list & grid views, cards, sidebar, detailed integration pages, install flows, badges, and a preview toggle. * **Bug Fixes** * Prevented stale markdown from showing when switching integrations. * **Style** * Improved responsive layouts, loading placeholders, and header/nav full-width behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45856) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Saxon Fletcher <saxonafletcher@gmail.com> Co-authored-by: Raminder Singh <romi_ssk@yahoo.co.in>	2026-05-20 11:01:32 +02:00
Sean Oliver	fdceb29260	fix(telemetry): exposure event captures dataApiDefaultPrivileges + drop race-fix hook (#46085) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? This PR addresses three issues with the implementation of the `dataApiRevokeOnCreateDefault` experiment ([GROWTH-858](https://linear.app/supabase/issue/GROWTH-858)) on the frontend side: 1. The `project_creation_default_privileges_exposed` event payload captures `dataApiEnabled`, which is the parent "Enable Data API" toggle. That value defaults to `true` for everyone in both arms, which doesn't help understand how people are interacting with the form. 2. The hook itself was gating on PostHog JS SDK values rather than our backend server values being sent from `/telemetry/feature-flags`. 3. The form on `/new/[slug]` captures `dataApiDefaultPrivileges` defaults once at mount via react-hook-form's `defaultValues`. If the flag is still loading when the page mounts, `useDataApiRevokeOnCreateDefaultEnabled()` returns `false` (coerced from undefined), and the form locks the field to the legacy default of `true`. The flag later resolving has no effect, and treatment users get the legacy default visually and in the exposure event. ## What is the new behavior? 1. Main-surface payload now sends `dataApiDefaultPrivileges` — the form field the experiment actually controls (`true` = legacy grants kept, `false` = revoked on create). Post-fix data will let us read out whether treatment users actually got the new default. 2. Hook is simplified: drop `orgCountReady`, drop the `onFeatureFlags` subscription, drop the `posthogClient` import. It now fires once when the flag resolves, period. Vercel surface is unchanged (still no `dataApiDefaultPrivileges` since there's no user-facing toggle there). Tests updated. 3. New useEffect in `/new/[slug]` watches the raw flag value and syncs `dataApiDefaultPrivileges` to the correct experiment-driven default when the flag resolves, gated on `getFieldState(...).isDirty` so we don't clobber intentional user input. ## Additional context Backend half of this fix is at supabase/platform#32933 (passes `org_count` and `signup_timestamp` in `personProperties` so the audience filter actually evaluates correctly). Both PRs are needed for the experiment to bucket at 5% and be measurable. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Changes** * Telemetry now records the selected default-privileges setting (dataApiDefaultPrivileges) in project-creation events; the previous dataApiEnabled field was removed. * Project-creation flows apply the experiment-driven default for that setting once the experiment resolves, but they do not overwrite user-edited choices. Vercel new-project flow syncs with the experiment until the user changes the checkbox. * **Tests** * Updated tests to validate tracking, deduplication, and sync/timing behaviors for dataApiDefaultPrivileges. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46085?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-19 12:54:36 -07:00
Pamela Chia	0bed80b340	chore(telemetry): clean up frontend event catalog (#45964) ... ## Summary Resolves 13 findings (2 HIGH, 5 MEDIUM, 6 LOW) from the frontend telemetry audit: 1 action-string collision, 1 camelCase experiment name, 9 dead events removed, 4 missing org groups attached, 1 ambiguous property renamed, 1 raw-string property narrowed, plus consolidations and a structural tightening on TABLE_EVENT_ACTIONS. ## Changes ### HIGH - Rename `EventPageCtaClickedEvent.action` to `www_event_page_cta_clicked` so it no longer collides with the pricing CTA event (which had a different schema sharing the same action string) - Snake_case the header-upgrade experiment exposure name (`headerUpgradeCta_experiment_exposed` → `header_upgrade_cta_experiment_exposed`); PostHog flag key and `?source=` URL param unchanged ### MEDIUM - Remove 4 dead `ProjectCreation*Step*` events (referenced a v2 route that doesn't exist; 0 emissions) - Remove 4 dead experiment exposure events: `ProjectCreationRlsOptionExperimentExposed`, `HomeNewExperimentExposed`, `TableCreateGeneratePoliciesExperimentExposed`, `TableCreateGeneratePoliciesExperimentConverted` (0 emissions) - Attach org group to `dpa_request_button_clicked` (0% had `$group_0` per Hex) - Delete `RegisterStateOfStartups2025NewsletterClicked` (interface naming outlier, 0 emissions, page renamed to 2026) - Rename `AssistantSuggestionRunQueryClickedEvent.category` to `mutationType` with tightened literal union (`'functions' | 'rls-policies' | 'unknown'`) - Attach org group to `project_creation_default_privileges_exposed` on Vercel surface via explicit `groupOverrides` (auto-injection misses because `useSelectedOrganizationQuery` is undefined on that page) ### LOW - Consolidate `IndexAdvisorBannerEnableButtonClickedEvent` + `IndexAdvisorDialogEnableButtonClickedEvent` into one event with `origin: 'banner' | 'dialog'` - Rename `ImportDataFileDroppedEvent` → `ImportDataFileAddedEvent` so the interface name matches the action and the verb is on the approved list - Rename `LogDrainConfirmButtonSubmittedEvent` → `LogDrainRemovedEvent` and action to `log_drain_removed` (fires on delete-confirm modal, matches `CronJobRemovedEvent` pattern) - Add `type` property to `CronJobRemovedEvent` (parsed from the job's command), matching the create/update event shape - Tighten `TABLE_EVENT_ACTIONS` values with `satisfies` against the event union so renames in the union fail typecheck here too - Attach org group to `www_pricing_plan_cta_clicked` at 5 emission sites when an org is available in the page context - Narrow `unified_logs_row_clicked.logType` from raw `string` to the 5-literal `LOG_TYPES` union (zod already validates server values) ### Bundled refactor Migrated 5 emission sites from deprecated `useSendEventMutation` to `useTrack` while their containing files were being edited: `DPA.tsx`, `DisplayBlockRenderer.tsx`, `Grid.tsx` (2 events), `DeleteCronJob.tsx`. Full sweep of the remaining ~79 files is a separate follow-up. ## Testing Mostly just renaming of events ## Linear - fixes GROWTH-798 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Standardized telemetry to a unified tracking system for more consistent analytics. * Simplified experiment exposure reporting for upgrade prompts. * **New Features** * More granular tracking for CSV import, cron job deletions, log drain removals, DPA downloads/requests, and pricing CTAs. * Assistant now classifies mutation queries more precisely. * **Bug Fixes** * Improved default-privileges exposure logic on Vercel deployments (skips when org missing). <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45964) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-18 18:21:58 +08:00
Gildas Garcia	86a3f8b03d	chore: upgrade to react-19 (#45886) ... - Most changes are related to either types or `useRef` usages (it now requires an initial value). - also updated `vaul` to its latest version and haven't noticed any change ([design-system demo](https://design-system-git-react-19-supabase.vercel.app/design-system/docs/components/drawer)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Upgraded workspace to React 19. * **Bug Fixes** * Improved null-safety and ref handling across editors, UI components, shortcuts, and markdown/image rendering to reduce runtime errors. * Safer event/timeout/interval cleanup and more robust command/context handling. * **Chores** * Bumped vaul dependency versions. * **Documentation** * Type and TypeScript accuracy improvements for clearer developer feedback. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45886) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-15 16:04:41 +02:00
Sean Oliver	856b2badf7	feat(telemetry): mirror signup_timestamp to PostHog person property (#45951) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — tiny telemetry addition. +7/-1 in one file. ## What is the current behavior? [PR #45946](https://github.com/supabase/supabase/pull/45946) added `org_count` as a PostHog person property to unblock targeting on org membership. But `org_count` is set on every authenticated session (the `Telemetry` component fires identify whenever `user.id` + `organizations` resolve), not just at signup completion. That means flag filters like `person.org_count == 1` match two populations: - Brand-new dashboard signups currently in their first org (intended) - Returning users who happen to have one org and just signed in (not intended) For the upcoming `dataApiRevokeOnCreateDefault` experiment, this contaminates the activation comparison because the "returning single-org" group can't activate (they already did, months ago), diluting the measured effect. ## What is the new behavior? Adds `signup_timestamp: user.created_at` to the existing `posthogClient.identify` call in `useTelemetryIdentify`. Since gotrue's `user.created_at` is immutable, the value stays constant across sign-ins — no need for `$set_once` semantics, no race with anonymous activity, no cohort refresh lag. Flag targeting can now combine `person.org_count == 1 AND person.signup_timestamp >= <experiment_start_date>` to cleanly scope to brand-new signups. ## Testing No new unit tests added — the existing `useTelemetryIdentify` function has no test file, the change is one additional field on an existing call, and the property's correctness is verifiable end-to-end (sign up → check PostHog person record). Adding to the test ticket [GROWTH-854](https://linear.app/supabase/issue/GROWTH-854) for coverage along with the broader posthog-client wrapper tests. ## Additional context Ref: [GROWTH-853](https://linear.app/supabase/issue/GROWTH-853) This is the follow-up gate before the 5% rollout of `dataApiRevokeOnCreateDefault` — without this, the experiment would mix brand-new signups with legacy single-org users on sign-in. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Enhanced telemetry and analytics data collection for signed-in users by improving user identification tracking and adding signup timestamp information for better analytics insights. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45951) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-14 13:47:36 -07:00
Sean Oliver	4c77ab5fef	feat(telemetry): mirror org_count to PostHog person property (#45946) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature + two follow-on fixes — small, scoped to telemetry / experiment plumbing. ## What is the current behavior? PostHog feature flags evaluated in Studio only have access to the `gotrue_id` person property (set in `useTelemetryIdentify`) and the `organization`/`project` group associations from pageviews. Flags can't target users by org membership without a behavioral cohort, which refreshes on a ~hourly schedule and lags behind real-time signup state. This is blocking the rollout of the `dataApiRevokeOnCreateDefault` experiment ahead of the May 30 default-privileges breaking change — we need to target brand-new dashboard signups with no prior org membership, and there's no person property to filter on. ## What is the new behavior? Three changes, scoped tightly to make experiment targeting reliable for brand-new signups: ### 1. Mirror `org_count` to a PostHog person property (`apps/studio/lib/telemetry.tsx`) The Studio `Telemetry` component now mirrors the user's current org-list length to a PostHog person property `org_count` via `posthog.identify(user.id, { org_count })`. The effect: - Subscribes to `useOrganizationsQuery` (shares the same React Query cache as `useSelectedOrganizationQuery`, so no extra network requests). - Dedupes via a ref keyed on `{ userId, orgCount }` so we only call identify when the value actually changes — handles user-switch (logout/login as different user with same count) correctly. - Generic enough to be useful beyond this experiment — analytics segmentation by org membership, future flags that depend on multi-org behavior, etc. ### 2. Merge pre-init identify properties (`packages/common/posthog-client.ts`) The previous `pendingIdentification` slot was a single-write buffer — calling `posthogClient.identify()` before the PostHog SDK initialized would overwrite any prior queued identify. Latent until this PR added a second identify caller (`org_count`), which exposed the last-write-wins behavior on first-visitor-before-consent flows. Now merges properties across pre-init calls for the same user so both `{ gotrue_id }` and `{ org_count }` land on the person record when the SDK flushes. Caught during Codex review. ### 3. Gate the exposure event on `org_count` being present (`apps/studio/hooks/misc/useDataApiRevokeOnCreateDefault.ts`) `useTrackDefaultPrivilegesExposure` previously fired on the first non-undefined value of the `dataApiRevokeOnCreateDefault` flag. For brand-new signups, this races the `org_count` identify: the initial `/flags/` response (before targeting can match) returns the untargeted variant, the exposure locks it in via `hasTracked`, then our identify fires and a subsequent `/flags/` refresh updates the flag — but the exposure has already recorded the wrong variant. Fix: gate the exposure on `org_count` being present on the SDK person, subscribing via `onFeatureFlags` so we pick up the post-identify `/flags/` response. Adds `posthogClient.getPersonProperty` as the local-state reader. Without this, the experiment would have a ~5-15% noise floor on cohort assignment for new signups. ## Verification End-to-end verified locally against the staging PostHog project (34343): - Local Studio's PostHog SDK has `$stored_person_properties: { gotrue_id: <uuid>, org_count: 1 }` after sign-in. - Both `$set` events landed server-side within ~300ms of each other, and the staging person record now shows `org_count = 1.0` with `gotrue_id` preserved. - Targeting query `person.properties.org_count == 1` works end-to-end against staging. ## Additional context Ref: [GROWTH-853](https://linear.app/supabase/issue/GROWTH-853) Targeting plan for the flag once shipped: `person.org_count == 1` plus a behavioral filter on recent `sign_up` event, at 5% rollout. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Telemetry now records and syncs the user's organization count as an analytics person property and avoids redundant identifications when unchanged. * Analytics client now merges queued identification properties made before initialization and exposes a method to read stored person properties. * **Bug Fixes** * Tracking now waits for organization-count readiness before firing certain exposure events to prevent missing data. * **Tests** * Added/updated tests to cover person-property behavior and gating logic. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45946) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-14 12:52:43 -07:00
Charis	453c31da16	refactor(common): drop ConfigCat proxy probe in favor of waitForReady (#45939) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / performance. ## What is the current behavior? `packages/common/configcat.ts` does a two-step setup: a probe `fetch` to the ConfigCat proxy URL, followed by SDK client initialization with the proxy as `baseUrl` (or against the direct ConfigCat CDN if the probe fails). On the happy path this fires **two** network requests for the same JSON config on cold start — the probe, then the SDK's own initial AutoPoll fetch. ## What is the new behavior? The probe is removed. We initialize the proxy client directly and inspect the `ClientCacheState` returned by `waitForReady()`. On `NoFlagData` (proxy unreachable, no cache) we `dispose()` the proxy client and fall back to the direct SDK key client. Cold-start fetches drop from 2 to 1 when the proxy is healthy. Worst-case fallback delay is bounded by `maxInitWaitTimeSeconds` (5s default), comparable to today's probe timeout on a broken proxy. The unused exported \`fetchHandler\` is removed (no external importers — verified via grep). Tests in \`configcat.test.ts\` are updated to mock \`waitForReady\`/\`dispose\` and a new test covers the proxy-failure fallback path. ## Additional context Resolves FE-3174 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved ConfigCat client initialization with robust fallback handling when proxy is unavailable. * **Chores** * Removed `fetchHandler` export from ConfigCat module. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45939) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-14 12:32:58 -04:00
Joshen Lim	ea03214d3d	Support dock position (#45919) ... ## Context Added an option to change dock position when a row is selected in unified logs Just note that this involves the `LogsListPanel` - i'm not too sure how this will look like tbh as I don't have any logs in my unified logs UI that match the criteria to render the `LogsListPanel` (e.g there could be a scenario where we have 3 panes side by side) <img width="1452" height="955" alt="image" src="https://github.com/user-attachments/assets/21c1a576-7f63-463f-88bf-04c05691995b" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Users can now toggle the service flow panel dock position between bottom and right alignment * Dock preference is automatically saved and persists across sessions * **Bug Fixes** * Improved logs data validation in the logs list panel for more reliable rendering <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45919) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-14 20:52:10 +08:00
Raminder SinghandJoshen Lim	897043952a	feat: add edge function secret installation method (#45826) ... Adds a new method of installation detection for partners like Doppler. Doppler creates edge function secrets with specific names (`DOPPLER_CONFIG`, `DOPPLER_ENVIRONMENT`, and `DOPPLER_PROJECT`). This method allows the dashboard to check for the presence of such a secret to show the installation status. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Support for edge-function-secret-based OAuth identification and verification. * Installation checks adapt to the selected installation method and only fetch required credentials when needed. * Integration detection can validate installations via API key prefixes or matching edge-function secret names. * **Chores** * Shared helper utilities and types exported to streamline installation checks and mappings. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45826) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-05-14 13:52:29 +05:30
Joshen Lim	2d47836f39	Joshen/fe 3213 make rls tester feedback callout more obvious (#45820) ... ## Context Minor nit to adjust the "Give feedback" button at the bottom to use default type + external link icon <img width="612" height="68" alt="image" src="https://github.com/user-attachments/assets/e74370cb-d284-4552-a69d-8c838f565af7" /> Also added telemetry for the "Run query" button <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added analytics tracking for RLS Tester query runs to better understand how the feature is used. * **Style** * Updated the "Give feedback" button in the RLS Tester to use the default button style and display an external-link icon for clarity. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45820) <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-13 21:08:41 +08:00
Ivan Vasilov	0abe792889	chore: Migrate the main Tailwind JS config to CSS (#45686) ... This PR migrates the JS config for Tailwind into a CSS config. As such, all variables have been defined as CSS variables and they're using the specialized Tailwind syntax for generating utility classes. Beside the migration, these changes were also added: - Added `tailwind.config.css` to few packages to make the Tailwind Intellisense work. - Migrated away from Radix style color classes to our defined classes, the values will remain the same. - Most of the CSS is generated by scripts, they'll be removed in next PRs. * Removed redundant `border-light` classes from several components since it was undefined. * Removed redundant `text-strong` classes from several components since it was undefined. How to test: - Open all apps, compare the UI (mainly colors) to builds from #45417 and try to find a difference. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Harmonized color variable usages and updated UI color references (affects palettes, charts, gradients, hero illustrations, and scrollbars). * Tweaked border, tab, and selection visuals across components. * **New Features** * Added a suite of theme animations and refined typography presets used by site prose and docs. * **Refactor** * Overhauled Tailwind/theme configuration and color token generation for more consistent theming. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-13 13:14:58 +02:00
Alex Hall	da44ab3088	feat(www): fetch partner integration listings from marketing-db (#45725) ... This adds a layer of indirection to fetch partner integration listings for the marketing page from the new Marketplace DB, which will allow us to maintain these listings via the same admin UI we're building for in-app integration listings. Fixes INT-102	2026-05-12 11:25:32 -04:00
Pamela Chia	e55411da5e	feat(studio): Fly.io deprecation banner (#45778) ... ## Summary Adding an in-dashboard banner for the Fly.io May 31 suspension. Banner targets users on a Fly project (or with a Fly project in their currently-selected org) and surfaces a per-project breakdown of what's affected in a dialog. Detection is self-correcting: as soon as the user migrates off Fly, the banner disappears with no follow-up. <img width="557" height="502" alt="Screenshot 2026-05-11 at 5 08 22 PM" src="https://github.com/user-attachments/assets/7bafb712-3490-4555-9667-66e9909f1b1a" /> <img width="1675" height="536" alt="Screenshot 2026-05-11 at 3 55 06 PM" src="https://github.com/user-attachments/assets/6c1bf9d1-4dcc-4aac-a679-2ed477d2ed1c" /> ## Changes - **Detection hook** (`useFlyDeprecationProjects`): reads only from already-cached data — `useSelectedProjectQuery` for the current project, plus `useOrgProjectsInfiniteQuery` scoped to the selected org. Zero cross-org fan-out: worst case is one paginated query per session (the same one the project list page already makes). - **Banner component** (`FlyDeprecationBanner.tsx`): mounted in `AppBannerWrapper`. Dynamic title (primaries / branches / both), dialog lists affected projects with org name, numbered migration steps, links to backup/restore CLI + Dashboard backup + branching docs. List truncates to 5 entries with "…and N more." tail when more are affected. - **Telemetry**: `fly_deprecation_banner_exposed` and `fly_deprecation_banner_dismissed` events emitted via `useTrack` (auto-injects project + org groups). Properties: `primaryCount`, `branchCount`. CTA click tracking intentionally omitted — migration outcome is measured via warehouse `cloud_provider = 'FLY'` decay. - **LocalStorage**: dated dismissal key `FLY_DEPRECATION_2026_05_31`; orphan `FLY_POSTGRES_DEPRECATION_WARNING` from PR #33510 removed in the same change so users who dismissed the Feb 2025 banner still see this one. - **Support contact**: email `success@supabase.io` only (no support ticket link), per Brian's outreach copy in the Linear issues. ## Coverage trade-off Banner renders on project pages (selected-project check) and pages where the selected org's projects list is cached (org overview, project list). It does **not** render on `/dashboard` home or other pages without org context. Email outreach from GROWTH-817 / GROWTH-819 handles those users. This was a deliberate trade-off to avoid cross-org fan-out load. ## Lifecycle Banner expires `2026-06-01T00:00:00Z` (right after the May 31 deadline). Stale client bundles stop rendering it without a redeploy. Cleanup PR planned post-deadline to remove the component, hook, localStorage key, and telemetry events. ## Testing Tested on the Vercel preview with React Query cache overrides to mock a Fly project: - [x] Banner renders for a user with at least one project where `cloud_provider === 'FLY'` - [x] Banner does **not** render for a user with no Fly projects - [x] Banner does **not** render on `/sign-in` - [x] Title varies by primaries-only / branches-only / both - [x] Dialog lists affected projects with org name in parens - [x] Dialog list truncates to 5 with "…and N more." for larger sets - [x] Migration guide / Dashboard backup / branching links open in a new tab - [x] Dismiss (×) closes the banner and persists across hard reload (localStorage `fly-deprecation-2026-05-31-dismissed`) - [x] PostHog receives one `fly_deprecation_banner_exposed` per mount with `primaryCount` + `branchCount` and `$groups.organization` populated - [x] PostHog receives one `fly_deprecation_banner_dismissed` on close with the same property shape ## Linear - fixes GROWTH-817 - fixes GROWTH-819	2026-05-12 02:24:47 +08:00
Joshen Lim	94851d1f8f	Add assistant CTA for query errors in RLS tester (#45628) ... ## Context Adding an "Ask Assistant" CTA in the RLS tester if the query executed returns an error <img width="618" height="375" alt="image" src="https://github.com/user-attachments/assets/8b0a5069-3ec5-44aa-aa0b-f1cd8041960d" /> Which will open the Assistant panel with the following prompt (attaches the query as well) <img width="427" height="281" alt="image" src="https://github.com/user-attachments/assets/16debd7b-9447-4b84-bef5-05debd0062ee" /> Theres a chance that the error might be just from the query and not related to the policy hence the last sentence in the prompt <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Integrated AI assistant into the RLS tester so users can open the assistant prefilled with a debug prompt and relevant SQL to troubleshoot policy issues. * Added an "Ask Assistant" action on execution error messages to quickly start guided debugging. * Streamlined error display to prioritize parse errors, then client-code parse errors, then execution errors for clearer diagnostics. * **Chores** * Added telemetry source identifier for the RLS tester to track assistant usage. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-08 18:50:48 +08:00
Saxon FletcherandGildas Garcia	ae66a6a9c0	Connect GitHub during project creation (#44884) ... <img width="1289" height="863" alt="image" src="https://github.com/user-attachments/assets/d661f107-b358-4894-8531-80441d60ab91" /> GitHub integration is now available on the free plan and so we'd like to start promoting code-first workflows as much as possible. One way to do that is to set the tone straight away by asking a user to connecting their GitHub repository to a project as part of project creation. This PR: - decouples GitHub connection and repo selection into a separate component we can make use of in integration settings and project creation. - Adds new GitHub fields to project creation form and sends them off to project creation endpoint - Pre-fills project name based on repo selection To test locally: - Ensure you have GitHub integration set up locally (using ngrok etc) - Ensure you are on the connected platform branch - Open create a new project page - Connect GitHub as part of the creation form and select a repo - Create the project and wait for status to be healthy - Check project settings integrations page and ensure repo is connected Note: - this requires changes on the management api end to accept new GitHub fields - it might make sense to pull out GitHub connection/authorization from GitHub repository selection but in the current state they are tied together. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * GitHub repository selection now available during project creation with integrated authorization flow * GitHub connection status and compute availability indicators now displayed on project dashboard * Project name auto-populates from selected GitHub repository name when available <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>	2026-05-08 13:52:09 +10:00
Joshen Lim	e6f819f7f8	Update notice banner for TOS update (#45632) ... ## Context As per PR title - just updates the NoticeBanner component for TOS update information <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a Terms of Service update notification banner to inform users about recent policy changes. * Notification includes a dialog/modal with full update details, links, and effective date; it replaces the previous maintenance notification so users receive clear, actionable information. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-06 09:39:43 -06:00
Jordi Enric	d8bb0ade65	feat(studio): add timezone picker to user dropdown (#45517) ... ## Problem The dashboard renders all timestamps in the browser's local timezone. When debugging app issues, users often want to see logs and timestamps in a different timezone (e.g. their app's deployment region) without changing their OS clock. ## Fix - New Timezone submenu in the user-avatar dropdown, sitting next to the existing Theme picker. Search-as-you-type combobox over the full IANA catalog plus an Auto detect option. - Selection persists in localStorage (`supabase-ui-timezone`) and survives `clearLocalStorage()`. No backend schema change. - New `lib/datetime.tsx` exposes pure timezone-aware formatters (`formatDateTime`, `formatDate`, `formatTime`, `formatFromNow`, `toTimezone`) plus a `TimezoneProvider` and matching React hooks (`useTimezone`, `useFormatDateTime`, ...). The pure functions take `tz` explicitly so they're easy to unit test (17 vitest cases covering DST transitions, multi-tz formatting, unix-micro/Date inputs, invalid-tz fallback). - The selected timezone propagates to every existing `<TimestampInfo>` in Studio via a new `TimestampInfoProvider` context exported from `ui-patterns`. No per-callsite changes needed for those ~20+ surfaces. - The `UnifiedLogs` date column migrates off `date-fns` to the new `useFormatDateTime` hook (the rest of the date-fns callers stay as-is, since they're either internal range math or non-display). - `ALL_TIMEZONES` (~600 entries) moves out of `PITR.constants.ts` into a shared `lib/constants/timezones.ts`. PITR keeps a re-export shim so its callers don't move. New `TIMEZONES_BY_IANA` dedupes the catalog by primary IANA name (the original list contains both PDT and PST rows for `America/Los_Angeles`, etc.) and `findTimezoneByIana` provides reverse lookup. - Telemetry: `timezone_picker_clicked` PostHog event with `previousTimezone`, `nextTimezone`, `isAutoDetected` properties. Notes for reviewers: - Bare `dayjs(x).format(...)` calls (~157 files) intentionally still render in browser-local time. Surfaces opt in by switching to the new wrappers, so this PR is the abstraction plus logs adoption; broader migration is a follow-up. - Two `// prettier-ignore` lines (`apps/studio/pages/_app.tsx`, `apps/studio/components/interfaces/UnifiedLogs/UnifiedLogs.fields.tsx`) work around a pre-existing local-tooling issue where `prettier-plugin-sql-cst` strips angle-bracket type arguments under certain conditions. Project's pinned prettier (3.8.1) does not strip; the issue surfaces with a globally-installed prettier. Worth tracking separately. - Hydration: `guessLocalTimezone()` and `useLocalStorageQuery` are client-only. Studio is mostly CSR via the Pages Router, but any SSR'd `<TimestampInfo>` may briefly render in the server's tz before client hydration. Existing behavior already had this mismatch with `.local()`; this PR does not regress it. - Backend timestamps round-tripped through query params and mutations stay UTC. The picker is display-only. ## How to test - Run `pnpm dev:studio`, sign in. - Open the user avatar dropdown (top right). Hover Timezone. - Search for "tokyo", pick `(UTC+09:00) Osaka, Sapporo, Tokyo`. - Open any project, navigate to Logs (e.g. `Project > Logs > Edge Functions`). Hover a log row's timestamp; the popover should show UTC, the chosen tz (`Asia/Tokyo`), and the relative time. Visible cell text should be in JST. - Visit any page that uses `<TimestampInfo>` (Database > Backups, Project Pause state, Edge Function details). Same tooltip should reflect Asia/Tokyo. - Refresh the page; timezone is still Asia/Tokyo. - Reopen the picker, choose Auto detect; timestamps revert to browser local. - Run `pnpm --filter studio test lib/datetime.test.ts`. 17 tests should pass. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Timezone selector added to the user menu with auto-detect and manual override * App-wide timezone provider and hooks plus a shared timezone catalog for consistent timezone-aware display * Timestamp components accept an optional timezone prop and respect user preference (persisted) * **Bug Fixes / Improvements** * Logs and timestamp displays now use the new timezone formatting hooks * **Tests** * Added comprehensive datetime and timezone catalog tests * **Telemetry** * Telemetry event added for timezone picker interactions <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-06 14:52:36 +02:00
Mert YEREKAPAN	da81b2f14d	feat(studio): add click tracking for top bar buttons (#45414) ... ## Summary Adds PostHog click/open tracking for every interactive element in the Studio top bar. Previously only 5 of ~16 surfaces were tracked. ### New events (16) | Event | Surface | |---|---| | `home_logo_clicked` | Supabase logo | | `header_back_to_dashboard_clicked` | Mobile back chevron | | `header_exceeding_usage_badge_clicked` | "Exceeding usage limits" badge | | `organization_dropdown_opened` | Org dropdown trigger | | `project_dropdown_opened` | Project dropdown trigger | | `branch_dropdown_opened` | Branch dropdown trigger | | `merge_request_button_clicked` | MR trigger (separate from existing success event) | | `connect_button_clicked` | Connect CTA | | `feedback_dropdown_opened` | Feedback dropdown trigger | | `advisor_button_clicked` | Advisor toggle | | `inline_editor_button_clicked` | SQL editor toggle | | `assistant_button_clicked` | AI Assistant toggle | | `user_dropdown_opened` | Account dropdown | | `local_dropdown_opened` | Local-dev settings dropdown | | `local_version_popover_opened` | CLI version popover | ### Notes - Uses `useTrack` (per `telemetry-standards`), all event names use approved `_clicked` / `_opened` verbs. - Dropdown `onOpenChange` handlers guard against Radix's double-fire by only tracking when `open === true`. - `merge_request_button_clicked` fires on the trigger click; the existing `branch_create_merge_request_button_clicked` continues to fire on successful MR creation. - Pre-existing tracked surfaces (`command_menu_opened`, `help_button_clicked`, `header_upgrade_cta_clicked`, `send_feedback_button_clicked`) are unchanged. ## Test plan - [x] Spot-check each event fires once per interaction in PostHog Live Events - [x] Verify no double-fire on dropdown close <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Added telemetry tracking for many header/navigation interactions (logo, back-to-dashboard, usage badge, connect/merge/advisor/assistant/inline-editor buttons, and multiple dropdowns/popovers). * **Tests** * Updated tests to stub telemetry calls so UI tests remain stable and deterministic. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-05 16:12:51 +00:00
Ivan Vasilov	97a8df0a23	feat: Handle the classic-dark theme in www and docs apps (#45214) ... This PR fixes a bug where a user might choose `classic-dark` as a theme in `studio` but then `docs` and `marketing` apps will look weird. To test: - Change the localStorage value of `theme` to `classic-dark` - Open `www` and `docs` apps, they should look ok <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a new "classic-dark" theme option for enhanced visual customization. * **Improvements** * Unified and simplified theme handling across apps for more consistent behavior. * Improved system-theme detection and smoother transitions when switching themes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-05-05 16:18:46 +02:00
Alex Hall	baaf07002f	chore(studio): add method property to integration installation events (#45473) ... Add new `method` property to existing event to distinguish from server-side emitted events	2026-05-04 16:28:02 -04:00
Mert YEREKAPAN	34241f1f66	revert(pricing): remove A/B experiment, keep control (#44293) (#45361) ... Reverts the pricing page flexibility/visibility A/B experiment from #44293. We decided to keep the control (original pricing page). **Changes:** - `PricingPlansSection.tsx`: removed all experiment logic (PostHog flag evaluation, exposure tracking, flexibility section) - `PricingContent.tsx`: removed `PricingPageExperimentVariant` type export - `PricingPlans.tsx`: removed `experimentVariant` prop and all variant-conditional rendering - `telemetry-constants.ts`: removed `PricingPageExperimentExposedEvent` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Consolidated pricing page component variants and simplified the component hierarchy by removing conditional experiment-dependent UI branches. * Removed pricing page experiment tracking and associated telemetry event definitions. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-29 11:33:12 +00:00
Francesco SansalvadoreandCopilot Autofix powered by AI	580598f0e8	feat(www): update changelog layout, rss and md files (#45219) ... - Update Changelog [index page layout](https://zone-www-dot-com-git-feat-changelog-update-supabase.vercel.app/changelog): - with full timeline - filterable based on text search and tags - New Changelog [detail pages](https://zone-www-dot-com-git-feat-changelog-update-supabase.vercel.app/changelog/45071) - all added to www_sitemap - Changelog [RSS Feed](https://zone-www-dot-com-git-feat-changelog-update-supabase.vercel.app/changelog/45071) + llm-friendly [/changelog.md](https://zone-www-dot-com-git-feat-changelog-update-supabase.vercel.app/changelog.md) - and llm-friendly changelog detail md files: https://zone-www-dot-com-git-feat-changelog-update-supabase.vercel.app/changelog/45071.md ## Before <img width="1604" height="1094" alt="Screenshot 2026-04-27 at 17 07 55" src="https://github.com/user-attachments/assets/eac52f14-e447-4f64-8d50-a8e287ccf989" /> ## After <img width="1247" height="849" alt="changelog-index" src="https://github.com/user-attachments/assets/69b7bae1-63eb-4a4d-a065-7541ed9738b4" /> ### Detail page <img width="1695" height="1101" alt="Screenshot 2026-04-27 at 18 27 27" src="https://github.com/user-attachments/assets/accd4be8-d665-43ed-bcb7-0e6baf537762" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Redesigned changelog page with full-text search and product tag filtering * Individual pages for each changelog entry with dedicated URLs * Added RSS feeds for changelog updates and product-specific feeds * Copy changelog entries as markdown with one click * Direct sharing integration with ChatGPT and Claude <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>	2026-04-29 12:31:30 +02:00
Alex Hall	c8781c885e	chore(studio): use new publish_dashboard column for marketplace db query (#45345) ... Updates the marketplace DB query to use the new `publish_dashboard` column that was added in https://github.com/supabase/marketplace/pull/49 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated internal marketplace integration query and database type definitions to streamline listing management logic. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-29 14:50:48 +08:00
Saxon FletcherandJoshen Lim	3b756e4d9f	Chore/project secure (#45108) ... <img width="2652" height="830" alt="image" src="https://github.com/user-attachments/assets/3c3921e7-c255-4e59-a9c3-c5f97da87788" /> Adds a full screen alert behind a feature flag `projectNeedsSecuring` that prompts for fixing RLS issues. Adjusts a few other small styles to add more prominence to critical advisor issues. To test: - Enable the flag - Make sure you have a table with RLS disabled - Open project home and note the fade in of full page review - Click "copy prompt" or "fix" and note the prompt - Click skip to home and refresh the page, note it doesn't appear anymore <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Project-level security gate on project home with AI assistant prompts, table details, per-project dismissible notice, and a new telemetry event for CTA interactions. * **Improvements** * Stronger visual treatment for critical advisor items and advisor CTA when critical issues exist. * Assistant dropdown supports a copy-prompt callback; added local-storage key and utilities/types to support project security workflows. * **Tests** * Added tests covering gate behavior, navigation, and dismissal logic. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-04-29 04:08:09 +00:00
Francesco Sansalvadore	072006ba0f	chore(studio): remove mobile toolbar flag (#45317)	2026-04-28 13:45:00 +00:00
Joshen Lim	dab1512fe9	Add callout for feature preview rls tester (#45307) ... ## Context Adds a banner on the auth policies page for the new RLS tester feature preview <img width="307" height="310" alt="image" src="https://github.com/user-attachments/assets/6864c2cb-c3b8-4c1f-8dce-57411425e17d" /> Also adds a Give feedback button in the RLS Tester sheet footer <img width="616" height="73" alt="image" src="https://github.com/user-attachments/assets/64755f56-4e27-4b54-92b2-a894badc0b88" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * RLS Tester preview banner added to the policies page with animated content and a locally persisted dismissed state. * Enabling the RLS Tester via the preview also dismisses and records the banner dismissal. * New feedback link added to the RLS Tester UI that opens in a new tab. * **Layout/Providers** * Banner stack context moved so banner state is available more broadly across the app. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-28 17:14:31 +08:00
Joshen Lim	5f867e5f6c	Feature Preview: RLS Tester (#45121) ... ## Context Resolves FE-3077 Related discussion: https://github.com/orgs/supabase/discussions/45233 Verifying the correctness of your RLS policies set up has always been a gap, as highlighted by a number of GitHub discussions like [here](https://github.com/orgs/supabase/discussions/12269) and [here](https://github.com/orgs/supabase/discussions/14401). As such, we're piloting a dedicated UI for RLS testing (using role impersonation as the base), in which you'll be able to - Run a SQL query as a user (not logged in / logged in - this is the role impersonation part) - See which RLS policies are being evaluated as part of the query - And hopefully be able to debug which policies are not set up correctly Changes are currently set as a feature preview - and we'll iterate as we get feedback from everyone 🙂 🙏 <img width="613" height="957" alt="image" src="https://github.com/user-attachments/assets/83c37f8a-28fc-43b3-b0ff-e28571d8710c" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * RLS Tester: run queries as anon or authenticated users, view inferred SQL, per-table policy summaries, and data previews of accessible rows. * UI preview: new RLS Tester preview card and modal with opt-in toggle; RLS Tester sheet with role/user selector and query editor. * SQLEditor: “Explain” tab is always visible. * **Chores** * Added supporting API endpoints, background checks for table RLS status, and a local-storage flag to persist the preview opt-in. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-28 15:02:49 +08:00
Alaister YoungandAlaister Young	5f6060197e	[COM-205] feat(studio): add logs:all flag to hide all logs (#45202) ... Adds a top-level `logs:all` flag (default `true`) so self-hosted and local setups can hide the logs pages in Studio when Logflare isn't configured — no separate Studio build required. The flag itself works everywhere; the additional `ENABLED_FEATURES_LOGS_ALL` env-var override (from FE-3036) is the self-hosted escape hatch so deployers can flip it without a custom build — that part is a no-op on `IS_PLATFORM` because hosted feature gating flows through `profile.disabled_features` instead. Addresses [COM-205](https://linear.app/supabase/issue/COM-205/add-feature-flag-to-disable-all-logs-in-studio). **Added:** - `logs:all` feature flag in `enabled-features.json` + schema **Changed:** - Sidebar "Logs" nav entry is hidden when `logs:all` is off (same pattern as `reports:all` / `billing:all`) - Cmd-K "Logs Explorer" / "Auth Logs" / etc. routes are hidden when the flag is off - `LogsLayout` renders `<UnknownInterface />` (soft-404) when the flag is off — covers all ~18 logs pages in one spot - `/logs/index.tsx` applies the same soft-404 for the unified-logs entry point ## To test Needs to be tested locally (preview doesn't let you flip the flag — hosted gating is profile-driven, not env-driven). Two ways: - Temporarily edit `"logs:all": false` in `packages/common/enabled-features/enabled-features.json` and run `pnpm dev:studio`, or - Run Studio locally with `ENABLED_FEATURES_LOGS_ALL=false` (env-var path, same as how self-hosted deployers would use it) With the flag **off**: - Sidebar "Logs" entry is hidden - Cmd-K search for "Logs" / "Auth Logs" / "Postgres Logs" etc. returns nothing - Direct navigation to `/project/<ref>/logs`, `/project/<ref>/logs/explorer`, `/project/<ref>/logs/auth-logs`, `/project/<ref>/logs/postgres-logs` (etc.) all render the "Looking for something?" soft-404 with a Head back button With the flag **on** (default): everything works as it does today. **Check on the preview deploy too** — nothing should change, no behaviour difference on hosted. Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>	2026-04-27 23:13:42 +08:00
Joshen Lim	7f5865872a	Enforce noUnusedLocals and noUnusedParameters in tsconfig.json + fix all related issues (#45264) ... ## Context Enforce `noUnusedLocals` and `noUnusedParameters` in tsconfig.json + fix all related issues	2026-04-27 17:42:34 +08:00
Ivan Vasilov	9fbe5152d9	chore: Remove dead code and unused files from the packages/ui (#45169) ... # Changes ## Removed unused themes - Deleted `concept-two.css` (unused) and `dark-combined.css` which was identical to `dark.css` - Removed the alias `deep-dark` to `dark` theme since it was unused ## Removed Figma token transform scripts - Deleted the entire `internals/transform/` directory (~700 lines of JS) — these scripts transformed Figma tokens into Tailwind variables but are no longer needed - Deleted `internals/tokens/cleanse-css-for-tailwind.js` and `extract-design-tokens.js` - Removed related dependencies from `package.json` ## Removed other unused files - Deleted `shadcn.css` (unused) - Deleted `tailwind-theming.md` (outdated doc), https://supabase.com/design-system/docs/color-usage is a better resource ## Refactoring - Extracted the `motion-safe-transition` Tailwind plugin into its own file (`packages/config/tailwind-plugins/motion-safe-transition.js`) - Renamed the tailwind class generation script for clarity - Added stub `tailwind.config.js` files in packages that were missing them, so VSCode IntelliSense works in those workspaces - Updated `packages/ui/README.md` to reflect current usage patterns (imports, styling conventions) instead of outdated Figma tokens workflow # Testing - Check all apps whether they have the correct themes with the correct colors [Linear task](https://linear.app/supabase/issue/FE-3059/clean-up-unused-ui-build-artifacts-themes-and-figma-token-scripts)	2026-04-24 10:30:35 +02:00
Sean Oliver	1f318582e1	fix(growth): preserve non-accept consent decisions on banner re-init (#45187) ... ## Problem Cookie banner keeps re-prompting GDPR users who denied consent or made a partial opt-out via Privacy Settings — they can't get rid of it. Reported by Christian Gedde-Dahl (Front SU-362240, mygame.no) and a Supabase support engineer independently. The March fix for FE-2648 handled the accept case — users got their banner dismissal stomped when GTM's Usercentrics integration migrated localStorage from `uc_settings` to `ucData`/`ucString`. But that fix only recognized uniformly-accepted `ucData`, so any other shape (deny-all, essentials-plus-some-tracking, partial opt-out via the Privacy Settings modal) fell through and was treated as "no prior decision." Banner re-prompts on every page load. Christian's and his colleague's `ucData.consent.services` showed 13 services accepted (essentials + functional) and 4 tracking services denied — the shape you get from toggling off the Marketing category in Privacy Settings. Our detection ignored it. ## Changes - `detectPriorConsent` now returns a discriminated union — `null`, `{ kind: 'uniform-accept' }`, or `{ kind: 'decisions'; decisions }` — so we restore per-service state faithfully instead of flattening to deny-all. - Parse `uc_settings` for the fast cross-app nav case. The old fallback treated `uc_user_interaction === "true"` as uniform-accept, which silently upgraded deny users (GDPR violation waiting to happen). Now the flag is just a gate confirming the user actually interacted, and we read real decisions from `uc_settings.services[]`. - Extracted the post-init orchestration from `initUserCentrics` into exported `applyPriorDecisionToSDK(UC, initialUIValues, priorDecision)` so it's unit-testable without mocking the dynamic SDK import. - Added a coverage cross-check: if the Usercentrics ruleset has a non-essential service that isn't in the user's stored decisions, force a re-prompt rather than silently defaulting the new service. Essentials are skipped because the SDK forces them on regardless. - Everything fails closed on partial `ucData` / `uc_settings` corruption. Cherry-picking the valid subset would bias toward over-consent, which is the worst-direction bias in this domain. ## Testing 27 unit tests covering `detectPriorConsent` parsing (both `ucData` and `uc_settings` paths, fail-closed on malformed or partially-corrupt blobs, combined scenarios) and `applyPriorDecisionToSDK` orchestration (uniform accept, decisions with full coverage, uncovered-non-essential compliance guard, essentials-only negative control, null fallthrough, SDK-already-consented passthrough). Can't fully repro on staging — CSP blocks GTM on preview, so the `ucData` migration never fires. Same limitation as the original FE-2648 fix. Will verify in production post-merge by asking Christian to reload and watching support ticket volume. Reviewed twice by Codex with a full iteration between passes; final pass found no functional blockers. GROWTH-790 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fail-closed validation for stored consent data: malformed, partial, or missing entries now yield null and avoid unsafe restoration. * Improved precedence and fallback so corrupt prior data won’t incorrectly restore consent. * **Refactor** * Consent detection now returns richer prior-decision results (uniform accept, per-service decisions, or null). * Applying prior decisions to the SDK uses stricter coverage checks before restoring per-service consent. * **Tests** * Expanded tests covering varied stored-consent shapes, gating rules, precedence, recovery, and SDK application behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-23 15:32:02 -07:00
3 people	1ab7251060	chore(studio): clarify partnered orgs and projects (#44328) ... ## What kind of change does this PR introduce? UI improvements. - Resolves DEPR-401 - Resolves DEPR-424 - Resolves DEPR-425 ## What is the current behaviour? Studio currently blurs two different concepts together: - `billing_partner` / `billing_via_partner`, which represent real billing ownership for marketplace-managed organisations such as AWS and Vercel - Stripe connection state, which is not actually partner billing in the same sense, but was previously being mocked through the same UI paths That made the Stripe work harder to reason about and left some local behaviour dependent on temporary overrides rather than the API shape we want to ship. ## What is the new behaviour? This PR separates those concerns while keeping the existing AWS and Vercel marketplace experience intact. - AWS and Vercel continue to use `billing_partner` / `billing_via_partner` for billing ownership, lockouts, and manage CTAs - Stripe display state now comes from `integration_source`, which lets Studio show Stripe-specific badges and alerts without treating Stripe as a billing partner - organisation-level partner UI is unified across AWS, Vercel, and Stripe, including the org banner, navbar icon treatment, and organisation cards - project-level Stripe UI now appears only when the project itself is marked as Stripe-connected, including the project switcher, project list surfaces, and a project-level banner - Stripe-connected organisations are no longer incorrectly blocked behind the AWS/Vercel-style billing management alerts for invoices, billing address, payment methods, or plan changes - banner dismissal is scoped to the relevant org/project and partner/integration state ## Review order Most of the diff size here is regression tests and generated types. The behavioural changes are concentrated in a smaller set of files. Recommended review order: 1. `integration_source` vs `billing_partner` data-model split and org/project query mapping 2. org-level UI: partner icon, org banner, org dropdown/card treatment 3. billing gating updates for Stripe vs AWS/Vercel 4. project-level Stripe UI: dropdown, list surfaces, banner 5. tests and generated types | Stripe Org(s) | | --- | | <img width="1024" height="759" alt="Organizations Supabase" src="https://github.com/user-attachments/assets/d0ef338c-3b41-4c6d-b3bd-f21a2c182840" /> | | Vercel Org(s) | | --- | | <img width="1024" height="759" alt="Organizations Supabase" src="https://github.com/user-attachments/assets/1dc57770-3f24-45ac-840f-34680555cde8" /> | | AWS Org(s) | | --- | | <img width="1024" height="759" alt="Organizations Supabase" src="https://github.com/user-attachments/assets/7847dad0-ee30-4a65-ab0b-b3b16af0d34f" /> | | Stripe Org, Non-Stripe Project | | --- | | <img width="1152" height="885" alt="Mallet Toolshed Supabase-1673E019-792C-462C-B6F8-C5DDB810B331" src="https://github.com/user-attachments/assets/556fbea3-b5ae-4f2f-96b9-6f66c6654e4a" /> | | Stripe Org, Stripe Project | | --- | | <img width="1152" height="885" alt="Hammer Toolshed Supabase-7E86C17C-561F-4221-BD16-EAFF7D41AAE0" src="https://github.com/user-attachments/assets/94f8daf6-0320-413e-8d56-59f9acaaea15" /> | | Vercel Org | | --- | | <img width="1024" height="759" alt="Projects Toolshed Supabase-A7891653-9366-4B99-89DD-789D70CD52E3" src="https://github.com/user-attachments/assets/c87ee6e8-4451-4866-a905-23a38b2593e3" /> | | AWS Org | | --- | | <img width="1024" height="759" alt="Projects Toolshed Supabase-58A43ECE-569E-4541-9463-346A90B02CFF" src="https://github.com/user-attachments/assets/9350a180-4d58-42a1-ad1a-95893c2e8b12" /> | This also removes the old Stripe mock override path in Studio so the frontend matches the intended API model more closely. ## ~~Dependencies~~ (merged!) This work depends on the private platform change that exposes `integration_source` on the relevant organisation and project payloads: - https://github.com/supabase/platform/pull/31874 _Update: now merged._ ## Local testing ### Stripe If you have the private `platform` repo checked out locally, make sure your local API returns `integration_source: 'stripe_projects'` consistently for the Stripe-linked org/project you are testing. Important responses: - `/platform/organizations` - `/platform/organizations/:slug/projects` - `/platform/projects/:ref` Verify: - org banner and org icon show the Stripe connected state - unopened and opened project switcher both show Stripe only for Stripe-linked projects - project cards / table rows show the Stripe chip only for Stripe-linked projects - the project-level Stripe banner appears across project surfaces - billing address, tax ID, invoices, payment methods, and plan changes remain editable in Studio for Stripe orgs ### Vercel Use a Vercel Marketplace org with real `billing_partner` / `billing_via_partner` values. Important org-level endpoints for local mocking in `platform`: - `/platform/organizations` - `/platform/organizations/:slug` - `/platform/organizations/:slug/billing/subscription` Project-level Vercel indicators still come from `/platform/integrations/:slug`, not `integration_source`. ### AWS Use an AWS Marketplace org with real `billing_partner` / `billing_via_partner` values. Important org-level endpoints for local mocking in `platform`: - `/platform/organizations` - `/platform/organizations/:slug` - `/platform/organizations/:slug/billing/subscription` AWS does not currently have a Stripe-like project-level indicator in these org/project payloads. ## Notes - `billing_partner` is no longer the right abstraction for the Stripe-connected case in this PR. It remains the source of truth for marketplace billing ownership, while Stripe currently uses `integration_source` as a connection/display signal. - I re-ran `pnpm api:codegen` while tightening this PR and kept only the generated type changes this branch actually depends on, to avoid unrelated API drift in the review. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Stripe Projects integration added for billing and project flows * Partner icons/badges shown across org and project lists, dropdowns, and rows * Dismissible, partner-specific marketplace/integration banners with contextual CTA behavior * Improved partner-billing detection to drive billing UI and invoice/plan availability * **Tests** * Extensive new test coverage for billing UI, partner-managed fallbacks, banners, icons, and related flows <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>	2026-04-23 12:17:24 +10:00
kemal.earth	4ec48666d2	feat(studio): unified logs guard change (#44962) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? This changes the guard to expose unified logs to Enterprise. **To test:** - Create an Enterprise org. - Go to a project and then Logs. - Default view should be unified logs (with a CTA offering to switch back to old logs). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added enterprise/Supabase-org eligibility checks and loading state for the unified logs preview. * **UX** * Updated messaging to state unified logs are only available to Enterprise plan organizations. * Sidebar and filter panels now show unified-logs preview panels based on eligibility. * **Analytics** * Track unified logs row clicks with a new telemetry event. * **Bug Fixes** * Prevent navigation until unified-logs eligibility and preview flag loading are resolved. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-22 14:39:39 +01:00
Alaister YoungandAlaister Young	75e08577c1	chore(studio): remove tableEditorApiAccessToggle flag (#45081) ... Cleans up the `tableEditorApiAccessToggle` PostHog flag now that the gated UI is shipping to everyone. Follow-up to #45034 — the new project-creation checkbox makes the management UI a prerequisite, so no reason to keep it behind a flag. **Removed:** - `useDataApiGrantTogglesEnabled` hook - Old schemas-only multi-selector branch in the Data API settings page (the rich per-table / per-function toggles + default-privileges switch become the only UI) - Flag gate around the `<ApiAccessToggle>` section in the table editor side panel - Flag gates around `updateTableApiAccess` calls in the save pipeline (create / duplicate / update) - `tableEditorApiAccessToggleEnabled` telemetry property + stale JSDoc / docs references **Changed:** - `createTableApiAccessHandlerParams` no longer takes an `enabled` param — it was always `true` after removal ## To test - Integrations → Data API settings page: exposed tables, exposed functions, default-privileges toggle all render and save correctly - Table editor: creating, duplicating, and editing a table all run the expected Data API privilege updates - Project creation flow still works end-to-end (unchanged, but the submit telemetry no longer includes `tableEditorApiAccessToggleEnabled`) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * API access configuration is now always available in the table editor and PostgreSQL settings, removing previous conditional gating. * Simplified the "Automatically expose new tables and functions" interface by consolidating UI branches. * **Documentation** * Updated telemetry guidance and examples with current feature-flag references. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>	2026-04-22 21:37:48 +08:00
3 people	d1a7d64e63	[FE-3023] feat(studio): default privileges toggle at project creation (#45034) ... <img width="783" height="414" alt="Screenshot 2026-04-20 at 3 02 37 PM" src="https://github.com/user-attachments/assets/a353c35a-3de5-4bfa-ab31-829c79c43165" /> Adds a "Default privileges for new entities" checkbox under "Enable Data API" in both the main create flow and the Vercel deploy-button flow. Default checked (current behaviour). When unchecked, runs `buildDefaultPrivilegesSql('revoke')` after the base init script so new entities in `public` aren't auto-granted to `anon` / `authenticated` / `service_role`. This PR decouples the two surfaces: - **`tableEditorApiAccessToggle`** — unchanged; still gates only the integrations → Data API settings UI. - **`dataApiRevokeOnCreateDefault`** (new) — controls only the default state of the new checkbox at project creation. `true` → checkbox unchecked by default (revoke runs); `false`/absent → checkbox checked by default (no behaviour change). The new flag is already live in PostHog at **0% rollout, off for everyone**, so shipping this PR changes nothing until the flag is explicitly flipped. ## Added - `apps/studio/hooks/misc/useDataApiRevokeOnCreateDefault.ts` — reads the new PostHog flag. Returns `false` in `IS_TEST_ENV` so existing E2E flows don't silently change default behaviour. - Checkbox UI in `SecurityOptions.tsx` (main flow) and `pages/integrations/vercel/[slug]/deploy-button/new-project.tsx` (Vercel flow), with copy matching the integrations → Data API settings page. - Tooltip + dimmed state for the main-flow checkbox when "Enable Data API" is unchecked (can't configure default privileges if Data API is off). - Telemetry: `dataApiDefaultPrivilegesGranted` (raw checkbox value) and `dataApiRevokeOnCreateDefaultEnabled` (raw flag, conditionally included using the existing raw-flag pattern so undefined flag state → omitted property, not `false`). - Vitest unit tests for the new hook. ## Changed - `pages/new/[slug].tsx`: removed the `false &&` rollback guard. Revoke SQL now runs only when `dataApi && !dataApiDefaultPrivileges`. Dropped the now-unused `useDataApiGrantTogglesEnabled` import. - `pages/integrations/vercel/[slug]/deploy-button/new-project.tsx`: this flow was **never rolled back** — it still ran revoke whenever `tableEditorApiAccessToggle` was on for a user. Now correctly gated on the new flag + checkbox state. - `packages/common/telemetry-constants.ts`: added the two new properties and corrected the `tableEditorApiAccessToggleEnabled` docstring (it no longer claims to control project-creation revoke behaviour). ## Kill switch Flipping `dataApiRevokeOnCreateDefault` to off in PostHog fully disables the revoke SQL for new projects without needing a redeploy — the checkbox just defaults to checked again. ## Follow-ups (not blockers) - joshenlim's review comments on PR 43704: (1) Auth Policies table row incorrectly showing "exposed via Data API" based on schema-level check instead of table-level at `apps/studio/components/interfaces/Auth/Policies/PolicyTableRow/index.tsx:64`; (2) Data API integrations page showing zero exposed tables even after exposing one. Both unrelated to this PR but will be more visible once the checkbox lands. - Once this flag fully rolls out, the old `tableEditorApiAccessToggle` docstring/comments elsewhere should stop claiming it controls project creation. ## To test - **Flag off (default state, simulates post-merge):** create a project with and without "Enable Data API" checked. The new "Default privileges for new entities" checkbox should default to **checked**. Submitting should produce an identical result to today — new tables in `public` are reachable via the Data API. - **Flag on (simulate rollout):** override the flag locally. The checkbox should default to **unchecked**. Creating a project with it unchecked should run the revoke SQL; create a new table in `public` afterwards and confirm it's not reachable via the Data API until grants are added. - **Enable Data API off:** the new checkbox should render disabled + dimmed with a tooltip reading "Enable the Data API to configure default privileges." The revoke SQL should not run in this case regardless of checkbox state. - **Vercel flow:** repeat at `/integrations/vercel/<slug>/deploy-button/new-project` — verify both checkbox states. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an "Automatically expose new tables and functions" checkbox to project creation and Vercel deploy flow; enabled only when Data API is available (disabled with tooltip otherwise) and affects initial project provisioning. * **Telemetry** * Tracks exposure of the default-privileges control and includes checkbox state and feature-flag status on project-creation submissions. * **Tests** * Added tests for flag behavior, exposure tracking, deduplication, and submission telemetry. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> Co-authored-by: Sean Oliver <882952+seanoliver@users.noreply.github.com>	2026-04-21 13:15:40 +08:00
Stephen MorganandJoshen Lim	bd55ad23a6	feat: iso27001 certificate (#44963) ... Edit: Can be merged, mgmt api deployed Dashboard addition to frontend for access to the ISO 27001 certificate. View for Team customers: <img width="1737" height="1151" alt="image" src="https://github.com/user-attachments/assets/cd62d24f-8b6e-4600-9ded-943a170cd124" /> Resolves SEC-799 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * ISO 27001 certificate added to Documents with a Download action, confirmation modal, new-tab open on success, and error toast on failure. * Users without billing permission see a no-permission view; users missing entitlement see an “Upgrade to Team” prompt. * **Refactor** * Upgrade-to-Team flows for SOC2 and related upgrade UI standardized to use the shared upgrade component. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-04-21 16:38:03 +12:00
Alaister YoungandAlaister Young	19027e73f8	[FE-3036] feat(studio): runtime env var overrides for enabled features (#45049) ... Lets self-hosted Studio toggle flags in `enabled-features.json` at container start time via `ENABLED_FEATURES_*` env vars, without rebuilding the prebuilt image. Addresses [FE-3036](https://linear.app/supabase/issue/FE-3036/allow-enabled-featuresjson-flags-to-be-overridden-via-env-vars) and is a prerequisite for [COM-205](https://linear.app/supabase/issue/COM-205/add-feature-flag-to-disable-all-logs-in-studio). **Added:** - `packages/common/enabled-features/overrides.ts` — pure parser that maps `ENABLED_FEATURES_*` env vars to a disabled-features list (forward-only key mapping, boolean validation, typo warnings) + 10 vitest tests - `apps/studio/pages/api/enabled-features-overrides.ts` — Next.js API route reading `process.env` at request time; no-op (`{ disabled_features: [] }`) when `IS_PLATFORM` - `apps/studio/data/misc/enabled-features-override-query.ts` — React Query hook with `staleTime: Infinity`, `enabled: !IS_PLATFORM` - `packages/common/enabled-features/README.md` — docs the env var convention, resolution order, `IS_PLATFORM` gating, and the `Support.constants.ts` build-time caveat **Changed:** - `apps/studio/hooks/misc/useIsFeatureEnabled.ts` — merges the override's `disabled_features` with `profile.disabled_features` ### Env var shape One var per flag, prefixed `ENABLED_FEATURES_`. Feature key → env name: uppercase with every non-alphanumeric char replaced by `_`. ```bash ENABLED_FEATURES_LOGS_ALL=false ENABLED_FEATURES_BRANDING_LARGE_LOGO=true ``` Values are `true`/`false` case-insensitively. Other values and prefixed vars that don't match a known feature are logged and ignored. ### Resolution order (runtime, Studio only) 1. `ENABLED_FEATURES_*` (self-hosted, via API route → React Query → hook) 2. `profile.disabled_features` (hosted, from `/platform/profile`) 3. `enabled-features.json` static value 4. Default (enabled) `ENABLED_FEATURES_OVERRIDE_DISABLE_ALL` still short-circuits everything. ### Known limitation `apps/studio/components/interfaces/Support/Support.constants.ts:4` calls `isFeatureEnabled('billing:all')` at module load to build `CATEGORY_OPTIONS`, which is spread into Zod form schemas. That call site stays resolved from the JSON — documented in the package README. `billing:all` isn't on the radar for self-hosted runtime toggling. ## To test - `cd packages/common && pnpm exec vitest run enabled-features` — 10 new tests pass - `pnpm --filter studio run typecheck` clean - Spin Studio locally with `NEXT_PUBLIC_IS_PLATFORM=false` and `ENABLED_FEATURES_LOGS_TEMPLATES=false`; `/project/[ref]/logs/explorer/templates` should reflect the flag after the override fetch resolves - Confirm the API route returns `{ disabled_features: [] }` when `NEXT_PUBLIC_IS_PLATFORM=true` - Set a typo like `ENABLED_FEATURES_LOGS_TMEPLATES=false` and check the warning in container logs; flag stays enabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Runtime feature-flag overrides for self-hosted deployments (env var driven), new API endpoint and client-side hook to fetch overrides, and client logic now merges profile and runtime overrides. * **Documentation** * Added comprehensive README describing the feature-flag system and override configuration. * **Tests** * Added unit tests for override parsing and E2E tests covering runtime override behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>	2026-04-20 22:28:56 +08:00
5 people	b721a2d780	feat(studio): advisor signal items for banned IPs (#44372) ... ## What kind of change does this PR introduce? Feature. Resolves DEPR-430. ## What is the current behaviour? The homepage Advisor summary, shared Advisor panel, and top-nav Advisor indicator only surface lints and notifications. Banned IPs are not represented as dismissible Advisor items, so network bans are easy to miss unless a user visits Database Settings directly. The `public bucket allows listing` warning is no longer part of this PR. That warning will move to a follow-up Splinter `WARN` lint so it can flow through the standard lint surfaces instead of a bespoke Studio signal path. ## What is the new behaviour? - adds a new Advisor `signal` source for banned IPs on the platform homepage, in the shared Advisor panel, and in the top-nav Advisor indicator - keeps dismissals client-side only for now, scoped by project and exact IP fingerprint - keeps banned IP signals at `warning` severity because they still indicate suspicious traffic and remain actionable if a user wants to review or remove a ban - leaves `/project/[ref]/advisors/security` as follow-up work because that surface is still lint-native, and banned IPs are management-plane signals rather than Splinter lints | After | | --- | | <img width="1728" height="997" alt="Mallet Toolshed Supabase-65A60B4A-107E-4D79-B9A8-23F754BEAB08" src="https://github.com/user-attachments/assets/c08ecbbb-c302-43bd-81bb-6ba7eb18b7b3" /> | ## Reviewer testing notes 1. Use a throwaway project. 2. Get the database connection string for that project. 3. Attempt to connect with the wrong password 3-4 times until you hit an `ECONNREFUSED`-style error, which should mean your IP has been banned. 4. Refresh Studio and confirm the project overview shows the new `Banned IP address` signal. 5. Open the Advisor Center and confirm: - the top-nav Advisor dot turns warning yellow - the signal detail shows `Entity`, `Issue`, and `Resolve` - `Edit network bans`, `Dismiss`, and `Learn more` are present 6. Open Database Settings > Network bans and confirm your banned IP appears there and can be unbanned. 7. Note that `/project/[ref]/advisors/security` will not show this item. That page is still lint-only, and this banned IP work is a short-term client-side signal rather than a true lint. Longer term, we likely want a more durable event model here so banned IPs can power notifications, webhooks, emails, and other project-level alerts. --------- Co-authored-by: kemal <hello@kemal.earth> Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-04-20 10:33:56 +10:00
Ali Waseem	e8df67d5d5	chore: migrate shortcuts to new hooks API (#44955) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Cleanup shortcuts with new hooks <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Centralized keyboard shortcut system for consistent shortcut behavior across the app and moved preference toggles to a unified registry. * **New Features** * Added explicit shortcuts for Command Menu, AI Assistant, Inline Editor, and result copy/download actions. * Hotkey preferences UI now renders dynamically from the centralized shortcut list. * **Tests** * Test helpers updated to include the command menu provider for accurate shortcut behavior in tests. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-17 10:02:56 -06:00
Ali Waseem	3ed436de74	feat: new shortcuts hook with registrations (#44954) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? - Brand new hook APIs for registering shortcuts using tanstack hotkeys - Support for command menu injection when shortcut is added <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Centralized keyboard shortcuts system with per‑shortcut registration and per‑user enable/disable preferences stored locally * Added a "Copy results as Markdown" shortcut (Mod+Shift+M) * Shortcuts can be surfaced in the Command Menu with a visual shortcut badge for discoverability * **Documentation** * Legacy keyboard shortcut hooks marked as deprecated and documentation updated to point to the new shortcut API <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-17 08:20:36 -06:00
Ali WaseemandJoshen Lim	ae4f1551f0	chore: make new table filter bar the default (#44910) ... ## Summary - Makes the new table filter bar the permanent default by hardcoding `useIsTableFilterBarEnabled` to return `true` - Removes the feature preview toggle (opt-out) from the preview modal - Cleans up E2E tests: removes old filter UI test, removes `enableFilterBar` helper, fixes race condition in column-drop test - Old filter code paths are left in place for a follow-up cleanup PR Closes FE-2819 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Removed the table filter bar preview and its opt-in/local-storage preview key. * Cleared preview content from the feature preview modal. * **Tests** * Removed the UI filtering e2e test and associated preview opt-in helper. * Updated filter-bar e2e flows to adjust navigation/wait behavior (added explicit waits, removed redundant reloads). <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-04-16 07:59:48 -06:00
Ali Waseem	02325f00e7	feat(studio): add Copy as CSV option to SQL editor results (#44911) ... ## Summary - Adds a new "Copy as CSV" action to the export dropdown in the SQL editor results panel, alongside the existing Copy as Markdown, Copy as JSON, and Download CSV options - Registers a `Shift+Cmd+C` keyboard shortcut for the action, with a toggle in Account > Preferences > Keyboard shortcuts - Works everywhere `DownloadResultsButton` is used: SQL editor, logs, query performance, and linter pages Fixes FE-2991 ## Test plan - [x] Run a SELECT query in the SQL editor, open the Export dropdown, and verify "Copy as CSV" appears between "Copy as JSON" and "Download CSV" - [x] Click "Copy as CSV" and verify CSV data is copied to clipboard - [x] Use `Shift+Cmd+C` shortcut and verify it copies CSV to clipboard - [x] Go to Account > Preferences > Keyboard shortcuts and verify the "Copy results as CSV" toggle is present and functional - [x] Disable the shortcut in preferences, verify `Shift+Cmd+C` no longer triggers the copy - [x] Verify the same option appears in the logs export dropdown <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added "Copy as CSV" action to the results download menu, allowing users to quickly copy query results in CSV format to the clipboard. * Introduced a new hotkey preference setting to enable/disable the Shift+Meta+C keyboard shortcut for copying results as CSV. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-16 07:13:09 -06:00
Raminder SinghandJoshen Lim	0cb71a2497	feat: new marketplace db (#44574) ... This PR integrates with the new marketplace db to allow Grafana (and other partners) OAuth apps to install from the integrations page. A demo of this working locally is available here: https://supabase.slack.com/archives/C01GN60J0BS/p1775551752479709. End to end flow is documented here: https://www.notion.so/supabase/Grafana-Integration-Flow-33a5004b775f80eeaf91c098beb8071f. TODO: - [ ] Make sure `NEXT_PUBLIC_MARKETPLACE_API_URL` variable is set to the new marketplace db. - [x] Test with the `marketplaceIntegrations` enabled and disabled in staging once https://github.com/supabase/platform/pull/31298 is merged and available in staging. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Add OAuth "Install integration" button that detects installed integrations and supports GET/POST install flows * Marketplace listings now include install links, installation method, partner info, and listing assets/logos * **Infrastructure** * Allow marketplace API origin for images and content in security and image config * Centralize marketplace types and switch marketplace data source for more reliable listings <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-04-16 17:57:12 +08:00
Sean Oliver	571533482f	refactor(growth): remove useTelemetryCookie and sb-telemetry-data cookie (#43840) ... The `sb-telemetry-data` cookie and `useTelemetryCookie` hook are fully superseded by the `_sb_first_referrer` edge cookie (GROWTH-625) and the in-memory first-touch store (GROWTH-656). GROWTH-656 already removed the `useTelemetryCookie` call from `PageTelemetry` — this PR cleans up the rest. **Changes** - Delete `useTelemetryCookie.tsx` hook - Remove `clearTelemetryDataCookie` from `telemetry-utils.ts` (and its `TELEMETRY_DATA` dep) - Remove the `clearTelemetryDataCookie` call from `consent.tsx` (the cookie is never written anymore, so clearing it on deny is a no-op) - Remove `TELEMETRY_DATA` key from `LOCAL_STORAGE_KEYS` **Testing** Verified no remaining references to `useTelemetryCookie`, `sb-telemetry-data`, `TELEMETRY_DATA`, or `clearTelemetryDataCookie` in the codebase. GROWTH-646 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Removed local telemetry data collection and cookie storage functionality. * Updated consent handling to remove associated telemetry cookie cleanup operations. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-15 23:51:01 +01:00
Alaister YoungandAlaister Young	1b1d05ff96	chore: upgrade vite to v8 and vitest to v4 (#44833) ... Upgrade vite and vitest to their latest major versions across the monorepo, along with related packages. **Changed:** - `vite` catalog: `^7.3.2` → `^8.0.8` (Rolldown replaces esbuild/Rollup) - `vitest` catalog: `^3.2.0` → `^4.1.4` - `@vitejs/plugin-react`: `^4.3.4` → `^6.0.1` - `@vitest/coverage-v8`: `^3.2.0` → `^4.1.4` - `@vitest/ui`: `^3.2.0` → `^4.1.4` - `vite-tsconfig-paths`: `^4.3.2` / `^5.1.4` → `^6.1.1` **Pinned to vite 7:** - `apps/lite-studio` — `@react-router/dev` hasn't declared vite 8 support yet - `blocks/vue` — Nuxt plugins (`vite-plugin-inspect`, `vite-dev-rpc`, `vite-hot-client`, `vite-plugin-vue-tracer`) haven't declared vite 8 support yet **Test fixes for vitest 4 breaking changes:** - **`apps/studio/lib/api/snippets.utils.test.ts`** — Replaced `vi.mock('fs/promises')` automock with an explicit factory. Vitest 4's automocking doesn't create mock functions for getter-based exports on Node built-ins, so `mockedFS.access.mockResolvedValue` etc. were `undefined`. - **`apps/studio/lib/api/self-hosted/functions/index.test.ts`** — Changed `mockReturnValue` to `mockImplementation(function() { ... })` for a constructor mock. Vitest 4 no longer allows `mockReturnValue` when the mock is called with `new`. - **`apps/studio/tests/pages/api/mcp/index.test.ts`** — Changed arrow function to regular `function` in `mockImplementation` for `StreamableHTTPServerTransport`. Arrow functions can't be constructors, and vitest 4 now enforces this. - **`packages/ui-patterns/vitest.setup.ts`** — Changed `ResizeObserver` mock from arrow function to regular `function` for the same constructor enforcement reason. This was crashing Radix popover rendering in jsdom. ## To test - `pnpm test:studio` — all 226 test files should pass - `pnpm --filter ui-patterns vitest run` — all 183 tests should pass - `pnpm --filter www test -- --run` — all 19 tests should pass - `pnpm --filter ui vitest run` — all tests should pass - `pnpm --filter dev-tools vitest run` — all tests should pass - `pnpm --filter ai-commands vitest run` — all tests should pass <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Standardized and updated development tooling versions and version sources for consistent installs across the repo (Vite, Vitest, vite-tsconfig-paths and related plugins/catalog entries). * **Tests** * Improved test mocks and typings (updated mock factories/implementations and tightened spy/type assertions) to increase test reliability and compatibility with updated tooling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>	2026-04-16 00:13:48 +09:00
Jordi EnricandClaude Sonnet 4.6	169a8ff44b	feat(studio): add direct Upgrade compute CTA to exhaustion banners (#44675) ... ## Problem The `ResourceExhaustionWarningBanner` routed disk IO, CPU, and memory/swap exhaustion warnings to `/settings/infrastructure#<metric>` — an infra chart page with no direct fix available. The action button label "Learn more" didn't reflect a clear next step, and there was no way to get AI-assisted query optimization from the banner. ## Changes **Routing & CTAs** - Compute warnings (`disk_io`, `cpu`, `ram`) now route to `/settings/compute-and-disk` instead of the infra chart page - Free plan users are routed to `/org/[slug]/billing?panel=subscriptionPlan&source=resource_exhaustion_banner` - Primary CTA text changed to "Upgrade compute" for all compute warnings (paid and free plan) - Read-only mode CTA changed from "Learn more" to "Manage disk" **Troubleshoot dropdown** - For compute warnings (which have both a docs URL and an AI prompt), a "Troubleshoot" dropdown replaces the standalone "Learn more" button, offering: - Documentation — links to the relevant troubleshooting guide - Ask AI Assistant — opens the AI assistant with a pre-filled query to identify expensive queries via `pg_stat_statements` - For warnings with only a docs URL (read-only mode, disk space, auth), a direct "Learn more" button is shown as before **Telemetry** Two new events track user interactions with the banner: | Event | Fires when | Properties | |---|---|---| | `resource_exhaustion_banner_upgrade_clicked` | User clicks the primary CTA | `warningTypes: string[]`, `isFreePlan: boolean`, `destination: string` | | `resource_exhaustion_banner_ai_assistant_clicked` | User clicks "Ask AI Assistant" | `warningTypes: string[]`, `isFreePlan: boolean` | Both events include the standard `groups` payload (project + org). **Suppression fixes** - Banner is now hidden on `/settings/compute-and-disk` for paid-plan compute warnings (CTA would be a no-op) - Banner stays visible on `/settings/infrastructure` for compute warnings (CTA now links to a different page) **Description text** - Removed stale "Check the usage page for more recent and detailed statistics" from compute warning descriptions — no button in the banner leads there - Updated `multiple_resource_warnings` descriptions to reflect the upgrade-focused CTAs **Bug fixes** - Fixed: auth rate limit critical banner was showing when warning content had no title/description - Fixed: CTA disabled state now only applies to compute warnings while org data is loading (not all warning types) ## How to test - Trigger or mock a `disk_io_exhaustion`, `cpu_exhaustion`, or `memory_and_swap_exhaustion` warning - Paid plan: CTA reads "Upgrade compute" → `/project/<ref>/settings/compute-and-disk` - Free plan: CTA reads "Upgrade compute" → `/org/<slug>/billing?panel=subscriptionPlan&source=resource_exhaustion_banner` - Troubleshoot dropdown appears with Documentation and Ask AI Assistant options - Verify `is_readonly_mode_enabled` shows "Manage disk" CTA and a direct "Learn more" button (no dropdown) - Verify `disk_space_exhaustion` and auth warnings show a direct "Learn more" button (no dropdown) - Verify the banner is hidden on `/settings/compute-and-disk` for paid-plan compute warnings - Verify the banner is still visible on `/settings/infrastructure` for compute warnings - Verify `resource_exhaustion_banner_upgrade_clicked` and `resource_exhaustion_banner_ai_assistant_clicked` events fire with the correct properties --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-15 15:08:31 +02:00
kemal.earth	fa951a55a6	feat(studio): posthog events for scoped pats (#44850) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? This is a follow up for both our classic and scoped PAT's to add events for tracking created and deleted. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Enhanced telemetry for access token creation and removal. * Creation events now include token type (classic or scoped), expiry setting, scope/resource access and permission counts when applicable. * Removal events now include token type (classic or scoped). * Instrumentation added across token creation and deletion flows to improve analytics and auditing. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-04-15 13:00:11 +01:00