dima/supabase
1
0 Fork 0
mirror of https://github.com/supabase/supabase.git synced 2026-10-09 19:35:06 +03:00
Code Issues Packages Projects Releases Wiki Activity
37,804 Commits 1,794 Branches 62 Tags
fix/api-keys-array-coerce
Commit Graph
37804 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
shaziya 8252b69b6a feat(www): convert TRAE webinar page to on-demand (#48225) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature — converts the TRAE webinar event page to its on-demand version
and adds a small template enhancement to support a custom type label.

## What is the current behavior?

The [TRAE webinar
page](https://supabase.com/events/supabase-trae-high-quality-apps) is
set up as a live, upcoming event: `onDemand: false`, a registration CTA
linking out to GoToWebinar, and copy written in the future tense ("What
we'll cover").

The shared event page template (`pages/events/[slug].tsx`) always
renders the raw `type` frontmatter value (e.g. "WEBINAR") as the label
at the top of the page, with no way to override it.

## What is the new behavior?

- Flips `onDemand` to `true` and swaps the `main_cta` from the
GoToWebinar registration link to a `#recording` anchor labeled "Watch
the recording", matching the pattern used for the Bolt and Perplexity
webinars once they went on-demand.
- Adds a `video-container` iframe placeholder (`id="recording"`) below
the intro copy. The `src` is intentionally left empty with a `TODO`
comment — neither the Bolt nor Perplexity on-demand pages expose the
recording URL in frontmatter, it's a hardcoded YouTube embed URL in the
MDX body, so this needs the real embed URL dropped in before merging.
- Replaces the "What we'll cover" section with updated "Key Takeaways"
copy and a closing line ("We hope you enjoy the recording!").
- Adds an optional `type_label` frontmatter field to the event page
template. When set, it renders in place of the raw `type` value at the
top of the page; when unset, behavior is unchanged for every other event
page. Used here to show "Supabase Live" instead of "WEBINAR".

## Additional context

Verified locally in preview:
- TRAE event page renders correctly with the new CTA, video placeholder,
updated copy, and "SUPABASE LIVE" label.
- Other event pages (e.g. `enterprise-innovation-with-bolt`) are
unaffected and still show their original type label, confirming the
`type_label` change is backward compatible.

Still needed before merging: the actual recording embed URL in the
iframe `src`.
 2026-07-23 11:13:14 -07:00
Francesco SansalvadoreClaudeLukas Bernert
 		312d05af4b fix(www): changelog frontmatter (#48249) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Security/bug fix

## What is the current behavior?

The changelog entry parser exposes all YAML frontmatter fields parsed by
`matter()` directly to the client via Next.js props. This includes
private fields like `internal:` (escalation teams, notes) and
`reviewers:`, which get serialized into the page's `__NEXT_DATA__` and
are visible in View Source even if never rendered.

## What is the new behavior?

- Added `PUBLIC_FRONTMATTER_KEYS` constant that explicitly allowlists
only the fields safe to expose to the browser
- Added `toPublicFrontmatter()` function that filters frontmatter down
to the allowlist, dropping `internal:`, `reviewers:`, and any other
private keys
- Updated `parseChangelogEntryFile()` to apply the allowlist before
returning frontmatter to callers
- Added comprehensive unit tests covering both the filtering logic and
the integration with the parser

This uses an allowlist approach rather than a denylist, so new private
fields added upstream won't silently leak to clients.

## Additional context

The allowlist is kept in sync with `ChangelogEntryFrontmatter` in
`changelog-repo.ts` per the code comment. Tests verify that:
- Only allowlisted keys are present in the returned frontmatter
- Private fields like `internal` and `reviewers` are never exposed
- Public fields flow through untouched
- Undefined values are omitted from the result

https://claude.ai/code/session_017uSmnCLsskFYR7YH8DKGkr

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a shared changelog title renderer that safely displays titles as
inline Markdown.
* Added plain-text title extraction for consistent headings and SEO
metadata.
* **Bug Fixes**
* Prevented private/internal changelog frontmatter (including reviewer
metadata) from being exposed to browser-rendered pages.
* Ensured featured and non-featured changelog timelines stay consistent
even when some entries fail to serialize.
* Improved the changelog detail not-found behavior to revalidate instead
of caching 404s indefinitely.
* **Tests**
* Added coverage for public frontmatter allowlisting, date normalization
(`publish_date`/sorting), and `sortDate` consistency across YAML
variations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Lukas Bernert <lukas@bernert.at>
 2026-07-23 08:26:01 -07:00
Ali Waseem 7781ee0d04 fix(studio): correct realtime settings UI limits to match backend (#48253) 
Realtime settings validation in Studio didn't match the backend's actual
limits:
- \`max_presence_events_per_second\` allowed up to 10000 (backend caps
at 5000),
- \`max_payload_size_in_kb\` allowed up to 3000 (backend caps at 10000)
- \`max_events_per_second\` allowed up to 10000 (backend caps at 50000).

Updated the Zod schema limits in both branches of the form's
discriminated union to match.

Fixes FE-3991

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Increased the allowed limits for realtime event throughput, presence
events, and payload size settings.
* Administrators can now configure higher-capacity realtime workloads,
including payloads up to 10,000 KB.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 14:33:02 +00:00
Ali Waseem e6ad56101f fix: MFA list Added on value uses last_challenged_at instead of created_at (#48252) 
Fixes FE-3985. `TOTPFactors` was displaying `updated_at` (which mirrors
`last_challenged_at`) for "Added on" instead of `created_at`.
 2026-07-23 14:23:36 +00:00
shaziya 3effea71aa feat(www): add Grafana Cloud partner drop blog post (#47716) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Launch blog post - Grafana!

## What is the current behavior?

Nonexistent 😆 

## What is the new behavior?

Adds the "Observability for every Supabase project with Grafana Cloud"
partner drop post, announcing the one-click Grafana Cloud integration.

- Post:
[`apps/www/_blog/2026-07-23-observability-for-every-supabase-project-with-grafana-cloud.mdx`](https://github.com/supabase/supabase/blob/blog/grafana-cloud-partner-drop/apps/www/_blog/2026-07-23-observability-for-every-supabase-project-with-grafana-cloud.mdx)
- Images:
`apps/www/public/images/blog/observability-for-every-supabase-project-with-grafana-cloud/`
(og + thumb)
- Author: `raminder_singh` · Date: 2026-07-23 · Category: product
- Includes the YouTube walkthrough embed and UTM-tagged dashboard links

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added a blog post announcing one-click Grafana Cloud observability
integration for Supabase projects.
* Highlights include preconfigured authentication, metric scraping, and
dashboards available on all plans, including free.
* Documents dashboard portability, Metrics API usage, setup
instructions, and upcoming log support.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 06:56:48 -07:00
Jeremias Menichelli 4272aba4b1 fix: Update Grafana Cloud integration guides (#47776) 2026-07-23 14:42:07 +02:00
Ivan Vasilov 8108528682 Fix: Update the auth user field in the Logs page (#48237) 
- Fix the user filter to work with `edge_logs`. 
- Update the `auth_user` field to be derived from other log attributes.
- Removed filtering for `postgres_logs` since it didn't really filter by
user actions, only by user id mentions.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Bug Fixes**
- Improved unified logs user filtering to rely only on exact attribution
identifiers from authentication and edge log sources, removing partial
message-based matching.
- Updated unified logs user identification by deriving `auth_user` from
authentication actor IDs or edge JWT subject values.
- Refined “user filter reachability” logic to consider only attributable
log types (auth and edge).
- **Tests**
- Adjusted unified logs query tests to match the updated attribution
routing and reachability outcomes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 12:48:33 +02:00
Gildas Garcia efc0ad3fce fix: fix migration dialog does not show the correct content in some edge cases (#48239) 
## Problem

When two projects have migrations with the same version but different
content, the details panel does not update the content and shows the
first loaded migration one.

## Solution

This is because the CodeEditor does not react to content only changes.
Settings its `key` ensures it does.
Unfortunately, we can't unit test that the CodeEditor content changes
correctly.

## How to test

- create two projects and push a migration with the same version but
different content on them
- open the _Database/Migrations_ page for the first project
- click the _View migration SQL_ and ensure its content matches the
migration for this project
- select the other project using the top bar
- click the _View migration SQL_ and ensure its content matches the
migration for this project

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved migration SQL display when switching between migrations or
projects.
* Ensured the code editor consistently refreshes with the currently
selected migration’s statements.
  * Improved type safety for the migration search input.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 12:38:10 +02:00
Francesco Sansalvadore d900c09e8a chore(studio): grafana-cloud slug (#48238) 
Use `grafana-cloud` slug for the partner integration.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added Grafana Cloud to the featured integrations in the marketplace.
* Added light and dark themed artwork for the Grafana Cloud featured
integration.
* **Improvements**
* Updated the OAuth “installed” detection to include Grafana Cloud
alongside Grafana.
* Included Grafana Cloud in the set of official partners for the
partner-only filter.
* **Tests**
* Expanded marketplace integration fixtures to cover Grafana Cloud
scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 09:43:22 +00:00
Francesco Sansalvadore 7c20cc574c feat(www): new changelog sync (#47880) 
## What kind of change does this PR introduce?

Sync changelog from private supabase/changelog.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Changelog entries now come from the structured changelog repository.
* Added filters for change type, product stage, and self-hosted impact.
* Updated badge UI for affected products and change types with filter
links.
* Changelog detail sidebar now shows lifecycle stage, sunset dates, and
self-hosted impact (when available).

* **Improvements**
  * Product category discovery and filtering now use affected products.
  * Discussion links show only when legacy discussion data is present.
* RSS feeds and generated changelog markdown now use the updated
metadata.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 11:16:39 +02:00
Alaister YoungandAlaister Young fbf7ce44ef [FE-3544] fix(studio): role impersonation for truncated cell loads (#48215) 
Loading a truncated cell's full value from the inline grid editors or
the row side-panel editors called `getCellValue` without
`roleImpersonationState`, so the fetch ran with full DB privileges
instead of the role selected in **View as role** — leaking values RLS
would deny. Same class of bug #46442 fixed for row copy/export; the
mutation already accepted the state, these call sites just weren't
passing it.

**Changed:**

- Pass `roleImpersonationState` into `getCellValue` in all 4
truncated-cell loaders (inline grid Text/Json editors + row side-panel
Text/Json editors), mirroring the existing `Header.tsx` pattern

**Added:**

- MSW component test on the row side-panel `TextEditor` asserting the
cell-value SQL is wrapped with `set local role` when impersonation is
active, and not wrapped when it isn't

## To test

Note: if the impersonated role can't select the row at all (e.g. force
RLS with no policy), the main grid correctly shows 0 rows under **View
as role**, so the "Load full value" button is never reachable — you
can't exercise this path that way. Use a row the role *can* see and
verify the request is role-wrapped:

- Create a table with a text value long enough to be truncated in the
grid (>16KB), with RLS enabled and an anon-visible row:
  ```sql
  create table public.secrets (id int primary key, secret text);
  alter table public.secrets enable row level security;
  alter table public.secrets force row level security;
create policy "anon can read" on public.secrets for select to anon using
(true);
  insert into public.secrets values (1, repeat('a', 20000));
  ```
- In the Table Editor, set **View as role → anon** — the row should be
visible with the `secret` cell truncated
- With the network tab open, load the full value via each path:
double-click the cell (inline editor) and the row side panel's expand
editor → "Load full text data" (a `jsonb` column exercises the two JSON
editor paths the same way)
- The `pg-meta` query request body should start with `set_config('role',
'anon', true)` + anon JWT claims before the `select secret …`. Before
this fix it was a bare unwrapped `select secret from public.secrets
where id = 1;`
- Drop the policy and confirm the grid shows 0 records under anon
(denial still applies at the grid level); switch back to the default
role and confirm the full value still loads normally with no wrapper

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-23 16:46:51 +08:00
Alaister YoungandAlaister Young 3121841863 [FE-2271] fix: correct stale email confirmation dashboard paths (#48228) 
Users were getting AI-generated troubleshooting steps pointing at
**Authentication → Settings → Sign up → "Enable email confirmations"** —
a dashboard path that no longer exists (FE-2271). The guidance comes
from external LLMs trained on stale supabase.com content: two 2022 blog
tutorials contain that exact phrasing. The real toggle is
**Authentication → Sign In / Providers → User Signups → "Confirm
email"**.

**Changed:**
- Updated the Flutter chat and Angular Trello blog tutorials to point at
the current toggle location (and removed screenshots of the old UI)
- Repointed the legacy `/project/:ref/auth/settings` redirect from
`/auth/users` to `/auth/providers`, so anyone following stale
instructions lands on the page that actually has the auth config

## To test

- Visit `/project/<ref>/auth/settings` in Studio — it should redirect to
`/project/<ref>/auth/providers` (verified locally on both the redirect
and the existing `redirects.shared.test.ts` suite)
- Check the two blog posts render correctly and the dashboard deep link
opens Sign In / Providers

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Bug Fixes**
- Updated authentication settings redirects so project settings pages
now open the correct sign-in and provider configuration page.

- **Documentation**
- Updated Flutter and Angular tutorial instructions for disabling email
confirmation.
- Added current navigation guidance and clarified where to turn off the
**Confirm email** option.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-23 16:17:06 +08:00
Jordi Enric e3fdfc9c15 docs(telemetry): make the Logs Explorer docs ClickHouse-focused (#47914) 
Makes the Logs Explorer query docs ClickHouse-focused.

The Logs Explorer runs on ClickHouse (default since June 2026): a single
`logs` table tagged by `source`, with nested fields in a
`log_attributes` map. This rewrites `## Querying with the Logs Explorer`
to document only that model:

- ClickHouse query mechanics (`log_attributes['...']` access,
`toInt32OrZero`, `count()`), with example queries and the "don't guess
keys" guidance
- The old BigQuery `cross join unnest(metadata)` section
(timestamp/unnesting/examples) is removed; a short note flags that
BigQuery is deprecated
- Best practices and the field reference reworded for ClickHouse

No dead anchors: the only repo reference to an `#unnesting-arrays`
anchor points at `advanced-log-filtering`, which is untouched.

Supersedes the earlier two-engine version on this branch. Skill side
(agent-skills#112) already points here as the single source for log
querying.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Updated Logs Explorer guides to use ClickHouse as the default query
engine.
* Added guidance for querying the unified `logs` table and accessing
structured fields.
* Added examples for filtering errors, SQLSTATE codes, numeric values,
and regular expressions.
* Documented how to discover available log fields and clarified MCP
log-query behavior.
* Updated best practices and field references to reflect the current log
structure.
* **Chores**
* Added SQLSTATE and substring terms to the documentation spelling
allow-list.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 16:12:47 +08:00
Francesco Sansalvadore 52030a88fe chore(studio): proper grafana light-mode image (#48232) 
Use a real light-mode grafana dashboard rather than an inverted dark
mode one.

<img width="888" height="287" alt="Screenshot 2026-07-23 at 09 45 45"
src="https://github.com/user-attachments/assets/f37a6950-19eb-4edc-b59d-fd48681874dd"
/>
 2026-07-23 07:59:12 +00:00
Joshen Lim 63e2eb3ca6 Joshen/fe 3971 blocked by visualization (#48187) 
## Context

Improving the "blocked by" visualisation for database connections - to
accommodate the situation whereby there might be a chain of blocked
process. Intention is so that users can identify whats the root process
that's blocking everything - and from there decide if they want to
terminate the process or not.

Also brings `ActivityRow` out into its separate file since `Activity` is
getting big

<img width="473" height="299" alt="image"
src="https://github.com/user-attachments/assets/21d0d223-5dbd-49d5-877c-815c78cb7482"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Streamlined the database activity view by separating the single-row
rendering into its own component, keeping the same end-user experience
(status badge, query/“No query”, duration warnings, blocking details,
PID copy, and actions).
* Kept “Terminate” behind confirmation prompts and preserved role-based
restrictions for when termination is available.
* **Improvements**
* Standardized how activity durations are calculated and how status
badges are styled for consistent display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 15:19:54 +08:00
Hieu b76d04d6a0 fix: read FGA permissions from openapi spec x-fga-permissions extension (#48181) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Follow up to https://github.com/supabase/platform/pull/35940, which
moved FGA permissions off security and onto the `x-fga-permissions`
extension.

This updates the docs reference component to read from the new field.



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* API documentation now supports displaying fine-grained access
permissions for endpoints.
* Endpoint security details are presented more consistently using the
documented permissions configuration.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 12:17:45 +07:00
Danny White 3bca21b3f8 chore(a11y): convert leftover focus recipes to focus-ring (#48219) 
## What kind of change does this PR introduce?

Accessibility cleanup (DEPR-628).

## What is the current behavior?

Leftover call sites still use ad-hoc focus recipes
(`ring-foreground-muted`, `outline-brand`, Dialog/Sheet `focus:` rings,
etc.) instead of the shared utilities from #41575.

## What is the new behavior?

Converts those leftovers across `packages/ui`, Studio, www, docs, and
design-system to `focus-ring`, preferring `focus-visible`. Keeps
documented exceptions (`group-focus-visible`, InputGroup `:has()`).

## To test

Tab through controls (keyboard only). Expect a consistent offset ring on
`:focus-visible`, not a green/brand/custom stack, and no ring animation.

### www (marketing)

Preview:
https://zone-www-dot-com-git-danny-depr-628-focus-ring-fbccf9-supabase.vercel.app

- Global nav on `/`: Product, Developers, Solutions dropdowns; logo;
hamburger + mobile menu
- `/features`: view toggles and feature cards
- `/company`: card links
- `/changelog`: timeline / entry links
- `/partners/catalog`: grid/list toggle and partner cards
- `/pricing`: compute section expand control
- Product / Modules / Solutions sticky navs on product pages (e.g.
`/database`, `/storage`)
- `/state-of-startups`: TwoOptionToggle if present

### docs

Preview:
https://docs-git-danny-depr-628-focus-ring-long-tail-supabase.vercel.app

- Any guide page: top nav dropdowns and items
- Narrow viewport: hamburger, then mobile menu links + close
- Guide with PromptPanel / tabs: tab to prompt actions and tab list

### studio (dashboard)

Preview:
https://studio-staging-git-danny-depr-628-focus-ring-long-tail-supabase.vercel.app

- Project home: Connect section tiles; drag-handle focus on sortable
sections
- Integrations marketplace (`/project/<ref>/integrations`): featured
cards, list/grid toggle, list rows
- Auth (`/project/<ref>/auth/oauth-apps`,
`/project/<ref>/auth/providers`): open create/edit sheet, tab to close
(X)
- Database policies (`/project/<ref>/database/policies`): open policy
editor sheet, tab to close
- Storage policies (`/project/<ref>/storage/files/policies`): bucket
section links; policy modal close
- Query performance (`/project/<ref>/observability/query-performance`):
info icon buttons on metrics
- Replication pipeline detail (if available): slot lag / status info
icons
- Support (`/support/new`): attachment add/remove controls
- Table editor: spreadsheet import preview checkboxes; row text/JSON
editor TwoOptionToggle
- Any Dialog/Sheet/toast close (X): ring on keyboard focus only, not
mouse click

### design-system

Preview:
https://design-system-git-danny-depr-628-focus-ring-long-tail-supabase.vercel.app

- Colour palette swatches (keyboard focus)
- Form patterns sidepanel example: avatar / focusable control in the
example

## Additional context

- Linear: [DEPR-628](https://linear.app/supabase/issue/DEPR-628)
- Follow-ups: form-group CSS (DEPR-629), Storage columns selection
(DEPR-630), ESLint rule (DEPR-632)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Accessibility & Usability**
* Standardized keyboard focus indicators across navigation, dialogs,
forms, buttons, toggles, links, and tooltips using a consolidated focus
style.
* Improved toggle controls to use proper button semantics (instead of
clickable text), including `aria-pressed`/disabled handling and better
keyboard navigation.

* **Visual Updates**
* Harmonized hover/focus ring visuals across the design system, Studio,
documentation, and marketing pages while preserving existing layout and
interaction behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 08:52:22 +10:00
Charis 0bef8e7d90 test(sql-editor): e2e coverage + delete jsdom test + merge Results.utils tests (Steps 5-6) (#48217) 
## Summary

Steps 5 and 6 of the SQL editor test refactor plan (the final two
steps).

**Step 5** — extends `e2e/studio/features/sql-editor.spec.ts` (real
browser, zero mocks) with cases that need the real Monaco editor / full
app render:
- destructive-query warning modal: confirm actually re-runs the forced
query (previously only `Cancel` was exercised)
- debug button opens the AI Assistant with the query error pre-filled

Deletes `apps/studio/tests/components/SQLEditor/SQLEditor.test.tsx` —
its logic-level cases are now covered mock-free by the Step 4 hook
tests, and its integration cases by e2e. Deleting rather than narrowing
is the honest consequence of "no mocking": every remaining assertion it
could make in jsdom requires a Monaco mock.

**Step 6** — merges
`apps/studio/tests/components/SQLEditor/Results.utils.test.ts`
(`formatClipboardValue`/`formatCellValue`) into the colocated
`apps/studio/components/interfaces/SQLEditor/UtilityPanel/Results.utils.test.ts`
(`formatResults`/`convertResultsToMarkdown`/`convertResultsToJSON`/`getResultsHeaders`/`isLargeValue`/`convertResultsToCSV`)
— both tested disjoint exports of the same source file. Deletes the
`tests/` copy.

This is the last step in the plan.

## Test plan

- [x] `pnpm --filter studio typecheck` — no new errors in changed files
- [x] `npx prettier --check` on all changed files
- [x] Ran the new/changed e2e cases locally end-to-end against a live
local stack — both pass
- [x] `cd apps/studio && npx vitest run
components/interfaces/SQLEditor/UtilityPanel/Results.utils.test.ts` —
42/42 passing after the merge

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Tests**
* Added end-to-end coverage for destructive SQL query warning modal flow
before forced execution.
* Added end-to-end coverage for the AI Assistant debug flow when SQL
execution fails.
* Expanded unit test coverage for SQL editor results formatting
utilities (clipboard and cell value formatting).
* Removed the prior SQLEditor unit test suite and the older
results-formatting unit tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 16:55:17 -04:00
Francesco Sansalvadore e4f75bf74c chore(studio): update copywriting on integrations pages (#48197) 2026-07-22 22:22:54 +02:00
Kanishk Dudeja ec260a594d docs(billing): clarify top-ups do not apply to outstanding invoices (#48220) 
### Summary

This PR clarifies that credit top-ups apply only to future invoices and
cannot be used to pay or adjust outstanding invoices.

It updates the Credits FAQ, Billing FAQ, and credit top-up modal with
consistent wording.

### Testing

#### Credits FAQ


https://docs-git-kanishk-billing-2726-update-billing-fa-bd77f2-supabase.vercel.app/docs/guides/platform/credits#credit-faq

#### Billing FAQ


https://docs-git-kanishk-billing-2726-update-billing-fa-bd77f2-supabase.vercel.app/docs/guides/platform/billing-faq#payments-and-billing-cycle

#### Credit Top Up Modal

<img width="544" height="473" alt="Screenshot 2026-07-23 at 1 17 30 AM"
src="https://github.com/user-attachments/assets/5d016398-7b46-455d-8bf1-a5767d10bc48"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Added FAQ guidance explaining that credit top-ups apply only to future
invoices and cannot pay or adjust outstanding invoices.
* **Billing Updates**
* Clarified that credits are granted based on the pre-tax payment
amount.
  * Confirmed that credits are non-refundable and do not expire.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 01:33:36 +05:30
Danny White 6f6badae51 fix(eslint): promote require-explicit-tabindex to error (#48170) 
## What kind of change does this PR introduce?

Accessibility / lint hardening (Safari keyboard focus).

## What is the current behavior?

`supabase/require-explicit-tabindex` is `'warn'`. Studio’s ratchet was
at 0 but the rule was still ratcheted; www / docs / design-system still
had raw `<button>` / `role="button"` call sites without an explicit
`tabIndex`.

[DEPR-627](https://linear.app/supabase/issue/DEPR-627) · follow-up to
#47984 / #48040

## What is the new behavior?

- Shared config: `'supabase/require-explicit-tabindex': 'error'`
- Swept www / docs / design-system (+ Studio test fixtures the ratchet
skipped)
- Removed the rule from the Studio ratchet + baselines

## To test

Prefer **Safari**. This PR only adds explicit `tabIndex` to raw
`<button>` / `role="button"` call sites — not links, and not controls
that already go through `Button` from `ui`.

### Marketing (`www`) ([staging
link](https://zone-www-dot-com-git-danny-depr-627-promote-req-7ae43c-supabase.vercel.app/))

- [x] Homepage frameworks / dashboard feature tabs — Tab through each
tab button
- [x] Product pages (e.g. `/auth`, `/database`) — section tab switchers
- [x] Narrow viewport — open the hamburger; Tab through menu buttons
- [x] `/partners/catalog` — filter / view controls
- [x] Blog view toggle (list ↔ grid)

### Docs ([staging
link](https://docs-git-danny-depr-627-promote-require-explici-25e46d-supabase.vercel.app/))

- [x] **Desktop (≥ lg):** top-right **⋯ menu** (hamburger icon) — opens
a dropdown that includes Theme. Not a separate theme button.
- [x] **Mobile (< lg):** top-right **hamburger** opens the sheet; close
(X) is the raw button we tagged. Theme inside the sheet uses
`ThemeToggle` / `DropdownMenuTrigger` from `ui` (already supposed to set
`tabIndex`).
- [x] **Code blocks** — copy / language controls
- [x] **Is this helpful?** — X / check are `Button` from `ui` (should
already Tab). After voting **while signed in**, the follow-up “What went
well?” / “How can we improve?” text button is the raw one we tagged.
- [x] **AI Tools → Copy as Markdown** (right rail on a guide) — this is
the only GuidesSidebar control this PR changed. “On this page” TOC items
are **links**, not covered by this lint.
- [x] **Reference docs** (e.g. JS client reference) — section headers
that expand/collapse in the left nav (`Collapsible.Trigger`)
- [x] **Troubleshooting index** — type in the search field, then Tab to
the **clear (X)** control

### Dashboard (`studio`)

No production UI changes in this PR (tests + lint config only). Quick
Safari smoke that prior tabindex work still holds:

- [x] Project sidebar — Tab through primary nav links
- [x] Settings → General — Tab through inputs / buttons
- [x] Storage → Files — Tab a bucket row / file actions
 2026-07-23 05:21:15 +10:00
Charis 08c4f64c42 test(sql-editor): add mock-free hook tests (Step 4) (#48214) 
## What

Step 4 of the SQL editor testability plan: **mock-free hook tests** for
the extracted SQL editor hooks, built on the Step 3 renderHook harness
(`tests/lib/sql-editor-test-utils.tsx`) — in-memory editor port + real
valtio stores + MSW. **Zero `vi.mock`.**

| File | Tests | Covers |
|------|-------|--------|
| `useSqlEditorExecution.test.tsx` | 8 | destructive-query gating
(`potentialIssues` vs. forced run), auto-limit suffixing,
connection-string → `x-connection-encrypted` header,
`onSuccess`/`onError` session-store writes, error-line highlight,
diff-open short-circuit |
| `useSqlEditorAi.test.tsx` | 7 | one-shot diff-request drain (empty vs.
non-empty editor), drain-exactly-once across remounts, accept/discard
diff, `onDebug` opening the assistant chat + debug prompt |
| `usePrettifyQuery.test.tsx` | 2 | in-place format + write-back,
diff-open no-op |
| `useSnippetIdentity.test.tsx` | 2 | generated identity + store-driven
loading state |
| `useSnippetTitleGenerator.test.tsx` | 2 | untitled-snippet naming via
the title endpoint |

Every test exercises real dependencies at the seam where they're real:
network via MSW, stores used real and reset per test, Monaco via the
in-memory editor port.

## Test plan

- [x] `pnpm test:studio -- SQLEditor` → **286/286 passing** (21 new
tests included)
- [x] `pnpm --filter studio typecheck` clean
- [x] Confirmed zero `vi.mock` in the new files


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Added comprehensive automated coverage for SQL query formatting,
snippet identity, and AI-generated titles.
* Added coverage for AI-assisted SQL editing, including diff acceptance,
rejection, debugging, and request handling.
* Added coverage for query execution, result persistence, safety checks,
replica selection, error highlighting, and diff-state behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 14:53:46 -04:00
Miranda Limonczenko 359974d071 fix(docs) Fix local broken links (#48212) 
Closes DOCS-1202

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## Problem

We have broken local links in docs.

I ran locally tests that crawl through all of our docs and flags broken
local links.

## Solution

This PR fixes local links where they were errored. The report I
generated had false-positives, so there are fewer fixes than initially
thought.

## Preview checklist

Docs preview:
https://docs-git-docs-fix-broken-local-links-supabase.vercel.app
WWW preview (redirects):
https://zone-www-dot-com-git-docs-fix-broken-local-links-supabase.vercel.app

| Page | Live (broken) | Preview (fixed) | Where to look |
| --- | --- | --- | --- |
| Amazon Bedrock |
[Live](https://supabase.com/docs/guides/ai/integrations/amazon-bedrock)
|
[Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/ai/integrations/amazon-bedrock)
| **You'll also need** → `A Postgres database with the pgvector
extension` |
| Getting started |
[Live](https://supabase.com/docs/guides/getting-started) |
[Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/getting-started)
| Tutorial cards → **Expo React Native Social Auth** |
| Product security |
[Live](https://supabase.com/docs/guides/security/product-security) |
[Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/security/product-security)
| **Database** list → `Superuser access and unsupported operations` |
| OAuth flows |
[Live](https://supabase.com/docs/guides/auth/oauth-server/oauth-flows) |
[Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/auth/oauth-server/oauth-flows)
| End of page, before **Next steps** → `OAuth methods in supabase-js` |
| ElevenLabs TTS |
[Live](https://supabase.com/docs/guides/functions/examples/elevenlabs-generate-speech-stream)
|
[Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/functions/examples/elevenlabs-generate-speech-stream)
| **Dependencies** → ElevenLabs `JavaScript SDK` |
| ElevenLabs STT |
[Live](https://supabase.com/docs/guides/functions/examples/elevenlabs-transcribe-speech)
|
[Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/functions/examples/elevenlabs-transcribe-speech)
| **Dependencies** → ElevenLabs `JavaScript SDK` |
| Realtime error codes |
[Live](https://supabase.com/docs/guides/realtime/error_codes) |
[Preview](https://docs-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/realtime/error_codes)
| `RealtimeDisabledForTenant` → reference link |
| Expo social auth redirect (legacy) |
[Live](https://supabase.com/docs/guides/with-expo-social-auth) |
[Preview](https://zone-www-dot-com-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/with-expo-social-auth)
| Should land on the Expo social auth quickstart |
| Expo social auth redirect (old tutorials path) |
[Live](https://supabase.com/docs/guides/getting-started/tutorials/with-expo-social-auth)
|
[Preview](https://zone-www-dot-com-git-docs-fix-broken-local-links-supabase.vercel.app/docs/guides/getting-started/tutorials/with-expo-social-auth)
| Should land on the Expo social auth quickstart |

### Manual testing

1. For each row, open the **Live** link and find the linked text in
**Where to look**.
2. Click the link and confirm it 404s or lands on the wrong page.
3. Open the matching **Preview** link, find the same linked text, and
click it.
4. Confirm the preview link resolves to the correct destination:
   - Amazon Bedrock → `/docs/guides/database/extensions/pgvector`
- Getting started →
`/docs/guides/auth/quickstarts/with-expo-react-native-social-auth`
   - Product security → `/docs/guides/database/postgres/roles-superuser`
   - OAuth flows → `/docs/reference/javascript/auth-admin-oauth-server`
- ElevenLabs TTS / STT → `https://github.com/elevenlabs/elevenlabs-js`
- Realtime error codes →
`/docs/guides/troubleshooting/realtime-project-suspended-for-exceeding-quotas`
- Redirect rows →
`/docs/guides/auth/quickstarts/with-expo-react-native-social-auth`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated links for pgvector, OAuth, ElevenLabs SDK, and database
security guidance.
  * Corrected the Expo React Native social authentication tutorial link.
* Updated Realtime troubleshooting references to the current
documentation path.

* **Bug Fixes**
* Fixed redirects for Expo social authentication guides so legacy URLs
reach the correct quickstart.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 11:49:04 -07:00
Alaister YoungandAlaister Young 25658ab733 chore(lint): ignore dist build output in shared ESLint config (#48216) 
Follow-up to #48202. The shared ESLint flat config only globally ignored
`.next`, `public`, and `.contentlayer`, so with the TanStack Start
migration, Studio's Vite build output in `dist/` was getting linted too
— making `pnpm --filter studio run lint:ratchet` (and regular lint) far
slower than it should be. ESLint flat config doesn't respect
`.gitignore`, so being gitignored didn't help.

**Changed:**

- Added `dist` to the global `ignores` in `eslint-config-supabase/next`
(applies to all apps extending the shared config)

## To test

- In `apps/studio` (with a `dist/` folder present from a TanStack
build), run `npx eslint dist/server/server.js` — it should report "File
ignored because of a matching ignore pattern"
- `pnpm --filter studio run lint:ratchet` no longer spends time linting
`dist/**`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated linting exclusions to ignore generated build output and static
asset directories.
  * Generalized related configuration documentation for clarity.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-22 18:29:41 +00:00
Miranda LimonczenkoandClaude Sonnet 5 ca2a390a3d fix(docs): restore Supabase env vars to stop crash on every page load (#48213) 
https://github.com/user-attachments/assets/0b9e4bd1-e2b6-4a58-b47e-803e2b34a32e


## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

Every page in `apps/docs` crashes at runtime with `Error: supabaseUrl is
required.`

Regression from #46757, which flipped `NEXT_PUBLIC_IS_PLATFORM` to
`"true"` in `apps/docs/.env.development` and, in the same diff,
duplicated a
`NEXT_PUBLIC_MARKETPLACE_API_URL`/`NEXT_PUBLIC_MARKETPLACE_PUBLISHABLE_KEY`
block where `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`
should have been. With `IS_PLATFORM` now `true`, `Feedback.tsx`
(rendered on every docs page) unconditionally calls `createClient()`
with an undefined URL/key, throwing synchronously on every page load.

Closes DOCS-1208 / FE-3980.

## What is the new behavior?

- `apps/docs/.env.development`: renamed the mislabeled duplicate block
back to `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`.
- `apps/docs/components/Feedback/Feedback.tsx`: widened the guard to
`IS_PLATFORM && supabaseUrl && supabaseAnonKey`, mirroring the existing
pattern in `app/api/ai/docs/route.ts`, so a future env misconfiguration
degrades gracefully (feedback votes silently skipped) instead of
crashing every page.

Verified locally by running `pnpm dev:docs` with no GitHub credentials
set:
- No more `"supabaseUrl is required."` anywhere; the Feedback widget
renders and fires its vote request instead of throwing.
- A normal guide page renders fine.
- `/guides/database/database-advisors` still shows its existing graceful
fallback admonition.
- `/guides/graphql` (federated content, absent on a clean checkout)
returns a clean 404 rather than crashing — confirming the related goal
of running docs dev locally without federated content already works (via
#48205 + existing `notFound()` handling), no extra changes needed there.

## Additional context

A related but separate gap was found in
`apps/docs/app/guides/database/extensions/wrappers/[[...slug]]/page.tsx`.
A new Linear issue is created:
https://linear.app/supabase/issue/DOCS-1209/wrappers-guide-page-crashes-on-unhandled-github-fetch-failure-without

## Manual testing


1. Checkout branch locally and run `pnpm run dev:docs` with no GitHub
credentials set. Confirm it starts without errors.
2. Open any guide page on docs locally and confirm no `supabaseUrl is
required` error, and the Feedback widget renders and responds to clicks.
3. Open `/docs/guides/database/database-advisors`. Confirm it renders
and does not crash.
4. Open `/docs/guides/graphql`. Confirm a clean 404, not a server error.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved feedback functionality by safely handling missing
configuration.
* Feedback votes and comments are skipped when the required service
configuration is unavailable, preventing errors.
* **Chores**
* Updated documentation-site configuration to use the appropriate
content service settings.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-22 11:06:50 -07:00
Ali Waseem ac714e81ba docs(tanstack): add a proper SSR quick start with cookie-based auth (#48105) 
## Summary

TanStack Start's quickstart only ever wired up an anonymous
`supabase-js` client — no cookies, no `@supabase/ssr`, no auth. This
ports the real `@supabase/ssr` client/server split and password-based
auth flow (already shipped in `apps/ui-library`) into the quickstart and
adds a matching tab to the SSR guide.

## Where this changed

- `apps/docs/content/guides/getting-started/quickstarts/tanstack.mdx` —
quickstart now installs the cookie-based auth flow via the Supabase UI
Library registry and queries data through the SSR-aware server client.
- `apps/docs/content/guides/auth/server-side/creating-a-client.mdx` —
new TanStack Start tab (client/server setup + protecting routes).
- `examples/auth/tanstack/` (new) — source files backing the
`$CodeSample` snippets above, ported from `apps/ui-library`'s registry.

## Test plan

- [x] Scaffolded a real TanStack Start app and ran the quickstart
commands end-to-end
- [x] Confirmed SSR loader + protected-route redirect work as documented
- [x] `pnpm lint:mdx` and `pnpm build:guides-markdown` pass

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added TanStack Start SSR setup examples for Supabase, including
browser and server client helpers with cookie-based session support.
* Included a protected route example that checks authentication on the
server and redirects unauthenticated users to the login page.
  * Added a server-side claims fetch helper for authorization checks.
* **Documentation**
* Expanded the “creating a client” guide with TanStack Start-specific
route protection and environment variable examples.
* Updated the TanStack Start quickstart to use the official CLI and
refined server-side authorization guidance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 12:00:05 -06:00
Alaister YoungandAlaister Young 2d5ec97df8 chore: split CLAUDE.md into root and studio-specific files (#48202) 
Splits agent guidance into a lean monorepo-wide root file and a
studio-specific file that Claude Code lazy-loads when working under
`apps/studio/`. This keeps every session's baseline context small while
giving studio work much richer, enforceable guidance.

**Changed:**
- `.claude/CLAUDE.md` — now monorepo-wide only: corrected pnpm version
(10 → 11), expanded workspace table (design-system, ui-library,
lite-studio, ui-patterns, api-types, pg-meta, shared-data), commands
(`format`, `generate:types`, `api:codegen`), CI gates + never-hand-edit
generated files, monorepo-wide conventions (incl. the named-exports
rule, which lives in the shared eslint preset and applies to all six
apps), and monorepo-wide skill triggers. Studio detail is replaced by a
pointer to the nested file. Also corrects a long-standing error
inherited from the old file: the `_Shadcn_` convention was inverted —
`Button_Shadcn_` is the only suffixed export left and is rarely the
right choice; primitives are unsuffixed.
- `.claude/skills/studio-ui-patterns/SKILL.md` — removed the same stale
`_Shadcn_` claim from the forms section (this skill also feeds
CodeRabbit reviews).
- `apps/studio/components/README.md` — component template now uses a
named export, matching the lint-enforced convention (was the one doc
still showing `export default`).
- `apps/studio/TANSTACK_MIGRATION.md` — cleanup checklist gains an item
to remove the migration section from `apps/studio/CLAUDE.md` when the
migration finishes.
- `.gitignore` — removed the blanket `CLAUDE.md` ignore rule (added in
#40231 for personal local files, no longer used that way). Nested
`CLAUDE.md` files are now tracked by default, so shared guidance can't
silently fail to land. For *personal* notes, use `CLAUDE.local.md`
(Claude Code loads it automatically alongside `CLAUDE.md`, and it's now
gitignored here) — or `.git/info/exclude` if you prefer a different
filename.

**Added:**
- `apps/studio/CLAUDE.md` — studio guidance, loaded on demand: mandatory
skill routing (always load `studio-best-practices`, plus a task → skill
table), TanStack Start migration rules (pages/routes mirroring, when a
manual mirror is needed, never delete `pages/**` files),
data-layer/state orientation, a default-to-shipping-tests-with-changes
policy, and a "defaults that differ here" list (ESLint warning ratchet +
local `lint:ratchet` command, `copyToClipboard` await rule, `useParams`
from `common`, dayjs/sonner, `ui` vs `ui-patterns` import split,
`@tanstack/react-table` over `react-data-grid`, etc.).

## Accuracy

Every factual claim in both files (62 total) was verified against the
code by parallel review agents instructed to refute each one. Results:
54 correct as written, 2 wrong (the inherited `_Shadcn_` inversion, and
a fabricated `useExecuteSqlQuery` hook name — the real export is
`useExecuteSqlMutation`), 6 imprecise (e.g. dayjs plugins load in both
runtime entries, the ratchet counts occurrences regardless of severity).
All fixed in this PR.

## Context cost

| File | Size | When it loads | % of a 200k window |
|---|---|---|---|
| `.claude/CLAUDE.md` | 70 lines, ~1.2k est. tokens | every session |
~0.6% |
| `apps/studio/CLAUDE.md` | 53 lines, ~1.6k est. tokens | only when
touching studio files | ~0.8% |

The always-loaded footprint grew only ~0.2k est. tokens vs the old
45-line file — everything studio-heavy sits behind the lazy load, so
docs/www sessions pay nothing for it. Both files are well under Claude
Code's large-file warning threshold (~40k chars) and the <200-line
adherence guidance, with room to roughly double before it's worth
worrying about.

## To test

- Open a fresh Claude Code session from the repo root and read any file
under `apps/studio/` — `apps/studio/CLAUDE.md` should get pulled into
context automatically.
- `git check-ignore apps/studio/CLAUDE.md` exits 1 (not ignored); `git
check-ignore CLAUDE.local.md` exits 0 (ignored).
- Skim both files — every claim has been code-verified (see Accuracy
above), but a human sanity pass on the *judgment* calls (what's
included/omitted) is welcome.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Refreshed monorepo onboarding conventions with updated tooling
requirements, expanded inventory, standardized common scripts, and
clearer CI gating and checks.
* Added/updated Studio contributor guidance, including the TanStack
Start migration rules and Studio development/testing/UI conventions.
  * Updated Studio component documentation to use named exports.
* Refreshed the “Forms” UI pattern guidance and adjusted the referenced
UI primitives.
* **Chores**
* Updated ignore rules so the primary top-level onboarding document is
tracked.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-23 01:49:22 +08:00
Ali Waseem 6d7c3361dc fix(studio): hide support access toggle when no project is selected (#48206) 
## Summary
Support access is granted per-project, but the "Allow support access"
toggle stayed visible and submittable even when "No specific project"
was selected. This hides the toggle and forces
`allowSupportAccess`/`allow_support_access` to `false` in that case,
across the standalone support form, sidebar form, and link-ticket form.

Addresses
[FE-3979](https://linear.app/supabase/issue/FE-3979/support-form-allows-support-access-without-a-project-selected).

## Test plan
- [x] Added/updated unit tests in `SupportFormPage.test.tsx` covering
toggle visibility and submitted payload when no project is selected
- [x] `pnpm vitest run components/interfaces/Support` passes (48 tests)
- [x] Typecheck and lint pass on changed files

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Support access is now offered only when a valid project and eligible
support category are selected.
* Support access is automatically disabled when no specific project is
selected.
* Form submissions now prevent unsupported support-access requests from
being enabled.
* **Tests**
* Added coverage for project clearing and scenarios without available
projects or organizations.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 11:49:03 -06:00
Charis 4d793a708e test(sql-editor): shared renderHook harness with in-memory editor port (#48209) 
## Summary

- Add `renderSqlEditorHook()` test harness that eliminates mocking
Monaco by injecting a real, deterministic in-memory editor port
(EditorController/DiffController backed by plain JS state)
- Include `createInMemoryEditor()`, `resetSqlEditorStores()`, and
`setupSqlEditorMocks()` utilities to provide isolation and mock-free
network testing via MSW handlers
- Export `CustomWrapper` from custom-render and add optional
`editor`/`diff` injection points to SQLEditorProvider (production
unaffected via null-coalesce fallback)

This is **Step 3** of an in-progress SQL editor testability refactor
(Step 2 finished EditorController/DiffController port; this harness has
no consumers yet — hook tests land in a follow-up step).

## Test plan

- [x] `pnpm --filter studio typecheck` passes (already verified)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Added reusable SQL Editor test utilities for in-memory editing,
selections, error highlighting, snippets, and diff content.
* Added helpers for resetting editor state, configuring API mocks, and
rendering SQL Editor hooks in a complete test environment.
* Enabled SQL Editor providers to accept optional controller overrides
for isolated testing.
  * Exported the shared test wrapper for reuse across test suites.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 13:32:55 -04:00
Andrey A. 2c72847fa6 docs: add new non-dictionary words to rule003 (#48207) 2026-07-22 09:45:27 -07:00
Danny White 90a53a5ee2 feat(studio): add shadcn tweet to sign-in testimonials (#48204) 
## What kind of change does this PR introduce?

Chore

## What is the current behavior?

Sign-in testimonials are drawn from the weighted tweet pool in
`packages/shared-data/tweets.ts`. shadcn's quote is not included.

Resolves
[FE-3978](https://linear.app/supabase/issue/FE-3978/add-shadcn-tweet-to-sign-in-page).

## What is the new behavior?

Adds [@shadcn](https://x.com/shadcn/status/1672913636132790272)'s tweet
("Supabase is really good. ⚡") with weight `10`, plus the profile image
under `twitter-profiles`.

## Additional context

Weighted selection on the Studio sign-in page and `topTweets` on www
both pick this up from the shared list.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Updated tweet module documentation to explain how tweet `weight`
impacts Studio sign-in weighted random selection and the `topTweets`
list (top 18 by weight).
* **New Content**
* Added a new tweet to the collection with an explicit `weight` of 10,
making it eligible for weighted selection and top-ranked inclusion.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 02:21:41 +10:00
Danny WhiteandJoshen Lim e19cd1863d feat(studio): connect logo contract for authorize (#48161) 
## What kind of change does this PR introduce?

Feature + docs. Closes
[DEPR-604](https://linear.app/supabase/issue/DEPR-604/define-connect-logo-asset-and-variant-contract).

## What is the current behavior?

`/authorize` logo resolution trusted self-asserted requester `name` (and
similar) for curated MCP marks, fell back to a letter tile when there
was no usable icon, and always used theme-reactive tile chrome. This
includes the scenario when pairing against unclassified uploaded OAuth
app bitmaps.

## What is the new behavior?

- [Documents the Connect logo asset/variant
contract](https://design-system-git-danny-depr-604-connect-logo-contract-supabase.vercel.app/design-system/docs/ui-patterns/connect-interstitials#logos)
(default to light, keep pairs matched, no theme-recolour of vendor
SVGs).
- Resolves curated partner logos from allowlisted `redirect_uri` hosts
only (`claude.ai` / `anthropic.com`, `cursor.com` / `cursor.sh`,
`chatgpt.com` / `openai.com`, `perplexity.ai`).
- Unknown / missing / failed requester icons show `SupabaseLogo` alone
(no letter tile).
- Uploaded organisation OAuth app icons (unclassified bitmaps) pair with
fixed light tile chrome (`border-black/10 bg-white` / `SupabaseLogo
forceLight`) on both sides across Studio themes.
- Curated partners keep theme-reactive tiles and may use dark assets
when available.

### To test

Real MCP clients (Claude, Cursor, etc.) only send users to
**production** `/authorize`, so you cannot drive a local or preview
Studio build from those tools. Use a Network override instead:

1. Start Studio and sign in (`pnpm dev:studio`, or use the Vercel
preview once available).
2. Open `/dashboard/authorize?auth_id=foo` (any `auth_id` is fine — the
real response may 404).
3. DevTools → **Network** → find `GET
…/platform/oauth/authorizations/foo` (or whatever id you used).
4. Right-click → **Override content** (enable Local Overrides / pick a
folder if prompted).
5. Paste one of the payloads below (status **200**), save, then reload
the authorize page.
6. Keep `expires_at` in the future so the request does not look expired.

The fields that matter for this PR are `name`, `icon`, and
`redirect_uri`.

#### Curated pair (allowlisted redirect)

Expect Cursor mark + Supabase pair. Toggle light/dark: curated dark
assets may swap; tiles stay theme-reactive (`bg-surface-75`).

```json
{
  "name": "Cursor",
  "website": "https://cursor.com",
  "icon": null,
  "domain": "cursor.com",
  "redirect_uri": "https://cursor.com/callback",
  "expires_at": "2099-01-01T00:00:00.000Z",
  "scopes": ["organizations:read", "projects:read"],
  "approved_at": null,
  "registration_type": "dynamic"
}
```

#### Unknown → Supabase alone

Expect Supabase bolt alone. No letter tile. No curated mark even if
`name` says Claude.

```json
{
  "name": "Acme",
  "website": "https://acme.example",
  "icon": null,
  "domain": "acme.example",
  "redirect_uri": "https://acme.example/callback",
  "expires_at": "2099-01-01T00:00:00.000Z",
  "scopes": ["organizations:read", "projects:read"],
  "approved_at": null,
  "registration_type": "dynamic"
}
```

#### Spoofed trusted name, non-allowlisted redirect (logo only)

Expect Supabase alone (no Claude mark). This PR does **not** show the
impersonation caution (that is coming in #48162).

```json
{
  "name": "Claude",
  "website": "https://claude.ai",
  "icon": null,
  "domain": "claude.ai",
  "redirect_uri": "https://evil.com/callback",
  "expires_at": "2099-01-01T00:00:00.000Z",
  "scopes": ["organizations:read", "projects:read"],
  "approved_at": null,
  "registration_type": "dynamic"
}
```

#### Uploaded OAuth app icon → forced-light pair

Expect remote icon + Supabase pair with forced-light tiles
(`border-black/10 bg-white`) on both sides in light and dark Studio
themes. The icon URL below is the checked-in solid-colour Acme bitmap on
this branch.

```json
{
  "name": "Acme",
  "website": "https://acme.example",
  "icon": "https://raw.githubusercontent.com/supabase/supabase/danny/depr-604-connect-logo-contract/apps/design-system/public/img/icons/acme-oauth-icon.png",
  "domain": "acme.example",
  "redirect_uri": "https://acme.example/callback",
  "expires_at": "2099-01-01T00:00:00.000Z",
  "scopes": ["organizations:read", "projects:read"],
  "approved_at": null,
  "registration_type": "static"
}
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Improved authorization interstitial branding with trusted requester
logos and safer fallback behavior.
* Added support for consistent light-theme treatment of uploaded OAuth
app icons.
* Added examples and documentation for unknown requesters, uploaded
logos, and wrong-account states.
* **Bug Fixes**
* Prevented unverified or unavailable requester icons from being
presented as trusted.
* Ensured logo pairing remains visually consistent across light and dark
themes.
* **Tests**
* Added coverage for trusted-host validation, fallback branding, icon
loading failures, and theme behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-07-23 02:20:42 +10:00
Danny White c8aca8d3a0 chore(design-system): standardise keyboard focus rings (#41575) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

UI / design-system consistency (accessibility).

## What is the current behavior?

Keyboard focus rings are inconsistent across Studio and `packages/ui`:

- Custom Button uses thick `outline` with per-variant colours (brand /
grey / destructive / warning)
- Form controls use muted grey rings (`ring-background-control`)
- Tabs / NavMenu / Radio use soft brand `ring-ring`
- Studio `.inset-focus` uses dark green `outline-brand-600`

Related: [DEPR-354](https://linear.app/supabase/issue/DEPR-354).

## What is the new behavior?

One shared focus recipe, exposed as Tailwind `@utility` classes in
`packages/config/css/utilities.css`:

| Utility | Use when |
| --- | --- |
| `focus-ring` | Buttons, inputs, most controls (offset ring) |
| `focus-inset` | Dense/flush surfaces such as interactive table rows
(renamed from `inset-focus`) |

```txt
# focus-ring
outline-hidden
focus-visible:ring-2
focus-visible:ring-ring
focus-visible:ring-offset-2
focus-visible:ring-offset-background
```

Applied on Button, shadcn form controls, Menu/NavMenu, Command palette
trigger, Studio table rows, and related call sites. Documented in the
design-system accessibility docs. Variants do not change focus ring
colour.

When the ring must appear on a different element than the focused one
(e.g. Menu + ProductMenu `Link` via `group-focus-visible`, or InputGroup
via `:has()`), keep an explicit ring stack. The utilities bake in
`:focus-visible` on the same element.

## Additional context

**Out of scope**

- Full `packages/ui` / Studio / www sweep
- Legacy Studio form-group green box-shadow cleanup
- ESLint rule for bare `outline-none`

## Test plan

Prefer Safari (“hard mode” for `tabIndex`). Expect one soft brand ring
everywhere: not grey, not solid green outline.

### Design system

- [ ]
[Accessibility](https://design-system-git-dnywh-choreimprove-tab-focus-styles-supabase.vercel.app/design-system/docs/accessibility):
recipe docs match what you see
- [ ]
[Button](https://design-system-git-dnywh-choreimprove-tab-focus-styles-supabase.vercel.app/design-system/docs/components/button):
Tab primary / default / danger; same ring colour
- [ ] [Table → Row-level
navigation](https://design-system-git-dnywh-choreimprove-tab-focus-styles-supabase.vercel.app/design-system/docs/components/table#row-level-navigation):
Tab an interactive row; inset outline (`focus-inset`) sits inside the
row

### Studio

- [ ] **Org home → table view** (`/organizations/_` or org projects):
switch to the table layout, Tab onto a project row; inset outline sits
inside the row (list/card view uses CardButton, not `focus-inset`)
- [ ] **Project sidebar** (Database, Auth, Storage, …): Tab the main
product nav links; ring follows the focused item (not the nested section
menus like Tables / Roles)
- [ ] **Storage → Files**: Tab a bucket row; same inset outline as org
table rows
- [ ] **Project Settings → General** (or Compute and Disk): Tab through
inputs, checkboxes, switches, selects; same offset ring, no ring on
mouse click
- [ ] **Header ⌘K** (desktop width): Tab to the search control after
Feedback; same soft brand `focus-ring` (was a thicker
`ring-border-strong` before)
- [ ] **Table Editor or SQL Editor tabs**: focus a tab, Tab to × if
active; close shows a ring
- [ ] **Light + dark**: ring stays visible against both backgrounds
 2026-07-22 12:10:07 -04:00
Jeremias Menichelli 71410b187a build: do not run federated content and markdown pipeline on dev (#48205) 2026-07-22 16:09:56 +00:00
Alaister YoungandAlaister Young 0fe2366659 [FE-3790] fix(studio): hide Multigres from user-facing surfaces (#48191) 
Hides the "Multigres" term from user-facing surfaces — it's the tech
powering High Availability projects, but "High Availability" is the only
term users should see for now (per Slack discussion with Saxon/Ivan).

**Changed:**
- High Availability badge hover card (project overview) no longer says
"Driven by Multigres"
- Project creation HA toggle description drops the Multigres name +
multigres.com link, keeps the informational copy
- All schema dropdowns now hide the `multigres` schema on HA projects,
by wiring in the previously-unused `filterSchemasForHighAvailability`
helper:
- `SchemaSelector` (shared — Table Editor, Functions, Indexes, Triggers,
Schema Visualizer, etc.)
  - `ExposedSchemaSelector` (API settings → exposed schemas)
- `EnableExtensionModal`, `CreateIndexSidePanel`, `ForeignKeySelector`,
`WrapperTableEditor`, Integrations install sheet `AdvancedSettings`
  - SQL editor schema autocomplete (`useAddDefinitions`)
- Schema list computations in the touched components are now memoized
(incl. stabilizing `SchemaSelector`'s `excludedSchemas` default so the
memo actually holds)

**Added:**
- Unit tests for `filterSchemasForHighAvailability` /
`resolveHighAvailability`
- MSW component test for `SchemaSelector` asserting `multigres` is
hidden on HA projects and still shown on non-HA projects

The filter is HA-gated on purpose: a self-hosted/non-HA user with their
own schema named `multigres` still sees it. The flag-gated Multigres
option in Logs is intentionally untouched — that exposure is kept for
the Multigres team's debugging (separate track).

## To test

- On an HA project (`high_availability: true`): hover the High
Availability badge on project overview — no "Multigres" mention; open
schema dropdowns in Table Editor / Database pages / SQL editor
autocomplete — no `multigres` schema
- Project creation with HA entitlement: toggle description has no
Multigres wording/link
- On a non-HA project: schema dropdowns behave as before

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Made schema dropdowns and related selectors high-availability aware
across extensions, indexes, integrations, SQL editing, API exposed
schemas, and relationship editors.
* Updated project high-availability UI text and badge hover description
to remove outdated branding and clarify horizontally scalable Postgres
architecture.
* **Tests**
* Added coverage to ensure the schema “multigres” option is hidden/shown
correctly based on high availability, and validated high-availability
value handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-23 00:08:11 +08:00
Danny White 9ea3919fb5 fix(studio): show column format in sort/filter type labels (#48201) 
## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

Table editor sort (and filter) column pickers show `USER-DEFINED` for
extension types such as PostGIS `geography`, because they use `dataType`
from pg-meta.

| Before |
| --- |
| <img width="549" height="196" alt="CleanShot 2026-07-22 at 11 32 44"
src="https://github.com/user-attachments/assets/9ba2dec8-f5a3-479f-81c8-2dd133f6d419"
/> |

## What is the new behavior?

Those pickers use the same display helper as column headers
(`getColumnFormat`), so labels match the header (e.g. `geography`,
`int4[]`).

## Test plan

In SQL Editor:

```sql
create extension if not exists postgis with schema extensions;

create table public.geography_sort_repro (
  id bigint generated always as identity primary key,
  location extensions.geography(point, 4326),
  tags text[]
);
```

Then open `geography_sort_repro` in the Table Editor → Sort → pick
`location` / `tags`. Confirm labels are `geography` and `text[]` (not
`USER-DEFINED` / `_text`). Same check in the Filter column picker.

Cleanup: `drop table public.geography_sort_repro;`

## Additional context

`data_type` is intentionally coarse for non-`pg_catalog` types in
pg-meta; `format` already carries the real type name. Arrays need
`getColumnFormat` so `_int4` becomes `int4[]`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved column type labels in filter and sort menus by displaying the
appropriate format instead of raw data types.
* Preserved existing JSON-field restrictions and tooltips while
improving the clarity of displayed column information.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 02:02:28 +10:00
Alaister YoungandAlaister Young badf16be07 [FE-3909] fix(studio): exclude generated columns from row insert form (#48195) 
Inserting a row through the table editor failed on any table with a
`GENERATED ALWAYS AS (...) STORED` column — the row editor sent an
explicit value for the generated column (e.g. `false` for booleans,
since the bool `Select` never hits the empty-string default heuristic
from #46826), which Postgres rejects with `428C9: cannot insert a
non-DEFAULT value into column`.

**Changed:**
- `RowField` now carries `isGenerated` (from pg-meta's `is_generated`,
previously unused by Studio)
- Generated columns are hidden from the row editor form (they're always
computed by the database, so there's nothing to input) but stay in
`rowFields` state so primary-key identifier logic is unaffected
- `generateRowObjectFromFields` skips generated fields, so they're
omitted from both insert and update payloads
- `validateFields` skips generated fields — an error on a hidden field
would be unfixable

**Added:**
- e2e test covering inserting a row into a table with a generated
boolean column
- unit tests for generated-column omission in insert/update payloads and
validation

## To test

1. Create a table with a generated column:
   ```sql
   create table t (
     id bigint generated by default as identity primary key,
     base_price int,
     discounted_price int,
     is_discounted boolean generated always as (
       base_price is distinct from discounted_price
     ) stored
   );
   ```
2. Table Editor → `t` → Insert row — `is_discounted` should not appear
in the form
3. Fill the other fields and save — the insert should succeed and the
grid should show the computed value
4. Edit an existing row and save — should still work (generated column
untouched)
5. Sanity-check a normal table with identity/default columns — clearing
a default field on insert should still fall back to the default (#46826
behavior)

Addresses
[FE-3909](https://linear.app/supabase/issue/FE-3909/studio-insert-form-fails-on-generated-boolean-columns)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added support for generated columns in the table editor.
* Generated columns are automatically computed and excluded from insert
and update forms.
* Generated values now appear correctly in the table after saving a row.

* **Bug Fixes**
  * Prevented validation errors for non-editable generated fields.
  * Ensured generated columns are excluded from submitted row data.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-22 22:19:36 +08:00
Alaister YoungandAlaister Young 1144b83885 feat(studio): add loading and fallback states to SPA shell (#48185) 
The prerendered TanStack SPA shell (`_shell.html`) had a visually empty
body, so every cold load showed a blank page until the JS bundle
downloaded and hydrated. This bakes proper fallback states into the
shell as static HTML — none of them rely on JS executing.

**Added:**
- `ShellFallback` component, rendered as the `ClientOnly` fallback
around the root `<Outlet />` — during the shell prerender it serializes
into `_shell.html`, and on the client it unmounts the moment the app
mounts (no hydration mismatch: `ClientOnly` renders the fallback on the
server and first client render)
- Animated `LogoLoader` (Supabase logo outline) centered on screen — the
stroke-dash animation is pure CSS so it runs before any JS executes
- Stuck-load help text that fades in after 7s via CSS `animation-delay`
(clear cookies / reload, contact support@supabase.com — the support
email is gated behind `IS_PLATFORM` so self-hosted builds don't get it)
- `noscript` message for JS-disabled browsers, which also hides the
loader so users don't see an infinite spinner (uses
`dangerouslySetInnerHTML` so React hydration never diffs noscript
children)
- `data-nosnippet` on both text blocks so Google doesn't surface the
boilerplate as the search snippet for dashboard URLs (the one shell
serves every route)

## To test

All on the Vercel preview:

- Open the preview — on a cold load you should catch the animated logo
loader before the app mounts (throttle to "Slow 4G" in devtools if it
flashes by too fast), and it never reappears on client-side navigation
- In devtools, block the JS bundle (Network tab → right-click the
`/assets/index-*.js` request → Block request URL) and reload — the
loader animates on its own, and the help text (clear cookies / contact
support) fades in after ~7s
- Disable JavaScript (devtools command palette → "Disable JavaScript")
and reload — no spinner, just the "requires JavaScript" message
- View page source (or `curl` any preview URL) — the body contains the
logo SVG, the help text, and the noscript block, all with
`data-nosnippet` on the text

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added a client-aware loading shell for Studio during initialization.
* Shows a branded loader with a help message that appears after a short
delay.
  * Includes platform-specific support contact details when available.
* **Bug Fixes**
* Prevents partial or incomplete content from rendering before the app
is ready.
* Improves consistency for no-JavaScript fallback rendering to avoid
hydration mismatches.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-22 22:08:52 +08:00
Francesco Sansalvadore 50d7030f48 chore(studio): default opt-in to integrations layout (#48183) 
Make the new "one-click" integrations feature preview opt-in by default
so it appears for all users once we switch `marketplaceIntegrations` to
_true_ and reframe the feature preview copywriting.

<img width="1007" height="694" alt="Screenshot 2026-07-22 at 12 01 08"
src="https://github.com/user-attachments/assets/4b35870c-dcf0-45cc-a1b5-69628e7e10b5"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added a visual preview image to the integrations layout preview.
  * Renamed the preview to “One-Click Integrations.”
* Made the preview enabled by default when the marketplace feature is
enabled.
* **Style**
* Refreshed the preview text and updated the layout with improved
spacing, border, and rounded corners.
* **Documentation**
* Updated the page header documentation link to the general integrations
guide.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 16:06:28 +02:00
Francesco Sansalvadore a10ebd9097 chore(studio): improve light mode images on featured integrations (#48179) 
## What is the current behavior?

featured integration image was looking muddy on light mode
<img width="1479" height="792" alt="Screenshot 2026-07-16 at 16 20 29"
src="https://github.com/user-attachments/assets/d51960f9-7c58-47d6-a751-e310f0edb32e"
/>

## What is the new behavior?

dedicated light-mode preview images
<img width="1482" height="785" alt="Screenshot 2026-07-16 at 16 29 48"
src="https://github.com/user-attachments/assets/5c1b9772-8ea2-4b94-aeba-cb095015df8e"
/>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added Stripe Sync Engine to the featured integrations list.
  * Added light-theme cover imagery for featured integrations.
* Featured integration cards now display theme-aware images and improved
visual overlays.
* Updated the marketplace grid for improved responsive layouts across
screen sizes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 09:50:36 -04:00
Lukas Klingsbo a132009a51 docs(dart): storage buckets, streaming/cache-purge, web3, OAuth grants, and July additions (#47971) 
## What

Updates the Dart/Flutter reference
(`apps/docs/spec/supabase_dart_v2.yml`) for features shipped in
[`supabase/supabase-flutter`](https://github.com/supabase/supabase-flutter)
in July (through the July 17 storage CDN-cache additions).

Built on the **new reference pipeline** (#47224 / #47994): each method's
section is inherited from the nearest section-header entry in the YAML,
and subcategory overviews are committed partials under
`spec/reference/dart/v2/partials/`. `common-client-libs-sections.json`
is **not** touched.

Scoped to items **not** already covered by #47728 (OAuth server
authorization details, custom providers admin, `explain` format,
realtime `onHeartbeat` and filter examples). Rebased onto `master` now
that #47994 and #47728 have landed.

## New reference entries

**Storage**
- Vector buckets (new **Vector Buckets** section):
create/get/list/delete bucket, index create/get/list/delete/access, and
vector put/get/list/query/delete (`supabase.storage.vectors`)
- Analytics (Iceberg) buckets (new **Analytics Buckets** section):
`createAnalyticsBucket`, `listAnalyticsBuckets`,
`deleteAnalyticsBucket`, and the `analyticsCatalog()` accessor
- `listPaginated` (list files v2), under File Buckets
- `downloadStream()` (streaming file downloads), under File Buckets
- `purgeCache()` (object CDN cache invalidation) and
`purgeBucketCache()` (bucket CDN cache invalidation)

**Auth**
- `signInWithWeb3`
- OAuth server `listGrants` and `revokeGrant` (in the **OAuth Server**
section, `supabase.auth.oauth`)

**Database**
- `stripNulls()` modifier

## Enrichments to existing entries

- Storage: `cacheNonce` on `getPublicUrl` / `createSignedUrl` /
`download`; filter/sort/pagination options on `listBuckets`
- Auth: `channel` on `mfa.challenge()`; `currentPassword` on
`updateUser`; async `getSession()` note and example; `friendlyName` on
`registerPasskey()` and `passkey.startRegistration()`
- Functions: `abortSignal` on `invoke`

## Pipeline plumbing

- New partials: `analytics-buckets.json`, `vector-buckets.json`,
`oauth-server.json`
- `generate-dart-reference.ts`: registers `analytics-buckets`,
`vector-buckets`, and `oauth-server-api` group-header ids in
`HEADER_IDS` so they render as section overviews rather than methods

## Source PRs

supabase-flutter: #1547, #1554, #1557, #1559, #1561, #1563, #1578,
#1579, #1580, #1585, #1588, #1590, #1591, #1593, #1603, #1607, #1608

## Verification

`pnpm codegen:references:dart` builds cleanly: the generator writes 141
method declarations (all ids resolve to a section, no invalid method
names, no slug collisions), and the nav renders the Analytics Buckets,
Vector Buckets, and OAuth Server sections with the expected methods.

## Notes

- Skipped (no reference home / would need product decisions): Iceberg
namespace/table management (the full `IcebergRestCatalog` API, which
lives in a standalone `iceberg-js` package upstream), `dryRun`,
functions exception subtypes, trace-context headers, `persistSession`,
configurable postgrest timeout/retry.
- `storageanalytics-from` maps to Dart's `analyticsCatalog(bucketId)`
(the Iceberg catalog entry point), since Dart has no `analytics.from()`
equivalent.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Expanded Dart docs with Web3 sign-in plus passkey, MFA channel, and
OAuth grant listing/revocation.
* Added storage APIs/examples for listing buckets with options, CDN
cache bypass via `cacheNonce`, and cache/purge support.
* Documented `stripNulls()` database modifier and cursor-based paginated
storage listing.

* **Documentation**
* Updated auth references with optional `currentPassword`,
`friendlyName`, and clarified `currentSession` vs `getSession()`.
* Added `abortSignal` support and examples for
`supabase.functions.invoke()`.

* **Bug Fixes**
* Improved Dart reference generation so analytics/vector bucket sections
aren’t emitted as method declarations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 15:43:55 +02:00
Ivan Vasilov 2428bddcb5 chore: Bump vulnerable deps (#48178) 
Fixes the following vulnerabilities:
- https://github.com/supabase/supabase/security/dependabot/3963
- https://github.com/supabase/supabase/security/dependabot/3963
- https://github.com/supabase/supabase/security/dependabot/3964
- https://github.com/supabase/supabase/security/dependabot/3965
- https://github.com/supabase/supabase/security/dependabot/3966
- https://github.com/supabase/supabase/security/dependabot/3927
- https://github.com/supabase/supabase/security/dependabot/3955
- https://github.com/supabase/supabase/security/dependabot/3913
- https://github.com/supabase/supabase/security/dependabot/3972
- https://github.com/supabase/supabase/security/dependabot/3959
- https://github.com/supabase/supabase/security/dependabot/3960
- https://github.com/supabase/supabase/security/dependabot/3916
- https://github.com/supabase/supabase/security/dependabot/3918
- https://github.com/supabase/supabase/security/dependabot/3947
- https://github.com/supabase/supabase/security/dependabot/3948
- https://github.com/supabase/supabase/security/dependabot/3956
- https://github.com/supabase/supabase/security/dependabot/3957
- https://github.com/supabase/supabase/security/dependabot/3958
- https://github.com/supabase/supabase/security/dependabot/3917
- https://github.com/supabase/supabase/security/dependabot/3919
- https://github.com/supabase/supabase/security/dependabot/3970
- https://github.com/supabase/supabase/security/dependabot/3928
- https://github.com/supabase/supabase/security/dependabot/3949
- https://github.com/supabase/supabase/security/dependabot/3950
- https://github.com/supabase/supabase/security/dependabot/3973
- https://github.com/supabase/supabase/security/dependabot/3920
- https://github.com/supabase/supabase/security/dependabot/3951

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated the bundled `tar` dependency to a newer patch version for
consistency and security across the workspace.
* Added/adjusted overrides to pin a few transitive dependencies to
specific versions.
* Normalized workspace configuration formatting and made minor
development configuration cleanup (no functional change).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 14:45:45 +02:00
Joshen Lim 31878cabf6 Stop re-rendering UI if live mode is off (#48188) 
## Context

For the Database Connections page, we run a `useEffect` every second to
re-render the UI so that the timestamps of each process' duration
reflects real time. However, duration should stop counting if live mode
is paused as otherwise it becomes inaccurate then.

Also forces an immediate refetch of the database activities when live
mode is re-enabled

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
  * Improved live activity updates on the Database Connections page.
* Pausing live mode now stops activity timestamp updates and refreshes.
* Resuming live mode immediately reloads the latest activity and updates
the UI to reflect live state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 20:30:04 +08:00
Ivan Vasilov efed6b5c6a chore: Server monaco editor from Cloudflare (#47973) 
How to test:
- Editor should load and work in the SQL Editor
- Search for JS bundles `https://cdnjs.cloudflare.com/*` in the preview
to verify that's it's loaded from a CDN
- Check in the local build whether the Monaco editor is loaded from the
base URL (have to do it locally, SQL Editor doesn't work on the
self-hosted Vercel deployment)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Performance**
* Improved delivery of Studio assets through CDN-based URLs in supported
environments.
* Updated the Monaco editor to load assets from the configured CDN when
available, with a local fallback.
* **Reliability**
* Added support for explicitly enabling or disabling CDN asset delivery
across environments.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 13:57:03 +02:00
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot] d847c48464 feat: update @supabase/*-js libraries to v2.110.8 (#48156) 
This PR updates @supabase/*-js libraries to version 2.110.8.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.110.8
- Updated @supabase/auth-js to 2.110.8
- Updated @supabase/realtime-js to 2.110.8
- Updated @supabase/postgest-js to 2.110.8
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.110.8

## 2.110.8 (2026-07-21)

### 🩹 Fixes

- **auth:** downgrade aborted/transient fetch failures from
console.error to warn
([#2544](https://github.com/supabase/supabase-js/pull/2544))
- **functions:** clean up cross-signal abort listener on invoke() return
([#2487](https://github.com/supabase/supabase-js/pull/2487))
- **functions:** match response Content-Type case-insensitively
([#2515](https://github.com/supabase/supabase-js/pull/2515))
- **storage:** url-encode object key in CDN purge methods
([#2545](https://github.com/supabase/supabase-js/pull/2545))
- **supabase:** skip Node warning in Deno
([#2541](https://github.com/supabase/supabase-js/pull/2541))

### ❤️ Thank You

- Franco Kaddour @FrancoKaddour
- Katerina Skroumpelou @mandarini
- Pedro Henrique
- Vaibhav @7ttp
## v2.110.7

## 2.110.7 (2026-07-16)

### 🩹 Fixes

- **postgrest:** correct self-reference inference
([#2525](https://github.com/supabase/supabase-js/pull/2525))
- **realtime:** trigger set auth on INITIAL_SESSION event
([#2531](https://github.com/supabase/supabase-js/pull/2531))
- **realtime:** update phoenix to fix presence issue
([#2532](https://github.com/supabase/supabase-js/pull/2532))

### ❤️ Thank You

- Eduardo Gurgel
- Filipe Cabaço @filipecabaco
- Vaibhav @7ttp

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
 2026-07-22 14:30:30 +03:00
claude[bot]andClaude ffd5a93f37 feat(www): add hidden Legal Hub subprocessor list page (draft) (#48100) 
<!-- ccr-slack-attribution -->
_Requested by **Nicole Kramer** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1783431374242039?thread_ts=1783431374.242039&cid=C0161K73J1J)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature (`apps/www`).

## What is the current behavior?

No public page for Supabase's subprocessor list, and no way for
customers to be notified when it changes.

## What is the new behavior?

A new hidden page at `/legal/customer-resources/subprocessor-list` shows
the current dated subprocessor PDF and lets anyone subscribe with their
name and email to receive an email whenever the list is updated. The
page is `noindex` and not linked from any nav, so it's shareable by
direct URL only for now. Mirrors Wiz's sub-processor-list page.

**How:**

- **Page**
`apps/www/pages/legal/customer-resources/subprocessor-list.tsx` —
pages-router, mirrors the existing Legal Hub pages (`DefaultLayout`,
`NextSeo`, `PageHeader` + breadcrumb, `SectionContainer` prose). Embeds
the PDF (inline preview + download link) and renders the subscribe form.
Marked `NextSeo` noindex/nofollow and intentionally left unlinked.
- A single `CURRENT_PDF` constant (filename + display date) is the only
thing to change when Legal hands over a new dated PDF.
- **Form** `apps/www/components/SubprocessorUpdatesForm.tsx` — mirrors
`SecurityNewsletterForm` (First name, Last name, Email; `ui`
primitives). Carries the framing copy verbatim, with **Subscribe to
updates** bold and Privacy Policy linked to
https://supabase.com/privacy.
- **API route**
`apps/www/app/api-v2/submit-form-subprocessor-updates/route.tsx` — exact
mirror of `submit-form-security-newsletter`; subscribes the user to the
Customer.io "Subprocessor Alerts" subscription (topic 4) via
`cio_subscription_preferences.topics.topic_4: true`.
- **PDF** `apps/www/public/legal/subprocessor-list/June-1-2026.pdf`.

**Updating the list in future:** Drop the new dated PDF into
`apps/www/public/legal/subprocessor-list/` and update the `CURRENT_PDF`
constant. Nothing else changes.

## Additional context

**Notes / to confirm:**

- Customer.io topic id `4` → `topic_4` (per Prashant); not independently
verified against Customer.io.
- Draft: page is intentionally unlinked and noindex until Legal signs
off.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01D9WS2QWQ8Y3o7PqDZabS3F)_

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-07-22 11:19:14 +01:00
Joshen Lim bb811ef67e Joshen/fe 3972 add filter for application name (#48180) 
## Context

Adds supporting for filtering by application name for Database
Connections
<img width="592" height="325" alt="image"
src="https://github.com/user-attachments/assets/e09b8d61-4215-4da4-b2aa-980cdc475738"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added an **Application** filter to database activity views.
* Expanded filtering to include session state, roles, and matching by
activity application name.
* Filter option counts are now more accurate based on the currently
selected criteria.

* **Bug Fixes**
* Improved filter reset behavior to reliably clear application/state
selections and restore role defaults.
  * Enhanced persistence of filter selections via URL query parameters.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 17:53:41 +08:00
Joshen Lim d5a882c4fa Support click to copy PID from activity row (#48177) 
## Context

Very tiny one - just supports clicking to copy PID from the Activity Row
in Database Connections
Will be useful for diving into details of the query with the Assistant
if needed
<img width="323" height="120" alt="image"
src="https://github.com/user-attachments/assets/b80a69eb-d1e8-49d3-93e3-08c111b3ea6e"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added the ability to click an activity process ID to copy it to the
clipboard.
  * Added confirmation feedback after copying the process ID.

* **UI Improvements**
* Improved query tooltip behavior by providing a slightly longer hover
delay.


<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 17:26:17 +08:00
Joshen Lim cf7da58eb3 Add overview section for database connections (#48147) 
## Context

Building on top of "Database Connections" - this adds a top summary
section, again from `pg_stat_activity`
<img width="948" height="324" alt="image"
src="https://github.com/user-attachments/assets/f4968193-0a5f-4754-a630-40685b747999"
/>

Each block comes with a tooltip in hopes to educate the significance of
each metric
- Connections: Spread of connections per database role
<img width="313" height="164" alt="image"
src="https://github.com/user-attachments/assets/8ceeab5d-b960-4be3-9a5b-8600bd5cf303"
/>
- Active queries: Rough representative of activity
<img width="350" height="196" alt="image"
src="https://github.com/user-attachments/assets/f9705ff1-a869-409a-86b6-50170a169674"
/>
- Idle in transaction: Important to identify as this indicates locks
(Suggests root cause)
<img width="350" height="196" alt="image"
src="https://github.com/user-attachments/assets/f9705ff1-a869-409a-86b6-50170a169674"
/>
- Blocked queries: Also important to identify stuck queries
<img width="335" height="183" alt="image"
src="https://github.com/user-attachments/assets/57255fb8-24f6-4ddd-aa54-850a77173b5c"
/>
- Longest running query: Might be useful to identify unusually long
queries
- Will be `text-warning` if exceeds 30 seconds for active queries,
`text-destructive` if exceeds 10 seconds for queries idle in transaction
<img width="342" height="119" alt="image"
src="https://github.com/user-attachments/assets/f6783b43-058a-4a32-a40c-0bc64f23d2ce"
/>

"Summarize activity" CTA leverages on the Assistant to give a quick
overview - highlights any potential issues for quick reference
<img width="1918" height="958" alt="image"
src="https://github.com/user-attachments/assets/340121fe-3186-48a5-8023-fbac2a93397a"
/>

## Other changes
- Hides "View running queries" in SQL Editor if `topForPostgres` feature
flag is enabled (since this UI is meant to replace that)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a Database Connections observability overview with metric cards
(connections, longest-running, active, blocked, idle-in-transaction) and
an interactive “Longest running” PID selector.
* Added a “Summarize activity” AI assistant dropdown that starts a
timestamped, activity-aware summary chat.
* **Improvements**
* Enhanced live activity refresh (including window-focus updates) and
standardized duration warning thresholds for active and
idle-in-transaction sessions.
* Improved hover details for query previews and allowed richer tooltip
content for metric labels.
* **Feature Changes**
  * Gated the “View running queries” bottom panel behind a feature flag.
* **Bug Fixes**
* Refined running-too-long badge and warning styling for
idle-in-transaction cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 17:25:56 +08:00
Steven Eubankgithub-actions[bot]Nik Richers
 		751dcecf86 docs(log-drains): overhaul page style and add missing Last9 + Syslog … (#48140) 
## Summary

Brings the Log Drains docs up to the same standard as the Metrics API
page.

- Replaces the plain destination table with a visual
`LogDrainDestinationCards` component — a 3-column card grid
that mirrors the product UI destination picker. Cards link to anchors on
the same page (no sub-pages needed since
  setup is simpler than Metrics).
- Adds a "What you can do" intro section and a consistent "Required
configuration + Steps" structure for every
  destination.
- Adds two destinations that were missing from the docs entirely:
**Last9** and **Syslog** (both are live in the
product). Config fields sourced from `LogDrainDestinationSheetForm.tsx`.
  - Cleans up raw `<ul><li>` HTML to markdown lists.
- Adds an "Additional resources" footer (pricing, Metrics API, JS SDK
tracing).

  ## Files changed

- `apps/docs/content/guides/telemetry/log-drains.mdx` — core of the
changes
- `apps/docs/components/LogDrainDestinationCards.tsx` — new card grid
component
- `apps/docs/components/LogDrainDestinationCards.data.ts` — destination
data (9 entries)
- `apps/docs/internals/markdown-schema/LogDrainDestinationCards.ts` —
markdown fallback renderer
- `apps/docs/features/docs/MdxBase.shared.tsx` — register new component
- `apps/docs/internals/generate-guides-markdown.ts` — register new
component

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

docs update

## What is the current behavior?

not supanice, also missing syslog and last9

<img width="619" height="687" alt="image"
src="https://github.com/user-attachments/assets/58e8f07c-eb40-4d30-a5e2-3988d1af87c2"
/>

## What is the new behavior?

hopefully more supanice, also added syslog and last9

<img width="568" height="667" alt="image"
src="https://github.com/user-attachments/assets/be61e67f-58aa-4e8c-be0d-44206f1b16de"
/>


## Additional context



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Reorganized the Log Drains guide with destination-specific sections
and a new destination chooser.
  * Added support and setup guidance for Last9 and Syslog destinations.
* Clarified HTTP batching, JSON delivery, compression, authentication,
and endpoint requirements.
* Updated OpenTelemetry, Datadog, Loki, Amazon S3, Sentry, and Axiom
instructions.
* Added Edge Function examples covering compressed and uncompressed
payloads.
* Added links to pricing, Metrics API, and JavaScript tracing resources.

* **UI Improvements**
* Updated destination listings with clearer, consistent icons and
presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Nik Richers <nik@validmind.ai>
 2026-07-22 10:51:52 +02:00