mirror of
https://github.com/supabase/supabase.git
synced 2026-10-10 20:05:06 +03:00
fix/docs-button-link-styling
189
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Danny WhiteandJoshen Lim
|
fce9d475ee |
chore(studio): migrate combobox triggers (#50157)
## What kind of change does this PR introduce? Studio UI consistency refactor. ## What is the current behaviour? Several Studio comboboxes still build their triggers from `Button` and supply their own double-chevron icon. This duplicates trigger styling and allows these controls to drift from selects and other comboboxes. ## What is the new behaviour? - Migrates the PITR timezone, AWS region, and account timezone controls to `ComboboxTrigger` - Migrates the shared `SchemaSelector` and `FunctionSelector`, updating their Studio callsites together - Preserves the globe icon in both timezone controls - Exposes the correct combobox role and open state through the shared trigger - Tightens the tiny schema selector end padding so its chevron aligns with adjacent controls - Leaves organisation and project context switchers unchanged | Before | After | | --- | --- | | <img width="504" height="490" alt="CleanShot 2026-09-09 at 13 56 56@2x" src="https://github.com/user-attachments/assets/117a9169-88bf-4f9e-8302-9df9b911a307" /> | <img width="496" height="512" alt="CleanShot 2026-09-09 at 11 31 26@2x" src="https://github.com/user-attachments/assets/bc98cded-2723-4d20-9d8c-49630ea018af" /> | | <img width="1250" height="394" alt="CleanShot 2026-09-09 at 13 58 34@2x" src="https://github.com/user-attachments/assets/9106f924-88fd-40d4-88e3-8d0ddbb61d12" /> | <img width="1246" height="376" alt="CleanShot 2026-09-09 at 13 58 09@2x" src="https://github.com/user-attachments/assets/7894a254-f6f9-40bb-a312-9f1a5079f096" /> | ## To test On the [Studio preview](https://studio-staging-git-dnywh-choremigrate-combobox-680102-supabase.vercel.app): 1. Open **Database > Tables** and use the schema selector above the table. It should use a single down chevron, open normally, and update the selected schema. 2. Open **Authentication > Hooks > Add hook**, then select **Postgres** as the hook type. The **Postgres schema** and **Postgres function** selectors should use a single down chevron and continue to open and select normally. The PITR, AWS region, and account timezone callsites require the relevant plan, integration, or feature flag. When available, their triggers should use the same single down chevron, and both timezone controls should retain the globe icon. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **UI Improvements** * Standardized timezone, AWS region, database backup, function, and schema selectors with a consistent combobox interface. * Added clear visual feedback for open and closed selector states. * Preserved contextual icons and labels, including globe icons for timezone selections. * Improved accessibility with appropriate combobox semantics, accessible names, and state information. * Timezone settings are now available without an optional feature flag. * **Tests** * Updated end-to-end coverage for the standardized combobox controls. * Added coverage confirming schema selectors expose the selected schema as an accessible name. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Gildas Garcia
|
bfb0737d14 |
Fix to ensure labels, descriptions and validation errors are correctly linked to their inputs (#50080)
## Problem `FormItemLayout` does not correctly binds inputs descriptions and validation messages to their inputs. This is because the input ids are generated and not correctly propagated to the `FormMessage` and `FormDescription` components. Besides, we still pass `name` or `id` directly to the inputs or `FormItemLayout` in some places. ## Solution - Fix `FormItemLayout` to correctly binds inputs descriptions and validation messages to their inputs - Fix incorrect usages - Fix Design System documentation ## How to test The issue is visible in production: - Open https://supabase.com/design-system/docs/ui-patterns/forms - Open the devtool and check the labels `for`, the description `id` and the input `id` or `aria-describedby` attributes. You'll see they often don't match Do the same on staging: - Open https://design-system-git-fix-a11y-form-input-descriptions-supabase.vercel.app/design-system/docs/ui-patterns/forms - Open the devtool and check the labels `for`, the description `id` and the input `id` or `aria-describedby` attributes. They now match Dashboard fixes: - https://studio-staging-git-fix-a11y-form-input-descriptions-supabase.vercel.app/dashboard/account/tokens: _Expires in_ select button is now correctly linked to its label - https://studio-staging-git-fix-a11y-form-input-descriptions-supabase.vercel.app/dashboard/account/me: the switches are now correctly linked to their label - In Database/Indexes: the select buttons when creating an index are now correctly linked to their label - All other changes are the same things |
||
|
|
c086fe0d3f |
fix(studio): stop duplicating access_token_creation_sheet_dismissed on Done (#50077)
<!-- ccr-slack-attribution --> _Requested by **Pam Chia** · [Slack thread](https://supabase.slack.com/archives/C076KTY11DF/p1788743741768969?thread_ts=1788743741.768969&cid=C076KTY11DF)_ ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix (telemetry). ## What is the current behavior? `access_token_creation_sheet_dismissed` (added in #49965) fires on every close of the "Generate token" sheet in `/account/tokens`, including a successful completion. The "Token created" step closes the sheet through a "safe" path (clicking **Done**), but `handleOpenChange` tracked the dismissed event on that path too: a 1:1 duplicate of the already-tracked `access_token_done_button_clicked` event, with `step: 'success'`. The event's `tokenType` property was also never meaningful: it is derived from a variable that is only set after a token is actually created and never reset, so on a first-attempt abandonment it is always `'none'` by construction, and on a later abandonment in the same session it carries the *previous* token's type. The sheet also force-closes when the permissions map fails to load. That close was indistinguishable from a user abandonment. Linear: [GROWTH-1196](https://linear.app/supabase/issue/GROWTH-1196/fix-access-token-creation-sheet-dismissed-duplicate-on-done) ## What is the new behavior? - The event no longer fires on **Done**. The token-created step already blocks Escape, outside click, and Cancel, so the event now only reflects the sheet closing before a token exists. - Dropped `tokenType` (never described the abandoned attempt, see above) and `step` (a constant `'form'` once Done stops firing it; it was also typed Numeric project-wide in PostHog, so its string values read as NULL in HogQL). - New properties, read from the live form at close time through a small `useImperativeHandle` ref on `NewScopedTokenForm` (`useForm` ownership stays inside the form component): - `resourceAccess` (`project` | `organization` | `account`): the in-flight scope selection. `account` is the classic-token path, so this carries what `tokenType` was meant to. It is the default `project` when the form is untouched, so filter on `isFormTouched` before reading it as intent. - `formStep` (`form` | `review`): which screen the user was on. The sheet-level `step` never captured this. - `isFormTouched`: whether any field was changed from its default. - `trigger` (`user` | `permissions_load_error`): the forced close on a failed permissions load now fires with its own trigger, so an endpoint regression shows up in the funnel instead of silently lowering `access_token_created`. - Fixed a double-fire on the load-error path: the form's error effect depended on the `onCancel` callback identity and re-ran on the sheet's close re-render (double toast, and a double event). It now reads the callback through a ref and depends only on `isError`, matching the existing `isReducedMotionPreferredRef` pattern in the same file. ## Additional context `NewScopedTokenSheet.test.tsx` asserts: Done does not emit the dismissed event; Cancel and Escape emit it with `trigger: 'user'` and the in-progress `resourceAccess` and `isFormTouched`; dismissing from the review screen reports `formStep: 'review'`; a 500 from the permissions endpoint emits exactly one event with `trigger: 'permissions_load_error'` and closes the sheet. `step` being typed Numeric in PostHog affects every event that sends a string `step`. That is a PostHog data-management fix handled separately, not in this PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01XW73umv73LrrKxFwwymSaH --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Pamela Chia <pamelachiamayyee@gmail.com> |
||
|
Gildas Garcia
|
50a6ebbe6d |
Scoped PAT: improve error handling when showing a token details (#49997)
We already have proper error handling on: - the token list query - token creation/deletion with toasts We had custom error handling on the token permissions sheet. Replaced it with an `AlertError`: <img width="798" height="371" alt="image" src="https://github.com/user-attachments/assets/24145308-b1cd-491f-8f54-0c628dd185ce" /> Question: should we do something about the sheet header when the token couldn't be loaded? <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved the access token loading error state with a clearer, consistent error display and “Please try again” guidance. * Added a fallback label of “Unknown” when an access token name is unavailable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earthandGildas Garcia
|
8654991847 |
feat(studio): additional events for scoped pat telemetry (#49965)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Adds PostHog tracking to the final step of the scoped PAT creation flow, after `access_token_created` fires. The token value is only ever shown once, so this measures whether users actually leave with a usable token. Three new events on the "Token created" step: | Event | Properties | | --- | --- | | `access_token_copied` | `tokenType` | | `access_token_stored_checkbox_clicked` | `tokenType`, `isChecked` | | `access_token_done_button_clicked` | `tokenType`, `hasCopiedToken` | - `isChecked` is the resulting state, so unticking the acknowledgement is captured too. - `hasCopiedToken` records whether the Copy button was used before finishing. Done is gated on the checkbox, not on copying, so this separates "copied it" from "ticked the box and left." - `tokenType` is threaded through from the sheet, which creates a classic token when resource access is `account` and a scoped one otherwise. It matches the existing `access_token_created` / `access_token_removed` property. ## Changes - `packages/common/telemetry-constants.ts` — three event interfaces, added to the `TelemetryEvent` union - `NewScopedTokenSuccess.tsx` — `useTrack()` plus a new `tokenType` prop; copy/acknowledge/done routed - `NewScopedTokenSheet.tsx` — `createdToken` state now holds `{ token, tokenType }` so the success step knows which - `NewScopedTokenSheet.test.tsx` — extended the two tests that already walk the full success flow with assertions and classic paths) ## Testing `pnpm test:studio` on `NewSco16 passing. Typecheck clean. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Analytics** * Added tracking for key access-token creation interactions, including copying tokens, selecting storage options, and completing the flow. * Tracking distinguishes between classic and scoped access tokens and records whether a token was copied before completion. * Added tracking when the access-token creation sheet is dismissed, including the current step. * **Behavior** * Existing copy, storage-selection, notification, and completion actions continue to work as expected. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Danny White
|
887279ec2a |
fix(studio): align remaining platform auth labels (#49879)
## What kind of change does this PR introduce? Copy fix in Studio platform UI. ## What is the current behavior? Studio still uses mixed auth wording outside nav dropdowns: in-app API docs use "Log in", account email change uses "Log out of", forgot-password uses title-case "Sign In", and org invites use "Create an account". ## What is the new behavior? Aligns remaining Studio surfaces with **Sign in / Sign out / Sign up**. Related to [#49874](https://github.com/supabase/supabase/pull/49874) and [#49877](https://github.com/supabase/supabase/pull/49877). CLI copy in `GeneratingTypes.tsx` is unchanged (`supabase login`). ## To test - Account → change email (GitHub identity): instructions say **Sign out of** - `/forgot-password`: footer link says **Sign in** - Org invite (signed out): secondary button says **Sign up** - Project → API docs → User Management: section titles use **Sign in** / **Sign out** <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated authentication terminology across user management guidance and GitHub email-change instructions for consistency. * **Improvements** * Changed the organization invitation link label to “Sign up.” * Standardized the forgot-password page link capitalization to “Sign in.” * **Tests** * Updated invitation view coverage to reflect the revised “Sign up” label. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
6181e27b93 |
Scoped PAT: ensure innaccessible resources are distinguishable (#49948)
## Problem When users don't have access to some resources targeted by a token, we show those resources slugs or refs. However, they are not distinguishable enough. ## Solution - Make them distinguishable by applying the _destructive_ color - Cleaned up unused code (`isInaccessible` prop wasn't used anymore after last refactoring but we forgot to remove it) ## How to test 1. Invite another user to one of your projects 2. As this other user, create a scoped pat targeting the project 3. As the initial user, remove the invited user from the project 4. As the invited user, check the token permissions: you should see an admonition at the top and the project should be displayed in red with only its ref (not its name) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Access token resource indicators now accurately show when an organization or project is inaccessible. - Inaccessible resources are clearly labeled as “revoked,” reducing ambiguity about their access status. - **Style** - Organization and project access indicators now use consistent badge styling, spacing, and icon treatments. - **Accessibility** - Revoked status messages are now announced more clearly to assistive technologies. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
d088ec6259 |
fix(studio): project selector fetch on scoped pat (#49865)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? The scoped-access-token project selector fetched a single page of the user's projects across all orgs and filtered client-side, so switching to an org whose projects weren't in that page left the list empty with no way to load more. Use the org-scoped projects query instead, keyed on the selected org, and fix project search to match by name. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Project selection now displays projects belonging to the currently selected organization. * Switching organizations refreshes the available project list, preventing projects from another organization from appearing. * **Tests** * Added coverage for organization-specific project loading, organization switching, pagination, and empty project lists. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
3146650a5a |
Fix FormItemLayout usages for a11y (#49761)
Follow up of #49637. Usages that impacted tests were fixed in the previous PR. This PR fixes the other usages so that label are correctly linked to their inputs. No visual changes ## How to test 1. Design system: [Form examples](https://design-system-git-fix-form-item-layout-usages-supabase.vercel.app/design-system/docs/ui-patterns/forms): moved `FormControl` around the `SelectTrigger` so that the label is linked to the button (It's actually done like this in the [Select Form example](https://design-system-git-fix-form-item-layout-usages-supabase.vercel.app/design-system/docs/components/select#form) and Radix recommend targeting the button too in their [documentation](https://www.radix-ui.com/primitives/docs/components/select#labelling)) 2. [Access tokens](https://studio-staging-463111oii-supabase.vercel.app/dashboard/account/tokens): updated usage to fallback on generated ids and fixed the select just like _1_ 3. [New TOTP factor](https://studio-staging-463111oii-supabase.vercel.app/dashboard/account/security): updated usage to fallback on generated ids 4. _Studio/Database/Extensions_ (`https://studio-staging-463111oii-supabase.vercel.app/dashboard/project/[PROJECT]/database/extensions`): updated the extension enabling modal to fallback on generated ids 5. _Studio/Integrations/Vault (`https://studio-staging-463111oii-supabase.vercel.app/dashboard/project/[PROJECT]/integrations/vault/secrets`): updated the secret edition modal to fallback on generated ids 6. _Studio/Observability(`https://studio-staging-463111oii-supabase.vercel.app/dashboard/project/[PROJECT]/observability`): updated the report creation and edition modals to fallback on generated ids 7. _Studio/SQL Editor(`https://studio-staging-463111oii-supabase.vercel.app/dashboard/project/[PROJECT]/sql/new`): updated the query renaming modal to fallback on generated ids 8. _Studio/Storage/Analytics(`https://studio-staging-463111oii-supabase.vercel.app/dashboard/project/[PROJECT]/storage/analytics`): updated the table creation sheet to fallback on generated ids (you must have a bucket first) 9. _Studio/Workers(`https://studio-staging-463111oii-supabase.vercel.app/dashboard/project/[PROJECT]/workers`): updated the worker creation modal to fallback on generated ids (you must have a bucket first) 10. Updated [Signup](https://studio-staging-463111oii-supabase.vercel.app/dashboard/sign-up?returnTo=%2Fnew), [Signin](https://studio-staging-463111oii-supabase.vercel.app/dashboard/sign-in) and [SSO Signin](https://studio-staging-463111oii-supabase.vercel.app/dashboard/sign-in-sso) forms to fallback on generated ids <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Improvements** - Standardized form field presentation across access tokens, authentication, reports, integrations, database extensions, SQL editor, storage, and worker deployment workflows. - Updated password fields and visibility toggles for more consistent input behavior. - Refined token expiration selection, verification code entry, and dropdown layouts. - Preserved existing labels, validation, options, and form functionality while simplifying the interface structure. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Wen Bo Xie
|
2681a21f5c |
docs: add Personal Access Tokens guide with generated permission tables (#49732)
Add a guide that compares classic and scoped personal access tokens, explains how account roles constrain token permissions, and walks through creating and testing a project-scoped token. Include generated tables mapping permissions to Management API endpoints and MCP tools, and link the guide from docs navigation and Studio token sheets. Move the scoped-token permission catalog from Studio into shared-data. Studio and docs generation now share permission names, categories, descriptions, risk metadata, modes, scopes, and display order. Generate the tables from the shared catalog, OpenAPI x-fga-permissions, and the downloaded MCP permission map. Exclude Workers permissions until the feature is live. Run regeneration through the docs Makefile, verify checked-in output in CI, and refresh it in the weekly Management API workflow. Add Dashboard and Docs ownership plus contributor guidance so permission changes stay synchronized. |
||
|
Ivan Vasilov
|
02cf09212e |
chore: Remove tsconfig paths (#49770)
This PR removes all `paths` in `tsconfig.json` for all apps and packages. They were added previosly because some of the components had a `_Shadcn` suffix because of an ongoing migration. How that the migration is done, the paths can be removed. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Standardized shared UI component, utility, and icon imports across design-system examples and application screens. * Simplified shared component access and project configuration. * Added shared access to anchor-link helpers and animation styles. * **Compatibility** * Updated component exports and imports without changing existing behavior. * No changes to user-facing workflows, screens, or functionality. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
4f92790587 |
fix: FormItemLayout does not apply item id correctly (#49637)
## Problem `<FormItemLayout>` does not apply item id correctly. This can be seen on https://supabase.com/design-system/docs/ui-patterns/forms: open the devtool and check the form items labels. They have no `for` attribute. This makes it harder to correctly test and is an accessibility issue. Axe devtool actually report it ## Solution When inside React Hook Form, `<FormItemLayout>` actually generate an `id` (via `<FormItem>`). However, this `id` is overridden in `<FormLayout>` and read from context by `<FormLabel>`. Ensure we use the generated id unless one was provided. Also updated the paths filters for the CI check so that any changes in either `ui` or `ui-patterns` triggers the studio unit and e2e tests. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved form accessibility by ensuring labels consistently connect to their corresponding input fields. - React-based forms now correctly preserve field-specific identifiers when associating labels with inputs. - Added support for explicitly specifying a label’s input target, improving compatibility with customized form layouts. - Updated Studio forms to use consistent control identifiers and labeling behavior. - **Quality Improvements** - Automated validation now also runs when shared UI components and patterns are updated. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
ChloeGarciaMillerand
|
8dcebc08ca |
fix: ESLint errors relating to accessibility in account preferences (#49301)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Improve toggle accessibility and `aria-label` for screen readers. ## What is the current behavior? Toggles have no accessible name or description because FormItemLayout is not properly linked to the Switch. An `aria-label` was missing. ## What is the new behavior? An `aria-label` and IDs have been added to associate the label with the switch and make the toggles accessible to screen readers. ## Additional context No visual changes have been made. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Accessibility** * Improved screen reader labels for password visibility controls. * Linked preference labels with their corresponding toggle controls. * Added descriptive identifiers to telemetry, dashboard, and hotkey settings for easier navigation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
claude[bot]
|
c32db2b80b | fix(studio): track resourceAccess='account' for legacy access tokens (#49448) | ||
|
kemal.earth
|
0218de559b |
fix(studio): validation scroll area bug in scoped pat (#49395)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? When trying to submit the scoped pat creation form a second time, after expanding accordion in the `<ScrollArea />` the `scrollTo` was breaking the height of the container. This PR fixes that. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved the missing-permissions warning when creating scoped access tokens. - The warning now scrolls into view after each invalid submission attempt, using smooth scrolling when supported. - Prevented repeated scrolling during unrelated form updates or motion-preference changes. - Selecting a permission or applying a non-empty preset clears the warning state. - Improved accessibility by respecting reduced-motion preferences. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
c7e8373bce |
Scoped PAT: Fix projects handling when user has more than 100 projects (#49393)
## Problem Some users have more than 100 projects and our current UI has the following issues: 1. The project selector only loads the first 100 making it impossible to see more 2. The review step and the token permissions view only loads the first 100 so we may display invalid warnings about missing projects However, we currently don't have an API route to fetch many projects by their refs in a single call. ## Solution 1. Make sure we load more projects when scrolling down in the project selector 2. When below 100 project, show the admonition for missing resources. Anyone above for the time being won't see these message and we display the project refs instead of their names <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Improved scoped access-token setup with paginated project loading and an easier scrolling project selector. - Organization and project access are now displayed as separate, clearer access indicators. - Access details show project information when available, with a fallback reference when details cannot be loaded. - **Bug Fixes** - Updated resource warnings to better reflect deleted resources and large project lists. - Improved multi-select list handling for more reliable interactions. - Preserved the name of inaccessible organizations when displaying lost access. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
31497ba127 |
feat(studio): add permission presets to scoped pat creation form (#49381)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? This adds a quick presets selector to scoped pat permissions. No access, read-only and full access. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added permission presets for scoped access tokens: No access, Read-only, and Full access. * Added a selector to quickly configure permissions across resources. * Displays “Custom” when individual permissions differ from a preset. * Shows warnings and guidance for high-risk full-access permissions. * Automatically uses read-only access for resources that do not support write permissions. * **Tests** * Added coverage for preset selection, application, warnings, ordering, and custom configurations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
54f56a1baa |
Scoped PAT: use CSS for the long text reveal animation (#49245)
Simplify the code for the long text reveal animation on hover using only CSS. This also improves performances on some devices ## How to test - Open https://studio-staging-git-gildas-scoped-pat-css-only-a-1d2de2-supabase.vercel.app/dashboard/account/tokens - Create a token with project settings read/write permissions - In the review step, ensure you can hover long URL to trigger a scrolling animation showing its end - In the review step, ensure short URL don't have this animation on hover - Create the token - Open its permissions and check the hover effects again <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Style** - Improved endpoint path reveal animations with smoother transitions and masking. - Added responsive behavior based on available container space. - Increased transition duration for easier reading. - Added support for reduced-motion preferences. - **Bug Fixes** - Improved endpoint path visibility and hover behavior while preserving the existing copy interaction. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
ce27b4ee5b |
chore(studio): scoped pat mcp tool ui improvement (#49188)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Follow on from view permissions sheet and review step tidy up to show a clear list of available mcp tools. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an “Available MCP tools” section to scoped token reviews and token details. * Displays enabled tools as badges, with a clear empty state when none are available. * **Improvements** * Simplified capability cards to focus on enabled API endpoints. * Removed per-permission MCP tool details and ungranted capability listings. * Updated endpoint count formatting for clearer singular and plural labels. * **Tests** * Updated capability and token detail tests to reflect the new MCP tool summary presentation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
dbb153042e |
feat(studio): cleaned up view permissions sheet (#49144)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Breaking down #49007 into smaller PR's. Part 1 merged in. More to follow... <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Redesigned token capability details with expandable cards and dense views for larger permission sets. * Added filtering by all, read, and read-write capabilities. * Improved endpoint and MCP tool attribution, display, and endpoint copying. * Added risk banners with permission and access warnings. * Enhanced resource badges, responsive layouts, relative timestamps, and dismissible creation guidance. * **Bug Fixes** * Corrected MCP tool attribution across alternative permission scopes. * Improved handling and display of inaccessible resources. * **Tests** * Expanded coverage for capability views, filtering, risk messaging, and permission evaluation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Danny White
|
fba3733148 |
test(studio): allow scoped token creation in CI (#49163)
## What kind of change does this PR introduce? Test reliability fix. ## What is the current behavior? The two longest scoped access token creation tests can exceed Vitest's default five-second timeout when they run under the full Studio CI shard, despite passing locally. ## What is the new behavior? The project-scoped and organisation-scoped token creation tests each use a targeted ten-second timeout. The global timeout and production code remain unchanged. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Increased test timeouts for project- and organization-scoped token creation scenarios to improve test reliability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
14fe0c0cc8 |
fix(studio): slightly round split-button corners on focus (#49129)
## What kind of change does this PR introduce? UI polish for split buttons (primary action + dropdown chevron). Follow-up to #49055. ## What is the current behavior? The focus ring sits above the neighbouring half, but the inner edge stays square, so the ring has two sharp corners at the join. ## What is the new behavior? On keyboard focus, the squared-off edge uses a slight radius so the ring matches the outer corners more closely. Resting state is unchanged. Split-button callsites now share the same join classes as the design-system example. | Before | After | | --- | --- | | <img width="1030" height="296" alt="43471" src="https://github.com/user-attachments/assets/9df3bd72-c7ac-4419-ae18-a7e649dc2d66" /> | <img width="1056" height="276" alt="CleanShot 2026-08-17 at 10 45 09@2x" src="https://github.com/user-attachments/assets/52e8a4dc-9c52-45ce-b4d0-f0e7b1b75935" /> | ## To test Tab to each half (labelled button, then chevron). Inner corners of the focus ring should be slightly rounded, not square. 1. [Split with dropdown](https://design-system-git-fix-split-button-focus-radius-supabase.vercel.app/design-system/docs/components/button#split-with-dropdown) (no login) 2. [Access Tokens](https://studio-staging-git-fix-split-button-focus-radius-supabase.vercel.app/dashboard/account/tokens) → Generate new token 3. Any project on [studio staging](https://studio-staging-git-fix-split-button-focus-radius-supabase.vercel.app/dashboard/_/settings/general) → Settings → General → Restart project <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Accessibility** - Added accessible labels to dropdown and export controls. - Improved keyboard-focus visibility, layering, and rounded edge treatment across joined buttons and menus. - Removed misleading or redundant screen-reader text and titles. - **Bug Fixes** - Prevented split-button controls from shrinking or displaying awkward borders and corners. - Refined hover and focus behavior for action buttons throughout settings, database, storage, account, and documentation interfaces. - **Documentation** - Clarified guidance for using overflow menus and responsive split-button actions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
89cd156e39 |
fix(studio): clarify MFA backup authenticator copy (#49083)
## What kind of change does this PR introduce? Bug fix (copy and layout) ## What is the current behavior? After setting up a single MFA factor, Account > Security warns you to add a "backup sign-in method". That reads like another account identity (email / Google / SSO), not a second authenticator app. The add action also sits at the bottom of the MFA card, so the callout has no nearby control. Fixes [FE-4171](https://linear.app/supabase/issue/FE-4171/clarify-backup-sign-in-method-after-mfa-setup) ## What is the new behavior? The MFA block is a `PageSection` with **Add app** in the aside. When one factor is configured, a danger callout above the card tells you to add a backup authenticator app, with **Add another app** opening the same modal. | Before | After | | --- | --- | | <img width="1482" height="896" alt="CleanShot 2026-08-14 at 10 27 33@2x" src="https://github.com/user-attachments/assets/7a8f3737-8e11-49c4-8f8e-3fda527a8c40" /> | <img width="1468" height="802" alt="CleanShot 2026-08-14 at 10 57 06@2x" src="https://github.com/user-attachments/assets/b2f6060e-b6c1-49e4-ae5c-99553ea3e60a" /> | ## To test 1. Open **Account > Security** (`/account/security`). 2. **0 apps:** empty card, **Add app** in the section aside. Click it. The add-factor modal should open. 3. **1 app:** danger callout under the section title. Copy should mention a backup authenticator app, not a sign-in method. **Add another app** and **Add app** should both open the same modal. 4. **2 apps:** callout and add buttons gone. Remove still works. Add or remove an authenticator app on that page to hit each state. If you already have one factor, step 3 is the important check. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved the multi-factor authentication interface with clearer sections, cards, and guidance. * Added an empty state when no authenticator apps are configured. * Added a warning when only one authenticator remains to help prevent account lockout. * Limited authenticator app setup to two configured factors. * **Bug Fixes** * Improved loading and error-state presentation for authentication factor management. * Simplified the security page to provide a more consistent MFA experience. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fadymak
|
17dde3d324 |
feat(account): let OAuth-only users add a password to their account (#49057)
Allows a user to add a password which automatically creates and email identity to enable email + password authentication for OAuth-only accounts. Gated behind a feature flag: `enableAccountPassword` When a user does not have an email identity, allow them to set a password: <img width="762" height="284" alt="Screenshot 2026-08-13 at 14 52 53" src="https://github.com/user-attachments/assets/70b4883a-ed38-488a-a1b7-908caa112a0b" /> Password modal: <img width="519" height="423" alt="Screenshot 2026-08-13 at 14 56 57" src="https://github.com/user-attachments/assets/56ac370d-9e6c-4b05-986f-3aa9a51826c2" /> Email identity has been created, allow unlinking and/or updating email address or password: <img width="764" height="285" alt="Screenshot 2026-08-13 at 14 55 04" src="https://github.com/user-attachments/assets/5d9d7692-f4e3-4638-958d-15fefad01333" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * OAuth-only accounts can set a password from Sign-in methods. * Added password visibility controls, validation guidance, and success or error feedback. * Sign-in methods display the account email when available. * **Updates** * Renamed “Account identities” to “Sign-in methods” throughout account preferences. * Standardized password requirements across password setup and reset forms. * Setting a password refreshes the current session and signs out other sessions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
88e916a4c0 |
fix(studio): focus state for buttons with dropdown (#49055)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? We've quite a few instances where some buttons have a dropdown appendage. The focus state for these were broken as well as visually regarding the separator. This first pass fixes the instances we have in studio, I've left potentially adding this to our design system fragment components as another PR. | Before | After | |--------|--------| | <img width="531" height="133" alt="Screenshot 2026-08-13 at 11 29 36" src="https://github.com/user-attachments/assets/70747fd0-11d4-4670-85fa-d76f3564837b" /> | <img width="519" height="130" alt="Screenshot 2026-08-13 at 11 40 15" src="https://github.com/user-attachments/assets/5920bebb-81ce-4962-908b-5f61526ca7ca" /> | | <img width="538" height="146" alt="Screenshot 2026-08-13 at 11 29 48" src="https://github.com/user-attachments/assets/f1c7018f-cd43-47fa-b4c0-045af350f80b" /> | <img width="515" height="148" alt="Screenshot 2026-08-13 at 11 39 56" src="https://github.com/user-attachments/assets/fee09113-433a-4b5d-ac68-3ab3f2565d34" /> | | <img width="538" height="143" alt="Screenshot 2026-08-13 at 11 29 52" src="https://github.com/user-attachments/assets/3063d391-99b2-4599-9cdf-edd0b2cdfdf0" /> | <img width="529" height="159" alt="Screenshot 2026-08-13 at 11 40 05" src="https://github.com/user-attachments/assets/4bdeb9e0-8324-45df-a211-8c7fd0ee11a6" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved keyboard focus visibility across Studio controls, including token management, email settings, replication, log drains, query insights, infrastructure, storage, and assistant actions. * Focused buttons in adjacent or split-button groups now appear above neighboring controls, preventing borders and overlays from obscuring the active selection. * Preserved existing button behavior, layout, and appearance while improving focus-state clarity. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
99545dc03a |
chore(studio): remove mcp mention in legacy token creation (#48945)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Small bit of lingering text that was leftover. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the legacy access token description to remove an outdated reference. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
1cc0682c47 |
chore(studio): remove admonition now that mcp supports scoped pat (#48931)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? This removes the pre-cautionary admonition we had before the MCP support for scoped access tokens landed. We can now remove this admonition (and anything related) as it's been merged. | Before | After | |--------|--------| | <img width="790" height="202" alt="Screenshot 2026-08-11 at 09 11 08" src="https://github.com/user-attachments/assets/8b99d93f-c398-4b86-84fe-e63a2ba40e26" /> | <img width="781" height="104" alt="Screenshot 2026-08-11 at 09 17 18" src="https://github.com/user-attachments/assets/b28b8262-ec01-4686-ace8-50065eb22822" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Changes** * Removed the MCP unsupported warning from scoped access-token creation and viewing screens. * Removed the option to switch from scoped-token creation to the legacy account-wide token flow. * MCP tools now display directly when available. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
5b68af1720 |
feat(studio): role-aware access feedback in scoped token creation (#48858)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Remaining bits of #48714 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added role-aware access checks throughout scoped token creation. * Organization selectors now disable project-only organizations and recommend project-scoped tokens when appropriate. * Review screens highlight missing capabilities and permissions exceeding your current role. * Permission rows display indicators when access exceeds your role. * Added resource keys, labels, and summaries to improve token review clarity. * **Documentation** * Updated permission guidance with links to access-control documentation. * **Bug Fixes** * Corrected project selector behavior when no organization is selected. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earthandClaude Sonnet 5
|
124ff77ad0 |
feat(studio): warn that scoped tokens don't support the MCP server (#48849)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Scoped PATs are blocked from the Supabase MCP server until AI-1025 ships FGA guard support, so surface that on the scoped review step (with a link back into legacy mode) and on the view-token sheet, sharing one warning module for easy removal. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a clear notice explaining that scoped access tokens aren’t supported by the Supabase MCP server. * Added an option to create a legacy token when applicable. * Displayed the MCP compatibility notice in token review and access views. * **UI Improvements** * Organization selectors now display their associated icons. * Standardized MCP guidance across token-related screens for a more consistent experience. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> |
||
|
kemal.earthandClaude Sonnet 5
|
33482bdc88 |
feat(studio): lifecycle and role-aware scoped token view sheet (#48848)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Extracts the token view sheet slice of #48742
(w3b6x9/scoped-pat-access-feedback, commit
|
||
|
kemal.earthandClaude Sonnet 5
|
3a98b0c818 |
feat(studio): add legacy token mode to scoped pat creation flow (#48844)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Replaces the scoped form's inline account-level access mode with a proper legacy-token escape hatch: "Create legacy token" switches the sheet to the classic form (name + expiry only) and creates through the legacy endpoint, skipping the two-step review. Mirrors the mode-switch links in both directions and restores the "Generate token for experimental API" split-button dropdown, extracted into a shared ExperimentalTokenDropdown. Ported from origin/w3b6x9/scoped-pat-ui-rework, excluding its expiry handling (shipped in #48811) and MCP-unsupported warnings (follow-up PR). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for creating classic account-wide access tokens alongside scoped tokens. * Added an experimental token dropdown for quick token creation. * Added links to switch between scoped and legacy token creation flows. * Classic token creation now provides dedicated warnings and simplified access settings. * **Improvements** * Updated token access messaging, descriptions, and labels for clarity. * **Tests** * Expanded coverage for token creation, navigation, validation, and clipboard behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> |
||
|
|
e8f5120dc5 |
feat(studio): enforce expiry scoped pat (#48811)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES Waiting on #48809 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added custom access-token expiration date limits, allowing dates from today through one year ahead. * Date pickers now enforce configured minimum and maximum date boundaries. * **Updates** * Removed the option to create non-expiring access tokens. * Expiration is now required when creating classic access tokens. * Improved form reset behavior and expiry tracking. * **Tests** * Added validation coverage for required, valid, and out-of-range custom expiration dates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Wen Bo Xie <wenbox323@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
|
f8206a5f81 |
fix(studio): model scoped pat permissions as OR-of-AND alternatives - smaller version (#48809)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Breaking down #48635 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Scoped access tokens now support alternative permission requirements, enabling more precise access for APIs and tools. - Added clearer role and resource access evaluation, including project-specific permissions and partial read access. - Access reviews now identify unavailable or excessive permissions and group inaccessible resources for easier resolution. - **Bug Fixes** - Improved handling of legacy, incomplete, or invalid permission data with safer fallback behavior. - Corrected access filtering for MCP tools and API capabilities. - **Documentation** - Updated access-review wording to clarify the relationship between scopes and related MCP tools. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Wen Bo Xie <wenbox323@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
|
2a3025df25 |
feat(studio): role inference core for scoped pat (#48805)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Logic-only extraction from #48742. Scoped PATs are enforced server-side as the intersection of the token's granted scopes and the owner's live role, re-checked on every request. This lands the pure inference layer that will power advisory (never blocking) UI feedback; no UI consumes it yet. - FGA_SCOPE_MINIMUM_ROLE: all 83 permission scopes transcribed from the OpenFGA model's role unions, mapped to the lowest base role that holds them. A drift-guard test pins the key set to the scope ids published in @supabase/shared-types, so upstream additions fail CI here with re-transcription instructions. - estimateRoleLevel: derives the user's base role per org (or per project for project-invited members) from the ungated /platform/profile/ permissions rows via four discriminating ABAC probes. Works for every member type with no permission-gated endpoint. - computeTokenRoleContext + applySelectionToRoleContext: role resolution (expensive, memoized) is split from selection evaluation (cheap, re-run per permission toggle). AccessToken.permissions.ts gains only what the roles module needs: the PermissionLevel type and the catalog's `level` field (decides whether an org or project role governs a resource), plus getEntryScopes, which selectionToScopes now reuses. The UI-only additions from #48742 (risk badge/dot variants, mode labels, the OverallRisk.text -> description rename) are deliberately left out so this PR touches no .tsx. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added role-aware evaluation for scoped access-token permissions. * Added support for organization- and project-level permission scoping. * Added guidance when selected permissions exceed the current role, including read-only downgrades and inaccessible resources. * Added clearer grouping of permission access issues by resource. * **Tests** * Added comprehensive coverage for role mapping, permission evaluation, scoping, and failure scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Wen Bo Xie <wenbox323@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
|
33008a39e5 |
chore(studio): remove scoped pat orphaned form (#48803)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? First step in breaking down #48635 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Removed the scoped access-token form, including token details, expiration settings, resource access, and permission configuration. * Removed resource and permission selection controls from the access-token workflow. * **Tests** * Removed automated coverage for access-token validation, permission handling, expiration logic, and resource selection. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Wen Bo Xie <wenbox323@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
|
cddb430310 |
feat(studio): scoped pat root branch (#48384)
## Description This is the Scoped PAT stacked PRs root branch ## How to test ### With the `scopedPAT` enabled (default on staging) Go to https://studio-staging-git-scopedpat-merge-token-lists-supabase.vercel.app/dashboard/account/tokens. - You shouldn't see two tabs anymore - If you had classic tokens, they should have the _Legacy_ badge - You can create scoped tokens - You have a way to copy newly created tokens before closing the form side panel ### With the `scopedPAT` disabled (use the devtool to override) - You shouldn't see two tabs anymore - If you had classic tokens, they should **not** have the _Legacy_ badge - You can create classic tokens - You have a way to copy newly created tokens above the list upon form submission <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Show classic and scoped access tokens together in one list, with classic tokens labeled “Legacy” when the scoped experience is enabled. * Add scoped access token creation with a two-step configure → review → success flow (when enabled). * Add a dismissible migration notice about scoped tokens with a link to API docs. * Show “View permissions” only for scoped tokens. * **Bug Fixes** * Token deletion now supports both classic and scoped tokens with the correct confirmation and success handling. * The scoped tokens page now redirects to the unified access tokens page. * **Accessibility** * Improved accessibility by adding a label to the token “more options” action. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ali Waseem <waseema393@gmail.com> Co-authored-by: kemal.earth <606977+kemaldotearth@users.noreply.github.com> |
||
|
ChloeGarciaMillerand
|
e241a21a9a |
fix: ESLint errors relating to accessibility in table editor, API Key and Access Token (#48479)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Added aria-label attributes and Tooltip to buttons ## What is the current behavior? alt attributes and Tooltip were missing ## What is the new behavior? Buttons have now aria-label attributes and Tooltip. ## Additional context No visual changes have been made. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Accessibility Improvements** * Added tooltips and improved accessible labeling for filter removal, sort controls, and action menu triggers. * Enhanced “More actions”/“More options” tooltips and aria-labels for API keys and access tokens. * Updated token scope selection and token banner close actions to use clearer tooltip messaging. * Wrapped panel close control with a tooltip and added an aria-label for clearer screen reader support. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
fadymak
|
e6b8725571 |
feat(account): require a user to name their TOTP authenticator (#48493)
Currently it's an autogenerated name. We want users to explicitly enter a name for their authenticator so that: - They can remember that they took the action of registering an authenticator - They can see a meaningful name during sign-in if they have multiple TOTP authenticators <img width="536" height="269" alt="Screenshot 2026-07-30 at 16 05 10" src="https://github.com/user-attachments/assets/e43de27f-b4ca-4d4f-969a-578267eeebe4" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Bug Fixes** * Improved TOTP enrollment: confirmation is no longer enabled unless an authenticator app name is provided (validated beyond whitespace). * **UI Improvements** * Updated the authenticator app name label/description, added an example placeholder, and auto-focused the field when the confirmation step appears. * Refined the on-screen guidance for suggested authenticator apps (e.g., Google Authenticator or 1Password). <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
fcfb0f0222 |
Refactor all usage of form.watch to either useWatch or subscribe (#48436)
## Context Replaces all usage of `form.watch()` to use `useWatch` instead + follows the "name what you watch" convention as specified in the react-hook-form skills. There's also a small refactor in `SmtpForm.tsx` which removes the unnecessary use of a `useState` to track if SMTP is enabled or not <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Updated many Studio forms to watch specific fields more precisely, improving live UI updates for previews, warnings, conditional sections, and validation messages. * Enhanced responsiveness across settings, authentication, billing, storage, integrations, and support flows while keeping save/update behavior the same. * **Refined Experiences** * Improved the analytics table creation flow with tighter, enum-based column type validation and structured, type-specific column options. * **Preserved Behavior** * Maintained existing permission checks, submission flows, and account-management workflows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Miranda Limonczenko
|
0d465e7b5f |
chore(ui): Remove 'tip' from Admonition (#48419)
Closes FE-3966 ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## Problem - The admonition uses both 'tip' and 'note', but the visual distinction has long-ago collapsed. - 'Note' is used far more frequently than 'tip' - The two are very similar and it is confusing to know which one to use when they are visually identical ## Solution Collapse 'tip' and 'note' into one by removing all places where there is 'tip' and updating all references to 'tip' into 'note'. **Note:** This PR also resolves new broken links flagged by the E2E docs checker. It may move to another PR since E2Es keep erroring. ### Specific changes See below for an AI-generated list of changes: - **Type system** — removed `'tip'` from `AdmonitionType`, its `TYPE_TO_VARIANT`/`TYPE_LABEL` entries, and the test case in [`packages/ui-patterns/src/Admonition/](packages/ui-patterns/src/Admonition/) - **Remark plugin** — [remarkAdmonition.ts](apps/docs/lib/mdx/plugins/remarkAdmonition.ts) now maps mkdocs `tip` → `note` - **Lint allowlist** — `tip` dropped from `supa-mdx-lint.config.toml` - **Content migration** — all 109 files with `type="tip"` (across `apps/docs`, `apps/www`, `apps/studio`) converted to `type="note"`; zero remaining hits confirmed by repo-wide grep - **Style guide** — `CONTRIBUTING.md` and `contributing/content.mdx` updated to describe 4 admonition types instead of 5 ### Usage before implementation See the usage table that points toward 'note' as being dominant across all apps: Here's the usage table: | Location | `note` | `tip` | |---|---|---| | apps/docs | ~480 | ~143 | | apps/studio | 34 | 6 | | apps/www (blog) | 19 | 3 | | packages/ui-patterns (tests) | 3 | 1 (parametrized) | | design-system / ui-library / packages/ui / packages/common | 0–1 (test fixture only) | 0 | ## Preview links | App | Page | Search text (Ctrl+F) | Verify | |---|---|---|---| | docs | [/docs/guides/ai-tools/byo-mcp](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/ai-tools/byo-mcp) | official MCP TypeScript SDK | callout's aria-label="Note" | | docs | [/docs/guides/ai-tools/mcp](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/ai-tools/mcp) | MCP server is available at | callout's aria-label="Note" | | docs | [/docs/guides/ai/python-clients](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/ai/python-clients) | Click Connect at the top of any project page | callout's aria-label="Note" | | docs | [/docs/guides/auth/audit-logs](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/auth/audit-logs) | Disabling Postgres storage reduces your database storage costs | callout's aria-label="Note" | | docs | [/docs/guides/database/tables](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/database/tables) | access a custom schema through the Supabase Data API | callout's aria-label="Note" | | docs | [/docs/guides/troubleshooting/edge-function-404-error-response](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/troubleshooting/edge-function-404-error-response) | Always configure an appropriate time frame | callout's aria-label="Note" (was single-quoted type='tip') | | www | [blog: cli-v2-config-as-code](https://zone-www-dot-com-git-admonition-collapse-note-tip-supabase.vercel.app/blog/cli-v2-config-as-code) | Detecting config drift | callout's aria-label="Note" | | www | [blog: cli-v2-config-as-code](https://zone-www-dot-com-git-admonition-collapse-note-tip-supabase.vercel.app/blog/cli-v2-config-as-code) | Setting Edge Function secrets | callout's aria-label="Note" | | www | [blog: nosql-mongodb-compatibility-with-ferretdb-and-flydotio](https://zone-www-dot-com-git-admonition-collapse-note-tip-supabase.vercel.app/blog/nosql-mongodb-compatibility-with-ferretdb-and-flydotio) | If your network supports IPv6 connections | callout's aria-label="Note" | Note: the `www` rows use the `zone-www-dot-com` preview host, not the `docs` one you gave — since blog pages are served from the www app, not docs. ## Manual testing 1. Open preview links for affected pages. 2. Inspect. Open console. 3. Paste the following in and see there is no 'Tip' on the page: ``` document.querySelectorAll('[role="alert"]').forEach(el => console.log(el.getAttribute('aria-label'), el.textContent.slice(0,60))) ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Standardized informational callouts across docs and tutorials from **“Tip”** to **“Note”**, updating multiple examples and guidance blocks. * Updated a few related doc references/links and conditional “Next steps” content. * **UI Updates** * Switched various in-app banners and notices to the **“Note”** style variant. * **Bug Fixes / Improvements** * Removed support for the retired **“Tip”** callout type and aligned docs linting, component behavior, and aria labeling to the remaining admonition types. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alaister YoungandAlaister Young
|
ca2b50a0a7 |
chore(ui-patterns): collapse the admonition shim into ui-patterns/Admonition (#48377)
Follow-up to #48344: collapses the two resolution paths for the Admonition module into one. `src/admonition.tsx` was a back-compat shim re-exporting `src/Admonition/`. Two ways to resolve one module is exactly what produced the macOS self-import bug fixed in #48344, and the local typecheck errors that #48374 worked around. This removes the shim and standardizes on the PascalCase subpath, matching every other export in the package. **Changed:** - Codemodded all 246 `ui-patterns/admonition` imports to `ui-patterns/Admonition` (240 `.tsx`, 5 `.mdx`, 1 `.ts` across studio, docs, www, design-system, and lite-studio) - Pointed the 5 internal `'../admonition'` imports back at the `'../Admonition'` directory **Removed:** - `packages/ui-patterns/src/admonition.tsx`, and its `./admonition` entry in the exports map (regenerated with `pnpm gen:exports`) ## To test - `grep -r "ui-patterns/admonition" --include='*.ts*'` → no hits - `pnpm test:case-hazards` → passes - `pnpm typecheck` → all 15 tasks green - `pnpm --filter studio run lint:ratchet` → passes - `pnpm --filter ui-patterns vitest run src/Admonition` → 11 tests pass <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Standardized Admonition component imports across the application and documentation. * Improved compatibility with case-sensitive environments by using the canonical component path. * Removed the legacy Admonition import entry point. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Ali Waseem
|
e6ad56101f |
fix: MFA list Added on value uses last_challenged_at instead of created_at (#48252)
Fixes FE-3985. `TOTPFactors` was displaying `updated_at` (which mirrors `last_challenged_at`) for "Added on" instead of `created_at`. |
||
|
Gildas Garcia
|
dba31df91d |
fix: scoped PAT creation form error messages are hidden (#48011)
## Problem When creating a new scoped PAT, if users didn't add at least one permission or have a misconfigured permission (no access selected), the form does not submit but no error message is shown. The UI looks broken. ## Solution This is because there's a zod validation happening but its messages are not displayed for permissions. The proper fix is to use react-hook-form field array. <img width="541" height="633" alt="image" src="https://github.com/user-attachments/assets/89cab58d-761e-4131-9bce-460625067f8a" /> <img width="540" height="594" alt="image" src="https://github.com/user-attachments/assets/ed95cee0-06b5-4233-9a23-6819fb0e1a17" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved permission selection and toggling behavior in the scoped access token flow. * Enhanced validation feedback for permission rows and action selections, keeping error states in sync after changes. * Updated error handling to surface permission-related messages more reliably. * **Refactor** * Reworked the permissions UI to use a more reliable control-based rendering approach for rows, selection changes, and error presentation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
22b3419a28 |
Extract project creation form into its own component (#47957)
## Context This is just a pre-requisite to consolidating the project creation UI as there's another page that has the project creation flow too [here](https://github.com/supabase/supabase/blob/master/apps/studio/pages/integrations/vercel/%5Bslug%5D/deploy-button/new-project.tsx). So the next step will just be to use the same `ProjectCreationForm` there No functional changes here - just moving things around ## To test - [ ] Verify that project creation still works <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a full “create project” experience with eligibility-aware defaults, advanced configuration sections, optional GitHub integration, and compute-cost confirmation when applicable. * **Improvements** * Enhanced project-creation success/error handling and navigation. * Refined CLI backup/restore dialogs (better layout/wording, accessibility updates, and improved section separation). * **Documentation** * Standardized all relevant documentation links across the app using a shared `DOCS_URL` source. * **Refactor** * Refactored the “New Project” page to delegate the wizard UI and flow to a reusable creation component. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
c41e2835e3 |
chore: UI theme cleanup (#47519)
## Problem - We still use/maintain the legacy theming even though we moved to Shadcn - We have two themes list with similar code ## Solution - Migrate some components to `cva` and `cn` instead of `styleHandler` - Remove redundant `themes` in favor of `singleThemes` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Standardized theme selection across the app so theme menus consistently offer the same light/dark/system options, including dropdowns, navigation menus, and command menus. * **Refactor** * Refreshed styling for multiple shared UI components (menus, tabs, side panels, loading indicators, icons, and modal dialogs) to improve consistency while preserving visual behavior. * **Chores** * Improved the UI patterns CI “validate exports” check for clearer failure output when exports change unexpectedly. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Pamela Chia
|
0099ad1aec |
fix(account): stop sb marker leaking into email toast (#47455)
## Summary
The email-change confirmation toast rendered a trailing `&sb=` ("...sent
to the other email&sb="). The dashboard parsed the auth-redirect URL
fragment with a naive `split('#message=')` that grabbed everything after
the key, including the empty `sb` origin marker the auth service appends
to every redirect fragment (an intentional, server-side Supabase-Auth
identifier so clients can tell a Supabase redirect from a third-party
OAuth one). The marker is working as designed; the bug is that the
dashboard wasn't parsing the fragment as URL params, so I fixed the
parse rather than the marker.
## Changes
- Parse the redirect fragment with `URLSearchParams` via a new
`parseRedirectMessage` helper, reading only the `message` key. Any other
trailing fragment param (the `sb` marker, or future ones) is now ignored
instead of being concatenated into the toast.
- Drop the manual `+`-to-space replacement. `URLSearchParams.get()`
already decodes form-encoded values, and the old `.replaceAll('+', ' ')`
would have clobbered a legitimately encoded `+`.
- Add unit tests for the helper: marker stripped, no hash, no `message`
key, `message` not first, and percent-encoded `+` preserved.
## Testing (Vercel preview)
The toast only reads the URL fragment, so the redirect can be simulated
directly. Do not use the real email round-trip on the preview: a real
confirm-link click is redirected to prod (the backend sets
`redirect_to`), not the preview build.
- [x] On the preview, log in and open the account preferences page with
this fragment appended:
`/account/me#message=Confirmation+link+accepted.+Please+proceed+to+confirm+link+sent+to+the+other+email&sb=`
— toast shows the clean sentence with no `&sb=`.
- [x] Open the same page with no fragment — no toast fires.
## Linear
- fixes GROWTH-938
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved how success messages are read after redirect in account
identity preferences, so notifications now display the correct text more
reliably.
* Supported messages with spaces and special characters, including cases
where the message appears later in the URL fragment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Gildas Garcia
|
b30db91d71 |
chore: cleanup UI patterns exports (#47406)
## Problem We now export components under a subpath in ui-patterns to avoid barrel files as they slow down every tools (from IDE to linters, etc.) and may also affect bundles our users have to download. ## Solution - Remove the UI patterns index file - Fix invalid impors |
||
|
Gildas Garcia
|
c6fc456910 |
chore: cleanup duplicate exports studio (#47387)
## Problem Knip reports many duplicate exports (both named and default). Besides, we're moving away from default exports and even have an eslint rule to enforce it on new code. ## Solution - Cleanup those exports - Update imports when necessary No functional changes. If it builds, it's fine |
||
|
|
f78c9db32e |
Make mfa lockout risk clear in dashboard (#47344)
## Problem #47330 is not enough. We want the alert to really catch users attention ## Solution <img width="1670" height="1138" alt="image" src="https://github.com/user-attachments/assets/3dab5145-2abf-4213-a591-45116eeacb6a" /> <img width="1634" height="1048" alt="image" src="https://github.com/user-attachments/assets/c70ac8cc-2af0-4778-a68b-3ea9ea8f8166" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Moved the “permanently locked out” MFA warning to the account security page when only one authenticator app is configured. * Removed the duplicate warning from the authenticator factor list so the message is shown in a single, consistent location. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: mo khan <mo@mokhan.ca> Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> |
||
|
Gildas Garcia
|
1ec86503fa |
fix: make mfa lockout risk clear in dashboard (#47330)
## Problem Lots of users are getting locked out of their accounts, with no way to get back in. The current warning after setting up an MFA is not visible enough: <img width="1484" height="836" alt="image" src="https://github.com/user-attachments/assets/944093f0-b912-4eb9-9955-a012be1a5248" /> ## Solution First part of the solution is to make the warning more visible: <img width="1612" height="930" alt="image" src="https://github.com/user-attachments/assets/06d334dc-ee6a-4bf3-a8b3-3d4282a275b7" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated the two-factor authentication setup warning to use a clearer warning style and horizontal layout. * Improved the guidance shown when only one authenticator app is configured, making the message easier to read. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |