* feat: update dpa retrieval
* add tracking for other legal docs
* ci: Autofix updates from GitHub workflow
* update api types
* update pdf
* Refactor DPA with text confirm modal
* Nit consistency with using a and buttons
* Update TextConfirmModal
---------
Co-authored-by: pamelachia <26612111+pamelachia@users.noreply.github.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* Replace all usage of useProjectContext with useSelectedProjectQuery
* Replace all usage of useSelectedProject with useSelectedProjectQuery
* Replace all usage of useProjectByRef with useProjectByRefQuery
* Replace all usage of useSelectedOrganization with useSelectedOrganizationQuery
* Deprecate useSelectedProject, useSelectedOrganization, and useProjectByRef hooks
* Deprecate ProjecContext
* Start
* Add join org logic
* Regenerate the API types and add RQ hooks.
* Various fixes to the UI for SSO config.
* Refactor the components to use RHF.
* Fix the loading/error states in the main file.
* fix: minor changes to SSO UI
* Expanded default attribute mapping preset for `Okta` to include `user_name`, `first_name`, and `last_name` to match our docs.
* Normalized role casing in the "Join Organization on Signup" dropdown to match the roles expected by the backend (`Owner`, `Administrator`, `Developer`).
* Added the role (`Read-only`) to the selectable roles for auto-join.
* Call update mutation when an `ssoConfig` has been retrieved.
* Treats `404` as a valid "create" flow state rather than an error.
* Conditionally renders the SSO config form when config is successfully loaded *or* when the provider is not found, allowing users to onboard from scratch and disable the provider.
* chore: prettier
* feat: add a button linking to SSO setup docs
* Revert "feat: add a button linking to SSO setup docs"
This will be included in a separate docs pr.
This reverts commit 0b616fdd2e.
* General clean up
* Nit copy
* Add empty state for SSO
* Smol change
* One last tweak
---------
Co-authored-by: Chris Stockton <180184+cstockton@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* basic typography classes
* Clean up classes for where we use h1 tags
* Clean up classes for where we use h2, h3, h4
* Clean up classes for where we use h6
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* fix: empty team drop downs
This fixes dropdowns returning empty on team invites when a user is signed in as a developer. For now it adds conditionals to show the option is not available for that role, but perhaps we can handle a little more gracefully.
* fix: change from inline to tooltips on dropdowns
This updates the members table dropdown to use the tooltip as opposed to inline message for disabled items.
* Tiny clean up
* Biiiit more nit
---------
Co-authored-by: kemal <kemaldotearth@kemaldotearth.local>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Add display of last_used_at timestamp for OAuth client secrets in Studio.
Shows relative time (e.g., "Last used 2 hours ago") when available,
or "Never used" for unused secrets.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Claude <noreply@anthropic.com>
- Update usage description, remove unnecessary quotes and dollar sign
- Add space between chart prefix and attribute name in AttributeUsage and InfrastructureActivity components.
It is possible to have multiple emails from different providers, a
common example being SSO users. The user flow being:
1) Sign up with email using name@company.local
2) Upgrade to teams or enterprise
3) Enable SSO for the Org using domain company.local
4) Sign in with name@company.local
5) The SSO provider now handles the login, assigning new gotrue_id
but uses the same primary_email
6) View the teams members and one will be omitted
This change fixes the case above so that both users are displayed. It also
uses the gotrue_id to ensure that the "You" badge displays the correct user.
Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
- Mandatory address input when adding a new payment method
- Removed the global HCaptcha store that wasn't used consistently and would sometimes block payment method changes
- Remove the custom billing address data & tax id form on org creation and plan upgrades in favour of Stripe's `AddressElement`
- Unify usage of the Stripe payment elements into a single component
- Customers can mark "Purchasing as a business" and will then be able to put down a tax id
- Adjusted billing address form to have better labels + tax id is filtered down to selected country
- Adjusted Stripe Elements styling to use floating labels (otherwise very hard to use with address element) + additional styling changes
- New flag to filter out payment methods that do not have an address for org upgrades and credit top ups, this will be enforced a few days after rolling this out
- Added Google Maps Places API integration for address auto-completion via Stripe AddressElement
- Upgraded Stripe dependencies
- Slight adjustments to styling of plan upgrade modal
* Add a special case for /new/last-visited-org
* Handle the case where last visited org is null. Don't show an admonition if the org slug is _.
* Smol fix to disable oauth apps request if slug is _, and also dont prematurely show no perms UI state
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* Clean up usage of newOrgAiOptIn and useBedrockAssistant feature flags
* Remove all OpenAI endpoints
* Fix for self-hosted
* Default isLimited to false
* Update PG meta tests
* Fix unit tests for model
* Revert pg meta tests
* Fix test
---------
Co-authored-by: Alaister Young <alaister@users.noreply.github.com>
* fix: show run logs for gitless branches
* fix: show edit branch modal for production
* remove side panel github
---------
Co-authored-by: Saxon Fletcher <saxonafletcher@gmail.com>
When changing the plan while also creating a payment method in the same breath, some customers double-clicked the confirm button leading to a double-submission and possibly leading to a state where the customer gets charged, but the plan change is not going through.
* update cancellation reasons
* update texts
* randomise options and only single select reasons
* label overrides and reason readability
* minor fixes
* fix reasons sending
* Fixes
* Adjust tooltip side
* improve header description
* add a label for radio options
* wrap shuffledReasons in useState so it doesn't randomly shuffle
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Alaister Young <a@alaisteryoung.com>
* Feature flag assistant endpoint + opt in UI
* Feature flag bedrock stuff for the other endpoints like title, cron, complete
* add edge function complete v2
* revert to old complete
* Revert hardcode
* fix chart colour
---------
Co-authored-by: Saxon Fletcher <saxonafletcher@gmail.com>
* step 1
* use mcp
* system prompt
* clean up
* space
* clean up
* add three state opt in toggle
* clean up
* todo
* hooks
* refactor opt in form and modal
* refinements
* add bedrock
* remove console
* update mcp util
* use bedrock
* remove openai sdk package
* re-add tools
* update complete endpoints
* fix: ai assistant markdown formatting (#35541)
* fix: mcp types and project ref (#35540)
* feat: more flexible aws credential provider (#35538)
* feat: more flexible aws credential provider
* fix: add AWS_REGION to turbo env vars
* change to allowed
* update complete endpoints
* add an additional permission
* refinements
* use claud 4
* legal copy changes
* update other ai functions to use bedrock
* update generate v3 copy
* remove generate sql modal
* fixes for query block
* re-add dragging to reports
* clean up
* add open ai edge function example
* use handle error from fetchers
* remove schema and lean on tools
* copy
* Assistant MCP tests (#36049)
* feat: refactor and test mcp and model logic
* fix: remove get_project tool
* fix: remove additional get_project tool references
* update copy
* Clean up, fixes, refactors
* oops
* Float errors from AI endpoionts as toasts
* Use a env var AWS_BEDROCK_PROFILE for bedrock.
* Rename the env var for AWS bedrock profile.
* feat: support custom aws bedrock env vars
* chore: add comments explaining aws credential chain
* MCP Self Hosted Check (#36185)
support self hosted
* feat: bedrock auth via vercel oidc
* Fix broken unit test
* Feeeex
* Refactor useOrgOptedIntoAi
* Remove useDisallowHipaa hook
* small system prompt change
* readd vercel packages
* fix self hosted
* increase max duration
* try more direct prompt
* max duration 90
* reduce max steps and add loading
* mono font
* backwards compat styling
* Chore/limit number of messages sent to assistant (#36388)
* Limit number of historical messages that get sent to assistant
* Update max chat history to 5
* alignment
* bump mcp server version
* Add feature flag for opt in tags (#36466)
* Add feature flag for opt in tags
* Add one more check
* security section system prompt
* rely on default link and replace image markdown
* Add custom link component to assistant message block (#36527)
* Add custom link component to assistant message block
* Update based on feedback
* Render plain text if URL is deemed unsafe
* fix mcp tools and parse data (#36593)
* Update Admonition for AI Assistant for when opt in is re-enabled (#36663)
* Update Admonition for AI Assistant for when opt in is re-enabled
* Update
* Smol fix
* Fix TS
* Tiny
---------
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* When a Vercel customer downgrades in the middle of the billing cycle the get credits (no refund to card). To make that clearer, they need to be able to see their balance.
- Remove captcha for downgrades to Free, it is not needed
- Properly handle 3DS if customer has multiple payment methods
- Move payment method invalidation to react-query
* original files from previous PR
* get rid of router in jwt-secrets to make it show up
* rename jwt-secrets page to jwt-signing-keys
* add jwt-signing-keys query
* add legacy jwt signing keys query
* wire-up JwtSecretKeysTable with queries
* add jwt signing keys page to settings menu
* deduplicate labels, descriptions, etc
* add create, update jwt-signing-key mutations
* update types
* remove unused components, to be refactored later
* make everything into a mostly working state
* legacy migration added
* put jwt keys page like api keys
* fully migrate legacy jwt secret page
* fix prettier
* fix typecheck ts-expect-error
* rm unneeded file
* Fix compile errors.
* Rename the files and move them to the same folder.
* Merge the two constant files.
* Fix the imports.
* Fix a bug in the API keys page when opening it in a new tab.
* Change the page to be at /signing-keys
* Fix some minor types.
* Break apart some of the components in the signing keys UI.
* Use a feature banner for the initial action.
* Make a create key dialog and move functionality there.
* Fix some cosmetic issues.
* Minor cosmetic fixes.
* Remove extra keys in RQ cache.
* Add a missing link
* Add a banner when the feature flag is false.
* Minor type fix.
* more tiny type fix
* fix error on create standby key
* add alert to prevent revoking legacy jwt secret without disabling legacy api keys first
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Disables organization selection if the org requires MFA but the user
does not have MFA enabled.
Add badges / hints to show that user has access to an Organization but
access is disabled because of MFA access requirement
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
This PR implements the new flow to confirm subscription upgrades using Orb pending changes. This is backwards compatible and based on a flag exposed by the backend (`subscriptionPreview.pending_subscription_flow`).
Just like the organization creation, the entire flow is slightly different - instead of creating a payment method separately, the payment method is added inline while doing the upgrade and then attached to the customer. If payment fails, the upgrade will not go through. If payment requires additional action, the user needs to confirm the payment before allowing the upgrade.
For testing the new flow locally, toggle the flag in `flags.ts` on the backend.
Changes include
- No longer rely on the `changeType` from the plans endpoint as this is regularly out-of-sync and displays wrong up/downgrade info due to race conditions
- `readOnly` mode for Stripe elements if anything is loading/submitting
- Reduced prop drilling for some components
- Hide payment method and address selection on downgrade
* Update new project flow to add a warning before redirecting
* Simplify the logic for picking an org.
* Small UI tweaks
* Readd the alert about a not found org.
* Link to all orgs if slug is undefined
* Nit
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
- Prefill email in Stripe form to set up Link faster or connect faster
- Overwrite a bit of styling so it looks less foreign
- Moved the Payment component from the NewOrgForm into it's own file and renamed it
Adds support for the new Orb pending subscription change flow that has been added to the backend.
By default, the new feature is disabled (enabled after merge on staging). If disabled, this should work just like before with the regular `confirmPayment` function that triggers 3DS if needed and properly lets a user confirm their additional factor.
With the new flag, we only create a payment method, as we will do another payment intent that is set up for future usage and that may require 3DS - so we avoid the possible double confirmation (setup confirmation + payment intent). The organization creation endpoint can either return a full organization (i.e. on Free Plan or immediate payment success) or a payment_intent_secret. In case of the secret being returned, we need to confirm the secret with the Stripe SDK.
Moved the Stripe Elements further down to avoid the entire form reloading (especially billing address) in case of a payment failure.
Kevin Grüneberg