* feat: improved jwt signing key rotation dialog
* small tweaks
* Minor CSS fixes.
* Minor CSS fixes for the initial dialog for JWT keys.
* Fix the error to be better. when revoking too fast.
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* feat: add documentation and UI integration for Before User Created hook
- Added new guide: `before-user-created-hook.mdx`, documenting usage, inputs,
outputs, and multiple complete examples for HTTP and SQL.
- Updated navigation menu and hook index table to include the new hook.
- Hook is now listed as available on Free and Pro plans.
Studio changes:
- Registered `Before User Created` hook in `hooks.constants.ts` with proper
title, slug, and configuration keys.
- Enabled Docs button linking to hook guide in both `CreateHookSheet` and `HookCard` components.
- Extended hook listing page to support docs access via `secondaryActions`.
This hook allows developers to intercept and reject user creation across all
flows (email/password, OAuth, SSO, SAML, anonymous) - enabling custom signup
logic like domain allowlists, geofencing, or account gating.
* fix: add subnet to mdx lint allowed list
* fix: incorporate feedback and spelling changes
* feat: add allow/deny domain and CIDR examples to before-user-created hook
This commit enhances the documentation for the before-user-created auth hook:
- Adds production-ready SQL examples for blocking or allowing signups by email domain (signup_email_domains) and IP address or CIDR (signup_networks)
- Introduces enum-based classification (allow vs deny) for both domain and network restrictions
- Adds full migration-style snippets for easy copy/paste into Supabase SQL Editor
- Includes updated HTTP examples that delegate to Postgres functions via Supabase client rpc()
- Adds environment setup guidance and edge function scaffolding
* fix: pnpm format
---------
Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
* Switch to async permissions for table editor
* Add debugging
* More debug
* Snap debug
* Snap debug again
* Snap debug again, again
* One more
* Remove debugging
* Cleanup
* Split the useEffect into two.
* Add a setter for editable.
* Revert unneeded change.
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* wip
* feat: distribute bedrock requests across regions
* fix: tests and type errors
* chore: remove AWS_BEDROCK_REGION from turbo.json
* fix: vercel oidc provider to fallback in credential chain
---------
Co-authored-by: delgado3d <27228526+delgado3d@users.noreply.github.com>
* chore: add signed out redirect timeout
* Add modal
* Nudge language
* Add temp github link
* Use captureException
* Minor refactor
* Revert staging specific testing logic
* Fix the sentry message send
* Change to event
* Add debugging
* Use an actual error
* Adjust logging
* always send errors
* even more debugging
* Remove all beforeSend checks
* Restore beforeSend
* Debug
* Retry original
* Again
* Test always send
* Cleanup
* Test frames again
* Retry third party error function
* Cleanup
* Remove hardcoded debugging
---------
Co-authored-by: Terry Sutton <saltcod@gmail.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* chore: add e2e test for sql editor snippets
* trigger build
* chore: fix failing test and add rls
---------
Co-authored-by: Terry Sutton <saltcod@gmail.com>
When downgrading from a larger compute size to <large while having provisioned IOPS or throughput, we would leave the disk as-is, even though the configuration is unsupported and then block any disk changes because the instance size is too small, essentially dead-locking the customer on the disk attributes, unless they bump back up to a higher instance size.
PR addresses multiple issues:
- Automatically reset disk attributes to default when customers downgrade to <large instances
- Do not use the baseline compute IOPS/throughput for the fields, as this leads to accidentally over-provisioning by customers
- Created DuplicateSecretWarningModal component following the pattern of DeployEdgeFunctionWarningModal
- Added duplicate key detection logic to AddNewSecretForm before secret creation
- Shows confirmation dialog when attempting to create a secret with an existing name
- Allows users to proceed with replacing the existing secret or cancel the operation
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Claude <noreply@anthropic.com>
* Update UnifiedLogs.queries.ts
* Update Unified Logs QueryOptions to use POST to logs.all
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
When changing the plan while also creating a payment method in the same breath, some customers double-clicked the confirm button leading to a double-submission and possibly leading to a state where the customer gets charged, but the plan change is not going through.
* Add third-parties dependency for GTM. Reexport the GTM from the common package.
* Add the TelemetryTagManager to four of the production apps.
* Add the GOOGLE_TAG_MANAGER_ID env var as a turbo dependency to the 4 apps.
* Skip rendering the tag manager if the env var is not set or not running on the platform.
* Fix the prop type to be extracted from the component.
* Add default values for consent to GTM.
* Another try to mimic gtag function.
* Fix a link in www.
* Try another approach.
* try.
* Remove the data-redaction flag.
* Remove extra code.
* Send a sign-up event if GTM is enabled.
* Send only the email to GTM.
* Minor fixes.
* Remove third-parties from pnpm lockfile.
* Lets try to make studio work again.
* Add CSP rules for img loading for GTM.
* Add event for testing.
* Add www.googletagmanager.com to the CSP rules.
* Add Stape to CSP rules.
* Fix stape CSP.
* Clean up the code.
* Remove extra console.log.
* Fix the stape urls for CORS.
* Fix the wrong category for Stape URL.
* Add google ads urls.
* Bump the timeout.
* Add google.com to the img-src for google ads.
* update csp
* remove comment
* update to use google analytics without signals
* add stape to default-src in csp
* move csp to middleware
* add google ads support and fix middleware base path
* remove google tag manager / google ads references from csp. load via stape proxy instead
* add double click url to image src
* add Google Tag Manager URL to CSP configuration
* add ga4 urls to csp
* remove google urls from CSP
---------
Co-authored-by: Alaister Young <a@alaisteryoung.com>
* update cancellation reasons
* update texts
* randomise options and only single select reasons
* label overrides and reason readability
* minor fixes
* fix reasons sending
* Fixes
* Adjust tooltip side
* improve header description
* add a label for radio options
* wrap shuffledReasons in useState so it doesn't randomly shuffle
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Alaister Young <a@alaisteryoung.com>
* feat: show upgrade warning if user objects exist in internal schemas
* Clean up warnings into a separate file
* Update API types + fix TS issues
* Update apps/studio/components/interfaces/Settings/Infrastructure/InfrastructureInfo.tsx
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* Feature flag assistant endpoint + opt in UI
* Feature flag bedrock stuff for the other endpoints like title, cron, complete
* add edge function complete v2
* revert to old complete
* Revert hardcode
* fix chart colour
---------
Co-authored-by: Saxon Fletcher <saxonafletcher@gmail.com>
* Fix z-index position of row
* Fix column widths to make it fit a laptop viewport better
* Fix auto fetching when scrolling to the bottom
* Small style fixes + decouple count loading state from table loading state
* Refactor row uuid to just id, add de-duping logic to logs data, standardise unified logs query options
* Clean up logs
* Misc styling tweaks
* Reinstate prev cursor and direction for live mode
* Clean
* Revert text sizes
* Remove now resolved comments
* chore: transition from AWS_NEW to AWS_K8S
* chore: transition from useIsAwsNew to useIsAwsK8s
* chore: new useIsAws method
* chore: disk management protections
* chore: IPV4 addon protections
* chore: AWS_K8S restart protection
* chore: AWS_K8S read replica protections
* chore: restore to new project protections
* Update apps/studio/components/interfaces/Settings/Infrastructure/InfrastructureConfiguration/DeployNewReplicaPanel.tsx
Co-authored-by: Tom Gallacher <tgallacher@users.noreply.github.com>
* chore: changes based on feedback
* fix: prettier
* minor fixes
* Use disabled state for ipv4 address in ipv4sidepanel isntead of hiding the UI entirely
* Revert hardcode in useSelectedProject
---------
Co-authored-by: Tom Gallacher <tgallacher@users.noreply.github.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* step 1
* use mcp
* system prompt
* clean up
* space
* clean up
* add three state opt in toggle
* clean up
* todo
* hooks
* refactor opt in form and modal
* refinements
* add bedrock
* remove console
* update mcp util
* use bedrock
* remove openai sdk package
* re-add tools
* update complete endpoints
* fix: ai assistant markdown formatting (#35541)
* fix: mcp types and project ref (#35540)
* feat: more flexible aws credential provider (#35538)
* feat: more flexible aws credential provider
* fix: add AWS_REGION to turbo env vars
* change to allowed
* update complete endpoints
* add an additional permission
* refinements
* use claud 4
* legal copy changes
* update other ai functions to use bedrock
* update generate v3 copy
* remove generate sql modal
* fixes for query block
* re-add dragging to reports
* clean up
* add open ai edge function example
* use handle error from fetchers
* remove schema and lean on tools
* copy
* Assistant MCP tests (#36049)
* feat: refactor and test mcp and model logic
* fix: remove get_project tool
* fix: remove additional get_project tool references
* update copy
* Clean up, fixes, refactors
* oops
* Float errors from AI endpoionts as toasts
* Use a env var AWS_BEDROCK_PROFILE for bedrock.
* Rename the env var for AWS bedrock profile.
* feat: support custom aws bedrock env vars
* chore: add comments explaining aws credential chain
* MCP Self Hosted Check (#36185)
support self hosted
* feat: bedrock auth via vercel oidc
* Fix broken unit test
* Feeeex
* Refactor useOrgOptedIntoAi
* Remove useDisallowHipaa hook
* small system prompt change
* readd vercel packages
* fix self hosted
* increase max duration
* try more direct prompt
* max duration 90
* reduce max steps and add loading
* mono font
* backwards compat styling
* Chore/limit number of messages sent to assistant (#36388)
* Limit number of historical messages that get sent to assistant
* Update max chat history to 5
* alignment
* bump mcp server version
* Add feature flag for opt in tags (#36466)
* Add feature flag for opt in tags
* Add one more check
* security section system prompt
* rely on default link and replace image markdown
* Add custom link component to assistant message block (#36527)
* Add custom link component to assistant message block
* Update based on feedback
* Render plain text if URL is deemed unsafe
* fix mcp tools and parse data (#36593)
* Update Admonition for AI Assistant for when opt in is re-enabled (#36663)
* Update Admonition for AI Assistant for when opt in is re-enabled
* Update
* Smol fix
* Fix TS
* Tiny
---------
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* fix: warning message on upgrade guards
When users are blocked from an upgrade because they have objects that
need to be dropped, the message in the warning is incorrect. It asks
users to "drop these extensions". But they're not extensions, they're
user-defined tables, foreign keys, etc. This will cause confusion.
Here we use a different messaging when users need to drop their objects.
* chore: prettier
Add the ability to look up error code explanation in API Gateway logs.
Also a bunch of GraphQL-related utilities and generated types for
calling the Content API.
