mirror of
https://github.com/supabase/supabase.git
synced 2026-10-05 17:35:10 +03:00
master
29
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Jordi Enric
|
38e8f12b1b |
fix(studio): gate homepage health advisor (#50328)
## Problem Health Advisor results appear on the project homepage whenever the main `healthAdvisor` flag is enabled, so the homepage cannot be rolled out separately. The existing gates also contain redundant boolean and platform checks. ## Fix Require both `healthAdvisor` and `healthAdvisorInHomepage` before fetching or displaying health advisories on the homepage. Simplify all Health Advisor gates to use the boolean ConfigCat flag directly, including the cleanup requested in the review of #50326. ## How to test - Enable only `healthAdvisor` and verify Health Advisor remains available outside the homepage while health results do not appear or load on the homepage. - Enable both flags and verify health results appear on the homepage. - Disable `healthAdvisor` and verify Health Advisor remains unavailable everywhere. - Existing targeted tests pass: 5 tests across Advisor menu and panel integration suites. - Prettier and whitespace checks pass. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Health Advisor is now available in non-platform environments when enabled. * Navigation, filtering, lint checks, and project pages consistently follow the Health Advisor feature setting. * Self-hosted environments can use the Health Advisor category. * **Bug Fixes** * Homepage Health Advisor visibility now follows both the Health Advisor and homepage-specific settings. * Updated empty states and health lint results to match the configured availability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi Enric
|
519a3a5644 |
fix(studio): gate health advisor behind feature flag (#50326)
## Problem Health Advisor runs checks and displays health alerts without a dedicated rollout flag. ## Fix Gate Health Advisor behind the ConfigCat `healthAdvisor` flag, defaulting to off when missing or loading. This covers the navigation and shortcut, command menu, direct page access, homepage alerts, Advisor panel filters and details, and health-check requests. Cached health results and saved Health filters no longer surface health content when disabled. Existing platform-only restrictions remain. The `healthAdvisor` flag will be created separately in ConfigCat. ## How to test - With `healthAdvisor` off, verify Health Advisor is absent from navigation, command search, homepage alerts, and Advisor panel categories. Opening `/project/<ref>/advisors/health` shows an unavailable message. No health-check POST requests should run. - With the flag on for an active platform project, verify these surfaces return and health checks load. - Disable the flag after loading health results and selecting the Health filter or an alert. Verify cached health alerts disappear and the panel remains usable. - Existing menu tests pass. No new feature flag tests are included. Formatting and whitespace checks passed. - Local lint could not start because the available dependency installation is missing `@eslint/compat`. Full TypeScript validation failed with missing dependencies and incompatible workspace types in the reused local dependency installation; it did not provide a clean validation result. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Health Advisor availability is now controlled by a feature flag on the platform. * When enabled, health advisories appear in advisor menus, filters, project checks, and empty-state messaging. * When unavailable, the Health Advisor page clearly indicates that it isn’t available for the project. * **Bug Fixes** * Health advisory data is no longer requested when the feature is disabled, preventing unavailable health results and errors from appearing. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
476d4a5851 |
refactor(ui): drop redundant Button variant="default" props (#50161)
## What kind of change does this PR introduce? Mechanical cleanup on top of the Button default-variant change (#50160). ## What is the current behavior? Many callsites still pass `variant="default"` even though that is now the component default. ## What is the new behavior? Removes redundant static `variant="default"` from legacy `Button` and `ButtonTooltip` callsites. Keeps explicit defaults where they document the API: - `button-default.tsx` and `button-sizes.tsx` demos - `DocsButton`, which pins neutral styling at the wrapper boundary ## To test Studio: - [Auth → Rate Limits](https://studio-staging-2s957kwc4-supabase.vercel.app/dashboard/project/_/auth/rate-limits): dirty the form so Cancel appears; Cancel stays neutral, Save stays green - [Project Settings → API Keys](https://studio-staging-2s957kwc4-supabase.vercel.app/dashboard/project/_/settings/api-keys): `DocsButton` in the header actions stays neutral Design system: - [Design system → Button](https://design-system-git-dnywh-dc924ac1-supabase.vercel.app/design-system/docs/components/button): `button-default` / `button-sizes` still show explicit default styling; Primary (green) is restricted to the Primary section (and `asChild`) WWW: - [www → Brand assets](https://zone-www-dot-com-git-dnywh-dc924ac1-supabase.vercel.app/brand-assets): Download logo kit / Download button kit stay neutral |
||
|
|
1966209483 |
chore(deps): upgrade vitest to v5 (#49994)
Upgrades Vitest from 4.1.4 to 5.0.0 across the monorepo, fixes the handful of things v5 turned into hard errors, and drops the `vi.clearAllMocks()` boilerplate that v5's `clearMocks` default makes redundant. **Changed:** - `vitest`, `@vitest/ui`, `@vitest/coverage-v8` 4.1.4 → 5.0.0 (catalog) - `vi.mock` calls that lived inside `beforeAll`/`beforeEach`/test bodies moved to module scope (v5 throws on nested calls). Affects the Studio and docs setup files and four Studio tests. - `detectBrowser` test restores `navigator` via `vi.unstubAllGlobals()` instead of assigning `global.navigator`, which now reaches jsdom's getter-only property. - `RowEditor.utils.test.ts` restores its `JSON.stringify` spy. It used to leak a throwing mock for the rest of the file, which v5's coverage provider now trips over. A later test in the same file had been asserting the leak's side effect (valid JSON reported as invalid) and now asserts the correct behavior. - `@testing-library/jest-dom` 6.6 → 7.0.1. Its vitest type augmentation resolves through a peer now, so it lands on each package's own `vitest` instead of whichever copy pnpm hoisted. Fixes `toBeInTheDocument` type errors in dev-tools after the reshuffle. - `@testing-library/react` 16.0.0 → 16.3.3 for the React 19 peer range. - `vite: catalog:` added to dev-tools, www, and common. Without it they resolved a newer vite than the catalog pin, which forked a second vitest instance in the lockfile. There's now one. - ai-commands custom matcher types use v5's `Matchers<R, T>` form. - 110 test files: `vi.clearAllMocks()` removed from `beforeEach`/`afterEach` hooks, along with hooks that only did that and the imports they left unused. Calls that also reset/restore mocks are untouched. Second commit, mechanical. **Added:** - `.vitest/` to the root gitignore (v5 writes JSON/JUnit/HTML reporter output there) **Removed:** - `vite-tsconfig-paths` catalog entry and deps. Vitest 5 resolves tsconfig paths itself. Release-age note: this sat in draft with a temporary `minimumReleaseAgeExclude` entry for `vitest` and `@vitest/*` while 5.0.0 was inside the workspace's 3-day `minimumReleaseAge` window. That window has closed, so the exclusion is gone and nothing bypasses the release-age gate. **Perf** (local, medians of 3 runs, same machine): | Suite | v4.1.4 | v5.0.0 | |---|---|---| | studio | 144.1s | 141.7s (-2%) | | studio `--coverage` | 156.9s | 146.4s (-7%) | | ui-patterns | 6.27s | 5.07s (-19%) | | ui `--coverage` | 3.35s | 2.14s (-36%) | | www | 0.89s | 0.47s (-47%) | Studio is dominated by jsdom environment setup per file, which v5 doesn't change. `vitest doctor` recommends keeping the current pool config: the vm pools and `isolate: false` all break tests. ## To test - `pnpm install --frozen-lockfile` succeeds with no `minimumReleaseAgeExclude` entry for vitest. - CI: Studio unit tests, ui, ui-patterns, www, docs, and typecheck/lint should all be green. The lint ratchet was checked locally: warning counts on touched Studio files are identical to master. - `pnpm test:studio` locally passes with coverage (588 files, 6240 tests). - Open a Studio test that uses `toBeInTheDocument` in your editor and confirm no type errors on jest-dom matchers, in Studio and in `packages/dev-tools`. - Known pre-existing failures unrelated to this PR: one dev-tools test (`getEventCountBadge` capped pill) fails on master too. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Tests - Improved test coverage for JSON validation and mobile navigation behavior. - Updated test setup, cleanup, environment configuration, and matcher support across application and shared package suites. - Removed obsolete coverage for alternate MCP transport selection. ## Chores - Streamlined TypeScript path resolution and Vitest reporter output handling. - Updated testing libraries and Vitest tooling across documentation, Studio, website, and shared packages. - Added Vitest reporter output to ignored files. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
|
b5daafd264 |
feat(studio): add health category to the advisor panel (#49662)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature ## Summary - Replace advisor panel tabs with multi-select category filters, including Health - Load health lints in the advisor panel (without blocking other categories on the slower health request) - Rename item `tab` to `category` and add empty-state copy for health Stacked on #49661. ## To test 1. Open any project in Studio. 2. Open Advisor Center from the toolbar (the advisor / lightbulb control). 3. Confirm the old All / Security / Performance / Messages **tabs are gone**. You should see **Category**, **Status**, and **Severity** filters instead. 4. Open Category and confirm **Health** is in the list with Security, Performance, and Messages. 5. Select only **Health**: - If the project is healthy: empty state “No health issues detected” / “Your database, instance and services are all responding normally”. - If it is not: only health issues in the list. 6. Clear Health, then filter **Security** and **Performance** separately. Those lists should still match what you expect from before. 7. With Health selected, also filter Severity to **Info** only. If nothing matches, you should get “No items found” and a way to clear filters — not a false “no health issues” message. 8. From project home, click an advisor card. Advisor Center should still open on that same item. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added category-based filtering for Advisor recommendations, including Security, Performance, Health, and Messages. - Added Health issue recommendations and category-specific icons, labels, and empty-state messaging. - Advisor results now load according to the selected categories. - Added clearer project requirements and hidden-item controls for filtered results. - **Bug Fixes** - Invalid category and severity filter values are safely ignored. - Improved categorization and telemetry for Advisor items, including health and security recommendations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Saxon FletcherandCursor
|
ad33b16f8c |
feat(studio): show health advisors on the project home (#49661)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature ## Summary - Add a `useProjectHealthLintsQuery` that runs the live health checks (database down, unreachable, connection limit, service error rate, infrastructure alerts) - Surface those results on the project home advisor row alongside security and performance errors - Register health lint metadata (titles, docs links, entity icon) so homepage cards can render them Bottom of the stack. The advisor sidebar still uses tabs; health items show under All until #49662. ## To test 1. Open any project home in Studio. 2. Find the Advisor row (the cards under “Advisor found N issues”). 3. If the project has a real health problem, you should see a **HEALTH** card (for example “Database process is down” or “Database connection limit reached”), not only SECURITY / PERFORMANCE. 4. If the project is healthy, you should **not** see a HEALTH card. Existing security and performance cards should still appear as before. 5. Click a HEALTH card (or any advisor card). Advisor Center should open on that item. 6. In Advisor Center on this PR, health items only show under the **All** tab — Health is not its own tab yet. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a Health category to Advisor, with a dedicated tab and activity icon. - Added health checks for database availability, connection limits, service errors, and infrastructure alerts. - Health issues now appear alongside security and performance recommendations with relevant troubleshooting links. - **Bug Fixes** - Health-related advisor findings are now correctly categorized and displayed. - **Tests** - Added coverage for health checks, categorization, filtering, and project health query behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
|
5b01b5a9c7 |
fix(studio): report advisorCategory consistently across advisor telemetry surfaces (#49746)
<!-- ccr-slack-attribution --> _Requested by **Pam Chia** · [Slack thread](https://supabase.slack.com/archives/C076KTY11DF/p1788139328573799?thread_ts=1788139328.573799&cid=C076KTY11DF)_ ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix (telemetry correctness). No user-visible change. ## What is the current behavior? Linear: [GROWTH-1153](https://linear.app/supabase/issue/GROWTH-1153/telemetry-advisorcategory-omitted-for-health-lints-on-two-of-five) **Before:** five surfaces emit the optional `advisorCategory` property on `advisor_detail_opened` and `advisor_assistant_button_clicked`, and they disagree about how to derive it. Three pass the lint's category straight through as `categories[0]`. Two compute it with a hardcoded ladder — `categories.includes('SECURITY') ? 'SECURITY' : categories.includes('PERFORMANCE') ? 'PERFORMANCE' : undefined` — which predates the `HEALTH` category and falls through to `undefined` for anything it does not name. Because the property is optional, those two surfaces ship the event with `advisorCategory` silently absent: no type error, no runtime error, just a hole in the data. A reader querying a category breakdown of either event gets numbers that depend on which surface the user happened to click, and `HEALTH` is under-counted. The split is clearest in `AdvisorSection.tsx`, where a single advisor card emits both events — the card click through the ladder (L83) and the Assistant button through the pass-through (L206) — so one card can report two different categories for the same lint. The cause is that `AdvisorCategory` in `packages/common/telemetry-constants.ts` is schema-derived: ```ts type AdvisorCategory = components['schemas']['GetProjectLintsResponse'][number]['categories'][number] ``` The API-types regeneration in supabase/supabase #49646 (merged 2026-08-27, `26e89b36c349893540f8efbd45613921be0a4d18`) widened `categories` from `('PERFORMANCE' | 'SECURITY')[]` to `('PERFORMANCE' | 'SECURITY' | 'HEALTH')[]`. `AdvisorCategory` picked up the third value incidentally and the two ladders were never updated — a union widening is invisible to a hardcoded ladder, so nothing broke loudly. | Event | Surface | HEALTH behavior before | | --- | --- | --- | | `advisor_detail_opened` | `apps/studio/components/ui/AdvisorPanel/AdvisorPanel.tsx` (L203) | ladder → property absent | | `advisor_detail_opened` | `apps/studio/components/interfaces/ProjectHome/AdvisorSection.tsx` (L83) | ladder → property absent | | `advisor_detail_opened` | `apps/studio/components/interfaces/Linter/LinterDataGrid.tsx` (L163) | pass-through → `'HEALTH'` | | `advisor_assistant_button_clicked` | `apps/studio/components/interfaces/Linter/LintDetail.tsx` (L38) | pass-through → `'HEALTH'` | | `advisor_assistant_button_clicked` | `apps/studio/components/interfaces/ProjectHome/AdvisorSection.tsx` (L206) | pass-through → `'HEALTH'` | The two `advisorCategory` property doc comments in `telemetry-constants.ts` (L2949, L2980) also still read "Category of the advisor (SECURITY or PERFORMANCE)", which the widening made false. ## What is the new behavior? **After:** all five surfaces derive `advisorCategory` the same way, so a category breakdown of these two events is consistent regardless of which surface produced the event, and `HEALTH` is reported wherever it can occur. The two ladder sites now read `item.original.categories[0]`, matching the three sites that already did. The `signal` branch (which reports `'SECURITY'`) and the `notification` branch (`undefined`) of those two expressions are unchanged, so nothing about non-lint advisor items moves. The stale parenthetical is cut from both doc comments. Net diff is 3 files, -12/+4 lines. No behavior change outside the value of one optional telemetry property. ## Additional context **How.** The fix is the pass-through, not an extended ladder. Per the two options considered: 1. **No lint carries more than one category in practice.** Every lint fixture in `apps/studio` uses a single-element array (`['SECURITY']`, `['PERFORMANCE']`). The API type permits a multi-element array, but nothing in the repo produces one, so the ladder's SECURITY-over-PERFORMANCE priority is not load-bearing. 2. **The advisors UI already treats the first element as canonical** — `LinterDataGrid.tsx` L196 renders `<LintCategoryBadge category={selectedLint.categories[0]} />`. 3. **Extending the ladder would not actually produce agreement.** In the one reachable multi-category case, a ladder with a `HEALTH` branch appended still reports the higher-priority category while the three pass-through sites report `categories[0]`. Only `categories[0]` makes all five agree, which is the point of the change. **Reviewers should look at this first — how much data is actually affected.** Narrower than the headline suggests, and worth stating precisely. Every surface feeding these events filters lints upstream by category, and all three filters still admit only `SECURITY` or `PERFORMANCE`: - `AdvisorPanel.utils.ts` `createAdvisorLintItems` drops any lint that resolves to no tab (`if (!tab) return null`), and it is the item source for **both** ladder surfaces - `pages/project/[ref]/advisors/security.tsx` filters `categories.includes('SECURITY')` - `pages/project/[ref]/advisors/performance.tsx` filters `categories.includes('PERFORMANCE')` So a HEALTH-**only** lint is not surfaced anywhere in Studio today and cannot currently reach any of the five emit sites. The divergence reachable today is a lint carrying `HEALTH` alongside another category: it passes the filters, and then the ladder sites and the pass-through sites disagree. The HEALTH-only omission is latent, and becomes live data loss the moment HEALTH lints are surfaced — presumably the point of the API adding the category. Practical consequence: **no backfill or historical-data caveat is needed**, because no HEALTH-only event was ever emitted. This is a correctness fix that gets the emit surfaces right ahead of the category being shown, not a response to an active data incident. **How it was tested.** Honest caveat up front: `pnpm install` cannot complete in this sandbox, so the Studio-scoped checks could not be run here. `apps/studio` depends on `@std/path` → `npm:@jsr/std__path`, and the JSR registry is network-blocked in this environment (`GET https://npm.jsr.io/~/11/@jsr/std__path/1.0.8.tgz` → `403`, both direct and proxied; `registry.npmjs.org` returns `200`, so it is JSR specifically). CI on this PR is the real signal for Studio lint, typecheck, and tests. What did run clean: - `prettier --config prettier.config.mjs --check` on all three changed files — clean - `tsc --noEmit` in `packages/common` (installed via `pnpm install --filter=common...`) — clean, and `--listFiles` confirms it genuinely covers both `telemetry-constants.ts` and the widened `packages/api-types/types/platform.d.ts` - the changed expression typechecked in a standalone harness against the real generated `components['schemas']['GetProjectLintsResponse']`, confirming `categories[0]` is assignable to `AdvisorCategory | undefined` — with a negative control that correctly errored (`Type '"HEALTH"' is not assignable to type '"PERFORMANCE" | "SECURITY" | undefined'`) to prove the harness had teeth No tests are added. There is no existing test coverage of `handleItemClick` / `handleCardClick` in either ladder component, and the change is a narrowing of one expression to match three existing call sites rather than new logic. Asserting an emitted property value would require standing up component tests for two components that have none, which is a larger piece of work than this fix and better done as its own change. **Suggested follow-up, deliberately not in this PR.** `createAdvisorLintItems` and the two advisors pages filter HEALTH lints out entirely, so the category the API now returns is invisible in Studio. Whether to surface it is a product decision about a new advisor category, not a telemetry fix. Also out of scope by request: `Linter.utils.tsx` badge styling (HEALTH falling back to PERFORMANCE's badge is harmless). --- _Generated by [Claude Code](https://claude.ai/code/session_01Xwj2SotnaHByjbTfqF4Kdm)_ Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Pamela Chia <pamelachiamayyee@gmail.com> |
||
|
Gildas Garcia
|
cabe14e5ca |
chore: remove _Shadcn_ suffix from ui tabs components (#47628)
## Problem Now that we migrated all usages of the deprecated `Tabs` component, we don't need the `_Shadcn_` suffix anymore. ## Solution Remove `_Shadcn_` suffix from `ui` tabs components. That's all this PR does, no visual nor functional changes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Standardized tab components across the app so pages and dialogs now use the same consistent tab UI. * Improved tab-based views in design, docs, studio, learn, and website experiences for a more uniform interface. * **Chores** * Updated shared UI exports to expose tab components directly, simplifying future usage across the product. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
b30db91d71 |
chore: cleanup UI patterns exports (#47406)
## Problem We now export components under a subpath in ui-patterns to avoid barrel files as they slow down every tools (from IDE to linters, etc.) and may also affect bundles our users have to download. ## Solution - Remove the UI patterns index file - Fix invalid impors |
||
|
Joshen Lim
|
74ddbc7453 |
Joshen/fe 3685 show a timestamp for failed restart messages in the (#47274)
## Context For notifications which affect a specific project, there's currently no indication of when the notification was created at all, so this PR addresses that ## Changes involved - For notifications, show created at timestamp in header description - Was previously showing project ref if present in notification metadata, but it's repeated information as the affected project is mentioned in the context section - It'll still show the project ref in the list view, change is only in the detail view (after clicking on a notification) ### Before <img width="400" alt="image" src="https://github.com/user-attachments/assets/e8ce247c-afa4-46df-832f-856d34ce82fd" /> <img width="400" alt="image" src="https://github.com/user-attachments/assets/2e0a6c8a-3bb4-4c05-ae13-36b8a92e7ff0" /> ### After No change for notifications list view <img width="400" alt="image" src="https://github.com/user-attachments/assets/e741b607-c5ef-4cd0-9985-5957f2b52bfc" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved how advisor panel details are displayed, ensuring timestamps and secondary text appear in the right situations. * Hidden metadata when no relevant information is available, reducing clutter in the panel. * **Style** * Updated a link layout in notification details for cleaner, more consistent formatting. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas GarciaandIvan Vasilov
|
96d43099bb |
chore: refactor Button API so that it can be used a standard button (#46880)
## Problem Our `<Button>` component breaks the default `button` contract by redefining the `type` prop to set its variant (`primary`, `default`, etc) instead of the button type (`submit`, `button`, etc). This is confusing and forces to write more code when using it with shadcn components that expect/inject the standard button props. ## Solution - rename the `type` prop to `variant` - rename the `htmlType` prop to `type` - propagate the changes where necessary - format code ## How to test As this is just prop renaming, if it builds it's ok --------- Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Mert YEREKAPAN
|
4c07df1a48 |
feat(studio): surface affected project in metric advisories (#46203)
## Summary Resolves [GROWTH-865](https://linear.app/supabase/issue/GROWTH-865) on the Studio side. Companion backend PR: [supabase/platform#33086](https://github.com/supabase/platform/pull/33086). Resource-exhaustion advisories (CPU, Disk IO, Memory) currently give users a list of identical-looking messages with no project context. This PR makes the affected project visible in the advisor panel and hardens the "Check consumption" deep-link. ### Changes **Advisor list view** — `AdvisorPanel.utils.ts`, `AdvisorPanel.types.ts`, `AdvisorPanel.tsx`, `AdvisorPanelBody.tsx` - `AdvisorNotificationItem` now carries `project_ref`. - `getAdvisorItemSecondaryText` accepts an optional `projectNameByRef` map and returns the resolved project name (falling back to the ref if the lookup hasn't loaded). Falls through to the existing date string for notifications without a project. - `AdvisorPanel.tsx` builds the map from `useProjectsInfiniteQuery` and threads it through `AdvisorPanelBody`. **NotificationDetail** — `NotificationDetail.tsx` - `[ref]` / `[slug]` substitution in action URLs falls back to `data.project_ref` / `data.org_slug` before the `_` literal. This fixes the universal-link bug Tim reported where "Check consumption" sometimes resolved to `/project/_/...` while `useProjectDetailQuery` was still loading. The companion backend PR updates the notification copy so the title/message also name the project. Both PRs degrade gracefully if landed independently. ## Test plan - [x] `pnpm test:studio -- AdvisorPanel.utils.test.ts` — 6/6 pass (4 new tests cover the notification branch of `getAdvisorItemSecondaryText`) - [x] `pnpm typecheck` passes for apps/studio - [x] `pnpm exec eslint components/ui/AdvisorPanel/` passes - [ ] Local Studio smoke test: open Advisor → Messages, confirm project name shows under each notification and "Check consumption" deep-links to the correct project even if the project detail query is slow <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Advisor Panel notifications now display resolved project names when available for clearer context. * **Bug Fixes** * Notification action URLs now prefer stored project and organization refs/slugs with improved fallbacks, making action links more reliable. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46203?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali WaseemandJoshen Lim
|
2f5f6ffa79 |
chore: help users navigate graphql lints for anon and authenticated roles (#45295)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix, feature, docs update, ... - Hide lints when exposed within local storage - Revoke on roles <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a GraphQL-exposure action in linter items that shows a confirmation modal with the exact SQL, lets you revoke GraphQL access, executes the operation, shows success/error toasts, and refreshes lint results. * Added an informational callout linking to database integration settings when GraphQL exposure is detected. * Lint actions now close the side panel and return the UI to the list after completion. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Ivan Vasilov
|
308cd791a2 |
chore: Prep work for migrating to Tailwind v4 (#45285)
This PR preps the monorepo for a migration to Tailwind v4: - Bump all Tailwind dependencies and libraries to the latest possible version, while still compatible with Tailwind 3. - Cleans up obsolete Tailwind 3 specific options and configs. - Cleans up unused CSS files and fixes the CSS imports. - Migrates all `important` uses in `@apply` lines to using the `!` prefix. - Move `typography.css` to the `config` package and import it from the apps. - Migrated all occurrences of `flex-grow`, `flex-shrink`, `overflow-clip` and `overflow-ellipsis` since they're deprecated and will be removed in Tailwind 4. - Make the default theme object typesafe in the `ui` package. - Migrate all `bg-opacity`, `border-opacity`, `ring-opacity` and `divider-opacity` to the new format where they're declared as part of the property color. - Bump and unify all imports of `postcss` dependency. |
||
|
Ali Waseem
|
32071e75e1 |
fix(studio): unblock advisor panel loading state on self-hosted (#45283)
## Summary Fixes [FE-3080](https://linear.app/supabase/issue/FE-3080/self-hosted-studio-advisors-toolbar-shows-blank-panel). On self-hosted Studio, opening the Advisors panel rendered an infinite skeleton with no network traffic. ## Root cause `useBannedIPsQuery` is gated by `IS_PLATFORM`. On self-hosted that disables the query — and a disabled React Query v5 query keeps `isPending: true` forever (only `isFetching` / `isLoading` go false). `useAdvisorSignals` re-exports that `isPending`, and `AdvisorPanel` folded it into its `isLoading` aggregate, pinning the panel into the skeleton state in `AdvisorPanelBody`. The other consumers were already designed around this — `AdvisorSection` on the home page explicitly does not wait on signals, and `AdvisorButton` only reads `data`. Only `AdvisorPanel` had the regression, introduced in #44372. ## Fix Drop `isSignalsActuallyLoading` from the panel's `isLoading` aggregate, mirroring the existing `[Joshen]` "ignore signal errors" exclusion two lines below and matching the home-page pattern. ## Test plan - [x] Existing unit + integration tests pass (`AdvisorPanel.utils`, `useAdvisorSignals`, `AdvisorSignals.integration` — 6/6) - [x] Verify on self-hosted Studio: open the Advisors sidebar and confirm lints render (or "no issues" empty state appears) instead of an infinite skeleton - [x] Verify on hosted Studio: lints, banned-IP signals, and notifications still render together; loading skeleton still appears while lints/notifications are in flight <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved loading state behavior in the Advisor Panel by excluding signal queries from blocking the panel's display. The loading indicator now only appears when actively fetching lints or notifications, allowing faster visibility of available content. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
samroseandDanny White
|
4afbe9c2b2 |
feat: lint integration for pg_graphql introspection + SECURITY DEFINER functions (#45260)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — wires up three new advisor lints landed in splinter, and updates the self-hosted SQL bundle for the existing `pg_graphql_anon_table_exposed` lint to track splinter's correctness fixes. Companion to `supabase/splinter` #160 (already merged) and #162 (test fix in flight). ## What is the current behavior? Splinter's `main` now exposes four lints in the pg_graphql / SECURITY DEFINER family: - `pg_graphql_anon_table_exposed` (0026, existing) — wired into Studio in #45253; SQL in `packages/pg-meta` is the original version that uses `has_table_privilege` and the relkind set `('r','p','v','m')`. - `pg_graphql_authenticated_table_exposed` (0027, new) — paired check against the `authenticated` role. Studio renders any new finding without a `lintInfoMap` entry as a row with no icon, no title mapping, and no "Fix" CTA. Self-hosted users do not see the lint at all because `packages/pg-meta` does not include it. - `anon_security_definer_function_executable` (0028, new) — `SECURITY DEFINER` function executable by `anon`. Same Studio + self-hosted gaps as 0027. - `authenticated_security_definer_function_executable` (0029, new) — same against `authenticated`. Splinter has also updated 0026 itself (PR #160) in two ways that need to flow into the self-hosted SQL bundle: 1. **`relkind` filter:** `('r','p','v','m')` → `('r','v','m','f')`. Drops partitioned table roots (pg_graphql does not expose them; their leaf partitions are still covered as `'r'`) and adds foreign tables, which pg_graphql does expose. 2. **Privilege predicate:** `has_table_privilege(role, oid, 'SELECT')` → `EXISTS` over `pg_attribute` calling `has_column_privilege`. Catches column-level grants such as `GRANT SELECT (col) ON t TO anon`, which pg_graphql's introspection exposes but `has_table_privilege` missed. Cloud projects auto-fetch `splinter.sql` via the platform mgmt-api's `getLintSql` (1-hour cache TTL), so they pick up #160's lint and SQL changes independently of this PR. This PR is about the Studio display mapping and the self-hosted SQL bundle. ## What is the new behavior? Two minimal additions, mirroring the integration shape of #45253. ### `apps/studio/components/interfaces/Linter/Linter.utils.tsx` Three new entries appended to `lintInfoMap`: - `pg_graphql_authenticated_table_exposed` — `Eye` icon (paired with the existing `pg_graphql_anon_table_exposed` entry); link points to the Table Editor scoped to `metadata.schema` + `metadata.name`; `linkText: 'View object'`; `category: 'security'`. - `anon_security_definer_function_executable` — `Unlock` icon (signals "this thing is callable when it shouldn't be"); link points to the Database Functions browser scoped to `metadata.schema` + `metadata.name`; `linkText: 'View function'`; `category: 'security'`. - `authenticated_security_definer_function_executable` — same as 0028 against `authenticated`. Each entry's `docsLink` points at the splinter-hosted lint doc. ### `packages/pg-meta/src/sql/studio/advisor/lints.ts` The existing `pg_graphql_anon_table_exposed` SQL block is updated in place to match the new splinter version: new `relkind` set, `case` statement for `'f'`, and the `EXISTS` over `pg_attribute` privilege check. Three new `union all` blocks are appended for 0027/0028/0029. The function lints (0028/0029) include the `pgrst.db_schemas` filter (mirroring lint `0023_sensitive_columns_exposed`) so findings are scoped to schemas PostgREST actually exposes; the self-hosted query wrapper already sets the GUC when `exposedSchemas` is passed (`enrichLintsQuery`). ## Coverage of the four exposure paths | Role | Tables/views/MVs/foreign tables | SECURITY DEFINER functions | |------|---------|----------| | `anon` | 0026 (existing, updated) | 0028 (new) | | `authenticated` | 0027 (new) | 0029 (new) | The 0026/0027 pair covers `pg_graphql` introspection visibility; the 0028/0029 pair covers RLS bypass via privileged function execution through `/rest/v1/rpc` (and `/graphql/v1` for compatible return types). Each lint's doc cross-references its sibling so an operator hitting one is steered toward the others. ## Verification - `cd packages/pg-meta && npx tsc --noEmit` — clean. - `cd apps/studio && npx tsc --noEmit` — clean for the changed file. (Other unrelated TS errors exist in the working tree but are pre-existing and not introduced by this PR.) - `cd apps/studio && npx eslint components/interfaces/Linter/Linter.utils.tsx` — clean. ## Files - `apps/studio/components/interfaces/Linter/Linter.utils.tsx` — adds three `lintInfoMap` entries (0027, 0028, 0029). - `packages/pg-meta/src/sql/studio/advisor/lints.ts` — updates the 0026 SQL block to match splinter's correctness fixes, appends 0027/0028/0029 SQL blocks. ## Related - supabase/splinter#160 — adds 0027/0028/0029 and rewrites 0026 (merged). - supabase/splinter#162 — fixes test setup for 0028/0029 (in flight; does not affect the SQL shipped here). - supabase/supabase#45253 — original 0026 Studio integration. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added security linting to detect authenticated-table exposure and executable SECURITY DEFINER functions. * Added signed-in visibility checks alongside anonymous checks. * **Bug Fixes / Improvements** * Improved relation type handling for accurate table/foreign/partition classification. * Switched to column-level privilege analysis for visibility. * Improved entity naming shown in lints (includes function argument display). <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> |
||
|
Danny White
|
2349f76e18 |
fix(studio): guard no-op advisor dismissal localStorage updates (#45031)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? Advisor dismissals use `useLocalStorageQuery`. When advisor signals pruning ran, it sometimes invoked `setDismissedKeys` even when nothing needed to change (no-op updater returning the same array reference). Separately, `useLocalStorageQuery` would still persist + `invalidateQueries` even when the computed next value was reference-equal to the current cached value. When `useAdvisorSignals` is mounted in two places at once (`AdvisorSection` + `AdvisorPanel`), those redundant invalidations / subscriber churn could occasionally cascade into React’s “Maximum update depth exceeded” error (often surfaced via Radix `composeRefs` in stack traces). CI saw this as an unhandled error during `AdvisorSignals.integration.test.tsx`. ## What is the new behavior? - `useLocalStorageQuery` now **early-returns** when `Object.is(next, current)` so no-op updates don’t write localStorage or invalidate the query. - `useAdvisorSignals` pruning effect now **short-circuits** unless there is actually a stale banned-IP dismissal to remove. ## Additional context Follow-up from #44372 (advisor signal items for banned IPs). Tests run locally: - `pnpm --filter studio exec vitest run components/ui/AdvisorPanel/useAdvisorSignals.test.tsx components/ui/AdvisorPanel/AdvisorSignals.integration.test.tsx hooks/misc/__tests__/useLocalStorageQuery.test.ts` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced handling of dismissed security alerts by preventing unnecessary state updates for stale dismissals, significantly reducing overhead and improving overall application performance. * Optimized local storage operations to skip redundant writes to storage and prevent triggering unnecessary cache updates and query invalidations when stored data values remain unchanged from the previous operation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
b721a2d780 |
feat(studio): advisor signal items for banned IPs (#44372)
## What kind of change does this PR introduce? Feature. Resolves DEPR-430. ## What is the current behaviour? The homepage Advisor summary, shared Advisor panel, and top-nav Advisor indicator only surface lints and notifications. Banned IPs are not represented as dismissible Advisor items, so network bans are easy to miss unless a user visits Database Settings directly. The `public bucket allows listing` warning is no longer part of this PR. That warning will move to a follow-up Splinter `WARN` lint so it can flow through the standard lint surfaces instead of a bespoke Studio signal path. ## What is the new behaviour? - adds a new Advisor `signal` source for banned IPs on the platform homepage, in the shared Advisor panel, and in the top-nav Advisor indicator - keeps dismissals client-side only for now, scoped by project and exact IP fingerprint - keeps banned IP signals at `warning` severity because they still indicate suspicious traffic and remain actionable if a user wants to review or remove a ban - leaves `/project/[ref]/advisors/security` as follow-up work because that surface is still lint-native, and banned IPs are management-plane signals rather than Splinter lints | After | | --- | | <img width="1728" height="997" alt="Mallet Toolshed Supabase-65A60B4A-107E-4D79-B9A8-23F754BEAB08" src="https://github.com/user-attachments/assets/c08ecbbb-c302-43bd-81bb-6ba7eb18b7b3" /> | ## Reviewer testing notes 1. Use a throwaway project. 2. Get the database connection string for that project. 3. Attempt to connect with the wrong password 3-4 times until you hit an `ECONNREFUSED`-style error, which should mean your IP has been banned. 4. Refresh Studio and confirm the project overview shows the new `Banned IP address` signal. 5. Open the Advisor Center and confirm: - the top-nav Advisor dot turns warning yellow - the signal detail shows `Entity`, `Issue`, and `Resolve` - `Edit network bans`, `Dismiss`, and `Learn more` are present 6. Open Database Settings > Network bans and confirm your banned IP appears there and can be unbanned. 7. Note that `/project/[ref]/advisors/security` will not show this item. That page is still lint-only, and this banned IP work is a short-term client-side signal rather than a true lint. Longer term, we likely want a more durable event model here so banned IPs can power notifications, webhooks, emails, and other project-level alerts. --------- Co-authored-by: kemal <hello@kemal.earth> Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
|
4a0bb36ca8 |
style: require sorted imports in studio/components (#44408)
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Joshen Lim
|
8d811b9837 |
Chore/advisor panel all should not show no project notice (#43169)
## Context Adjust advisor panel to not show "Project required" UI for the "All" panel since messages do not require to be in a specific project <img width="434" height="251" alt="image" src="https://github.com/user-attachments/assets/8a999ca7-1a81-4c63-a6f7-c73cbdd676e3" /> Also adjusts the red dot for advisor center button to show if there's critical notifications |
||
|
Joshen Lim
|
4f26af6259 |
Remove org slug and project ref filter for GET notifications request (#43167)
## Context Since moving notifications to the Advisors Panel, we've been sending `org_slug` and `project_ref` to the GET notifications endpoint, which resulted in certain notifications not being returned such as those that are user specific (no org slug nor project ref) Am opting to remove both slug and ref filters for the notifications as the notifications should be on a user level (irregardless if you're within a project or not) - the Advisor's Panel's button in the layout header would also suggest that notifications in there are not tied to an org or project ## To test This one's a bit tricky to test unless you have notifications on staging, but i've double checked on prod with a curl command that removing the org slug and project ref filters returns the correct notifications |
||
|
Francesco Sansalvadore
|
bd9e78b209 |
chore: dashboard header alignments (#42769)
Align borders to match header heights. <img width="2904" height="1734" alt="shot_2026-02-04_at_08 42 21z_2x" src="https://github.com/user-attachments/assets/0538f8eb-64a5-4329-94fb-3ea4feed847d" /> |
||
|
Joshen Lim
|
3dfb7ace25 |
Fix advisor panel header not scrollable (#41340)
* Fix advisor panel header not scrollable * Smol |
||
|
Ivan Vasilov
|
0d5be306ef |
chore: Bump React Query to v5 (#40174)
* Bump the deps, refactor deprecated code.
* Migrate keepPreviousData usage.
* Migrate all uses of InfiniteQuery.
* Fix refetchInterval in queries.
* Migrate all use of isLoading to isPending in mutations.
* Fix accessing location in claim-project.
* Fix a bug in duplicate query keys.
* Migrate all queries to use isPending.
* Revert "Fix accessing location in claim-project."
This reverts commit
|
||
|
Ali WaseemandPamela Chia
|
25dc1efb9f |
Analytics: Update tracking for Advisor (#40629)
* remove resolved events * Remove advisor_resolved event tracking * updated linting * updated events to be cleaner * refactored types * refactor(telemetry): rename advisor click telemetry to assistant button click --------- Co-authored-by: Pamela Chia <pamelachiamayyee@gmail.com> |
||
|
Saxon FletcherandCopilot
|
986f3464a6 |
Advisor refine (#40293)
* advisor panel title * refactor * use badge for critical * Update apps/studio/components/ui/AdvisorPanel/AdvisorPanel.utils.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * refactor --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> |
||
|
Saxon FletcherandAlaister Young
|
643e544231 |
default filters and state fix (#40232)
* default filters and state fix * add created at * text color * small simplification * always unregister sidebar --------- Co-authored-by: Alaister Young <a@alaisteryoung.com> |
||
|
|
c63d2a92a0 |
Unify Inbox and Advisor (#40026)
* sidebar-manager * storage keys * tests * more ai spots * test fix * revert to default * remove ref * Update apps/studio/state/sidebar-manager-state.tsx Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update apps/studio/components/ui/AIAssistantPanel/AIAssistant.tsx Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix ts * fix * fux * fux query param * clean * fix * more * mock local storage * simplify * remove provider test * remve useopensidebar * fix(new homepage): open ai assistant on advisor card button clicks * Update apps/studio/components/layouts/ProjectLayout/LayoutSidebar/index.tsx Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * Update apps/studio/state/sidebar-manager-state.tsx Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * refine * editor sidebar manager * reset results * advisor sidebar manager * empty state and notice * event tracking * remove variable * remove use effect * open in sidebar * use sidebar old home * Update apps/studio/components/ui/EditorPanel/EditorPanel.tsx Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * connect hotkey * Update apps/studio/components/layouts/AppLayout/AssistantButton.tsx Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * Update apps/studio/state/advisor-state.ts Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * Update apps/studio/state/advisor-state.ts Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * fix * initial prompt * fix(inline editor button): only show keyboard shortcut if hotkey active * cleanup(advisor panel): minor code cleanup * fix(advisor panel): misplaced key on list * fix(advisor panel): add error state * fix(advisor panel): improve a11y * fix(advisor panel): cannot find selected item * fix * fix * tooltip * link * sidebar move up * merge inbox * project/org sidebars * panels * clean * fix use effect * layoutheader export * fix * ts * prettier * tests * remove markdown * remove org and project filters from state * text link * Update apps/studio/state/sidebar-manager-state.tsx Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix * prettier * remove files * bump limit * noop * format * remove notifications on self hosted --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com> Co-authored-by: Alaister Young <alaister@users.noreply.github.com> |
||
|
|
d10001b7a7 |
Advisor sidebar manager (#39889)
* sidebar-manager * storage keys * tests * more ai spots * test fix * revert to default * remove ref * Update apps/studio/state/sidebar-manager-state.tsx Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update apps/studio/components/ui/AIAssistantPanel/AIAssistant.tsx Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix ts * fix * fux * fux query param * clean * fix * more * mock local storage * simplify * remove provider test * remve useopensidebar * fix(new homepage): open ai assistant on advisor card button clicks * Update apps/studio/components/layouts/ProjectLayout/LayoutSidebar/index.tsx Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * Update apps/studio/state/sidebar-manager-state.tsx Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * refine * editor sidebar manager * reset results * advisor sidebar manager * empty state and notice * event tracking * remove variable * remove use effect * open in sidebar * use sidebar old home * Update apps/studio/components/ui/EditorPanel/EditorPanel.tsx Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * connect hotkey * Update apps/studio/components/layouts/AppLayout/AssistantButton.tsx Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * Update apps/studio/state/advisor-state.ts Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * Update apps/studio/state/advisor-state.ts Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> * fix * initial prompt * fix(inline editor button): only show keyboard shortcut if hotkey active * cleanup(advisor panel): minor code cleanup * fix(advisor panel): misplaced key on list * fix(advisor panel): add error state * fix(advisor panel): improve a11y * fix(advisor panel): cannot find selected item * fix * fix * tooltip * link * sidebar move up * LayoutSidebarProvider to only sendEvent if in a project --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
