dima/supabase
1
0 Fork 0
mirror of https://github.com/supabase/supabase.git synced 2026-10-10 03:45:06 +03:00
Code Issues Packages Projects Releases Wiki Activity
37,587 Commits 1,799 Branches 62 Tags
842609fffbcbca542e855a4676fbcd48cb2030db
Commit Graph
4155 Commits
Author SHA1 Message Date
Claude 842609fffb copy(studio): rename 'Trash' to 'Deleted files' in the Storage UI 
Renamed every user-facing occurrence: the Files sub-tab label, the bucket
detail page's link button, the empty state, error subject, and the retention
copy. Internal naming (Trash/ folder, component names, hooks, query keys,
route path) is left as-is — only the displayed text changed.

Also updates the demo script and implementation notes to match.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TiUEvmC84bRsteqsWXHY2p
 2026-07-27 15:52:44 +00:00
Claude c79c915e54 polish(studio): preview pane header, timeline spacing, bucket Trash link 
- Preview pane: when Versions is available, the Details/Versions tabs move
  into the header row alongside the close icon instead of sitting below it;
  added horizontal gap between the tabs.
- Version timeline: more vertical breathing room between entries.
- Bucket detail page: add a Trash button next to Policies/Edit bucket,
  deep-linking to Files > Trash pre-filtered to the viewed bucket.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TiUEvmC84bRsteqsWXHY2p
 2026-07-27 15:13:17 +00:00
Claude d9b8820a96 feat(studio): fold storage retention into Storage Size, add platform restore points 
Usage page: remove the standalone Card-based Storage Size section and fold the
retention breakdown into the existing Storage Size attribute. The chart now
stacks live objects / object versions / snapshots via the standard
UsageBarChart attributes, and the breakdown renders in the right column through
`additionalInfo`, matching every other section's layout and styling.
splitStorageSizeByRetention attributes the reported daily total across the three
segments without changing the total (unit tested).

Database backups: reframe a backup as an environment-wide restore point rather
than a database-only one. A backup restores Postgres — and Auth users plus
Storage metadata with it, since those live in Postgres — but not object bytes,
which is exactly what produces rows referencing files that no longer exist. So:

- Per-row coverage chips across Database / Storage / Config, with the storage
  gap surfaced rather than implied
- A coverage notice naming which buckets aren't protected and linking to the fix
- Restore dialog offers 'into a new preview branch' as the default, since
  branching is a copy-on-write platform primitive: verify a restore point before
  promoting it, instead of destructively restoring over production. In-place
  restore remains available and still uses the existing backup-restore mutation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TiUEvmC84bRsteqsWXHY2p
 2026-07-27 13:56:40 +00:00
Claude c1512f7f7f fix(studio): restore vertical gap in Snapshots and Trash pages 
PageSectionContent is a plain div, so a gap-y-* className has no effect
without flex flex-col — same pattern already used by StorageSettings,
VectorBuckets, and AnalyticsBuckets. Snapshots.tsx and Trash.tsx were missing
the flex flex-col, so the gap between the toolbar and the table/empty-state
was silently not applied.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TiUEvmC84bRsteqsWXHY2p
 2026-07-27 13:09:04 +00:00
Claude a2761e82a6 refactor(studio): Snapshots/Trash as Files sub-tabs + unit inputs 
- Move Snapshots and Trash out of the Storage sidebar (which lists bucket
  *types*: Files/Analytics/Vectors) into tabs under Files, at
  /storage/files/snapshots and /storage/files/trash — they're recovery views
  over file buckets, not a separate bucket type. Tabs added in
  StorageBucketsLayout; sidebar items reverted in StorageMenuV2.
- Use the design-system 'Input with unit' pattern (InputGroup +
  InputGroupAddon/InputGroupText) for the lifecycle day inputs in the bucket
  data-protection section.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TiUEvmC84bRsteqsWXHY2p
 2026-07-27 11:53:05 +00:00
Claude b1184b3a99 feat(studio): Storage Snapshots & Versioning demo (mock data) 
Implements the five Claude Design mockups as real Studio components behind a
single prototype flag (STORAGE_PROTECTION_ENABLED), wired to an in-memory mock
data layer since no platform API exists yet:

- Data protection section in create/edit bucket modals (versioning + snapshots
  toggles + lifecycle policies)
- Snapshots: new bucket-scoped nav page with Pre-backup/Manual triggers, take
  snapshot, and restore-with-diff
- Versions tab in the storage explorer preview pane (restore an older version)
- Storage size retention breakdown on the org usage page (live / versions /
  snapshots, retained-data callout, per-bucket table)
- Trash: new bucket-scoped nav page for soft-deletes with held-by-snapshot state

Adds mock query/mutation hooks under data/storage/protection, Snapshots + Trash
nav items, and new pages/routes (+ TANSTACK_MIGRATION entries).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TiUEvmC84bRsteqsWXHY2p
 2026-07-25 00:37:12 +00:00
Tyler Hillery 74a57861b3 chore(studio): remove region limitation for vector buckets (#48248) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Remove the region limitation on vector buckets

## What is the current behavior?

Currently vector buckets are limited to a subset of Supabase regions

## What is the new behavior?

All supabase regions now have access to vector buckets

## Additional context




<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Vector buckets are now available based solely on platform enablement,
without region-based restrictions.

* **Bug Fixes**
* Removed the region limitation message and related region availability
checks from the Storage Vectors page.
* Updated vector bucket upgrade behavior to reflect platform
availability more consistently.

* **Tests**
* Updated coverage to reflect the simplified platform-based availability
behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-24 07:54:07 -07:00
Danny White 6cff728742 feat(studio): polish Connect sheet mode selector and steps (#48266) 
## What kind of change does this PR introduce?

UI polish for the Connect sheet: clearer mode selection, wider sheet
layout, and step/content chrome across Direct, Server, MCP, and shadcn
flows.

## What is the current behavior?

- Connect modes use a weak selected state and an awkward grid layout.
- The sheet can jump width below the `lg` breakpoint when switching
modes.
- Direct connection chrome is noisy (reset in a footer, Title Case /
mono pooler labels, mismatched copy-button sizes).
- Several steps use admonitions or extra tips that repeat footer
guidance.
- Case-sensitive import of `InlineLink` breaks Linux/Vercel builds.

## What is the new behavior?

### Mode selector and sheet
- Stronger selected/hover treatment; comfortable single row that wraps
via `@container`.
- Empty odd slots use a sunk placeholder cell.
- Sheet uses `size="lg"` with `max-w-4xl` and `w-full min-w-0` so width
stays stable when switching modes.

### Steps chrome
- “Follow these steps” header with a copy-prompt action for coding
agents.
- Optional steps labelled `(optional)`.
- Shared `CodeBlock` for install snippets; MCP feature groups preselect
all except Storage.
- Server / shadcn tips folded into footers; IPv4 add-on admonition is
responsive with an inline Learn more link and a single Enable action.

### Direct connection
- Connection string and connection parameters stay one step (same
credentials, two formats).
- Reset database password lives in the string card title row beside
Shared/Dedicated pooler.
- Card titles use sans + sentence case (`Shared pooler`, `Connection
parameters`); `.env` stays mono.
- Icon-only copy buttons match CodeBlock square sizing; row actions sit
slightly closer to the right edge (`pr-2`).
- Shared pooler toggle copy clarified.

| Before | After |
| --- | --- |
| <img width="390" height="763" alt="API Keys Settings Chisel Toolshed
Supabase"
src="https://github.com/user-attachments/assets/adca3cc5-94f8-47e5-a4a2-2831790f430a"
/> | <img width="390" height="763" alt="API Keys Settings Chisel
Toolshed Supabase"
src="https://github.com/user-attachments/assets/f03afe58-e654-435e-a821-835f6243ca95"
/> |
| <img width="1718" height="1323" alt="API Keys Settings Chisel Toolshed
Supabase"
src="https://github.com/user-attachments/assets/79f08620-7e1e-4246-a70f-801606c0f499"
/> | <img width="1718" height="1323" alt="API Keys Settings Chisel
Toolshed Supabase"
src="https://github.com/user-attachments/assets/fb45e851-955e-46c2-90f1-afecb93d6ac4"
/> |
| <img width="1718" height="1323" alt="API Keys Settings Chisel Toolshed
Supabase"
src="https://github.com/user-attachments/assets/eda36d21-bba7-46ab-ad48-134acf93b471"
/> | <img width="1718" height="1323" alt="API Keys Settings Chisel
Toolshed Supabase"
src="https://github.com/user-attachments/assets/b7b728c6-fc92-46a7-8e3f-2f182c56ece7"
/> |

### Test plan

- [ ] Open **Connect** and confirm mode cells select/hover clearly;
narrow the sheet and confirm wrap + stable width.
- [ ] Direct: switch Direct / Transaction / Session; confirm pooler
title, reset in title row, parameters table, and percent-encode note.
- [ ] Toggle IPv4 shared pooler on Transaction; confirm string updates
and admonition/Learn more behaviour when on IPv4-only paths.
- [ ] Server: `.env` Copy all / row copy sizing; install command copy.
- [ ] MCP / shadcn / Framework: steps still resolve and copy prompt
still builds a useful agent prompt.
- [ ] Spot-check light/dark and a Linux/Vercel build (InlineLink import
casing).
 2026-07-25 00:13:54 +10:00
Danny WhiteandJoshen Lim 69570a357d fix(studio): route vercel deploy-button params to create despite marketplace source (#48258) 
## What kind of change does this PR introduce?

Bug fix for the Vercel Deploy Button → Studio handoff.

## What is the current behavior?

Vercel sometimes opens our install popup with `source=marketplace` while
still sending Deploy Button params (`currentProjectId`, `external-id`).
We trust `source` alone, so users are routed to choose-project (connect)
instead of create — which is why create never gets reached in the Deploy
Button flow.

## What is the new behavior?

- When both Deploy Button signals (`currentProjectId` + `externalId`)
are present, route to create even if Vercel sent `source=marketplace` /
`external`
- Hide Skip (and related empty-state copy) on choose-project when those
signals are present, so Deploy Button users can't continue without
linking

## Additional context

Stacked on #48230.

Test plan:
- [ ] Unit tests for `resolveVercelInstallSource` /
`hasVercelDeployButtonSignals` pass
- [ ] Deploy Button flow with mislabeled `source=marketplace` + both
params → lands on create after org install/continue
- [ ] Genuine marketplace install (no `currentProjectId`/`external-id`)
→ still lands on choose-project with Skip available
- [ ] If choose-project is opened with both Deploy Button params, Skip
is hidden

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Improved Vercel installation handling for Deploy Button workflows,
ensuring the correct setup path is selected.
- Added clearer project-connection guidance when no projects are
available (including conditional skip copy).

- **Bug Fixes**
- Prevented Deploy Button installations from incorrectly offering a skip
option.
- Preserved the skip-and-connect-later guidance for other Vercel
installation flows.
- Improved recognition of Deploy Button installations even when the
reported Vercel source differs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-07-25 00:00:37 +10:00
Crispy 8c092185ae feat: paused project restore window copy and backup downloads (#48279) 
Shows the restore deadline as a date on the paused-project screens, and
offers backup downloads while a paused project is still restorable
(previously only after the restore window ended).

Depends on a backend change — keep as draft until that is live.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Extended the paused-project restore window from 90 days to up to 1
year.
* Added clearer, downloadable options for database backups and storage
objects while a project is paused.
* Paused-project screens now show an “available until” date when
applicable (and updated resume guidance).
* **Documentation**
* Updated platform and troubleshooting guides to reflect the new 1-year
restore window and post-window recovery limitations.
* **Bug Fixes**
* Standardized restore-window wording across the pause confirmation and
paused-state UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-24 19:45:34 +07:00
ChloeGarciaMillerand cea246d195 Fix: improve accessibility for icon buttons (Table Editor menu) (#47639) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix (accessibility improvement)

## What is the current behavior?

Icon-only buttons do not have explicit accessible names for screen
readers or tooltips.

## What is the new behavior?

All icon-only buttons now have explicit accessible names using visually
hidden text (sr-only), ensuring proper screen reader support.

## Additional context

Tooltip text is preserved or added for visual users.
No visual changes were introduced.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Accessibility Improvements**
* Updated table editor action controls with clearer, context-aware
`aria-label`s (e.g., “Add new column”, “More options for …”, “New
table”).
* **UI Refinements**
* Added hover tooltips to key table editor actions, including
add-column, more-options dropdown triggers, and create-new-table button,
improving discoverability and guidance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-24 10:47:14 +02:00
Alaister YoungandAlaister Young a06eb5f26f [FE-3724] feat(studio): add enable cleanup button to cron jobs page (#48200) 
Adds a standalone **Enable cleanup** button to the Cron Jobs page header
so users can schedule the daily `delete-job-run-details` cleanup job
proactively — previously this was only reachable inside the conditional
"table too big" overflow dialog. Addresses
[FE-3724](https://linear.app/supabase/issue/FE-3724/enable-pg-cron-cleanup-job-from-ui-and-api)
(the UI half; the Management API half needs platform-side work).

**Added:**
- `Enable cleanup` button in the cron jobs header (left of Refresh),
hidden while the existence check loads and whenever a
`delete-job-run-details` job already exists
- Confirmation dialog with a retention-period select (defaults to 7
days), live SQL preview, and telemetry
(`cron_job_cleanup_enable_button_clicked` with `origin` +
`retentionInterval`)
- Component tests (MSW) for visibility gating and the schedule/cancel
flows
- E2E regression test for the full schedule → delete → button-reappears
cycle

**Fixed:**
- Name-based `useCronJobQuery` lookup: the `queryFn` dropped the `name`
param, and a not-found job returned `undefined` (rejected by react-query
v5) — now passes `name` through and returns `CronJob | null`
- Cache invalidation gaps: create/delete now invalidate the whole
cron-jobs prefix (list, count, job details), so the footer count updates
after create/delete and the button reappears after the cleanup job is
deleted. The schedule mutation deliberately invalidates only the
existence check + count (see inline comment)
- Pre-existing e2e leak: the cleanup-workflow test left
`delete-job-run-details` scheduled; it now cleans up after itself

## Screenshots

| Header button | Dialog |
| --- | --- |
| <img width="890" height="325" alt="Screenshot 2026-07-22 at 9 44
40 PM"
src="https://github.com/user-attachments/assets/966cd640-d8a6-4c8f-92e7-73151bf4de9c"
/> | <img width="512" height="461" alt="fe3724-dialog"
src="https://github.com/user-attachments/assets/6be1785f-cc7e-4048-a648-9ef260b0949f"
/> |

## To test

- Go to a project's Integrations → Cron → Jobs with pg_cron enabled and
no `delete-job-run-details` job → the `Enable cleanup` button shows next
to Refresh
- Open the dialog, switch retention intervals → the SQL preview updates;
confirm → success toast, the job appears in the grid (`0 12 * * *`), and
the button disappears without a reload
- Delete the `delete-job-run-details` job from the grid → the button
reappears without a reload
- Create then delete any other job → the footer `Total: N jobs` count
updates both ways without a reload
- Regression: with the high-query-cost banner forced (or via the e2e),
the overflow dialog's "Schedule cleanup job" step still shows its
success state — the dialog must not close mid-flow

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Added an **Enable cleanup** action to the Cron Jobs tab header,
including a retention selector and SQL preview.
* Enabling schedules the daily cleanup, shows a success toast, updates
the grid, and hides the enable button; **Cancel** closes the dialog
without scheduling.

* **Bug Fixes**
  * Improved cron job lookup to work by name when needed.
* Refreshed related cron job data more reliably after scheduling and
deletion.

* **Telemetry**
  * Added an event for cleanup enable button clicks.

* **Tests**
* Added component and Playwright coverage for
enable/cancel/schedule/delete and cleanup banner flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-24 16:43:00 +08:00
Joshen Lim 223a10d1bb Add query filter for Database Connections (#48242) 
## Context

Adds a way to filter against the query string in Database Connections
<img width="682" height="161" alt="image"
src="https://github.com/user-attachments/assets/1ba6d678-553a-4a1a-9da9-412532c626df"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added a free-text search filter for database activity sessions.
* Search works alongside existing state, role, and application filters.
  * Filter option counts now reflect the current search results.

* **Bug Fixes**
* Improved filter reset behavior to reliably clear search along with all
other selections.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-24 16:42:57 +08:00
Riccardo BusettiVictor FarazdagiJoshen Lim
 		b2b150fa3c feat(pipelines): Add UI selector for choosing which tables to skip copy of (#47808) 
## Summary

Adds initial-copy scoping to Pipelines in Studio. Users can copy all
existing rows, skip all initial copies, copy only selected publication
tables, or skip selected table copies. All publication tables continue
streaming new changes regardless of the initial-copy policy.

The policy now round-trips through create, edit, validation, and the
generated Management API contract. Initial-copy estimates and
table-restart confirmations use the same scope. Edit requests also
preserve redacted credentials and pipeline settings that Studio does not
own.

This completes the Studio layer of the [ETL API
change](https://github.com/supabase/etl/pull/897) and [Management API
change](https://github.com/supabase/platform/pull/35479).

## Screenshots

### Selector

<img width="1153" height="465" alt="image"
src="https://github.com/user-attachments/assets/bf615e82-ee61-4222-979d-a8695a957e82"
/>

### Select certain tables only

<img width="1153" height="465" alt="image"
src="https://github.com/user-attachments/assets/28adaa24-f239-4d1d-8fb8-fdb1988320cd"
/>

### Confirm copy costs

As the final step before the pipeline is created:

<img width="597" height="619" alt="image"
src="https://github.com/user-attachments/assets/a660bd87-bfb8-41c5-8099-4cdbdef943bf"
/>


### Policy-aware initial-copy estimate

#### Copy no table is selected

<img width="407" height="464" alt="image"
src="https://github.com/user-attachments/assets/99d859ec-2ec3-452a-ab69-11924a8db260"
/>

#### Some tables are selected

<img width="407" height="464" alt="image"
src="https://github.com/user-attachments/assets/e68aedf4-66bc-4372-98ef-0dd7fecef324"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added configurable “initial table copy” policies (copy/skip all and
copy/skip selected) during replication setup, including table-picker
behavior, pruning of stale selections, and updated restart/cost
estimates.
- **Bug Fixes**
- Improved restart flows to consistently use `schema.table` identity and
simplified “errored tables” targeting to match error-state tables.
- Reduced unnecessary loading by gating publication/table fetches to
when panels are visible; improved validation/toast handling when
publication tables are unavailable.
- **Tests**
- Added/expanded coverage for destination form submission, table-copy
selection, restart/cost dialogs, and copy-estimate summarization.
- **Style**
- Refreshed warning/label text for clearer configuration and
confirmation messaging.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Victor Farazdagi <simple.square@gmail.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-07-24 10:29:46 +03:00
Andrew ValleteauandClaude Fable 5 6c6a721cb7 fix(pg-meta): scope remaining O(catalog) introspection queries behind pgMetaScopedIntrospection (#48148) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix (performance), follow-up to #47894, plus regression-guard tests.

## What is the current behavior?

#47894 scoped the Table Editor and entity-definition introspection
queries, but four more `@supabase/pg-meta` query families still do
O(catalog) work per request. On a production project with a very large
catalog (hundreds of schemas, ~465K `pg_constraint` rows) they run 5 to
55 seconds each, trip the 58s `statement_timeout`, and spill sorts to
temp files. During a recent "DB CPU > 85%" incident on such a project,
24 of 27 active backends were running these queries concurrently.

1. **`tables.retrieve()` (single-table lookup by name+schema or id)**:
the `tables`/`columns` CTEs scan the whole catalog (`pg_class`,
`pg_constraint`, `pg_index`, all of `pg_attribute`, per-table sizes) and
the one-table predicate is applied only on the outer select. Same bug
class #47894 fixed for the OID-based table editor query; this sibling
path never got the treatment. It accounted for 94 of the 96
statement-timeout cancellations in the incident.
2. **Types listing**: the `t_enums` and `t_attributes` subqueries
aggregate the entire `pg_enum` and every composite relation before the
wrapper's schema filter applies.
3. **Table privileges**: `aclexplode` + double `pg_roles` join + GROUP
BY over every relation in the database; schema/OID filters applied only
after aggregation, in both `list()` and `retrieve()`.
4. **Row counts**: `getTableRowsCountSql` treats `reltuples = -1`
(never-analyzed table) as "small table, run exact count(*)". A freshly
bulk-loaded multi-million-row table times out on every Table Editor
pagination render.

Two Studio-side amplifiers turned one slow query into a sustained load
storm:

- `useTableQuery` (behind `tables.retrieve()`) mounts once per visible
foreign-key grid cell via `ForeignKeyFormatter`, so a single Table
Editor view fires ~20 concurrent copies against the FK target table. A
timed-out query caches nothing, and TanStack retries errored no-data
queries on every observer mount by default, so scrolling kept re-issuing
the 58s scan.
- `useTableApiAccessQuery` fetched table privileges for the entire
database and filtered down to one schema client-side.

## What is the new behavior?

**pg-meta (all behind the existing `pgMetaScopedIntrospection` flag,
same rollout mechanism as #47894; `scoped: false` keeps serving the
current SQL):**

- `tables.retrieve()`: the identifier is resolved to a scalar
`targetOid` init-plan and pushed into the base scan, primary-key,
relationships (both FK directions kept: `conrelid` or `confrelid`) and
columns CTEs. A materialized `target` CTE was deliberately avoided: it
acts as an optimization barrier and forces the very seq scans being
removed.
- Types: filter `pg_type`/`pg_namespace` first, then compute
enums/attributes per surviving row via correlated index-scan subqueries
(`pg_enum(enumtypid, enumsortorder)`, `pg_attribute(attrelid, attnum)`).
- Table privileges: schema/OID predicates injected into the base WHERE
before `aclexplode`/GROUP BY for `list()` and `retrieve()`.
- Row counts: `reltuples = -1` is treated as "unknown" and gated on
physical size via `pg_relation_size` (a cheap stat call; `relpages` is
equally stale pre-vacuum). At or below `THRESHOLD_ESTIMATE_BYTES`
(~10MB, derived from `THRESHOLD_COUNT` at a conservative ~200 bytes/row)
the exact count runs as before: fast by construction, and it avoids
bogus estimates since Postgres floors never-vacuumed heaps at 10 pages,
so an empty table would otherwise report ~2K estimated rows. Above the
gate the count routes through the EXPLAIN-based
`pg_temp.count_estimate`, or returns `-1`/`is_estimate = true` in
read-only contexts where the temp function cannot be created. The scoped
branch embeds the estimated select via `literal()` instead of legacy's
apostrophe-only escaping, so it stays correct under
`standard_conforming_strings = off`. `enforceExactCount` unchanged.

**Studio:**

- The flag decision is contained in the data layer instead of
prop-drilled: a small imperative accessor
(`apps/studio/data/scoped-introspection.ts`) is hydrated from `useFlag`
via a one-line `useSyncScopedIntrospection()` call in `DefaultLayout`,
and the query functions read it internally when building the pg-meta
SQL. `DefaultLayout` is shared by both the Next and TanStack router
trees; hydrating from `_app.tsx` alone would leave TanStack-served pages
permanently unscoped since `routes/__root.tsx` mounts its own flag
provider. Cold loads cannot race the flag: the query functions await a
readiness promise that resolves only after the sync hook has hydrated
the accessor with a loaded flag store (immediately on self-hosted where
flags are disabled; a 5s safety net armed lazily on the first `ready()`
call - not at module import, which would let the timer expire before a
project page ever mounts - bounds genuine ConfigCat outages). No
component threading, no query-key changes (remaining tradeoff,
documented in the module: a mid-session flag flip can serve stale-keyed
caches until refetch, fine for a session-stable rollout flag). #47894's
existing threading is left as-is and gets deleted together with the flag
in the cleanup PR. Also fixes the previously-missing `scoped`
pass-through in `getTableRowsCount`.
- Flag-independent hardening: `useTableQuery` now sets `retryOnMount:
false`, `refetchOnWindowFocus: false` and `staleTime: 5min`. Errored
(timed-out) queries no longer refire on every grid cell remount, while
stale successful metadata still revalidates on mount after `staleTime`.
- `useTableApiAccessQuery` now passes `includedSchemas: [schemaName]`;
the client-side filter stays as a safety net.
- The rows-count query is `enabled`-gated on the permission check
settling, so a transiently-false `canSQLAdminWrite` can no longer cache
a read-only `-1` count for a writable user (read replicas short-circuit
synchronously as before).

**Regression guards (extending the #47894 infrastructure):**

- Execution-based scoped-vs-legacy equivalence tests for all four
queries: both variants run against the test database and are compared
with raw `toEqual` - no normalization, ids included (types across 6
option combos, privileges incl. multi-grantee + PUBLIC,
`tables.retrieve` for both identifier branches, row counts for every
case where the two paths must agree). Two documented exceptions where
only the LEGACY side is sorted, because a de-normalized diagnostic run
proved legacy emits genuinely plan-dependent order there (an
adversarial-FK fixture shows it is neither oid, name, nor creation
order): the `types.list` outer row order (scoped adds `order by t.oid`;
legacy has no ORDER BY) and the `tables.retrieve` relationships array
(scoped orders by `constraint_name` + column-name tie-breakers - a
composite two-column FK expands to 4 entries sharing one
constraint_name). Everything else (privileges via `aclexplode` over the
same relacl, columns by `ordinal_position`, primary keys by `indkey`
order, enums by `enumsortorder`) is byte-identical between the two paths
with no test-side help. The one intentional value divergence,
never-analyzed tables above the size gate where legacy's exact count is
the timeout bug itself, is asserted explicitly as a divergence.
- Plan-guard budgets for every scoped query against the stress catalog
(extended with 200 enums + 200 composite types). Residual seq scans are
justified in-budget: `pg_constraint` max 2 (no index on `confrelid`),
`pg_attrdef` max 1, `pg_authid` max 2 (scales with role count, not
schema count).
- Legacy templates carry a FROZEN do-not-edit marker (they must keep
matching production behavior until the flag cleanup deletes them); the
ordinary test suite runs against the legacy default, so behavioral drift
there fails regular tests.

### Validation

- pg-meta: typecheck clean; the affected suites (types,
table-privileges, tables, rows-count, catalog-plan-guard) pass in full.
- Cross-version: the scoped-vs-legacy equivalence and rows-count
behavioral suites were validated on PostgreSQL 14, 15, and 17 (identical
results on all three). Two version-marginal planner choices surfaced on
17 (`pg_type` / `pg_class` seq scan vs full-index bitmap for per-schema
listings, both structurally unavoidable without an index leading on the
namespace column) and are carried as justified plan-guard budget
entries. A full 468-test suite run sequentially: 452 passed, 16 failures
verified environmental (13 timeouts in an untouched file that passes
27/27 in isolation on the marathon-run cluster, 3 cluster-global role
collisions from container reuse).
- Studio: `pnpm --filter studio typecheck` clean; 39/39 tests across the
touched data hooks; eslint clean on touched files.

### Rollout

Same staged ConfigCat rollout as #47894 via `pgMetaScopedIntrospection`
(user-email targeting first, then percentage, then 100%). The
`useTableQuery` hardening and the API-access schema scoping ship
unflagged (behavior-safe). Gate before percentage rollout: functionally
verify the FK popover/selector UX under the new
`staleTime`/`retryOnMount` settings (a just-edited FK target must not
look stale anywhere Studio does not already refetch on save). Once fully
rolled out, the legacy templates and flag get deleted together with
#47894's in one cleanup PR.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-07-24 08:07:08 +02:00
Joshen LimandDanny White 7f42765070 Joshen/fe 3983 no way to create a new project in vercel integration when (#48230) 
## Context

For the Vercel integration flow (e.g "Deploy with Vercel" button on GH)
If an organization has no projects, there currently isn't a way to
create a project and connect it in the same session - users can only hit
"Skip".

This addresses that by directing users to the /deploy-button/new-project
route in this scenario

<img width="505" height="539" alt="image"
src="https://github.com/user-attachments/assets/6cc85030-42c7-4e58-b4b3-cb8ac0f5da9e"
/>

## Other changes involved
- Also separates `ProjectLinker` into smaller components - preference
for avoiding declaration of components within a component

## To test

I'm not sure if this can be tested on staging to be honest, but
otherwise we can give it a go on production after the changes are
through, as this doesn't change any existing logic to the usual "Connect
project" flow

I did try clicking the "Deploy with Vercel" button on a repo, and just
changing the URL to the staging URL at the Supabase step - seems to work

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary

* **UI Improvements**
* Streamlined the Vercel/GitHub project-linking step while keeping the
same create/connect/skip flow, including the searchable project picker,
branding/status indicators, and the feature-flagged “create new project”
option.
* On the Vercel choose-project step, the default selection now reflects
the current project context.

* **Bug Fixes / Tests**
* Improved Vercel install routing query handling to preserve
deploy-button configuration when present, with updated automated test
coverage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
 2026-07-24 11:22:57 +08:00
Ali Waseem 7781ee0d04 fix(studio): correct realtime settings UI limits to match backend (#48253) 
Realtime settings validation in Studio didn't match the backend's actual
limits:
- \`max_presence_events_per_second\` allowed up to 10000 (backend caps
at 5000),
- \`max_payload_size_in_kb\` allowed up to 3000 (backend caps at 10000)
- \`max_events_per_second\` allowed up to 10000 (backend caps at 50000).

Updated the Zod schema limits in both branches of the form's
discriminated union to match.

Fixes FE-3991

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Increased the allowed limits for realtime event throughput, presence
events, and payload size settings.
* Administrators can now configure higher-capacity realtime workloads,
including payloads up to 10,000 KB.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 14:33:02 +00:00
Ali Waseem e6ad56101f fix: MFA list Added on value uses last_challenged_at instead of created_at (#48252) 
Fixes FE-3985. `TOTPFactors` was displaying `updated_at` (which mirrors
`last_challenged_at`) for "Added on" instead of `created_at`.
 2026-07-23 14:23:36 +00:00
Ivan Vasilov 8108528682 Fix: Update the auth user field in the Logs page (#48237) 
- Fix the user filter to work with `edge_logs`. 
- Update the `auth_user` field to be derived from other log attributes.
- Removed filtering for `postgres_logs` since it didn't really filter by
user actions, only by user id mentions.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Bug Fixes**
- Improved unified logs user filtering to rely only on exact attribution
identifiers from authentication and edge log sources, removing partial
message-based matching.
- Updated unified logs user identification by deriving `auth_user` from
authentication actor IDs or edge JWT subject values.
- Refined “user filter reachability” logic to consider only attributable
log types (auth and edge).
- **Tests**
- Adjusted unified logs query tests to match the updated attribution
routing and reachability outcomes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 12:48:33 +02:00
Gildas Garcia efc0ad3fce fix: fix migration dialog does not show the correct content in some edge cases (#48239) 
## Problem

When two projects have migrations with the same version but different
content, the details panel does not update the content and shows the
first loaded migration one.

## Solution

This is because the CodeEditor does not react to content only changes.
Settings its `key` ensures it does.
Unfortunately, we can't unit test that the CodeEditor content changes
correctly.

## How to test

- create two projects and push a migration with the same version but
different content on them
- open the _Database/Migrations_ page for the first project
- click the _View migration SQL_ and ensure its content matches the
migration for this project
- select the other project using the top bar
- click the _View migration SQL_ and ensure its content matches the
migration for this project

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved migration SQL display when switching between migrations or
projects.
* Ensured the code editor consistently refreshes with the currently
selected migration’s statements.
  * Improved type safety for the migration search input.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 12:38:10 +02:00
Francesco Sansalvadore d900c09e8a chore(studio): grafana-cloud slug (#48238) 
Use `grafana-cloud` slug for the partner integration.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added Grafana Cloud to the featured integrations in the marketplace.
* Added light and dark themed artwork for the Grafana Cloud featured
integration.
* **Improvements**
* Updated the OAuth “installed” detection to include Grafana Cloud
alongside Grafana.
* Included Grafana Cloud in the set of official partners for the
partner-only filter.
* **Tests**
* Expanded marketplace integration fixtures to cover Grafana Cloud
scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 09:43:22 +00:00
Alaister YoungandAlaister Young fbf7ce44ef [FE-3544] fix(studio): role impersonation for truncated cell loads (#48215) 
Loading a truncated cell's full value from the inline grid editors or
the row side-panel editors called `getCellValue` without
`roleImpersonationState`, so the fetch ran with full DB privileges
instead of the role selected in **View as role** — leaking values RLS
would deny. Same class of bug #46442 fixed for row copy/export; the
mutation already accepted the state, these call sites just weren't
passing it.

**Changed:**

- Pass `roleImpersonationState` into `getCellValue` in all 4
truncated-cell loaders (inline grid Text/Json editors + row side-panel
Text/Json editors), mirroring the existing `Header.tsx` pattern

**Added:**

- MSW component test on the row side-panel `TextEditor` asserting the
cell-value SQL is wrapped with `set local role` when impersonation is
active, and not wrapped when it isn't

## To test

Note: if the impersonated role can't select the row at all (e.g. force
RLS with no policy), the main grid correctly shows 0 rows under **View
as role**, so the "Load full value" button is never reachable — you
can't exercise this path that way. Use a row the role *can* see and
verify the request is role-wrapped:

- Create a table with a text value long enough to be truncated in the
grid (>16KB), with RLS enabled and an anon-visible row:
  ```sql
  create table public.secrets (id int primary key, secret text);
  alter table public.secrets enable row level security;
  alter table public.secrets force row level security;
create policy "anon can read" on public.secrets for select to anon using
(true);
  insert into public.secrets values (1, repeat('a', 20000));
  ```
- In the Table Editor, set **View as role → anon** — the row should be
visible with the `secret` cell truncated
- With the network tab open, load the full value via each path:
double-click the cell (inline editor) and the row side panel's expand
editor → "Load full text data" (a `jsonb` column exercises the two JSON
editor paths the same way)
- The `pg-meta` query request body should start with `set_config('role',
'anon', true)` + anon JWT claims before the `select secret …`. Before
this fix it was a bare unwrapped `select secret from public.secrets
where id = 1;`
- Drop the policy and confirm the grid shows 0 records under anon
(denial still applies at the grid level); switch back to the default
role and confirm the full value still loads normally with no wrapper

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-23 16:46:51 +08:00
Joshen Lim 63e2eb3ca6 Joshen/fe 3971 blocked by visualization (#48187) 
## Context

Improving the "blocked by" visualisation for database connections - to
accommodate the situation whereby there might be a chain of blocked
process. Intention is so that users can identify whats the root process
that's blocking everything - and from there decide if they want to
terminate the process or not.

Also brings `ActivityRow` out into its separate file since `Activity` is
getting big

<img width="473" height="299" alt="image"
src="https://github.com/user-attachments/assets/21d0d223-5dbd-49d5-877c-815c78cb7482"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Streamlined the database activity view by separating the single-row
rendering into its own component, keeping the same end-user experience
(status badge, query/“No query”, duration warnings, blocking details,
PID copy, and actions).
* Kept “Terminate” behind confirmation prompts and preserved role-based
restrictions for when termination is available.
* **Improvements**
* Standardized how activity durations are calculated and how status
badges are styled for consistent display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 15:19:54 +08:00
Danny White 3bca21b3f8 chore(a11y): convert leftover focus recipes to focus-ring (#48219) 
## What kind of change does this PR introduce?

Accessibility cleanup (DEPR-628).

## What is the current behavior?

Leftover call sites still use ad-hoc focus recipes
(`ring-foreground-muted`, `outline-brand`, Dialog/Sheet `focus:` rings,
etc.) instead of the shared utilities from #41575.

## What is the new behavior?

Converts those leftovers across `packages/ui`, Studio, www, docs, and
design-system to `focus-ring`, preferring `focus-visible`. Keeps
documented exceptions (`group-focus-visible`, InputGroup `:has()`).

## To test

Tab through controls (keyboard only). Expect a consistent offset ring on
`:focus-visible`, not a green/brand/custom stack, and no ring animation.

### www (marketing)

Preview:
https://zone-www-dot-com-git-danny-depr-628-focus-ring-fbccf9-supabase.vercel.app

- Global nav on `/`: Product, Developers, Solutions dropdowns; logo;
hamburger + mobile menu
- `/features`: view toggles and feature cards
- `/company`: card links
- `/changelog`: timeline / entry links
- `/partners/catalog`: grid/list toggle and partner cards
- `/pricing`: compute section expand control
- Product / Modules / Solutions sticky navs on product pages (e.g.
`/database`, `/storage`)
- `/state-of-startups`: TwoOptionToggle if present

### docs

Preview:
https://docs-git-danny-depr-628-focus-ring-long-tail-supabase.vercel.app

- Any guide page: top nav dropdowns and items
- Narrow viewport: hamburger, then mobile menu links + close
- Guide with PromptPanel / tabs: tab to prompt actions and tab list

### studio (dashboard)

Preview:
https://studio-staging-git-danny-depr-628-focus-ring-long-tail-supabase.vercel.app

- Project home: Connect section tiles; drag-handle focus on sortable
sections
- Integrations marketplace (`/project/<ref>/integrations`): featured
cards, list/grid toggle, list rows
- Auth (`/project/<ref>/auth/oauth-apps`,
`/project/<ref>/auth/providers`): open create/edit sheet, tab to close
(X)
- Database policies (`/project/<ref>/database/policies`): open policy
editor sheet, tab to close
- Storage policies (`/project/<ref>/storage/files/policies`): bucket
section links; policy modal close
- Query performance (`/project/<ref>/observability/query-performance`):
info icon buttons on metrics
- Replication pipeline detail (if available): slot lag / status info
icons
- Support (`/support/new`): attachment add/remove controls
- Table editor: spreadsheet import preview checkboxes; row text/JSON
editor TwoOptionToggle
- Any Dialog/Sheet/toast close (X): ring on keyboard focus only, not
mouse click

### design-system

Preview:
https://design-system-git-danny-depr-628-focus-ring-long-tail-supabase.vercel.app

- Colour palette swatches (keyboard focus)
- Form patterns sidepanel example: avatar / focusable control in the
example

## Additional context

- Linear: [DEPR-628](https://linear.app/supabase/issue/DEPR-628)
- Follow-ups: form-group CSS (DEPR-629), Storage columns selection
(DEPR-630), ESLint rule (DEPR-632)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Accessibility & Usability**
* Standardized keyboard focus indicators across navigation, dialogs,
forms, buttons, toggles, links, and tooltips using a consolidated focus
style.
* Improved toggle controls to use proper button semantics (instead of
clickable text), including `aria-pressed`/disabled handling and better
keyboard navigation.

* **Visual Updates**
* Harmonized hover/focus ring visuals across the design system, Studio,
documentation, and marketing pages while preserving existing layout and
interaction behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 08:52:22 +10:00
Charis 0bef8e7d90 test(sql-editor): e2e coverage + delete jsdom test + merge Results.utils tests (Steps 5-6) (#48217) 
## Summary

Steps 5 and 6 of the SQL editor test refactor plan (the final two
steps).

**Step 5** — extends `e2e/studio/features/sql-editor.spec.ts` (real
browser, zero mocks) with cases that need the real Monaco editor / full
app render:
- destructive-query warning modal: confirm actually re-runs the forced
query (previously only `Cancel` was exercised)
- debug button opens the AI Assistant with the query error pre-filled

Deletes `apps/studio/tests/components/SQLEditor/SQLEditor.test.tsx` —
its logic-level cases are now covered mock-free by the Step 4 hook
tests, and its integration cases by e2e. Deleting rather than narrowing
is the honest consequence of "no mocking": every remaining assertion it
could make in jsdom requires a Monaco mock.

**Step 6** — merges
`apps/studio/tests/components/SQLEditor/Results.utils.test.ts`
(`formatClipboardValue`/`formatCellValue`) into the colocated
`apps/studio/components/interfaces/SQLEditor/UtilityPanel/Results.utils.test.ts`
(`formatResults`/`convertResultsToMarkdown`/`convertResultsToJSON`/`getResultsHeaders`/`isLargeValue`/`convertResultsToCSV`)
— both tested disjoint exports of the same source file. Deletes the
`tests/` copy.

This is the last step in the plan.

## Test plan

- [x] `pnpm --filter studio typecheck` — no new errors in changed files
- [x] `npx prettier --check` on all changed files
- [x] Ran the new/changed e2e cases locally end-to-end against a live
local stack — both pass
- [x] `cd apps/studio && npx vitest run
components/interfaces/SQLEditor/UtilityPanel/Results.utils.test.ts` —
42/42 passing after the merge

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Tests**
* Added end-to-end coverage for destructive SQL query warning modal flow
before forced execution.
* Added end-to-end coverage for the AI Assistant debug flow when SQL
execution fails.
* Expanded unit test coverage for SQL editor results formatting
utilities (clipboard and cell value formatting).
* Removed the prior SQLEditor unit test suite and the older
results-formatting unit tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 16:55:17 -04:00
Francesco Sansalvadore e4f75bf74c chore(studio): update copywriting on integrations pages (#48197) 2026-07-22 22:22:54 +02:00
Kanishk Dudeja ec260a594d docs(billing): clarify top-ups do not apply to outstanding invoices (#48220) 
### Summary

This PR clarifies that credit top-ups apply only to future invoices and
cannot be used to pay or adjust outstanding invoices.

It updates the Credits FAQ, Billing FAQ, and credit top-up modal with
consistent wording.

### Testing

#### Credits FAQ


https://docs-git-kanishk-billing-2726-update-billing-fa-bd77f2-supabase.vercel.app/docs/guides/platform/credits#credit-faq

#### Billing FAQ


https://docs-git-kanishk-billing-2726-update-billing-fa-bd77f2-supabase.vercel.app/docs/guides/platform/billing-faq#payments-and-billing-cycle

#### Credit Top Up Modal

<img width="544" height="473" alt="Screenshot 2026-07-23 at 1 17 30 AM"
src="https://github.com/user-attachments/assets/5d016398-7b46-455d-8bf1-a5767d10bc48"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Added FAQ guidance explaining that credit top-ups apply only to future
invoices and cannot pay or adjust outstanding invoices.
* **Billing Updates**
* Clarified that credits are granted based on the pre-tax payment
amount.
  * Confirmed that credits are non-refundable and do not expire.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 01:33:36 +05:30
Danny White 6f6badae51 fix(eslint): promote require-explicit-tabindex to error (#48170) 
## What kind of change does this PR introduce?

Accessibility / lint hardening (Safari keyboard focus).

## What is the current behavior?

`supabase/require-explicit-tabindex` is `'warn'`. Studio’s ratchet was
at 0 but the rule was still ratcheted; www / docs / design-system still
had raw `<button>` / `role="button"` call sites without an explicit
`tabIndex`.

[DEPR-627](https://linear.app/supabase/issue/DEPR-627) · follow-up to
#47984 / #48040

## What is the new behavior?

- Shared config: `'supabase/require-explicit-tabindex': 'error'`
- Swept www / docs / design-system (+ Studio test fixtures the ratchet
skipped)
- Removed the rule from the Studio ratchet + baselines

## To test

Prefer **Safari**. This PR only adds explicit `tabIndex` to raw
`<button>` / `role="button"` call sites — not links, and not controls
that already go through `Button` from `ui`.

### Marketing (`www`) ([staging
link](https://zone-www-dot-com-git-danny-depr-627-promote-req-7ae43c-supabase.vercel.app/))

- [x] Homepage frameworks / dashboard feature tabs — Tab through each
tab button
- [x] Product pages (e.g. `/auth`, `/database`) — section tab switchers
- [x] Narrow viewport — open the hamburger; Tab through menu buttons
- [x] `/partners/catalog` — filter / view controls
- [x] Blog view toggle (list ↔ grid)

### Docs ([staging
link](https://docs-git-danny-depr-627-promote-require-explici-25e46d-supabase.vercel.app/))

- [x] **Desktop (≥ lg):** top-right **⋯ menu** (hamburger icon) — opens
a dropdown that includes Theme. Not a separate theme button.
- [x] **Mobile (< lg):** top-right **hamburger** opens the sheet; close
(X) is the raw button we tagged. Theme inside the sheet uses
`ThemeToggle` / `DropdownMenuTrigger` from `ui` (already supposed to set
`tabIndex`).
- [x] **Code blocks** — copy / language controls
- [x] **Is this helpful?** — X / check are `Button` from `ui` (should
already Tab). After voting **while signed in**, the follow-up “What went
well?” / “How can we improve?” text button is the raw one we tagged.
- [x] **AI Tools → Copy as Markdown** (right rail on a guide) — this is
the only GuidesSidebar control this PR changed. “On this page” TOC items
are **links**, not covered by this lint.
- [x] **Reference docs** (e.g. JS client reference) — section headers
that expand/collapse in the left nav (`Collapsible.Trigger`)
- [x] **Troubleshooting index** — type in the search field, then Tab to
the **clear (X)** control

### Dashboard (`studio`)

No production UI changes in this PR (tests + lint config only). Quick
Safari smoke that prior tabindex work still holds:

- [x] Project sidebar — Tab through primary nav links
- [x] Settings → General — Tab through inputs / buttons
- [x] Storage → Files — Tab a bucket row / file actions
 2026-07-23 05:21:15 +10:00
Charis 08c4f64c42 test(sql-editor): add mock-free hook tests (Step 4) (#48214) 
## What

Step 4 of the SQL editor testability plan: **mock-free hook tests** for
the extracted SQL editor hooks, built on the Step 3 renderHook harness
(`tests/lib/sql-editor-test-utils.tsx`) — in-memory editor port + real
valtio stores + MSW. **Zero `vi.mock`.**

| File | Tests | Covers |
|------|-------|--------|
| `useSqlEditorExecution.test.tsx` | 8 | destructive-query gating
(`potentialIssues` vs. forced run), auto-limit suffixing,
connection-string → `x-connection-encrypted` header,
`onSuccess`/`onError` session-store writes, error-line highlight,
diff-open short-circuit |
| `useSqlEditorAi.test.tsx` | 7 | one-shot diff-request drain (empty vs.
non-empty editor), drain-exactly-once across remounts, accept/discard
diff, `onDebug` opening the assistant chat + debug prompt |
| `usePrettifyQuery.test.tsx` | 2 | in-place format + write-back,
diff-open no-op |
| `useSnippetIdentity.test.tsx` | 2 | generated identity + store-driven
loading state |
| `useSnippetTitleGenerator.test.tsx` | 2 | untitled-snippet naming via
the title endpoint |

Every test exercises real dependencies at the seam where they're real:
network via MSW, stores used real and reset per test, Monaco via the
in-memory editor port.

## Test plan

- [x] `pnpm test:studio -- SQLEditor` → **286/286 passing** (21 new
tests included)
- [x] `pnpm --filter studio typecheck` clean
- [x] Confirmed zero `vi.mock` in the new files


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Added comprehensive automated coverage for SQL query formatting,
snippet identity, and AI-generated titles.
* Added coverage for AI-assisted SQL editing, including diff acceptance,
rejection, debugging, and request handling.
* Added coverage for query execution, result persistence, safety checks,
replica selection, error highlighting, and diff-state behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 14:53:46 -04:00
Ali Waseem 6d7c3361dc fix(studio): hide support access toggle when no project is selected (#48206) 
## Summary
Support access is granted per-project, but the "Allow support access"
toggle stayed visible and submittable even when "No specific project"
was selected. This hides the toggle and forces
`allowSupportAccess`/`allow_support_access` to `false` in that case,
across the standalone support form, sidebar form, and link-ticket form.

Addresses
[FE-3979](https://linear.app/supabase/issue/FE-3979/support-form-allows-support-access-without-a-project-selected).

## Test plan
- [x] Added/updated unit tests in `SupportFormPage.test.tsx` covering
toggle visibility and submitted payload when no project is selected
- [x] `pnpm vitest run components/interfaces/Support` passes (48 tests)
- [x] Typecheck and lint pass on changed files

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Support access is now offered only when a valid project and eligible
support category are selected.
* Support access is automatically disabled when no specific project is
selected.
* Form submissions now prevent unsupported support-access requests from
being enabled.
* **Tests**
* Added coverage for project clearing and scenarios without available
projects or organizations.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 11:49:03 -06:00
Charis 4d793a708e test(sql-editor): shared renderHook harness with in-memory editor port (#48209) 
## Summary

- Add `renderSqlEditorHook()` test harness that eliminates mocking
Monaco by injecting a real, deterministic in-memory editor port
(EditorController/DiffController backed by plain JS state)
- Include `createInMemoryEditor()`, `resetSqlEditorStores()`, and
`setupSqlEditorMocks()` utilities to provide isolation and mock-free
network testing via MSW handlers
- Export `CustomWrapper` from custom-render and add optional
`editor`/`diff` injection points to SQLEditorProvider (production
unaffected via null-coalesce fallback)

This is **Step 3** of an in-progress SQL editor testability refactor
(Step 2 finished EditorController/DiffController port; this harness has
no consumers yet — hook tests land in a follow-up step).

## Test plan

- [x] `pnpm --filter studio typecheck` passes (already verified)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Added reusable SQL Editor test utilities for in-memory editing,
selections, error highlighting, snippets, and diff content.
* Added helpers for resetting editor state, configuring API mocks, and
rendering SQL Editor hooks in a complete test environment.
* Enabled SQL Editor providers to accept optional controller overrides
for isolated testing.
  * Exported the shared test wrapper for reuse across test suites.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 13:32:55 -04:00
Danny WhiteandJoshen Lim e19cd1863d feat(studio): connect logo contract for authorize (#48161) 
## What kind of change does this PR introduce?

Feature + docs. Closes
[DEPR-604](https://linear.app/supabase/issue/DEPR-604/define-connect-logo-asset-and-variant-contract).

## What is the current behavior?

`/authorize` logo resolution trusted self-asserted requester `name` (and
similar) for curated MCP marks, fell back to a letter tile when there
was no usable icon, and always used theme-reactive tile chrome. This
includes the scenario when pairing against unclassified uploaded OAuth
app bitmaps.

## What is the new behavior?

- [Documents the Connect logo asset/variant
contract](https://design-system-git-danny-depr-604-connect-logo-contract-supabase.vercel.app/design-system/docs/ui-patterns/connect-interstitials#logos)
(default to light, keep pairs matched, no theme-recolour of vendor
SVGs).
- Resolves curated partner logos from allowlisted `redirect_uri` hosts
only (`claude.ai` / `anthropic.com`, `cursor.com` / `cursor.sh`,
`chatgpt.com` / `openai.com`, `perplexity.ai`).
- Unknown / missing / failed requester icons show `SupabaseLogo` alone
(no letter tile).
- Uploaded organisation OAuth app icons (unclassified bitmaps) pair with
fixed light tile chrome (`border-black/10 bg-white` / `SupabaseLogo
forceLight`) on both sides across Studio themes.
- Curated partners keep theme-reactive tiles and may use dark assets
when available.

### To test

Real MCP clients (Claude, Cursor, etc.) only send users to
**production** `/authorize`, so you cannot drive a local or preview
Studio build from those tools. Use a Network override instead:

1. Start Studio and sign in (`pnpm dev:studio`, or use the Vercel
preview once available).
2. Open `/dashboard/authorize?auth_id=foo` (any `auth_id` is fine — the
real response may 404).
3. DevTools → **Network** → find `GET
…/platform/oauth/authorizations/foo` (or whatever id you used).
4. Right-click → **Override content** (enable Local Overrides / pick a
folder if prompted).
5. Paste one of the payloads below (status **200**), save, then reload
the authorize page.
6. Keep `expires_at` in the future so the request does not look expired.

The fields that matter for this PR are `name`, `icon`, and
`redirect_uri`.

#### Curated pair (allowlisted redirect)

Expect Cursor mark + Supabase pair. Toggle light/dark: curated dark
assets may swap; tiles stay theme-reactive (`bg-surface-75`).

```json
{
  "name": "Cursor",
  "website": "https://cursor.com",
  "icon": null,
  "domain": "cursor.com",
  "redirect_uri": "https://cursor.com/callback",
  "expires_at": "2099-01-01T00:00:00.000Z",
  "scopes": ["organizations:read", "projects:read"],
  "approved_at": null,
  "registration_type": "dynamic"
}
```

#### Unknown → Supabase alone

Expect Supabase bolt alone. No letter tile. No curated mark even if
`name` says Claude.

```json
{
  "name": "Acme",
  "website": "https://acme.example",
  "icon": null,
  "domain": "acme.example",
  "redirect_uri": "https://acme.example/callback",
  "expires_at": "2099-01-01T00:00:00.000Z",
  "scopes": ["organizations:read", "projects:read"],
  "approved_at": null,
  "registration_type": "dynamic"
}
```

#### Spoofed trusted name, non-allowlisted redirect (logo only)

Expect Supabase alone (no Claude mark). This PR does **not** show the
impersonation caution (that is coming in #48162).

```json
{
  "name": "Claude",
  "website": "https://claude.ai",
  "icon": null,
  "domain": "claude.ai",
  "redirect_uri": "https://evil.com/callback",
  "expires_at": "2099-01-01T00:00:00.000Z",
  "scopes": ["organizations:read", "projects:read"],
  "approved_at": null,
  "registration_type": "dynamic"
}
```

#### Uploaded OAuth app icon → forced-light pair

Expect remote icon + Supabase pair with forced-light tiles
(`border-black/10 bg-white`) on both sides in light and dark Studio
themes. The icon URL below is the checked-in solid-colour Acme bitmap on
this branch.

```json
{
  "name": "Acme",
  "website": "https://acme.example",
  "icon": "https://raw.githubusercontent.com/supabase/supabase/danny/depr-604-connect-logo-contract/apps/design-system/public/img/icons/acme-oauth-icon.png",
  "domain": "acme.example",
  "redirect_uri": "https://acme.example/callback",
  "expires_at": "2099-01-01T00:00:00.000Z",
  "scopes": ["organizations:read", "projects:read"],
  "approved_at": null,
  "registration_type": "static"
}
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Improved authorization interstitial branding with trusted requester
logos and safer fallback behavior.
* Added support for consistent light-theme treatment of uploaded OAuth
app icons.
* Added examples and documentation for unknown requesters, uploaded
logos, and wrong-account states.
* **Bug Fixes**
* Prevented unverified or unavailable requester icons from being
presented as trusted.
* Ensured logo pairing remains visually consistent across light and dark
themes.
* **Tests**
* Added coverage for trusted-host validation, fallback branding, icon
loading failures, and theme behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-07-23 02:20:42 +10:00
Danny White c8aca8d3a0 chore(design-system): standardise keyboard focus rings (#41575) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

UI / design-system consistency (accessibility).

## What is the current behavior?

Keyboard focus rings are inconsistent across Studio and `packages/ui`:

- Custom Button uses thick `outline` with per-variant colours (brand /
grey / destructive / warning)
- Form controls use muted grey rings (`ring-background-control`)
- Tabs / NavMenu / Radio use soft brand `ring-ring`
- Studio `.inset-focus` uses dark green `outline-brand-600`

Related: [DEPR-354](https://linear.app/supabase/issue/DEPR-354).

## What is the new behavior?

One shared focus recipe, exposed as Tailwind `@utility` classes in
`packages/config/css/utilities.css`:

| Utility | Use when |
| --- | --- |
| `focus-ring` | Buttons, inputs, most controls (offset ring) |
| `focus-inset` | Dense/flush surfaces such as interactive table rows
(renamed from `inset-focus`) |

```txt
# focus-ring
outline-hidden
focus-visible:ring-2
focus-visible:ring-ring
focus-visible:ring-offset-2
focus-visible:ring-offset-background
```

Applied on Button, shadcn form controls, Menu/NavMenu, Command palette
trigger, Studio table rows, and related call sites. Documented in the
design-system accessibility docs. Variants do not change focus ring
colour.

When the ring must appear on a different element than the focused one
(e.g. Menu + ProductMenu `Link` via `group-focus-visible`, or InputGroup
via `:has()`), keep an explicit ring stack. The utilities bake in
`:focus-visible` on the same element.

## Additional context

**Out of scope**

- Full `packages/ui` / Studio / www sweep
- Legacy Studio form-group green box-shadow cleanup
- ESLint rule for bare `outline-none`

## Test plan

Prefer Safari (“hard mode” for `tabIndex`). Expect one soft brand ring
everywhere: not grey, not solid green outline.

### Design system

- [ ]
[Accessibility](https://design-system-git-dnywh-choreimprove-tab-focus-styles-supabase.vercel.app/design-system/docs/accessibility):
recipe docs match what you see
- [ ]
[Button](https://design-system-git-dnywh-choreimprove-tab-focus-styles-supabase.vercel.app/design-system/docs/components/button):
Tab primary / default / danger; same ring colour
- [ ] [Table → Row-level
navigation](https://design-system-git-dnywh-choreimprove-tab-focus-styles-supabase.vercel.app/design-system/docs/components/table#row-level-navigation):
Tab an interactive row; inset outline (`focus-inset`) sits inside the
row

### Studio

- [ ] **Org home → table view** (`/organizations/_` or org projects):
switch to the table layout, Tab onto a project row; inset outline sits
inside the row (list/card view uses CardButton, not `focus-inset`)
- [ ] **Project sidebar** (Database, Auth, Storage, …): Tab the main
product nav links; ring follows the focused item (not the nested section
menus like Tables / Roles)
- [ ] **Storage → Files**: Tab a bucket row; same inset outline as org
table rows
- [ ] **Project Settings → General** (or Compute and Disk): Tab through
inputs, checkboxes, switches, selects; same offset ring, no ring on
mouse click
- [ ] **Header ⌘K** (desktop width): Tab to the search control after
Feedback; same soft brand `focus-ring` (was a thicker
`ring-border-strong` before)
- [ ] **Table Editor or SQL Editor tabs**: focus a tab, Tab to × if
active; close shows a ring
- [ ] **Light + dark**: ring stays visible against both backgrounds
 2026-07-22 12:10:07 -04:00
Alaister YoungandAlaister Young 0fe2366659 [FE-3790] fix(studio): hide Multigres from user-facing surfaces (#48191) 
Hides the "Multigres" term from user-facing surfaces — it's the tech
powering High Availability projects, but "High Availability" is the only
term users should see for now (per Slack discussion with Saxon/Ivan).

**Changed:**
- High Availability badge hover card (project overview) no longer says
"Driven by Multigres"
- Project creation HA toggle description drops the Multigres name +
multigres.com link, keeps the informational copy
- All schema dropdowns now hide the `multigres` schema on HA projects,
by wiring in the previously-unused `filterSchemasForHighAvailability`
helper:
- `SchemaSelector` (shared — Table Editor, Functions, Indexes, Triggers,
Schema Visualizer, etc.)
  - `ExposedSchemaSelector` (API settings → exposed schemas)
- `EnableExtensionModal`, `CreateIndexSidePanel`, `ForeignKeySelector`,
`WrapperTableEditor`, Integrations install sheet `AdvancedSettings`
  - SQL editor schema autocomplete (`useAddDefinitions`)
- Schema list computations in the touched components are now memoized
(incl. stabilizing `SchemaSelector`'s `excludedSchemas` default so the
memo actually holds)

**Added:**
- Unit tests for `filterSchemasForHighAvailability` /
`resolveHighAvailability`
- MSW component test for `SchemaSelector` asserting `multigres` is
hidden on HA projects and still shown on non-HA projects

The filter is HA-gated on purpose: a self-hosted/non-HA user with their
own schema named `multigres` still sees it. The flag-gated Multigres
option in Logs is intentionally untouched — that exposure is kept for
the Multigres team's debugging (separate track).

## To test

- On an HA project (`high_availability: true`): hover the High
Availability badge on project overview — no "Multigres" mention; open
schema dropdowns in Table Editor / Database pages / SQL editor
autocomplete — no `multigres` schema
- Project creation with HA entitlement: toggle description has no
Multigres wording/link
- On a non-HA project: schema dropdowns behave as before

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Made schema dropdowns and related selectors high-availability aware
across extensions, indexes, integrations, SQL editing, API exposed
schemas, and relationship editors.
* Updated project high-availability UI text and badge hover description
to remove outdated branding and clarify horizontally scalable Postgres
architecture.
* **Tests**
* Added coverage to ensure the schema “multigres” option is hidden/shown
correctly based on high availability, and validated high-availability
value handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-23 00:08:11 +08:00
Alaister YoungandAlaister Young badf16be07 [FE-3909] fix(studio): exclude generated columns from row insert form (#48195) 
Inserting a row through the table editor failed on any table with a
`GENERATED ALWAYS AS (...) STORED` column — the row editor sent an
explicit value for the generated column (e.g. `false` for booleans,
since the bool `Select` never hits the empty-string default heuristic
from #46826), which Postgres rejects with `428C9: cannot insert a
non-DEFAULT value into column`.

**Changed:**
- `RowField` now carries `isGenerated` (from pg-meta's `is_generated`,
previously unused by Studio)
- Generated columns are hidden from the row editor form (they're always
computed by the database, so there's nothing to input) but stay in
`rowFields` state so primary-key identifier logic is unaffected
- `generateRowObjectFromFields` skips generated fields, so they're
omitted from both insert and update payloads
- `validateFields` skips generated fields — an error on a hidden field
would be unfixable

**Added:**
- e2e test covering inserting a row into a table with a generated
boolean column
- unit tests for generated-column omission in insert/update payloads and
validation

## To test

1. Create a table with a generated column:
   ```sql
   create table t (
     id bigint generated by default as identity primary key,
     base_price int,
     discounted_price int,
     is_discounted boolean generated always as (
       base_price is distinct from discounted_price
     ) stored
   );
   ```
2. Table Editor → `t` → Insert row — `is_discounted` should not appear
in the form
3. Fill the other fields and save — the insert should succeed and the
grid should show the computed value
4. Edit an existing row and save — should still work (generated column
untouched)
5. Sanity-check a normal table with identity/default columns — clearing
a default field on insert should still fall back to the default (#46826
behavior)

Addresses
[FE-3909](https://linear.app/supabase/issue/FE-3909/studio-insert-form-fails-on-generated-boolean-columns)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added support for generated columns in the table editor.
* Generated columns are automatically computed and excluded from insert
and update forms.
* Generated values now appear correctly in the table after saving a row.

* **Bug Fixes**
  * Prevented validation errors for non-editable generated fields.
  * Ensured generated columns are excluded from submitted row data.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-22 22:19:36 +08:00
Alaister YoungandAlaister Young 1144b83885 feat(studio): add loading and fallback states to SPA shell (#48185) 
The prerendered TanStack SPA shell (`_shell.html`) had a visually empty
body, so every cold load showed a blank page until the JS bundle
downloaded and hydrated. This bakes proper fallback states into the
shell as static HTML — none of them rely on JS executing.

**Added:**
- `ShellFallback` component, rendered as the `ClientOnly` fallback
around the root `<Outlet />` — during the shell prerender it serializes
into `_shell.html`, and on the client it unmounts the moment the app
mounts (no hydration mismatch: `ClientOnly` renders the fallback on the
server and first client render)
- Animated `LogoLoader` (Supabase logo outline) centered on screen — the
stroke-dash animation is pure CSS so it runs before any JS executes
- Stuck-load help text that fades in after 7s via CSS `animation-delay`
(clear cookies / reload, contact support@supabase.com — the support
email is gated behind `IS_PLATFORM` so self-hosted builds don't get it)
- `noscript` message for JS-disabled browsers, which also hides the
loader so users don't see an infinite spinner (uses
`dangerouslySetInnerHTML` so React hydration never diffs noscript
children)
- `data-nosnippet` on both text blocks so Google doesn't surface the
boilerplate as the search snippet for dashboard URLs (the one shell
serves every route)

## To test

All on the Vercel preview:

- Open the preview — on a cold load you should catch the animated logo
loader before the app mounts (throttle to "Slow 4G" in devtools if it
flashes by too fast), and it never reappears on client-side navigation
- In devtools, block the JS bundle (Network tab → right-click the
`/assets/index-*.js` request → Block request URL) and reload — the
loader animates on its own, and the help text (clear cookies / contact
support) fades in after ~7s
- Disable JavaScript (devtools command palette → "Disable JavaScript")
and reload — no spinner, just the "requires JavaScript" message
- View page source (or `curl` any preview URL) — the body contains the
logo SVG, the help text, and the noscript block, all with
`data-nosnippet` on the text

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added a client-aware loading shell for Studio during initialization.
* Shows a branded loader with a help message that appears after a short
delay.
  * Includes platform-specific support contact details when available.
* **Bug Fixes**
* Prevents partial or incomplete content from rendering before the app
is ready.
* Improves consistency for no-JavaScript fallback rendering to avoid
hydration mismatches.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-22 22:08:52 +08:00
Francesco Sansalvadore 50d7030f48 chore(studio): default opt-in to integrations layout (#48183) 
Make the new "one-click" integrations feature preview opt-in by default
so it appears for all users once we switch `marketplaceIntegrations` to
_true_ and reframe the feature preview copywriting.

<img width="1007" height="694" alt="Screenshot 2026-07-22 at 12 01 08"
src="https://github.com/user-attachments/assets/4b35870c-dcf0-45cc-a1b5-69628e7e10b5"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added a visual preview image to the integrations layout preview.
  * Renamed the preview to “One-Click Integrations.”
* Made the preview enabled by default when the marketplace feature is
enabled.
* **Style**
* Refreshed the preview text and updated the layout with improved
spacing, border, and rounded corners.
* **Documentation**
* Updated the page header documentation link to the general integrations
guide.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 16:06:28 +02:00
Francesco Sansalvadore a10ebd9097 chore(studio): improve light mode images on featured integrations (#48179) 
## What is the current behavior?

featured integration image was looking muddy on light mode
<img width="1479" height="792" alt="Screenshot 2026-07-16 at 16 20 29"
src="https://github.com/user-attachments/assets/d51960f9-7c58-47d6-a751-e310f0edb32e"
/>

## What is the new behavior?

dedicated light-mode preview images
<img width="1482" height="785" alt="Screenshot 2026-07-16 at 16 29 48"
src="https://github.com/user-attachments/assets/5c1b9772-8ea2-4b94-aeba-cb095015df8e"
/>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added Stripe Sync Engine to the featured integrations list.
  * Added light-theme cover imagery for featured integrations.
* Featured integration cards now display theme-aware images and improved
visual overlays.
* Updated the marketplace grid for improved responsive layouts across
screen sizes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 09:50:36 -04:00
Joshen Lim bb811ef67e Joshen/fe 3972 add filter for application name (#48180) 
## Context

Adds supporting for filtering by application name for Database
Connections
<img width="592" height="325" alt="image"
src="https://github.com/user-attachments/assets/e09b8d61-4215-4da4-b2aa-980cdc475738"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added an **Application** filter to database activity views.
* Expanded filtering to include session state, roles, and matching by
activity application name.
* Filter option counts are now more accurate based on the currently
selected criteria.

* **Bug Fixes**
* Improved filter reset behavior to reliably clear application/state
selections and restore role defaults.
  * Enhanced persistence of filter selections via URL query parameters.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 17:53:41 +08:00
Joshen Lim d5a882c4fa Support click to copy PID from activity row (#48177) 
## Context

Very tiny one - just supports clicking to copy PID from the Activity Row
in Database Connections
Will be useful for diving into details of the query with the Assistant
if needed
<img width="323" height="120" alt="image"
src="https://github.com/user-attachments/assets/b80a69eb-d1e8-49d3-93e3-08c111b3ea6e"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added the ability to click an activity process ID to copy it to the
clipboard.
  * Added confirmation feedback after copying the process ID.

* **UI Improvements**
* Improved query tooltip behavior by providing a slightly longer hover
delay.


<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 17:26:17 +08:00
Joshen Lim cf7da58eb3 Add overview section for database connections (#48147) 
## Context

Building on top of "Database Connections" - this adds a top summary
section, again from `pg_stat_activity`
<img width="948" height="324" alt="image"
src="https://github.com/user-attachments/assets/f4968193-0a5f-4754-a630-40685b747999"
/>

Each block comes with a tooltip in hopes to educate the significance of
each metric
- Connections: Spread of connections per database role
<img width="313" height="164" alt="image"
src="https://github.com/user-attachments/assets/8ceeab5d-b960-4be3-9a5b-8600bd5cf303"
/>
- Active queries: Rough representative of activity
<img width="350" height="196" alt="image"
src="https://github.com/user-attachments/assets/f9705ff1-a869-409a-86b6-50170a169674"
/>
- Idle in transaction: Important to identify as this indicates locks
(Suggests root cause)
<img width="350" height="196" alt="image"
src="https://github.com/user-attachments/assets/f9705ff1-a869-409a-86b6-50170a169674"
/>
- Blocked queries: Also important to identify stuck queries
<img width="335" height="183" alt="image"
src="https://github.com/user-attachments/assets/57255fb8-24f6-4ddd-aa54-850a77173b5c"
/>
- Longest running query: Might be useful to identify unusually long
queries
- Will be `text-warning` if exceeds 30 seconds for active queries,
`text-destructive` if exceeds 10 seconds for queries idle in transaction
<img width="342" height="119" alt="image"
src="https://github.com/user-attachments/assets/f6783b43-058a-4a32-a40c-0bc64f23d2ce"
/>

"Summarize activity" CTA leverages on the Assistant to give a quick
overview - highlights any potential issues for quick reference
<img width="1918" height="958" alt="image"
src="https://github.com/user-attachments/assets/340121fe-3186-48a5-8023-fbac2a93397a"
/>

## Other changes
- Hides "View running queries" in SQL Editor if `topForPostgres` feature
flag is enabled (since this UI is meant to replace that)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a Database Connections observability overview with metric cards
(connections, longest-running, active, blocked, idle-in-transaction) and
an interactive “Longest running” PID selector.
* Added a “Summarize activity” AI assistant dropdown that starts a
timestamped, activity-aware summary chat.
* **Improvements**
* Enhanced live activity refresh (including window-focus updates) and
standardized duration warning thresholds for active and
idle-in-transaction sessions.
* Improved hover details for query previews and allowed richer tooltip
content for metric labels.
* **Feature Changes**
  * Gated the “View running queries” bottom panel behind a feature flag.
* **Bug Fixes**
* Refined running-too-long badge and warning styling for
idle-in-transaction cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 17:25:56 +08:00
Joshen Lim f55ff0e6dd Update copy for grace period (#48138) 
## Context

If an organization is exceeded usage and has the grace period banner -
the current copy is really long which causes the text to truncate.
<img width="1126" height="67" alt="image"
src="https://github.com/user-attachments/assets/f8095dc6-540c-47e5-941a-31a4264a6017"
/>

Banners are meant to be short and to the point, so opting to revise the
copy a little.
<img width="1392" height="51" alt="image"
src="https://github.com/user-attachments/assets/55596369-ee65-48cd-8616-66747e4d2590"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Copy Updates**
- Clarified the grace-period message to explain that projects may be
restricted from the displayed date if usage remains over quota.
- Updated the available actions to include a billing link alongside
“Review usage.”

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 10:50:10 +08:00
Danny White b6ed55e272 fix(studio): restore project creation panel chrome on /new (#48171) 
## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

Regression from #48113: the regular `/new` project creation form is
missing its card border/shadow because Panel flatten classes were
applied when `!isVercelIntegrationFlow`.

## What is the new behavior?

Flattens Panel chrome only for the Vercel interstitial flow, restoring
the card on `/new`.

| Before | After |
| --- | --- |
| <img width="980" height="997" alt="New Project Supabase"
src="https://github.com/user-attachments/assets/5af9bc8b-5abd-47ea-9821-207ea5c2c127"
/> | <img width="980" height="997" alt="New Project Supabase"
src="https://github.com/user-attachments/assets/28a32216-d250-497c-90df-94e2df19ce00"
/> |

## Additional context

N/A

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Updated the project creation panel’s appearance during the Vercel
integration flow, removing unnecessary borders, shadows, and background
styling.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-21 17:42:26 -04:00
Charis 3d83e026f9 refactor(sql-editor): finish EditorController/DiffController port (Step 2) (#48166) 
## Summary
Step 2 of the SQL Editor testability plan.

`SQLEditorContext` already wrapped the Monaco refs and exposed a few
semantic imperative helpers (`getEditorSql`, `clearHighlights`,
`applyErrorHighlight`, `refocusEditor`, …). This finishes that
abstraction so no hook or controller touches
`editorRef.current`/`diffEditorRef.current` directly anymore — they only
call the port. The port is what will let Step 3's test harness inject a
real in-memory editor adapter instead of mocking Monaco; production
wires it to the real Monaco refs, unchanged.

- Extends the context value with two semantic controllers, backed by the
existing refs:
- `editor: EditorController` — `isReady`, `getValue`,
`getSelectionStartLine`, `getSql` (today's `getEditorSql`), `replaceAll`
(wraps the repeated `executeEdits(...)` pattern), `focus`,
`revealLineInCenter`, `highlightErrorLine` (today's
`applyErrorHighlight`), `clearHighlights`.
- `diff: DiffController` — `isMounted`, `getModifiedValue`, `setDiff`
(the diff-sync effect body), `attach` (today's `handleDiffEditorMount`).
- Migrates every touch point off raw refs onto the port:
`useSqlEditorExecution`, `usePrettifyQuery`, `useSqlEditorShortcuts`,
`SQLEditorControllers`' `readEditorSql`, and `useSqlEditorAi`'s
`acceptAiHandler`/`drainDiffRequest`/`handleDiffEditorMount`/diff-sync
effect.
- `SQLEditorEditorPanel.tsx` is intentionally left untouched — it wires
the raw refs into the real Monaco/DiffEditor React components for
rendering, which isn't decision logic to abstract.

Behavior-preserving.

## Test plan
- [x] `pnpm --filter studio typecheck`
- [x] `pnpm test:studio -- SQLEditor` (265 tests passing)
- [x] `pnpm --filter studio run lint:ratchet`
 2026-07-21 16:22:47 -04:00
Charis cdc843dadd refactor(sql-editor): extract deriveSnippetIdentity, debug/completion/diff-key helpers (#48014) 
## Summary
Pure-fn extraction pass across the SQL editor hooks.

- Extracts `deriveSnippetIdentity` out of `useSnippetIdentity`'s inline
id + `isLoading` derivation into `SQLEditor.utils.ts`.
- Extracts `extractDebugContext` (shared snippet/result/error
extraction) and `buildDebugChatArgs` (the `aiSnap.newChat(...)` payload
builder) out of `useSqlEditorAi`'s `buildDebugPrompt`/`onDebug` into
`SQLEditor.utils.ts`.
- Extracts `buildCompletionRequestBody` (the AI completion endpoint's
request body builder) and `planDiffRequestApplication` (the
pending-diff-request application decision: replace vs. open a diff,
depending on whether the editor is currently empty) out of
`useSqlEditorAi` into `SQLEditor.utils.ts`. The `drainDiffRequest`
effect now just applies the plan instead of branching inline.
- Extracts `resolveDiffKeyAction` out of `useSqlEditorShortcuts`'s
window-keydown Enter/Escape branch into `SQLEditor.utils.ts`.

## Test plan
- [x] `pnpm --filter studio typecheck`
- [x] `pnpm test:studio -- SQLEditor` (265 tests passing)
- [x] `pnpm --filter studio run lint:ratchet`
 2026-07-21 13:47:40 -04:00
Luiz Felipe Machado b883b102b4 fix(studio): gate user logs tab behind feature flag (#48122) 2026-07-21 15:22:41 +00:00
Francesco Sansalvadore 9f5e75183c chore(studio): add bullet-point to integration uninstall modal (#48139) 
## What is the current behavior?

<img width="533" height="394" alt="Screenshot 2026-07-21 at 11 55 05"
src="https://github.com/user-attachments/assets/4e5e8fde-5823-4ad2-849e-abad90bfa72a"
/>

## What is the new behavior?

<img width="501" height="430" alt="Screenshot 2026-07-21 at 12 43 17"
src="https://github.com/user-attachments/assets/2888d815-8c2c-47db-a058-dc60b208d6b1"
/>

## Additional context

Also fixed font-weight for strong text in studio to be `font-bold`.
 2026-07-21 17:21:18 +02:00
Danny WhiteandJoshen Lim 0324f3422a chore(studio): polish vercel deploy-button new project interstitial (#48113) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Studio UI polish for the Vercel deploy-button new-project connect flow
(DEPR-616 follow-up).

## What is the current behavior?

- Deploy-button project creation still used
`VercelIntegrationWindowLayout` (top bar + Docs/Support footer) while
install and choose-project already use shared `InterstitialLayout`
- The remove-integration note sat as a floating admonition above the
form
- Advanced / internal-only config sections could show double dividers,
and the Oriole radio bottom border could clip inside the collapsible

## What is the new behavior?

- Deploy-button new-project uses `InterstitialLayout` with
`VercelIntegrationLogo` and `VercelIntegrationFooter`, matching the
other Vercel connect surfaces
- Regular `/new` project creation is unchanged; Panel chrome is only
flattened when `isVercelIntegrationFlow` is set
- Removes unused `VercelIntegrationWindowLayout` /
`IntegrationWindowLayout`
- Fixes Advanced/Internal-only dividers and collapsible border clipping

| Before | After |
| --- | --- |
| <img width="965" height="1107" alt="Supabase"
src="https://github.com/user-attachments/assets/99c1225c-c9e5-4fac-bd64-17920403e447"
/> | <img width="965" height="1107" alt="Create Vercel Project Supabase"
src="https://github.com/user-attachments/assets/c42bff96-5f9f-4c8b-8f3c-093e380f90ed"
/> |

## Additional context

### Testing

With Studio running locally and while signed in:

1. Open
`http://localhost:8082/integrations/vercel/<your-org-slug>/deploy-button/new-project`
2. Confirm the interstitial card: Vercel + Supabase logo pair, “Create a
new project” title, form fields, and the muted remove-integration footer
under the card
3. Confirm there is no old window chrome (no “Marketplace Connector” /
“Deploy Button” top bar, no Docs/Support footer)
4. Optionally submit and confirm project creation still works
5. Spot-check `/new` to confirm the normal project creation form is
unchanged

If you have advanced config enabled, expand Advanced Configuration and
confirm single dividers (not doubles) and that the Oriole option’s
bottom border is not clipped.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Added configurable width to the shared interstitial layout for Vercel
project creation.
  * Updated the Vercel “new project” flow to use the interstitial UI.

* **Bug Fixes**
* Prevented child borders/shadows from being clipped in expandable
configuration sections.

* **Refactor**
* Removed legacy Vercel/window layout components and updated routing to
rely on the interstitial flow.
* Switched advanced and internal-only configuration sections to render
inside panel content.

* **Documentation**
* Refreshed Vercel integration route guidance in the migration checklist
and inline route comments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-07-22 00:08:00 +10:00
Gildas Garcia d0abc7a64a fix: cron job has no default for timeout input (#48103) 
The cron job form has no default value for the timeout input. However,
if left empty, the zod schema default it to 0 which fails validation.

By setting a default value on the input we ensure:
- a value is actually provided
- validation triggers if users clear the input

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Cron job forms now use a consistent 1-second timeout default across
function and HTTP request types.
* Changing the cron job “Type” clears any previously generated snippet
and resets the timeout back to the shared default.
* Form initialization and reset behavior were improved to prevent stale
timeout/snippet state when creating or editing cron jobs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-21 16:06:16 +02:00
Ali Waseem da7a10be6b chore: simplify CPU messaging for compute sizes (#48109) 
## Summary
- Simplify CPU messaging on the Compute and Disk docs page and in
Studio's compute size UI to keep it generic rather than
architecture-specific.

## Test plan
- [x] Unit tests pass
- [x] Typecheck passes
- [x] Lint passes

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Updates**
* Simplified compute size labels across the UI by removing
cloud-provider architecture details from CPU text.
* Standardized CPU descriptions to show core counts and whether
resources are shared or dedicated.
* Updated the “Compute Size” pricing/specs table in the compute & disk
guide to use generic CPU labels while keeping pricing, memory, and
database size guidance the same.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-21 06:40:50 -06:00