Fifth stacked PR for scoped PAT extracted from the prototype #47783 to
ease reviewing.
Previous stacked PR is #47999
Next stacked PR is #48359
This PR refactor how we get the map of which scopes enable which
endpoint or mcp tool. Previously it was an hardcoded file. We now
compute it from the OpenAPI specs of our API. This ensure the map stays
up to date when the API changes.
However, we don't have an always up-to-date equivalent for mcp tools so
we duplicated code from platform that map the OAuth scopes they check
with the FGA permissions.
## Notes
The react-hook-form usage is not great. A follow up PR will fix it
## How to test
- On
https://studio-staging-git-scopedpat-scope-permissions-api-supabase.vercel.app/dashboard/account/tokens
- Create a new token with a few permissions (their risk marker should be
displayed: (_High risk_, _Medium risk_ or _Low risk_)
- You should see the available endpoints and mcp tools in the review
step
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added dynamic permission mapping for scoped access tokens, covering
Management API endpoints and MCP tools.
* Added a permissions endpoint with hosted-platform support and caching.
* Updated scoped token creation and review screens to show capabilities
based on granted permissions.
* Added permission-aware risk indicators and tool visibility.
* **Bug Fixes**
* Improved authorization checks so endpoints and tools require all
necessary scopes.
* **Tests**
* Added coverage for endpoint, scope, and MCP tool mapping behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor
## What is the current behavior?
The `/incident-banner` endpoint is implemented using the Pages Router.
## What is the new behavior?
The `/incident-banner` endpoint is moved to the App Router, enabling
caching of the upstream fetch. This does not turn on the querying from
the frontend yet, making that a separate PR so we can revert easily if
needed.
## Additional context
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor
## What is the current behavior?
`/incident-status` is handled via Pages Router.
## What is the new behavior?
`/incident-status` is handled via App Router, enabling use of Vercel
Data Cache to cache the upstream fetch.
## Additional context
Adding the first App Router route handler triggered `next typegen` (run
as `pretypecheck`) to generate `.next/dev/types/validator.ts`, which
imports all route files and expanded the type-checked graph. This
surfaced pre-existing `null`-safety errors in:
- `components/grid/SupabaseGrid.utils.ts` — `useSearchParams()` result
- `components/layouts/ProjectLayout/UpgradingState/index.tsx` —
`useSearchParams()` result
- `pages/project/[ref]/sql/quickstarts.tsx` — `useParams()` result
- `pages/project/[ref]/sql/templates.tsx` — `useParams()` result
These are fixed with optional chaining. The `tsconfig.json` change
(adding `.next/dev/types/**/*.ts` to `include`) is auto-generated by
Next.js and committed as correct behavior.
* Add vercel/ai. Commit additional next types.
* Add a API route in /app for streaming responses.
* Make the components work with streaming response.
* Add a dummy page to /app folder to fix a linking bug.
* Fix the dummy page.
* Fix the dummy page again.
* Add an empty layout to the app folder.
* Make the code snippets in the chat read-only.
* Remove queries and mutations for suggest.
* Reset the chat when closing the panel.
* Make the AI instructions a bit better.
* Don't render empty code blocks.
* Try to use remark for rendering the code. Style fixes for CodeBlock in AI assistant panel.
* Fix the styling of the definitions when sending them to OpenAI.
* Fix the css styling of the messages and code blocks.
* Move the suggest API route from app to pages folder.
* Revert the change for app API routes.
* Make the API route look like the rest of the API routes.
* Use Pre instead of Code because the <code> tags aren't working if between spans.
* Minor leftovers.
* Revert to using app route handlers.
* Change the wording on the diff header.
* Add nextjs types.
* Fix a missing import.
* Move AssistantChatForm back to db-new.
* Fix a build error.
* Rename the suggest route to assistant.
* Fix Joshen's comments.
Gildas Garcia