dima/supabase
1
0 Fork 0
mirror of https://github.com/supabase/supabase.git synced 2026-10-09 11:25:06 +03:00
Code Issues Packages Projects Releases Wiki Activity
36,434 Commits 1,796 Branches 62 Tags
f05ab582da90efd5f4fa64e2dc314d7ae6b92556
Commit Graph
5294 Commits
Author SHA1 Message Date
Alaister Young f05ab582da chore(studio): wire self-hosted run + e2e env handling for TanStack build 
Previous setup ran the studio under `vite preview` and signalled e2e
mode via `NODE_ENV=test`. That broke twice on this branch:

1. `NODE_ENV=test` in the shell overrides Vite's default
   `NODE_ENV=production` for `vite build`, which makes
   `@vitejs/plugin-react` emit the dev JSX runtime (`jsxDEV`). The
   production SSR bundle doesn't have `jsxDEV` available, so every SSR
   request crashed with `TypeError: jsxDEV is not a function`.
2. `vite preview` is a static SPA preview; it can't reuse the
   `fetch`-handler shape that `apps/studio/api/server.js` exposes to
   Vercel. Self-hosted prod needs its own HTTP listener for the same
   handler.

Changes:

- Swap `NODE_ENV=test` for `MODE=test` end-to-end. `vite build --mode
  test` keeps `NODE_ENV=production` automatically (per Vite docs), so
  the React plugin stays on the prod JSX runtime and TanStack Start
  bakes the right `NODE_ENV` into the SSR bundle. `.env.test` overrides
  load through the standard `loadEnv(mode, ...)` order, so the
  developer's `.env.local` no longer leaks `NEXT_PUBLIC_IS_PLATFORM=true`
  into e2e builds.
- Explicitly set `NEXT_PUBLIC_IS_PLATFORM=false` in
  `generateLocalEnv.js` so `.env.test` (which loads after `.env.local`)
  wins regardless of what a developer has set locally.
- Add `apps/studio/scripts/serve.js`: a small zero-dep Node HTTP
  adapter that loads env files, serves `dist/client/*` statics with
  proper cache headers, and forwards everything else to the
  `fetch`-handler exported by `dist/server/server.js` — the same
  handler `api/server.js` hands to Vercel. `pnpm start` runs this;
  `pnpm preview` keeps the old `vite preview` flow as a debug
  escape-hatch.
- Add `dist/**` to studio's turbo outputs so cached builds restore
  the Vite output (not just the legacy `.next/**`).
- Declare `MODE`, `PORT` in turbo env so cache invalidates correctly
  when switching between test and production builds.
 2026-05-15 16:19:59 +08:00
Alaister Young c7de8411cf Merge remote-tracking branch 'origin/master' into alaister/tanstack-start 
Resolve conflicts:
- apps/studio/package.json: drop @supabase/postgres-meta (replaced by
  @supabase/pg-meta on master) while keeping tanstack/tailwind v4 dev deps
- pnpm-lock.yaml: take master's and reconcile via pnpm install

Bump tanstack deps to latest available (post supply-chain unpublish):
- @tanstack/react-devtools ^0.10.2 -> ^0.10.3
- @tanstack/react-hotkeys ^0.9.1 -> ^0.10.0
- @tanstack/react-query / -devtools ^5.0.0 -> ^5.100.10 (studio/docs/ui-library)
 2026-05-15 13:39:15 +08:00
Danny WhiteandGildas Garcia 09fa2b8fc1 Clarify alert and collapsible design-system patterns (#45863) 
## What kind of change does this PR introduce?

Docs update and design-system component taxonomy cleanup

## What is the current behavior?

The design-system docs conflate low-level shadcn primitives with
product-level alert patterns. Collapsible documentation previews the
alert-specific wrapper, and the alert/collapsible relationship is
unclear

## What is the new behavior?

- Documents Alert and Collapsible as low-level atom components
- Moves the alert-styled expandable wrapper into
`ui-patterns/expandable-alert` as `ExpandableAlert`
- Documents Expandable Alert as a Fragment Component next to Admonition
- Updates the Session Timeout modal to import `ExpandableAlert` from
`ui-patterns/expandable-alert`


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* `CollapsibleAlert` component is now available for alert-styled
expandable content.

* **Documentation**
* Updated component documentation to clarify when to use `Alert`,
`Collapsible`, `Admonition`, and `CollapsibleAlert`.
* Added comprehensive documentation for `CollapsibleAlert` with usage
examples and variant options.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45863)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
 2026-05-15 15:29:16 +10:00
Vaibhav bcffb9d245 fix: ai sidebar closing (#45932) 
## TL:DR 

fixes ai assistant panel closing after running queries in logs and
analytics

## b4: 
(thanks to OP)
<img width="2102" height="854" alt="Image"
src="https://github.com/user-attachments/assets/6a1416d8-67bf-4166-999a-d8743746efda"
/>

## after:


https://github.com/user-attachments/assets/bec3366b-b4d6-41c8-a287-f8c37a818f71



## ref: 
- closes https://github.com/supabase/supabase/issues/45930

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved synchronization between the Logs Explorer editor and the
URL/search state: running a query now updates the shared search state
(and recent snippets) rather than performing a full route push, and the
editor now prioritizes the URL/state value when present to prevent
mismatches during navigation or query execution.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45932)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 19:10:58 -06:00
Danny White 8935043a1b simplify sql editor warning dialog (#45912) 
## What kind of change does this PR introduce?

Studio UI cleanup.

## What is the current behaviour?

The SQL editor query warning modal repeats itself with an admonition, a
nested warning panel, and extra confirmation copy. Single-warning cases
are harder to scan than they need to be.

## What is the new behaviour?

The warning now uses `AlertDialog` and resolves each detected issue into
concise title/body copy. Single-warning cases show one short
description, while multi-warning cases show a compact list. The existing
RLS actions are preserved.

## Testing instructions

Manual SQL editor checks:

Open the Studio SQL editor, paste each snippet, click **Run**, verify
the warning copy, then click **Cancel**. These snippets are only
intended to trigger the warning UI, so do not confirm the dangerous
ones.

Destructive operation warning:

```sql
drop table if exists public.codex_warning_destructive;
```

UPDATE without WHERE warning:

```sql
update public.codex_warning_table set id = id;
```

Prevent database connections warning:

```sql
alter database postgres connection limit 0;
```

Missing RLS warning:

```sql
create schema if not exists codex_warning;
create table codex_warning.missing_rls (id bigint);
```

Multiple issues warning:

```sql
drop table if exists public.codex_warning_destructive;
update public.codex_warning_table set id = id;
create schema if not exists codex_warning;
create table codex_warning.missing_rls_multi (id bigint);
```

## Additional context

| Before | After |
| --- | --- |
| <img width="1024" height="759" alt="Codex Warning Table Maintenance
SQL Editor Hammer Toolshed Supabas-BDBD32C7-FCE8-4623-ACF2-D2554233EBB4"
src="https://github.com/user-attachments/assets/aaed16c2-9910-424a-8a3c-f9815139b1bf"
/> | <img width="1024" height="759" alt="Codex Warning Table Maintenance
SQL Editor Hammer Toolshed Supabas-C8964C98-1CF9-4992-89D6-86C081C884E8"
src="https://github.com/user-attachments/assets/d291c559-1e64-4c63-b918-b20b58d9a2a5"
/> |
| <img width="1024" height="759" alt="Codex Warning Table Maintenance
SQL Editor Hammer Toolshed Supabas-C341A032-B5B0-49A2-8EA2-E3E6EEC54E4F"
src="https://github.com/user-attachments/assets/667d9d1a-e34b-4411-9f91-4972ee8d1a23"
/> | <img width="1024" height="759" alt="Codex Warning Table Maintenance
SQL Editor Hammer Toolshed Supabas-FC66ADE9-6AF1-44D2-A6B6-F7B2FC935C0E"
src="https://github.com/user-attachments/assets/1348377e-6606-47c0-aa95-128d7f86ed56"
/> |
| <img width="1024" height="759" alt="Codex Warning Table Maintenance
SQL Editor Hammer Toolshed Supabas-43AAD9FA-7FAC-4DCE-A713-00E8FC76B343"
src="https://github.com/user-attachments/assets/bdadedc2-f17d-4011-ae67-5248097b3e92"
/> | <img width="1024" height="759" alt="Codex Warning Table Maintenance
SQL Editor Hammer Toolshed Supabas-279EC81D-31C7-49C7-B4A8-EEEF1738740A"
src="https://github.com/user-attachments/assets/0c178fff-ff49-4522-870d-7a3401c6af30"
/> |
| <img width="1024" height="759" alt="Codex Warning Table Maintenance
SQL Editor Hammer Toolshed Supabas-D405AED5-613F-4C78-909E-F718C67CF17E"
src="https://github.com/user-attachments/assets/a4399935-3596-471b-854a-c689e2e0df07"
/> | <img width="1024" height="759" alt="Codex Warning Table Maintenance
SQL Editor Hammer Toolshed Supabas-725FBCE6-5606-4BC3-B13F-6210DBADF6F2"
src="https://github.com/user-attachments/assets/0dcd08fc-cfb4-4d67-b167-eb6eaa768764"
/> |
| <img width="1024" height="759" alt="Codex Warning Table Maintenance
SQL Editor Hammer Toolshed Supabas-EA6563AF-DE7E-4AB8-9164-AC66164CA581"
src="https://github.com/user-attachments/assets/ef56fe0f-0243-4ff3-a2b2-ee8b3fe2330a"
/> | <img width="1024" height="759" alt="Codex Warning Table Maintenance
SQL Editor Hammer Toolshed Supabas-EC85EFB1-715E-4841-BBCA-51F88B539595"
src="https://github.com/user-attachments/assets/5be05527-920d-4f23-92eb-c7cd0bbff13e"
/> |

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Prevented unintended modal dismissal and duplicate handling when
confirming.

* **Refactor**
* Redesigned SQL editor warning modal with structured, consolidated
warnings, adaptive title/confirmation copy, and centralized handling of
missing-RLS table names.
  * Added conditional "Run and enable RLS" confirmation when available.

* **Tests**
* Updated end-to-end tests to match the new modal headings and body
text.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45912)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 10:00:58 +10:00
Danny White 3e50212ad7 fix storage policy warning spacing (#45910) 
## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

The Storage public bucket warning confirmation modal can render
`SELECTpolicy` without a space. The source relied on implicit JSX
whitespace after an inline `<code>` element, and that whitespace can be
normalised away when React renders the sentence.

## What is the new behavior?

The modal now renders an explicit JSX space after the `SELECT` code
element, so the sentence reads `SELECT policy`.

| Before | After |
| --- | --- |
| <img width="860" height="666" alt="CleanShot 2026-05-14 at 14 31
36@2x-2B492E39-5CB4-4D4D-A409-0F0AF268E108"
src="https://github.com/user-attachments/assets/683cc8c7-c112-411e-9569-de3be2a1d906"
/> | <img width="858" height="668" alt="CleanShot 2026-05-14 at 15 08
08@2x"
src="https://github.com/user-attachments/assets/e9a28bb0-9977-4da9-aecb-d4fa56dff368"
/> |

## Additional context

Testing instructions:

1. Open the staging link.
2. Open the SQL Editor and run:

```sql
insert into storage.buckets (id, name, public)
values ('public-warning-repro', 'public-warning-repro', true)
on conflict (id) do update set public = true;

drop policy if exists "public warning broad select repro" on storage.objects;

create policy "public warning broad select repro"
on storage.objects
for select
to anon, authenticated
using (bucket_id = 'public-warning-repro');
```

3. Navigate to Storage > `public-warning-repro`.
4. Click `Remove policy` on the warning banner.
5. Confirm the modal says `This will drop the SELECT policy...`, not
`SELECTpolicy`.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Style**
* Improved wording and inline code styling in the public bucket
destructive confirmation modal for clearer, more readable messaging;
visual presentation updated without changing behavior or confirmation
logic.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45910)

<!-- review_stack_entry_end -->

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45910)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-15 09:49:35 +10:00
Sean Oliver 4c77ab5fef feat(telemetry): mirror org_count to PostHog person property (#45946) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature + two follow-on fixes — small, scoped to telemetry / experiment
plumbing.

## What is the current behavior?

PostHog feature flags evaluated in Studio only have access to the
`gotrue_id` person property (set in `useTelemetryIdentify`) and the
`organization`/`project` group associations from pageviews. Flags can't
target users by org membership without a behavioral cohort, which
refreshes on a ~hourly schedule and lags behind real-time signup state.

This is blocking the rollout of the `dataApiRevokeOnCreateDefault`
experiment ahead of the May 30 default-privileges breaking change — we
need to target brand-new dashboard signups with no prior org membership,
and there's no person property to filter on.

## What is the new behavior?

Three changes, scoped tightly to make experiment targeting reliable for
brand-new signups:

### 1. Mirror `org_count` to a PostHog person property
(`apps/studio/lib/telemetry.tsx`)

The Studio `Telemetry` component now mirrors the user's current org-list
length to a PostHog person property `org_count` via
`posthog.identify(user.id, { org_count })`. The effect:

- Subscribes to `useOrganizationsQuery` (shares the same React Query
cache as `useSelectedOrganizationQuery`, so no extra network requests).
- Dedupes via a ref keyed on `{ userId, orgCount }` so we only call
identify when the value actually changes — handles user-switch
(logout/login as different user with same count) correctly.
- Generic enough to be useful beyond this experiment — analytics
segmentation by org membership, future flags that depend on multi-org
behavior, etc.

### 2. Merge pre-init identify properties
(`packages/common/posthog-client.ts`)

The previous `pendingIdentification` slot was a single-write buffer —
calling `posthogClient.identify()` before the PostHog SDK initialized
would overwrite any prior queued identify. Latent until this PR added a
second identify caller (`org_count`), which exposed the last-write-wins
behavior on first-visitor-before-consent flows. Now merges properties
across pre-init calls for the same user so both `{ gotrue_id }` and `{
org_count }` land on the person record when the SDK flushes. Caught
during Codex review.

### 3. Gate the exposure event on `org_count` being present
(`apps/studio/hooks/misc/useDataApiRevokeOnCreateDefault.ts`)

`useTrackDefaultPrivilegesExposure` previously fired on the first
non-undefined value of the `dataApiRevokeOnCreateDefault` flag. For
brand-new signups, this races the `org_count` identify: the initial
`/flags/` response (before targeting can match) returns the untargeted
variant, the exposure locks it in via `hasTracked`, then our identify
fires and a subsequent `/flags/` refresh updates the flag — but the
exposure has already recorded the wrong variant.

Fix: gate the exposure on `org_count` being present on the SDK person,
subscribing via `onFeatureFlags` so we pick up the post-identify
`/flags/` response. Adds `posthogClient.getPersonProperty` as the
local-state reader. Without this, the experiment would have a ~5-15%
noise floor on cohort assignment for new signups.

## Verification

End-to-end verified locally against the staging PostHog project (34343):

- Local Studio's PostHog SDK has `$stored_person_properties: {
gotrue_id: <uuid>, org_count: 1 }` after sign-in.
- Both `$set` events landed server-side within ~300ms of each other, and
the staging person record now shows `org_count = 1.0` with `gotrue_id`
preserved.
- Targeting query `person.properties.org_count == 1` works end-to-end
against staging.

## Additional context

Ref: [GROWTH-853](https://linear.app/supabase/issue/GROWTH-853)

Targeting plan for the flag once shipped: `person.org_count == 1` plus a
behavioral filter on recent `sign_up` event, at 5% rollout.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Telemetry now records and syncs the user's organization count as an
analytics person property and avoids redundant identifications when
unchanged.
* Analytics client now merges queued identification properties made
before initialization and exposes a method to read stored person
properties.

* **Bug Fixes**
* Tracking now waits for organization-count readiness before firing
certain exposure events to prevent missing data.

* **Tests**
* Added/updated tests to cover person-property behavior and gating
logic.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45946)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 12:52:43 -07:00
Charis d79a276824 studio: ColumnTypeRef cascade + FK type comparison fixes (2/7) (#45903) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Refactor + bug fixes (part of the SafeSql migration stack — PR 2 of 7,
stacks on top of #45897).

## What is the current behavior?

- `pgMeta.columns.create` and the table-editor SQL builder take column
type as a string with array suffix and schema baked in (e.g.
`'private.test_enum'`, `'int4[]'`).
- The studio table-editor SQL emits the legacy schema-embedded `format`
string for enums in non-public schemas, while the pg-meta columns SQL
already returns the new shape (bare `format` + separate
`format_schema`). The two queries disagree on how to represent the same
column, surfacing as a false-positive type mismatch in the FK selector
when both ends are an enum from a non-public schema.
- The FK selector compares column types by `format` alone — same-named
enums in different schemas appear equal, and arrays vs. scalars of the
same base type pass the family check.
- `displayColumnType` renders arrays as the raw `_typname` pg-meta emits
(e.g. `_int4` instead of `int4[]`).

## What is the new behavior?

**pg-meta**

- Introduce `ColumnTypeRef` (`{ schema?, name, isArray? }`) for column
type input, replacing the legacy string-with-array-suffix format.
`pgMeta.columns.create` and the table-editor SQL builder consume the new
shape.
- Add `format_schema` to the column zod schema; pg-meta SQL emits the
type's schema for the table editor's ColumnType dropdown.
- `pgMeta.columns.create` returns a `SafeSqlFragment`.
- Studio table-editor SQL now emits bare `format` + `format_schema`,
matching pg-meta's columns SQL.

**Studio**

- `SafePostgresColumn`/`SafePostgresTable` extend the new `PG*` types
(master dropped postgres-meta).
- Pipe `ColumnTypeRef` through `SidePanelEditor` → `ColumnEditor` →
`TableEditor`, along with the column-create mutation, table
retrieve/list queries, and the `TableList`/`ColumnList` surfaces.
- `displayColumnType` helper renders arrays as `type[]` (or
`schema.type[]`) and handles non-implicit schemas.
- FK selector now carries `sourceIsArray`/`targetIsArray` and compares
the full `(format, format_schema, isArray)` triple. Family checks for
numeric/text/uuid skip when either side is an array (FKs across array
boundaries are never compatible).
- Type-mismatch and type-notice alerts pass `isArray` to the display
helper.
- Bundle `Policies.utils` + `Policies.types` + `sql-policy-mutation`,
`PolicyEditorModal`, and `SchemaGraph` here because `SidePanelEditor`
consumes `acceptGeneratedPolicy`/`AcceptedGeneratedPolicy` — splitting
requires temporary overloads with no architectural payoff.

## Additional context

Part of the SafeSql migration stack. Stacks on top of #45897.

### Manual test checklist

Surfaces touched by this PR — please exercise each:

**Table editor**
- [x] Create a new table with a mix of column types (scalar, array,
enum, foreign key)
- [x] Add a column to an existing table; verify the type dropdown lists
scalars + arrays separately and shows schema-qualified names for
non-public enums
- [x] Edit an existing column's type (scalar ↔ array, switch between
enums in different schemas) and save
- [x] Verify enum types from a non-public schema (e.g.
`private.my_enum`) display as `private.my_enum` in the column list

**Foreign key selector**
- [x] Open the FK selector for a column and pick a target column with a
matching type — no mismatch warning
- [x] Pick a target column whose type differs only by schema (two
same-named enums in different schemas) — should show a type-mismatch
alert
- [x] Pick a target column where one side is an array and the other is a
scalar of the same base type — should show a type-mismatch alert (no
auto-cast across array boundary)
- [x] When FK target sets the column type, verify `format_schema` and
`isArray` are preserved on the source column
- [x] Type-mismatch and type-notice alert messages render array types as
`type[]` (not `_type`)

**Column list / table list**
- [x] Schema-qualified type names display correctly for columns whose
type lives in a non-public schema
- [x] Array columns display as `type[]` (or `schema.type[]`)

**Policies (bundled due to import dependency)**
- [x] Open the Policies page; create/edit/delete a row-level policy via
the modal
- [x] Generate a policy via the AI assistant and accept it through
`SidePanelEditor` — verify the accepted policy lands in the editor
correctly

**Schema visualizer**
- [x] Open the Schemas → Schema Visualizer page; verify it renders
without type errors and shows tables/relationships

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Support for column types in non-public schemas and richer column type
presentation (includes schema and array info).
* Stronger SQL safety around policies and constraints; draft policy SQL
is now promoted explicitly on save.
* Improved foreign-key type validation and compatibility checks using
enhanced type metadata.

* **Tests**
* Updated snapshots and tests to reflect new column metadata and SQL
fragment handling.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45903)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 15:12:08 -04:00
oniani1 29bfa7b75b fix(studio): encode special characters in project securing policies links (#45849) 
Closes #45847.

## Summary

`ProjectNeedsSecuringView.tsx` built the `View policies` href on the
first-time security gate by interpolating `table.schema` and
`table.name` directly into the URL. A table or schema containing `&`,
`=`, `+`, or `#` corrupted the destination and routed the user to the
wrong policies filter on what is meant to be a guided onboarding flow.

Extracts the URL into `getTablePoliciesHref` in
`ProjectNeedsSecuring.utils.ts` with `encodeURIComponent` wraps, and
replaces the inline interpolation. Same pattern as #45385.

## Test plan

Added `ProjectNeedsSecuring.utils.test.ts` covering
`getTablePoliciesHref` (plain values, special chars in name, special
chars in schema, both, undefined inputs) and pulling in the
previously-untested `getTableKey`, `formatRlsDescription`, `sortTables`,
and `buildSecurityPromptMarkdown` utilities. Ten tests total.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Added comprehensive test coverage for security utilities, including
URL construction, formatting, sorting, and markdown report generation.

* **Refactor**
* Extracted URL building logic into a centralized utility function for
improved consistency and maintainability.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45849)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 18:52:49 +00:00
oniani1 461c1c1783 fix(studio): encode special characters in trigger/function cross-link search params (#45851) 
Closes #45850.

## Summary

`TriggerList`, `EventTriggerList`, and `FunctionList` built cross-links
between the database triggers and functions pages by interpolating
user-controlled identifiers directly into the URL query string. A
function or schema name containing `&`, `=`, `+`, or `#` corrupted the
destination filter and routed users to the wrong row.

Adds `getDatabaseFunctionsHref` to `TriggerList.utils` (used by both
`TriggerList` and `EventTriggerList`) and a new
`getDatabaseTriggersHref` in `FunctionList.utils`, both with
`encodeURIComponent` wraps. Replaces the three inline interpolations.

`FunctionList` only has a single search param (no schema) because the
link filters by function name only, so its helper takes one less
argument.

Same pattern as #45385.

## Test plan

Added `TriggerList.utils.test.ts` covering `getDatabaseFunctionsHref`
(plain, special chars in name, special chars in schema, both, undefined
inputs) and `FunctionList.utils.test.ts` covering
`getDatabaseTriggersHref` (plain, special chars in name, plus signs and
spaces, undefined inputs). Nine tests total.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Improved database navigation links for functions and triggers by
standardizing link generation through centralized utility functions.
This ensures consistent URL encoding and parameter handling across the
application.

* **Tests**
* Added comprehensive test coverage for database navigation link
utilities, including edge cases with special characters and empty
parameters.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45851)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 14:40:10 -04:00
oniani1 39f1358f08 fix(studio): encode special characters in table editor policy links (#45846) 
Closes #45845.

## Summary

`GridHeaderActions.tsx` interpolated `table.name` and `table.schema`
directly into the policies URL at two `<Link href>` builders. A table or
schema containing `&`, `=`, `+`, or `#` corrupted the destination and
routed users to the wrong policies filter.

Extracts the URL into `getTablePoliciesUrl` in `TableEntity.utils.ts`
with `encodeURIComponent` wraps, and replaces both inline
interpolations. Same pattern as #45385 (Linter shortcut links).

## Test plan

Added four `getTablePoliciesUrl` cases in `TableEntity.utils.test.ts`:
plain values, special chars in name, special chars in schema, special
chars in both. Existing seven tests in the same file still pass.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Improved Row-Level Security (RLS) policy URL handling in the table
editor using a shared utility function for consistent URL building and
proper parameter encoding.

* **Tests**
* Added test coverage for RLS policy URL generation with various
parameter combinations and special character handling.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45846)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 13:35:59 -04:00
Jordi EnricandClaude Sonnet 4.6 2035b2fb7b feat(logs): gate CH/otel toggle in log explorer behind feature flag (#45944) 
## Problem

The CH/otel queries toggle in log explorer was only shown on staging and
local environments, controlled by the hardcoded `IS_STAGING_OR_LOCAL`
check. This made it impossible to enable for specific users or teams in
production via a feature flag.

## Fix

Replaced the `IS_STAGING_OR_LOCAL` check with
`useFlag('showChToggleInLogExplorer')` from `common`, so the toggle
visibility is controlled by the PostHog feature flag instead of the
environment.

## How to test

1. Open log explorer on a project.
2. Without the `showChToggleInLogExplorer` flag enabled, confirm the
CH/otel toggle is not visible.
3. Enable the `showChToggleInLogExplorer` flag in PostHog for your user.
4. Reload log explorer and confirm the CH/otel toggle appears.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated internal feature gating mechanism for the OTEL toggle in Logs
settings from environment-based to flag-based configuration.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45944)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 19:06:33 +02:00
Jordi EnricandClaude Sonnet 4.6 5a067d0937 feat(unified-logs): show feature preview for flag or team/enterprise plan (#45937) 
## Problem

The unified logs feature preview was only shown to users with the
\`unifiedLogs\` LaunchDarkly flag enabled AND who were either on an
enterprise plan or on staging/local. Team plan users were excluded, and
the staging escape hatch added noise.

## Fix

Updated the eligibility check to use an OR condition: show the feature
preview if the \`unifiedLogs\` flag is on OR the org is on a team or
enterprise plan. Also added \`team\` to the
\`useIsEnterpriseOrSupabaseOrg\` hook and removed the
\`IS_STAGING_OR_LOCAL\` bypass.

## How to test

- Log in as a user on a team plan and verify the "New Logs interface"
option appears in the Feature Previews modal
- Log in as a user on an enterprise plan and verify the same
- Log in as a user on a free or pro plan without the \`unifiedLogs\`
flag enabled and verify the option does not appear
- Enable the \`unifiedLogs\` LaunchDarkly flag for a free/pro user and
verify the option appears

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Unified logs preview is now more accessible for enterprise and
Supabase organizations without requiring additional staging conditions.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45937)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 18:01:59 +02:00
Joshen Lim ebfec0df36 Improve click targets on property actions (#45936) 
## Context

When opening the logs detail panel, some of the fields can be clicked to
add them as a filter. However the existing UX is that the clickable part
is just the text which makes it target small
<img width="233" height="127" alt="image"
src="https://github.com/user-attachments/assets/1d876bcc-05cf-464c-bdbe-907229be0586"
/>

Am opting the following:
- Make the whole row clickable
- Make all rows clickable with the main action being "Copy {column}"
- Only filterable columns will have the option to "Add as filter"

### After
<img width="483" height="153" alt="image"
src="https://github.com/user-attachments/assets/9d6e5479-fdbb-4609-839c-2bb7ad571b57"
/>
<img width="473" height="152" alt="image"
src="https://github.com/user-attachments/assets/f22197df-fa59-4e01-be00-2557260374f8"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Row actions now consistently wrap rows and show a filter icon next to
the label when a resolved filter is available; copy menu displays "Copy
{label}".

* **Style**
* Standardized icon sizes and adjusted dropdown/row spacing; simplified
text wrap/truncate behavior for field values; minor status text color
refinement.

* **Bug Fixes**
* Dropdown row-action rendering made more robust to ensure menu wrappers
render reliably.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45936)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 22:31:40 +08:00
Charis ec21e68eee studio(logs): use safe sql escaping for new logs queries (#45887) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Introduced a safe SQL fragment system and helpers to build composable,
validated log queries and aggregations.

* **Refactor**
* Rewrote unified log query builders and inspection flows to use the new
safe fragments and identifier/literal validators.

* **Bug Fixes**
* Improved validation and error handling for filter keys and literal
escaping to prevent malformed or injectable queries.

* **Tests**
* Added tests covering identifier quoting, value escaping, and rejection
of invalid filter inputs.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45887)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 10:29:50 -04:00
Joshen Lim eb915e99f8 Joshen/debug 76 fix sticky hover state on log rows (#45933) 
## Context

The original problem was that some log rows remain in the hover state
after the cursor moves away

I was just cleaning up some of the styles and noticed that it doesn't
seem to happen anymore so thinking this might have fixed it haha 😅

## Changes involved
- Remove `group-hover` background color change behaviour in `TableCell`
in `ui`
- `TableRow` should handle the background color instead, hence the
changes in `UnifiedLogs.utils` too
- Remove unnecessary `renderLiveRows` in `DataTableInfinite` -> the prop
isn't being passed anywhere

## To test
- [ ] The sticky hover state happens when you hover over the rows very
quickly, so just make sure there's no "stale" hover state in any row eg:
<img width="400" alt="image"
src="https://github.com/user-attachments/assets/b4a91bc6-d269-4ee6-b222-b0476b9feffa"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Standardized hover styling for log rows and table cells to use direct
hover rules for more consistent visual feedback.
* Adjusted table cell hover/transition behavior to simplify styling
while preserving layout and checkbox spacing.
* Streamlined the data table API by removing the custom live-row
rendering override.
* Made the resizable panel’s minimum size dynamic based on dock
position.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45933)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 22:00:04 +08:00
Vaibhav b56ba64d2e fix: tooltip dates (#45922) 
## TL;DR

fixes one day off observability tooltip 

## before:
<img width="227" height="159" alt="image"
src="https://github.com/user-attachments/assets/6cc8653f-2304-4d63-bf53-af01425c0d96"
/>

## after:
 
<img width="288" height="200" alt="image"
src="https://github.com/user-attachments/assets/9aa35e63-2fbc-42aa-82c8-1a3b158e6f40"
/>


## ref:

- closes https://github.com/supabase/supabase/issues/45921
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved chart tooltip date label formatting: tooltips now detect
ISO-like date strings and format them consistently, while preserving
previous formatting for other values. This change ensures correct,
readable dates in both bar and line chart tooltips within reports.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45922)

<!-- review_stack_entry_end -->

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45922)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 15:28:49 +02:00
Joshen Lim ea03214d3d Support dock position (#45919) 
## Context

Added an option to change dock position when a row is selected in
unified logs

Just note that this involves the `LogsListPanel` - i'm not too sure how
this will look like tbh as I don't have any logs in my unified logs UI
that match the criteria to render the `LogsListPanel` (e.g there could
be a scenario where we have 3 panes side by side)

<img width="1452" height="955" alt="image"
src="https://github.com/user-attachments/assets/21c1a576-7f63-463f-88bf-04c05691995b"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **New Features**
* Users can now toggle the service flow panel dock position between
bottom and right alignment
  * Dock preference is automatically saved and persists across sessions

* **Bug Fixes**
* Improved logs data validation in the logs list panel for more reliable
rendering

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45919)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 20:52:10 +08:00
Joshen Lim cf49bc74ef Update copy for adding filter from log details (#45918) 
## Context

Just updates the copy for adding filters from the log details in unified
logs. "Include" was vague so opting for something more clearer, "Add as
filter for {column}"

### Before
<img width="199" height="130" alt="image"
src="https://github.com/user-attachments/assets/b5e0231c-99de-42a3-9cf2-66e0d9558379"
/>


### After
<img width="262" height="140" alt="image"
src="https://github.com/user-attachments/assets/8e8e3889-443c-4566-b118-7a13eb60f3b1"
/>

<img width="235" height="146" alt="image"
src="https://github.com/user-attachments/assets/e23b15ff-dd35-4e47-9d17-a82c8b898534"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved data table filter dropdown UI with clearer action labels and
properly sized icons for checkbox and input filter types.
* Expanded filter dropdown menu width for better visual clarity and
usability.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45918)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 20:45:21 +08:00
Joshen Lim 98ecf8001e Use font mono for unified log rows (#45917) 
## Context

Opting to use `font-mono` and `tracking-tight` for all the data within
the unified logs table to improve readability

### Before
<img width="1451" height="956" alt="image"
src="https://github.com/user-attachments/assets/8c3f51b8-40bb-4e84-b1b3-af4d69e92224"
/>


### After
<img width="1450" height="959" alt="image"
src="https://github.com/user-attachments/assets/5cb64864-fdf8-4c97-8caf-a440aa405b3d"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Refined the visual styling of the Unified Logs table columns for
improved readability, including updated typography and letter spacing
for the Date, Method, Pathname, and Event message columns.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45917)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 20:45:04 +08:00
Joshen Lim 1b3a88a323 Opt to use Code2 icon instead of BookHeart for unified logs postgrest rows (#45916) 
## Context

We use the `Code2` icon for the Data API integration, so opting to use
the same icon for Postgrest in unified logs for consistency
<img width="538" height="176" alt="image"
src="https://github.com/user-attachments/assets/cd98d781-be60-4d09-9dcb-6f064c58f446"
/>


### Before
<img width="422" height="87" alt="image"
src="https://github.com/user-attachments/assets/4c7024ad-b5a7-48aa-8f27-46bb8cd94b57"
/>


### After
<img width="434" height="89" alt="image"
src="https://github.com/user-attachments/assets/4bc18b10-53ee-4c57-89e3-52f45cc8fc07"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **UI Improvements**
* Updated the icon representation for PostgreSQL REST API logs to
enhance visual clarity and user recognition.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45916)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 20:44:37 +08:00
Joshen Lim 597ad2ba56 Fix width of unified logs table to fit viewport, which fixes centering of load more button (#45914) 
## Context

Load more button in unified logs was off center because the `table`
element was exceeded the viewport width.
The fix needed was hence to adjust the width of the `table` to only take
up the remaining width of the viewport which then fixes the positioning
of the load more button.


### Before
<img width="1446" height="204" alt="image"
src="https://github.com/user-attachments/assets/fcd99e18-ede8-4454-b612-91b4384fb3e1"
/>


### After
<img width="1450" height="274" alt="image"
src="https://github.com/user-attachments/assets/d5f56383-bdb0-4418-a36f-242e72fe3a5b"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Updated table container styling and layout properties for improved
rendering.
* Enhanced table header cell structure with improved styling attributes.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45914)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 20:44:17 +08:00
Joshen Lim 8ee2f90d65 Target hover background color change for unified log rows to the cell (#45915) 
## Context

The `TableCell` component from `ui` has a `group-hover:bg-surface-200`
class name
([ref](https://github.com/supabase/supabase/blob/master/packages/ui/src/components/shadcn/ui/table.tsx#L152)),
hence the original class names in `UnifiedLog.utils.ts` which targets
only the table row's background color on hover doesn't work.

Hence fix is to target the `td` element on row hover to apply the
background color change

Although separately, i'm wondering whether it makes more sense for the
hover bg color change to be applied on the `tr` instead of `td`

### Before
<img width="1182" height="61" alt="image"
src="https://github.com/user-attachments/assets/78939525-7832-4c4f-8985-e856715a731b"
/>

### After
<img width="1211" height="79" alt="image"
src="https://github.com/user-attachments/assets/5726063d-d06a-439c-90d8-a27407a94a05"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Enhanced hover interactions for warning and error log rows with
improved dark mode styling consistency.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45915)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 20:35:47 +08:00
Joshen Lim 59c550ac49 Improve loading state for unified logs (#45913) 
## Context

Improves loading state for unified logs

### Before
<img width="1451" height="957" alt="image"
src="https://github.com/user-attachments/assets/97280982-1358-4234-bcf4-d3e6590040b9"
/>


### After
<img width="1451" height="956" alt="image"
src="https://github.com/user-attachments/assets/b28eb3a8-e7eb-4fc9-bd0d-d0c8d40933ec"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **UI Improvements**
  * Organization slug field now displays as read-only.
* Data table loading states now show skeleton rows with shimmer effect
instead of spinner.
  * Empty state displays simplified "No results found" message.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45913)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 20:35:22 +08:00
Raminder SinghandJoshen Lim 897043952a feat: add edge function secret installation method (#45826) 
Adds a new method of installation detection for partners like Doppler.
Doppler creates edge function secrets with specific names
(`DOPPLER_CONFIG`, `DOPPLER_ENVIRONMENT`, and `DOPPLER_PROJECT`). This
method allows the dashboard to check for the presence of such a secret
to show the installation status.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Support for edge-function-secret-based OAuth identification and
verification.
* Installation checks adapt to the selected installation method and only
fetch required credentials when needed.
* Integration detection can validate installations via API key prefixes
or matching edge-function secret names.
* **Chores**
* Shared helper utilities and types exported to streamline installation
checks and mappings.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45826)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-05-14 13:52:29 +05:30
Jordi Enric 19e0b36650 feat(logs): migrate unified logs queries to OTEL endpoint DEBUG-71 (#45642) 2026-05-14 08:56:32 +02:00
K-Dog (Kevin) 2efaf8e5c1 chore(upcoming invoice): min amount / no plan fee (#45877) 
Prep work for new platform plan
<img width="733" height="120" alt="Screenshot 2026-05-13 at 8 25 29 PM"
src="https://github.com/user-attachments/assets/5667bb86-e317-44f7-86ac-07a8c5cc1994"
/>
 2026-05-14 12:05:11 +08:00
Danny White fd01c665e2 feat(studio): move Stripe Projects to connect interstitial (#45862) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature update. Resolves DEPR-553.

## What is the current behavior?

Stripe Projects login still uses the older `APIAuthorizationLayout`
surface, so it does not match the newer shared connect interstitial
pattern used by organisation invites and CLI login.

## What is the new behavior?

Moves `/partners/stripe/projects/login` onto the shared
`InterstitialLayout` while preserving the existing `ar_id` account
request lookup, confirmation mutation, wrong-account sign-out path, and
missing-parameter redirect.

The temporary reviewer mocks have been removed after approval.

## Testing instructions

Automated checks run locally:

- `pnpm --dir apps/studio exec prettier --write
pages/partners/stripe/projects/login.tsx
components/layouts/InterstitialLayout.tsx`
- `pnpm --dir apps/studio exec eslint
pages/partners/stripe/projects/login.tsx
components/layouts/InterstitialLayout.tsx`
- `git diff --check`

`pnpm --dir apps/studio exec tsc --noEmit` was also run earlier on this
branch, but still fails on existing unrelated issues in
`components/interfaces/Integrations/Landing/useAvailableIntegrations.tsx`
and `packages/common/marketplace-client.ts`.

Manual Stripe Projects testing requires a real account request. Opening
`/partners/stripe/projects/login` without an `ar_id` redirects to `/404`
by design.

If you need the real flow:

1. Use the Stripe staging provider. In the Stripe CLI flow, run `export
DEV_MODE=true` so the provider is `Supabase_Staging_Env`.
2. From a local project directory, run `stripe projects init` and
complete the Stripe setup flow.
3. Run `stripe projects add Supabase_Staging_Env`.
4. When the browser opens the Supabase authorization URL, keep the
generated path and query string exactly as-is, including `ar_id`, but
replace only the origin with this PR preview deployment origin.

Note: the staging Stripe Projects flow can still incur real Stripe
costs; use the staging provider and coordinate refunds with team billing
if needed.

## Additional context

This is a deliberately small stacked slice toward the broader shared
connect interstitial work.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **User Interface**
* Redesigned Stripe authorization login page with improved layout and
visual state management
* Enhanced account row component to support flexible action buttons and
styling
* Added clearer messaging and UI states for authorization scenarios
(pending, success, errors, and account mismatches)

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45862)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-14 12:13:10 +10:00
Raminder SinghandSaxon Fletcher 5a41d0155e chore: integration UI refinement (#45507) 
This PR:

* Refactors integrations page implementation to make it simpler and
easier to understand.
* Integration category pages from marketplace db show category name and
description.
* Shows featured integrations coming from the marketplace db at the top
of the page.
* Hides empty categories:
https://linear.app/supabase/issue/INT-113/hide-empty-categories-on-dashboard-integrations-page

Below design related fixes will be done in a separate PR:
https://github.com/supabase/supabase/pull/45856. So this PR is ready to
merge with current fixes.

<details>

~~Design fixes needed after consulting with the design team:~~

- [ ] ~~Do not use inverted colors on images for featured integrations.
This leads to inconsistent images for the featured marketplace listings.
E.g. Grafana listing shown in the featured listings:~~
<img width="463" height="260" alt="image"
src="https://github.com/user-attachments/assets/76816807-667f-44b0-b68c-5e1ca342be1f"
/>

~~vs shown on it's own page:~~

<img width="909" height="667" alt="image"
src="https://github.com/user-attachments/assets/00efda48-3e4e-4b05-87ad-cbbce9047c94"
/>

- [ ] ~~The images on featured marketplace integrations should not be
truncated as seen in the first image above.~~
- [ ] ~~The **Install integration** button feels floating far out on the
right.~~
- [ ] ~~The description under the title is too long and truncated.
Requested by Doppler here:
https://supabase.slack.com/archives/C0AL11JG5MG/p1778009104728819?thread_ts=1777654129.027269&cid=C0AL11JG5MG~~
- [ ] ~~The content section doesn't render bulleted lists correctly.~~
</details>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Dedicated "Featured Integrations" section on the integrations page.
* Integrations can be marked as featured to appear in the featured
section.

* **Improvements**
  * Sidebar shows only categories that contain integrations.
  * Integration image handling improved for featured cards.
* Updated loading placeholders for integrations to provide a smoother
loading experience.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45507)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Saxon Fletcher <saxonafletcher@gmail.com>
 2026-05-14 02:36:28 +05:30
Charis 2d2cc95caa studio: add SafeSql foundation utilities (1/7) (#45897) 
## Summary

First in a stack of seven PRs migrating the remaining `executeSql` call
sites to `SafeSqlFragment`. This PR lands pure additions — shared types
and helpers that later PRs import.

- `apps/studio/lib/postgres-types.ts` — `SafePostgresColumn` /
`SafePostgresTable` wrappers over `PGColumn` / `PGTable` that brand
`check` as `SafeSqlFragment` and add the optional `format_schema` field
- `apps/studio/lib/sql.ts` — `trimSafeSqlFragment` overload set that
preserves the brand through `.trim()`
- `apps/studio/lib/type-helpers.ts` — refine `DeepReadonly` so
primitives pass through unchanged
- `apps/studio/components/ui/SafeSqlInput.tsx` — `<Input>` wrapper that
emits `SafeSqlFragment` via `rawSql`

No consumers in this PR. The next PRs in the stack pick these up.

## Stack

This is PR 1 of 7. The full sequence:

1. **This PR** — Foundation utilities
2. `charis/safe-sql-last/2` — pg-meta columns + ColumnTypeRef cascade
3. `charis/safe-sql-last/3` — pg-meta non-column SafeSql
(functions/policies/triggers)
4. `charis/safe-sql-last/4` — Studio reports / query performance /
privileges
5. `charis/safe-sql-last/6` — Stragglers + remaining tests
6. `charis/safe-sql-last/7` — Flip `executeSql` signature from `string`
to `SafeSqlFragment`

## Test plan

- [x] `pnpm typecheck` passes for the Studio target on this branch
- [x] No runtime behavior changes — only type-level additions and a new
unused component

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **New Features**
* Introduced SafeSqlInput component providing secure and validated SQL
query input handling with built-in constraints and error prevention.

* **Refactor**
* Enhanced internal type definitions and utilities for Postgres metadata
handling and SQL operations to improve code reliability and
maintainability.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45897)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 14:57:08 -04:00
Vaibhav 9b86b6ca25 test: cron coverage (#45895) 
adds coverage for:
- https://github.com/supabase/supabase/pull/45848 which
solved/closed: https://github.com/supabase/supabase/issues/45860

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Enhanced test coverage for parsing SQL commands with lowercase
statements to ensure robust handling of case-insensitive input.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45895)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 11:43:56 -06:00
Charis d4079083fc chore(studio): drop @supabase/postgres-meta in favor of @supabase/pg-meta (#45844) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Refactor / dependency cleanup.

## What is the current behavior?

`apps/studio` lists both `@supabase/pg-meta` (workspace package) as a
runtime dep and `@supabase/postgres-meta` (external npm package,
`^0.64.4`) as a devDependency. The external package is used only for
type imports across 44 files — there is no runtime usage and no codegen
pipeline that needs it.

## What is the new behavior?

Every `Postgres*` type import (`PostgresTable`, `PostgresColumn`,
`PostgresPolicy`, `PostgresTrigger`, `PostgresView`,
`PostgresMaterializedView`, `PostgresForeignTable`, `PostgresSchema`,
`PostgresPublication`, `PostgresRelationship`, `PostgresPrimaryKey`) is
replaced with its `PG*` counterpart from `@supabase/pg-meta`, and the
external dep is removed from \`apps/studio/package.json\`. Top-level
type re-exports were added to \`packages/pg-meta/src/index.ts\` so
consumers can import directly from the package root.

Two latent issues surfaced by the stricter pg-meta types are also fixed:
- \`data/foreign-tables/foreign-tables-query.ts\` was casting
foreign-table results as \`PostgresView[]\`; corrected to
\`PGForeignTable[]\`.
- \`pg-meta\`'s \`PGTrigger\` Zod schema declared
\`orientation\`/\`activation\` as \`z.string()\`, inconsistent with
pg-meta's own \`getDatabaseTriggerUpdateSQL\` helper that requires the
narrow literal unions; tightened to \`z.enum\`.

## Additional context

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated internal TypeScript type definitions across the codebase to
use the latest type system from `@supabase/pg-meta`.
  * Removed `@supabase/postgres-meta` dependency.
* Enhanced type validation for database triggers and schemas to enforce
stricter constraints.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45844)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 16:07:10 +00:00
Ali Waseem 6383150c3e fix(tests): flaky unit tests (#45852) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

- Typing each character by hand leads to slowness with multiple render
cycles in CI
- Update timeouts 

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Improved test reliability and stability for the Support form page.
Enhanced test synchronization and timing for UI interactions including
form field prefilling, organization and project selection, category and
severity assignment, form submission, error notifications, dashboard
logging toggles, and attachment uploads. These enhancements strengthen
test quality and help prevent regression issues in form functionality.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45852)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 08:55:49 -06:00
Vaibhav fe769bfe7e fix: escape quotes (#45848) 
## TL;DR


- closes https://github.com/supabase/supabase/issues/45860
- closes https://github.com/supabase/supabase/issues/45544
 & supersedes https://github.com/supabase/supabase/pull/45543


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added explicit allowed facet fields and validation to prevent invalid
facet usage.

* **Bug Fixes**
* Improved filter handling by coercing values to strings and properly
escaping single quotes for array, scalar, and LIKE filters (including
facet search), reducing query errors and injection risks.
* Enhanced parsing of scheduled-job SQL commands to tolerate varied
casing/whitespace and strip leading SELECT before processing.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45848)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 08:32:15 -06:00
Ali WaseemandDanny White 712cf7e60b feat(storage): add keyboard shortcuts for storage screens (#45837) 
## Summary

Adds keyboard shortcuts to the Storage section, mirroring the
conventions already established for Auth Users and Database pages:

- **Storage navigation chords** (`S, F` / `S, A` / `S, V` / `S, 3`)
active only inside `StorageLayout`.
- **Files (bucket list) page** shortcuts for search, create, refresh,
reset filters, reset sort.
- **Storage Explorer** shortcuts for upload, new folder, view toggle,
refresh, search, multi-select download/move/delete, and an Escape
ladder.
- `ShortcutTooltip` wired into the relevant buttons so users can
discover keybinds on hover.
- Reload spinner is now driven by a shared store flag, so it shows
whether you click the button or fire the shortcut.

## Test plan

### Storage navigation chords
Active anywhere under `/project/<ref>/storage/*`.

| Keybind | Action |
|---------|--------|
| `S` then `F` | Go to Files |
| `S` then `A` | Go to Analytics buckets (platform + feature-flagged) |
| `S` then `V` | Go to Vector buckets (platform + feature-flagged) |
| `S` then `3` | Go to S3 settings (platform only) |

### Files (bucket list) page
At `/project/<ref>/storage/files`.

| Keybind | Action | Notes |
|---------|--------|-------|
| `Shift+F` | Focus search ("Search buckets") | Selects existing text |
| `Shift+N` | Create new bucket | Opens the create-bucket modal |
| `F` then `C` | Reset filters | Clears the search string |
| `Shift+R` | Refresh buckets | Refetches the bucket list |
| `S` then `C` | Reset bucket sort | Only fires when sort ≠ default
(Created at) |

### Storage Explorer (inside a bucket)
At `/project/<ref>/storage/files/buckets/<bucketId>`.

| Keybind | Action | Notes |
|---------|--------|-------|
| `Shift+F` | Focus search ("Search files") | Opens the search input if
hidden, then focuses |
| `Shift+R` | Refresh | Refetches all opened folders; spinner reflects
state |
| `I` then `F` | Upload files | Disabled w/o ` STORAGE_WRITE ` or at
bucket root with no folder |
| `I` then `N` | Create folder | Same permission gates as Upload |
| `V` then `C` | View as columns | |
| `V` then `L` | View as list | |
| `Shift+D` | Download selected | Only fires when ≥1 item selected;
single vs many handled |
| `Shift+M` | Move selected | Only fires when ≥1 item selected AND `
STORAGE_WRITE ` granted |
| `Mod+Backspace` | Delete selected | Only fires when ≥1 item selected
(` Mod ` = ⌘ on macOS / ` Ctrl ` on Win/Linux) |
| `Escape` | Clear selection | If ≥1 item selected |
| `Escape` | Close file preview | If no selection and preview pane open
|
| `Escape` | Close search | If no selection, no preview, and search is
open |

### Tips while testing
- [x] Chords (two-key sequences): press the first key, release, then
press the second key within ~1s
- [x] Hover any wired button (search, Refresh, Upload, Create folder,
View, Download, Move, Delete, the bucket Create button, sidebar items)
to see the keybind in a tooltip
- [x] Most actions also appear under "Shortcuts" in `Cmd+P`
- [x] Chords starting with a plain letter (` S, F ` / ` I, F ` / ` V, C
` / ` F, C ` / ` S, C `) won't fire while typing in an input — click out
first
- [x] `Escape` does fire from inside the search field (closes the
search)
- [x] `Cmd+/` opens the full shortcuts reference

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Keyboard shortcuts added across Storage: buckets (refresh, clear sort,
create, search), explorer (upload, create folder, refresh, download,
move, delete, clear search), and navigation shortcuts for
Files/Analytics/Vectors/S3.
* **UI**
* Shortcut keytips/tooltips added to relevant buttons and menu items for
discoverability.
* **Documentation/Tests**
  * Shortcut reference sheet labels updated and covered by a new test.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45837)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
 2026-05-13 08:26:04 -06:00
kemal.earth 8ca04989c8 fix(studio): reports table footer overflow (#45885) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

A small bug that was causing the overflow of chart table footers to
break on smaller viewports. Now fixed along with cell horizontal
spacing.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Enhanced table layouts in the Reports section by enabling horizontal
scrolling for API Routes and Cache Misses tables, ensuring all data is
visible on various screen sizes.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45885)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 08:09:18 -06:00
kemal.earth 8459c34202 fix(studio): export metric banner logos overflow (#45879) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

These logos began to overflow the more log drains we've added. Imported
the animated logos from the empty state of log drains settings on free
accounts.

| Before | After |
|--------|--------|
| <img width="317" height="256" alt="Screenshot 2026-05-13 at 13 38 11"
src="https://github.com/user-attachments/assets/46f04abc-fe33-48f2-8c1f-7d543c85b5a8"
/> | <img width="638" height="540" alt="CleanShot 2026-05-13 at 13 47
11"
src="https://github.com/user-attachments/assets/e49a9123-f486-45d8-9714-ef41402762d6"
/> |





<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **New Features**
* Expanded support for additional telemetry and service integrations
including OTLP, Amazon S3, Axiom, Last9, and Syslog in the Log Drains
interface.

* **Refactor**
* Updated animated logo component to support flexible sizing and styling
options, improving layout consistency across the metrics API banner.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45879)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 14:35:30 +01:00
Joshen Lim 28f5484369 Prevent request billing owner for downgrade of plan (#45823) 
Related PR: https://github.com/supabase/supabase/pull/45803

Opting for a simpler way to prevent requesting billing owners for
downgrading of plan as such:
<img width="933" height="258" alt="image"
src="https://github.com/user-attachments/assets/604b8c2f-9341-4aec-885c-e2d9d2861b9f"
/>

Currently we're incorrectly showing a "Request to upgrade to Free" CTA

## To test

- [ ] For a pro plan or above organization, and a user that has a
"Developer" role, ensure that you're not able to downgrade the org nor
send a upgrade request


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Clarified CTA behavior for users without billing update permission:
downgrade actions now show a disabled button with an explicit tooltip,
while non-downgrade upgrade attempts prompt a request to billing owners.
Tooltip messaging has been refined across enterprise, free-tier, and
marketplace-managed plans for clearer guidance.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45823)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 21:32:34 +08:00
Joshen Lim 2d47836f39 Joshen/fe 3213 make rls tester feedback callout more obvious (#45820) 
## Context

Minor nit to adjust the "Give feedback" button at the bottom to use
default type + external link icon
<img width="612" height="68" alt="image"
src="https://github.com/user-attachments/assets/e74370cb-d284-4552-a69d-8c838f565af7"
/>

Also added telemetry for the "Run query" button

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added analytics tracking for RLS Tester query runs to better
understand how the feature is used.

* **Style**
* Updated the "Give feedback" button in the RLS Tester to use the
default button style and display an external-link icon for clarity.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45820)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 21:08:41 +08:00
Ivan Vasilov 380c917b94 chore: Bump vulnerable dependencies (#45876) 
- Bump various vulnerable dependencies, `nitropack`, `mermaid`, `hono`,
`protobufjs`, `fast-xml-builder` and `fast-uri`.
- Add `babel/core` to `studio` to stabilize the dependency resolving for
`studio`.
- Also deduped `cheerio`, `c12`, `browserslist`, `unstorage` and
`@mdx-js/mdx` since they were present as multiple similar versions.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Added development dependency for the studio application build tooling
* Updated workspace configuration to refine dependency exclusion
settings

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45876)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 14:50:01 +02:00
kemal.earth 376d85d7b2 fix(studio): query performance query column truncation (#45878) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Previously our Query Performance Query column was scrollable inline.
This means if you have thicc scrollbars turned on via your OS, it would
look a bit clunky. This fix truncates query, full query still viewable
in the click through sheet.

| Before | After |
|--------|--------|
| <img width="1106" height="1164" alt="cleanshot_2026-05-13_at_18 56
16_2x"
src="https://github.com/user-attachments/assets/4718e8d7-d3c5-499b-a125-6192ac547bfe"
/> | <img width="456" height="286" alt="Screenshot 2026-05-13 at 13 34
30"
src="https://github.com/user-attachments/assets/7446afb5-c0d7-4272-905a-42c144334472"
/> |






<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Style**
* Adjusted query column width in the query performance monitoring table
for optimized layout.

* **Bug Fixes**
* Enhanced query display rendering with improved data type handling to
prevent potential display issues.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45878)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 13:48:50 +01:00
Ivan Vasilov 0abe792889 chore: Migrate the main Tailwind JS config to CSS (#45686) 
This PR migrates the JS config for Tailwind into a CSS config. As such,
all variables have been defined as CSS variables and they're using the
specialized Tailwind syntax for generating utility classes.

Beside the migration, these changes were also added:
- Added `tailwind.config.css` to few packages to make the Tailwind
Intellisense work.
- Migrated away from Radix style color classes to our defined classes,
the values will remain the same.
- Most of the CSS is generated by scripts, they'll be removed in next
PRs.
* Removed redundant `border-light` classes from several components since
it was undefined.
* Removed redundant `text-strong` classes from several components since
it was undefined.

How to test:
- Open all apps, compare the UI (mainly colors) to builds from #45417
and try to find a difference.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Style**
* Harmonized color variable usages and updated UI color references
(affects palettes, charts, gradients, hero illustrations, and
scrollbars).
  * Tweaked border, tab, and selection visuals across components.

* **New Features**
* Added a suite of theme animations and refined typography presets used
by site prose and docs.

* **Refactor**
* Overhauled Tailwind/theme configuration and color token generation for
more consistent theming.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 13:14:58 +02:00
Joshen Lim d6d644ec24 Update project name if dashboard is local CLI (#45864) 
## Context

Very minor one, just updates the project name for local CLI, to show
"Supabase Studio (CLI)" instead of "Default project" which is a bit more
meaningful

<img width="1450" height="374" alt="image"
src="https://github.com/user-attachments/assets/b6c60172-99e2-43b7-a095-2914248ed292"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **UI Updates**
* Refined Project dropdown styling in non-platform mode with improved
spacing and text sizing
* Default project name now dynamically displays as "Supabase Studio
(CLI)" when applicable
* Minor header layout tweaks for more consistent spacing and transitions
* Improved local version indicator initialization for more reliable
version display

* **Other Updates**
  * Small code and organization refinements

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45864)

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45864)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 16:38:28 +08:00
Gildas GarciaandAli Waseem bcfc666284 chore: migrate remaining old input usages (#45791) 
## Problem

We still use our old `Input` in some places. This means multiple
components are bundled for the same use cases and we have some design
differences across the application.

## Solution

- [x] Migrate to the new ShadCN inputs
- [x] Fix `<InputGroupButton>` cannot be used with components that
triggers modal, popovers, dropdowns
- [x] Fix `<FormLayout>` does not display errors for inputs that are not
inside a React Hook Form
- [x] Fix `InputGroup` invalid design 

## Screenshots

### Table Editor - table edition sidepanel

Before:
<img width="758" height="1206" alt="image"
src="https://github.com/user-attachments/assets/d4da4af0-a9d3-4967-935f-554233d7896b"
/>

After:
<img width="747" height="1209" alt="image"
src="https://github.com/user-attachments/assets/6286e6a0-317f-486c-a8b4-0e233706ba0f"
/>

### Table Editor - row edition sidepanel
Before:
<img width="675" height="710" alt="image"
src="https://github.com/user-attachments/assets/9fdfe819-6d62-40c8-bdc8-fa6051dab834"
/>

After: (I placed the TextArea button at the bottom because ShadCN
reserves a full line space for it. It was weird at the top.
<img width="674" height="714" alt="image"
src="https://github.com/user-attachments/assets/611d5f8d-de12-4c16-ac38-bd9192cd6d73"
/>

### Database settings - password reset modal
Before:
<img width="773" height="548" alt="image"
src="https://github.com/user-attachments/assets/17f679a7-3aed-4cf9-8245-194a8a16823f"
/>

After:
<img width="563" height="311" alt="image"
src="https://github.com/user-attachments/assets/08888471-4cc8-4a3c-bf1e-8dce364f1aa6"
/>

### Database - Event triggers
Before:
<img width="1134" height="453" alt="image"
src="https://github.com/user-attachments/assets/e9d06d58-782c-4ccb-93c0-2ce1ca8c5748"
/>

After:
<img width="1115" height="451" alt="image"
src="https://github.com/user-attachments/assets/c437acb0-c602-4dd2-b249-66c7a7e739d6"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Copy action now shows confirmation state (“Copy” → “Copied”) when
copying error details.

* **UI Improvements**
* Unified form-field layouts and input-group composition across editors,
settings, and integration forms for a more consistent experience.
* Password-strength feedback moved into field layout for clearer
messaging.
* Improved inline input/button/dropdown behaviors and non-React-form
error display.

* **Removed**
  * Display configuration settings component.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45791)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ali Waseem <waseema393@gmail.com>
 2026-05-13 09:40:00 +02:00
Gildas Garcia 35571d242e chore: migrate <Collapsible> to shadcn <Collapsible> (#45819) 
## Problem

We have multiple `Collapsible` components.

## Solution

Reduce their number by using only the one from shadcn.
I haven't noticed any visual nor functional changes.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Migrated expandable/collapsible UI to a unified shadcn-based
implementation for more consistent expand/collapse behavior across the
app.

* **Style**
* Updated listbox check icon sizing and removed obsolete collapsible
open/close animations.

* **Chores**
* Removed deprecated collapsible variants and consolidated UI component
surface for simpler maintenance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 09:39:48 +02:00
Gildas Garcia 0751fe2bf4 fix: logs explorer field references doesn't show all sources (#45828) 
## Problem

The field reference side panel doesn't show all sources: there are
actually 11 items and users can't see them nor select them.

## Solution

Use a combobox instead

## Screenshots

Before:
<img width="667" height="414" alt="image"
src="https://github.com/user-attachments/assets/8017597f-e058-4306-8761-fb54d8c653ba"
/>

After:
<img width="1306" height="1642" alt="image"
src="https://github.com/user-attachments/assets/67579315-65cc-4bf9-9744-42f09b816772"
/>
<img width="1346" height="972" alt="image"
src="https://github.com/user-attachments/assets/13df449a-0bb1-41e4-934d-0bb18e9f06d9"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Schema selector in the Logs Query Panel is now a searchable popover
and shows the selected source in the button (or prompts “Select
source...”).
  * Field table now displays fields for the chosen schema only.

* **Refactor**
* UI simplified for faster schema selection and clearer field reference
browsing.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45828)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 09:14:42 +02:00
Danny White 205ab69061 feat(studio): move CLI login to connect interstitial (#45814) 
## What kind of change does this PR introduce?

Feature / UI refactor

## What is the current behaviour?

The CLI browser login route still uses the older API authorisation
layout and redirects missing or failed sign-in session states to generic
404/500 pages.

## What is the new behaviour?

Moves `/cli/login` onto the shared connect interstitial layout as the
next small stacked slice after the organisation invite work.

This keeps the real CLI login contract intact while updating the
surface:
- creates the CLI login session from `session_id`, `public_key`, and
optional `token_name`
- redirects to the generated `device_code`
- renders missing-parameter and session-creation failures in-card
instead of redirecting away
- keeps the 8-character verification code selectable and copyable as a
single string
- uses a full-width primary `Copy code` action

This also adds the small shared interstitial helpers needed by this
surface and adjusts `CopyButton` so the copied check icon inherits the
primary button colour instead of turning green.

This also removes the CLI version admonition:

> Browser login flow requires Supabase CLI version 1.219.0 and above.

I checked with our stats and the CLI team. The vast majority of users
are on a newer version.

| Before | After |
| --- | --- |
| <img width="1024" height="759" alt="Authorize API access
Supabase-D1E3CF26-BD59-4BB2-B457-B552EE47E3DA"
src="https://github.com/user-attachments/assets/c89b8b13-fa98-41b7-8093-e59d15b2aa9e"
/> | <img width="1024" height="759" alt="Authorize CLI
Supabase-C9977F21-88B8-441B-8A2C-09A9515935B0"
src="https://github.com/user-attachments/assets/ca13b65a-3875-425c-b73b-8f2101c1e406"
/> |
| <img width="1024" height="759"
alt="Supabase-F42FBEAF-F74D-4920-8A51-7C25004F66D5"
src="https://github.com/user-attachments/assets/51adb1e6-a2fb-41fb-b36f-0ae466fe60e2"
/> | <img width="1024" height="759" alt="Authorize CLI
Supabase-8159A1B1-2594-4183-AC35-FEF1EFD4EA37"
src="https://github.com/user-attachments/assets/6f143218-795d-41c9-a8e1-52e529a6b988"
/>
| <img width="1024" height="759"
alt="Supabase-2506E468-9F42-44B9-A5B7-BC4D3777F552"
src="https://github.com/user-attachments/assets/a304fca5-cf26-4ae7-abe9-77cdbc21fba5"
/> | <img width="1024" height="759" alt="Authorize CLI
Supabase-A0EE1239-A345-427C-9CF7-997037A8FC0E"
src="https://github.com/user-attachments/assets/33118777-35f3-49d6-bc1e-30e7124b3677"
/> |
| <img width="1024" height="759" alt="Authorize API access
Supabase-A7B84CA6-D230-4C3E-9227-DE21CE35375C"
src="https://github.com/user-attachments/assets/78eb6296-035a-4201-b254-b97eda44443c"
/> | <img width="1024" height="759" alt="Authorize CLI
Supabase-F55E26B2-609B-449C-9C64-08AA90AE3D1E"
src="https://github.com/user-attachments/assets/ff7b3b4e-729c-4681-844d-2d5d94bfc084"
/> |

## Testing instructions

Use the Vercel preview URL for this PR once it is available. The
examples below use `<preview-origin>` as a placeholder, for example
`https://studio-git-dnywh-feat-cli-login-interstitial-supabase.vercel.app`.

You need to be signed in to Studio to see these states because
`/cli/login` is still behind `withAuth`.

Ready state:
- Open `<preview-origin>/cli/login?device_code=ABCD1234`
- Check the page title is `Authorize CLI | Supabase`
- Check the card title is `Authorize Supabase CLI`
- Check the code fills the width, uses the normal sans font, and can be
selected
- Drag-select the code and copy it; the clipboard should contain
`ABCD1234`, not one character per line
- Click `Copy code`; the button should show the usual copied success
state without a green check icon on the primary button

Missing parameters state:
- Open `<preview-origin>/cli/login`
- Check the card says `Missing sign-in parameters` and names the missing
`session_id` and `public_key` parameters
- Open `<preview-origin>/cli/login?session_id=session-test`
- Check it still stays in-card and names the missing `public_key`
parameter instead of redirecting to `/404`

Creation error state:
- Open
`<preview-origin>/cli/login?session_id=not-real&public_key=not-real&token_name=local-dev`
- Check it stays in-card with `Unable to create CLI sign-in` instead of
redirecting to `/500`
- The exact error detail can vary by environment; the important bit is
that the failure is shown inside the interstitial card

Loading state:
- This is transient because there are no production mocks in this slice
- To inspect it manually, throttle the browser network before opening a
session-creation URL such as
`<preview-origin>/cli/login?session_id=not-real&public_key=not-real`

Real CLI flow:
- Run the browser login flow from Supabase CLI as usual
- When the CLI opens a Studio URL, keep the path and query string but
replace the origin with the PR preview origin
- The page should create the login session and then route to
`/cli/login?device_code=<8 character code>`
- Enter that 8-character code back in the CLI prompt


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Redesigned CLI login flow with clearer state-driven screens and
improved verification UI.
* Added a small paired-logo component for centered logo pairs with a
connector icon.

* **Improvements**
* Copy button behavior and styling refined for consistent visual
feedback across variants.

* **Tests**
* New unit tests covering copy-button behavior and multiple CLI login UI
flows.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45814)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 11:14:38 +10:00
Danny White 9660b0075c refine organisation invite state helpers (#45813) 
## What kind of change does this PR introduce?

Code cleanup. Follow-up to #45774.

## What is the current behavior?

The organisation invite interstitial derives invite states, titles, and
descriptions from nested conditional logic in the component. That makes
the component harder to scan and pushes too much state coverage into
render tests.

## What is the new behavior?

See #45774 for screenshots of the general UI before-and-after (which
this one builds upon). That PR also contains testing instructions.

Extracts the invite status and content decisions into small pure
helpers, then covers those helpers with focused unit tests.

The component keeps the user-facing render and interaction coverage,
including the invalid lookup regression where a 404 should render the
invalid invite state instead of raw backend copy.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Improved organization invite flow with enhanced error state handling
for expired, invalid, and wrong-account scenarios.
* Better consistency in error messages and user guidance throughout the
invite process.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45813)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-13 10:40:41 +10:00
Matt Rossman 36152cb7fe docs(ai): assistant evals development workflow (#45840) 
Adds `README.md` to `apps/studio/evals` explaining the development
workflow for updating offline and online evals for Studio's AI
Assistant.

Resolves AI-681

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Added comprehensive documentation for Studio Assistant Evals, covering
evaluation setup, configuration of scoring methods, and deployment
workflows for both offline and online evaluation processes.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45840)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-12 15:24:29 -04:00
Matt Rossman d143571586 feat(assistant): trace-level scorers + server-side tool execution with needsApproval (#45654) 
## Motivation

When Assistant runs a potentially destructive tool like `execute_sql`,
it stops the LLM request and prompts for client-side approval and
execution of the tool. After approval, a second request kicks off under
a separate trace. This has made scoring and
[Topics](https://www.braintrust.dev/blog/topics) classification
challenging, as the generated `output` is split across stateless
requests. The [span-level
scoring](https://www.braintrust.dev/docs/evaluate/custom-code#score-spans)
approach we've used thusfar (after the LLM call, we massage the result
into an `output` payload that's stuck onto the root span) has been
cumbersome and led to invalid scores / topics where only part of the
assistant response is considered. It's also inefficient, as we're
duplicating potentially large info (like the `search_docs` output) that
already exists within the trace.

An alternative to scoring spans is to [score
traces](https://www.braintrust.dev/docs/evaluate/custom-code#score-traces).
Braintrust [best
practices](https://www.braintrust.dev/docs/evaluate/score-online#best-practices)
advise:

> Use span scope for evaluating individual operations or outputs. Use
trace scope for evaluating multi-turn conversations, overall workflow
completion, or when your scorer needs access to the full execution
context.

We've also received [direct
guidance](https://supabase.slack.com/archives/C05QYJBLX89/p1777925770927149?thread_ts=1777905716.911979&cid=C05QYJBLX89)
from their team to use this approach.

## Changes

Migrates eval scorers from custom `AssistantEvalOutput` shape to
trace-level scoring via `trace.getThread()` / `trace.getSpans()`, with
thread parsing that scores the full latest Assistant turn and passes
prior conversation separately where relevant.

Moves `execute_sql` and `deploy_edge_function` from client-side
execution after approval to AI SDK `needsApproval` + server-side
`execute()`. SQL results returned to the model are gated by AI opt-in
level, so row data is only included with `schema_and_log_and_data`;
otherwise the tool returns the no-data-permissions sentinel.

Adds `metadata.isFinalStep` to disambiguate multiple LLM requests within
an "assistant" turn due to tool call requests/responses. For online
evals, this means we should configure automations to only score traces
with `metadata.isFinalStep = true` to ensure we're judging the complete
generated response.

Other minor kaizen changes:
- Renamed `promptProviderOptions` to `systemProviderOptions` to clarify
that this is associated with the "system" message and disambiguate from
the root `providerOptions`
- Adds `evals/trace-utils.ts` to handle Zod validation of the `unknown`
span shapes from Braintrust, to more easily access typed inputs/output
on tool spans.
- Bumps AI SDK floor version `^6.0.116` → `^6.0.174`
- Tweaked the "Conciseness" scorer to not unfairly dock points for the
new `[called tool_name]` labels in serialized assistant response

## Verification

In the studio staging build, I asked Assistant to create a todos table
with 3 sample todos. I manually approved the `execute_sql` call and saw
Assistant generate text before & after the call.

In Braintrust I verified two traces were produced (see [filtered
logs](https://www.braintrust.dev/app/supabase.io/p/Assistant/logs?v=Staging&tvt=trace&search={%22filter%22:[{%22text%22:%22metadata.environment%2520%253D%2520%27staging%27%22,%22label%22:%22metadata.environment%2520%253D%2520%27staging%27%22,%22originType%22:%22btql%22},{%22text%22:%22%2560Chat%2520ID%2560%2520%253D%2520%25221cb2ac45-e5e7-458c-9da4-3bf6863b8842%2522%22,%22label%22:%22Chat%2520ID%2520equals%25201cb2ac45-e5e7-458c-9da4-3bf6863b8842%22,%22originType%22:%22form%22}]})),
the first with `metadata.isFinalStep = false` and the second with
`metadata.isFinalStep = true`.

In the Braintrust staging scorers, I ran the preview Completeness scorer
on the second trace and verified it sees the complete Assistant response
including markers for tool calls ([link to
trace](https://www.braintrust.dev/app/supabase.io/p/Assistant%20(Staging%20Scorers)/trace?object_type=project_logs&object_id=b5214b62-ad1e-4929-9d5b-40b1daebe948&r=0ed0a4f8-8aff-4a34-bb1d-1df1d88a5070&s=ff9015f8-6bf7-4ab3-83a9-ca4e69e27e82))

<img width="1193" height="960" alt="CleanShot 2026-05-07 at 11 27 10@2x"
src="https://github.com/user-attachments/assets/509d4858-c3a1-4068-986d-3aa4d5617d1a"
/>

I also tested the `deploy_edge_function` workflow and verified it still
prompts for permission and warns on deployment of existing functions.

**References**
- https://www.braintrust.dev/docs/evaluate/custom-code#score-traces
-
https://ai-sdk.dev/docs/ai-sdk-core/tools-and-tool-calling#tool-execution-approval

Supercedes https://github.com/supabase/supabase/pull/45556 and
https://github.com/supabase/supabase/pull/45339

Closes AI-473

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Tool actions (SQL execution, edge-function deploy) now require
explicit user Approve/Deny before proceeding.

* **Improvements**
* Assistant pauses for approval responses before sending follow-ups,
giving clearer control over risky actions.
  * Deploy/replace flows show confirmation and clearer replace warnings.
* Evaluation/scoring updated to use richer trace data for more accurate
assistant performance signals.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-05-12 15:24:21 -04:00