## What kind of change does this PR introduce? A11y cleanup follow-up to #47984 / [DEPR-626](https://linear.app/supabase/issue/DEPR-626). ## What is the current behavior? Studio had 82 ratcheted `supabase/require-explicit-tabindex` violations (raw `<button>` / `role="button"` without explicit `tabIndex`). ## What is the new behavior? - Explicit `tabIndex={0}` (or disabled → `-1`) on those Studio call sites across nav, `components/ui`, Database, Storage, and the remainder - Ratchet baseline cleared (**82 → 0**) and the rule **removed from the Studio ratchet** (debt is gone; ratchet is temporary) - Rule remains a shared **`warn`** for now — promoting to `error` (and sweeping www/docs/design-system) is a follow-up - Also fixed the learn/ui-library call sites that surfaced while experimenting with error promotion - Small follow-ups where making controls focusable exposed gaps: accessible names, disabled/focus consistency, focus-ring polish on To-test surfaces, home section `KeyboardSensor`, and an E2E locator tightened after `aria-label="Remove column"` Prefer migrating to `Button` from `ui` in future touch-ups; this PR takes the minimal path so Studio debt can stay at zero. ## Additional context Batches landed together so baseline conflicts stayed simple while chipping away: - Hotspots / nav (FirstLevelNav, Marketplace, AttachmentUpload, Column, Tabs, …) - `components/ui` shared - Database + Storage - Remainder **Out of scope / intentional deferrals** - Promoting `supabase/require-explicit-tabindex` to a lint **error** (follow-up after www/docs/design-system sweeps) - Tabs/Radio roving, tooltips, context menus, in-menu items - Full keyboard-accessible tab-close UX (close stays hover + `tabIndex={-1}`; context menu still closes tabs) - Data API docs links (`/project/<ref>/api` redirect) **Reviewer notes** - Rule only flags raw `<button>` / `role="button"` without a `tabIndex` prop. `Button` from `ui` already bakes this in - `tabIndex={-1}` is intentional for disabled controls, in-menu / roving-focus children, and hover-only tab close - For dnd-kit grips, put `tabIndex` **after** `{...attributes}` so it isn’t overwritten (TS2783) ### To test Use **Safari** with macOS Keyboard navigation **off** (System Settings → Keyboard). Chrome once for a sanity pass. For each surface below: Tab until the control is focused, then activate with Enter/Space where relevant. 1. **API Docs side panel** (Table Editor → open a table → **API docs**) - Floating API Docs panel — **not** `/project/<ref>/api` (that redirects to Data API docs; language ToggleGroup uses arrow keys; links are out of scope) - Left nav buttons — Tab through several and activate one; active highlight / navigation still works 2. **Integrations → Marketplace** - Enable **Integrations layout** feature preview first (avatar menu → Feature previews) - `/org/<slug>/integrations` or project integrations marketplace - “Clear all”, grid/list toggles — Tab + activate 3. **Table Editor → create a table → Columns** - Drag handles only appear while **creating** (not when editing an existing table) - Tab to grip / remove (X) / sensitive-data eye if shown 4. **Project Home** — section drag handles - Tab to a grip (visible focus ring) - Optional: Space to pick up, arrows to move, Space/Esc to drop (KeyboardSensor added) - Mouse dnd still works 5. **Storage → Policies** — expand/collapse bucket list chevron (design-system focus ring, no stuck grey open bg) 6. **Support form** (Help → Support) — attachment remove (×) and add-attachment control when visible Disabled controls should be **skipped** by Tab. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Accessibility Improvements** * Improved keyboard navigation throughout Studio by explicitly managing focus (`tabIndex`) across many interactive controls (menus, tabs, tables, charts, dialogs, navigation, and form actions). * Disabled or non-interactive controls are now removed from the tab order (or made unfocusable), while available actions remain reachable. * Ensured `type="button"` on relevant controls to prevent unintended submissions, and refined keyboard focus behavior for various toggles and copy/remove actions. * **Chores** * Updated the ESLint rule baseline configuration to match the new focus behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Supabase Studio E2E Tests
Set up
Prerequisites
For Self-Hosted Tests
- Nothing is required, running with IS_PLATFORM=false should run the tests locally with a self hosted docker container
For Platform Tests
- Create a platform account - You can authenticate using either:
- Email and password
- GitHub OAuth (requires TOTP 2FA)
- Create an organization on the platform, this can be done if run locally through
mise fullstack - Generate a Personal Access Token (PAT) for API access
- Configure the environment variables below (see Authentication section for details on email vs GitHub auth)
Configure Environment
Choose the appropriate example file based on your testing scenario:
For self-hosted tests:
cp .env.local.self-hosted.example .env.local
For platform tests with email authentication:
cp .env.local.email.example .env.local
For platform tests with GitHub authentication:
cp .env.local.github.example .env.local
Edit .env.local and set the appropriate values based on your test environment (see Environment Variables section below).
Install the playwright browser
⚠️ This should be done in the e2e/studio directory
cd e2e/studio
pnpm exec playwright install
Environment Variables
Configure your tests by setting the following environment variables in .env.local. We have examples of what required on self hosted and platform:
Core Configuration
STUDIO_URL: The URL where Studio is running (default:http://localhost:8082)API_URL: The Supabase API endpoint (default:https://localhost:8080)IS_PLATFORM: Set totruefor platform tests,falsefor self-hosted (default:false)- When
true: Tests run serially (1 worker) due to API rate limits - When
false: Tests run in parallel (5 workers)
- When
Authentication (Required for Platform Tests)
⚠️ Before running platform tests, you must create an account and organization on the platform you're testing.
Authentication is automatically enabled when either email/password OR GitHub credentials are configured.
Email Authentication
EMAIL: Your platform account emailPASSWORD: Your platform account passwordPROJECT_REF: Project reference (optional, will be auto-created if not provided)
When both EMAIL and PASSWORD are set, the tests will authenticate using email/password. HCaptcha is mocked during test setup. Note this only works on local and staging environments
GitHub Authentication
GITHUB_USER: Your GitHub usernameGITHUB_PASS: Your GitHub passwordGITHUB_TOTP: Your GitHub TOTP secret for 2FA (required, as GitHub enforces 2FA)
When GITHUB_USER, GITHUB_PASS, and GITHUB_TOTP are all set, the tests will authenticate using GitHub OAuth with TOTP-based 2FA. The authentication flow handles:
- Clicking "Sign In with GitHub" button
- Filling GitHub credentials
- Generating and submitting TOTP codes
- Handling GitHub authorization prompts
- Automatic retry on failure (up to 3 attempts)
Getting your GitHub TOTP secret:
When setting up 2FA on GitHub, you'll see a QR code. Click "enter this text code instead" to reveal the secret key. This is the value to use for GITHUB_TOTP.
Platform-Specific Variables (Required when IS_PLATFORM=true)
ORG_SLUG: Organization slug (default:default)SUPA_REGION: Supabase region (default:us-east-1)SUPA_PAT: Personal Access Token for API authentication (default:test)BRANCH_NAME: Name for the test branch/project (default:e2e-test-local)
Optional Variables
OPENAI_API_KEY: Required for the AI Assistant test (assistant.spec.ts). Without this variable, the assistant test will be skipped.VERCEL_AUTOMATION_BYPASS_SELFHOSTED_STUDIO: Bypass token for Vercel protection (default:false)
Setup Commands Based on Configuration
The test setup automatically runs different commands based on your environment:
- Platform + Localhost (
IS_PLATFORM=trueandSTUDIO_URL=localhost): Runspnpm run e2e:setup:platform - Platform + Remote (
IS_PLATFORM=trueand remoteSTUDIO_URL): No web server setup - Self-hosted (
IS_PLATFORM=false): Runspnpm run e2e:setup:selfhosted
Running the tests
Check the package.json for the available commands and environments.
pnpm run e2e
With Playwright UI:
pnpm run e2e -- --ui
Tips for development
- Read Playwright Best Practices
- Use
pnpm run e2e -- --uito get the playwright UI. - Add the tests in
examples/examples.tsto Cursor as context. - Add messages to expect statements to make them easier to debug.
Example:
await expect(page.getByRole('heading', { name: 'Logs', exact: true }), {
message: 'Logs heading should be visible',
}).toBeVisible()
- Use the test utility instead of playwrights test.
import { test } from '../utils/test'
- Use the PWDEBUG environment variable to debug the tests.
PWDEBUG=1 pnpm run e2e -- --ui
What should I test?
- Can the feature be navigated to?
- Does the feature load correctly?
- Can you do the actions (filtering, sorting, opening dialogs, etc)?
API Mocks
Read here: https://playwright.dev/docs/mock#mock-api-requests
Example:
await page.route(`*/**/logs.all*`, async (route) => {
await route.fulfill({ body: JSON.stringify(mockAPILogs) })
})