mirror of
https://github.com/supabase/supabase.git
synced 2026-10-08 19:05:06 +03:00
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — a new UI Library block. Stacked on #49573 (already in main) Fixes AI-1064 ## What is the new behavior? Adds `headless-app-tanstack`: customers sign in, authorize an MCP client, and use the product through agent tool calls. It composes the existing Password-Based Auth, OAuth Consent, and MCP Server blocks. - `/agents` provides a copyable connection prompt, lists OAuth authorizations, and lets customers revoke access. - The shared MCP runtime exposes `whoami` plus example task CRUD tools. Tools use the caller's Supabase client, with database grants and RLS enforcing ownership. - A root-level `supabase/` directory supplies local Auth/OAuth configuration, a declarative tasks schema, and Edge Function files, including `.env.example`. - Docs cover local setup, signing keys, migrations, environment configuration, deployment, and extending the tools. `/example/headless-app` previews the sign-in, consent, connect, and connected states. Shared block fixes make a fresh install work: - Explicit public URL resolution fixes OAuth discovery in local Edge Runtime when middleware runtime detection fails. Both external OAuth access tokens and ordinary authenticated app session tokens remain supported; embedded agents do not need an additional consent flow. - Registry targets keep backend files outside `src/`, and generated consumer routes omit source-only TypeScript suppressions. - Signup respects `auth.email.enable_confirmations`; sign-in/signup preserve the return destination. Missing consent IDs retain the existing error state without serializing `null` into the URL. ## How to test Use the UI Library on **staging** and follow the block pages' instructions. 1. Open the **Headless App** block page for TanStack Start. Install it into a fresh app and follow the setup instructions through connecting an MCP client. 2. Sign up, open `/agents`, and use the connection prompt to authorize a client. Call `whoami`, then create, list, update, and delete a task. 3. Confirm the client appears on `/agents`. Revoke access and verify it disappears and token refresh fails. An existing access token can continue working until it expires. 4. Follow the **MCP Server** block page's embedded-agent instructions using an authenticated app session. Confirm tools work without another OAuth consent flow and `whoami` returns `client_id: null`. 5. With a second user, confirm each user can only access their own tasks. Check that signup behaves correctly for the configured email-confirmation setting. 6. Check the Headless App preview states and run the installed app's typecheck and production build. ## Validation performed Fresh local installation and browser/SDK verification passed: 26 live MCP/Data API checks, 10 Deno tests, and 7 connection-page component tests. Also passed UI Library typecheck, targeted lint, registry/Markdown builds, and fresh consumer typecheck/production build. Both OAuth and ordinary app session authentication were exercised. Hosted deployment and consuming the confirmation-email link were not tested. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a TanStack Headless App example with sign-in, OAuth consent, MCP connection, and connected-agent screens. - Added task management tools for listing, creating, updating, and deleting tasks through MCP. - Added connected-agent management, including server URL and prompt copying, refresh, and access revocation. - Added a new Headless App registry block and documentation. - **Bug Fixes** - Preserved intended destinations through sign-up, email confirmation, and protected-route login redirects. - Improved OAuth discovery URL handling across forwarded-host deployments. - **Documentation** - Updated setup, environment, deployment, and Supabase CLI guidance for headless apps and MCP servers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: repro <repro@local> Co-authored-by: Raúl Barroso <code@raulb.dev>
87 lines
2.6 KiB
TypeScript
87 lines
2.6 KiB
TypeScript
'use client'
|
|
|
|
import { useState } from 'react'
|
|
|
|
import { ConnectedAgentsView } from '@/registry/default/blocks/headless-app-tanstack/components/connected-agents'
|
|
import type { OAuthGrant } from '@/registry/default/blocks/headless-app-tanstack/hooks/use-oauth-grants'
|
|
import { OAuthConsentCard } from '@/registry/default/blocks/oauth-consent/components/oauth-consent'
|
|
import { LoginForm } from '@/registry/default/blocks/password-based-auth-nextjs/components/login-form'
|
|
|
|
const PRODUCT_NAME = 'Acme'
|
|
const MCP_SERVER_URL = 'https://your-project.supabase.co/functions/v1/mcp-server'
|
|
|
|
const grants: OAuthGrant[] = [
|
|
{
|
|
client: { id: 'claude-code', name: 'Claude Code', uri: '', logo_uri: '' },
|
|
scopes: ['openid', 'profile'],
|
|
granted_at: '2026-08-20T09:12:00Z',
|
|
},
|
|
{
|
|
client: { id: 'codex', name: 'Codex', uri: '', logo_uri: '' },
|
|
scopes: ['openid'],
|
|
granted_at: '2026-08-24T16:40:00Z',
|
|
},
|
|
]
|
|
|
|
const screens = {
|
|
'sign-in': <LoginForm className="mx-auto w-full max-w-sm" />,
|
|
consent: (
|
|
<OAuthConsentCard
|
|
className="mx-auto w-full max-w-lg"
|
|
clientName="Claude Code"
|
|
productName={PRODUCT_NAME}
|
|
redirectUri="http://localhost:3000/callback"
|
|
email="alex@example.com"
|
|
scopes={['openid', 'profile']}
|
|
/>
|
|
),
|
|
connect: (
|
|
<ConnectedAgentsView
|
|
className="mx-auto w-full max-w-lg"
|
|
mcpServerUrl={MCP_SERVER_URL}
|
|
productName={PRODUCT_NAME}
|
|
grants={[]}
|
|
/>
|
|
),
|
|
connected: (
|
|
<ConnectedAgentsView
|
|
className="mx-auto w-full max-w-lg"
|
|
mcpServerUrl={MCP_SERVER_URL}
|
|
productName={PRODUCT_NAME}
|
|
grants={grants}
|
|
/>
|
|
),
|
|
}
|
|
|
|
const labels: Record<keyof typeof screens, string> = {
|
|
'sign-in': 'Sign in',
|
|
consent: 'Consent',
|
|
connect: 'Connect',
|
|
connected: 'Connected',
|
|
}
|
|
|
|
export default function HeadlessAppDemo() {
|
|
const [screen, setScreen] = useState<keyof typeof screens>('sign-in')
|
|
|
|
return (
|
|
<div className="flex flex-col gap-8">
|
|
<div className="mx-auto flex rounded-lg bg-secondary p-1" role="group" aria-label="Screen">
|
|
{(Object.keys(screens) as (keyof typeof screens)[]).map((key) => (
|
|
<button
|
|
key={key}
|
|
type="button"
|
|
tabIndex={0}
|
|
aria-pressed={screen === key}
|
|
data-active={screen === key}
|
|
className="rounded-md px-3 py-1.5 text-xs text-muted-foreground transition-colors data-[active=true]:bg-background data-[active=true]:text-foreground"
|
|
onClick={() => setScreen(key)}
|
|
>
|
|
{labels[key]}
|
|
</button>
|
|
))}
|
|
</div>
|
|
{screens[screen]}
|
|
</div>
|
|
)
|
|
}
|