mirror of
https://github.com/supabase/supabase.git
synced 2026-10-10 20:05:06 +03:00
0760733a40
<img width="1196" height="427" alt="image" src="https://github.com/user-attachments/assets/6784b5e9-99c8-4fc9-b9f5-49672ba6e768" /> This reworks the security section within our project creation form to expose two options. 1/ Enable or disable Data API which is essentially the same as we had previously, just reframed 2/ Enable auto RLS which creates an event trigger that enables RLS on all tables created via public schema. This is the same as what we do via the RLS banner in authentication pages. Note that this also removes the option to disable Data API on public schema and move to dedicated schema. The user can still do this post project creation . Assumption is this is rarely changed on project creation and adds complexity. To test: 1. Create a new project 2. Enable Data API and enable RLS setting 3. After project creation, go to triggers -> event tab -> notice enable rls trigger 4. Create project and disable Data API 5. After project creation , go to settings/api and make sure data api is disabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an optional automatic Row-Level Security (RLS) event trigger option in project creation (toggleable via experiment). * **Improvements** * Security panel simplified to checkbox-based controls for Data API and RLS. * Project creation form now includes the enableRlsEventTrigger flag and applies related setup when enabled. * Telemetry records RLS experiment exposure, variant, and whether the RLS trigger was enabled. * Free-project messaging updated to consider user limits. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com> Co-authored-by: Sean Oliver <882952+seanoliver@users.noreply.github.com>
106 lines
3.9 KiB
TypeScript
106 lines
3.9 KiB
TypeScript
import { UseFormReturn } from 'react-hook-form'
|
|
|
|
import Panel from 'components/ui/Panel'
|
|
import { usePHFlag } from 'hooks/ui/useFlag'
|
|
import Link from 'next/link'
|
|
import {
|
|
Checkbox_Shadcn_,
|
|
FormControl_Shadcn_,
|
|
FormDescription_Shadcn_,
|
|
FormField_Shadcn_,
|
|
FormItem_Shadcn_,
|
|
FormLabel_Shadcn_,
|
|
useWatch_Shadcn_,
|
|
} from 'ui'
|
|
import { Admonition } from 'ui-patterns'
|
|
import { FormItemLayout } from 'ui-patterns/form/FormItemLayout/FormItemLayout'
|
|
import { CreateProjectForm } from './ProjectCreation.schema'
|
|
|
|
interface SecurityOptionsProps {
|
|
form: UseFormReturn<CreateProjectForm>
|
|
layout?: 'vertical' | 'horizontal'
|
|
}
|
|
|
|
export const SecurityOptions = ({ form, layout = 'horizontal' }: SecurityOptionsProps) => {
|
|
const rlsExperimentVariant = usePHFlag<'control' | 'test' | false | undefined>(
|
|
'projectCreationEnableRlsEventTrigger'
|
|
)
|
|
const shouldShowEnableRlsEventTrigger = rlsExperimentVariant === 'test'
|
|
const dataApi = useWatch_Shadcn_({ control: form.control, name: 'dataApi' })
|
|
|
|
return (
|
|
<Panel.Content className="pb-8">
|
|
<FormItemLayout layout={layout} label="Security" isReactForm={false}>
|
|
<div className="flex flex-col gap-4">
|
|
<FormField_Shadcn_
|
|
name="dataApi"
|
|
control={form.control}
|
|
render={({ field }) => (
|
|
<FormItem_Shadcn_ className="flex items-start gap-3">
|
|
<FormControl_Shadcn_>
|
|
<Checkbox_Shadcn_
|
|
checked={field.value}
|
|
disabled={field.disabled}
|
|
onCheckedChange={(value) => field.onChange(value === true)}
|
|
/>
|
|
</FormControl_Shadcn_>
|
|
<div className="space-y-1">
|
|
<FormLabel_Shadcn_ className="text-sm text-foreground">
|
|
Enable Data API
|
|
</FormLabel_Shadcn_>
|
|
<FormDescription_Shadcn_ className="text-foreground-lighter">
|
|
Autogenerate a RESTful API for your public schema. Recommended if using a client
|
|
library like{' '}
|
|
<Link
|
|
href="https://supabase.com/docs/reference/javascript/introduction"
|
|
target="_blank"
|
|
className="text-link"
|
|
>
|
|
supabase-js
|
|
</Link>
|
|
.
|
|
</FormDescription_Shadcn_>
|
|
</div>
|
|
</FormItem_Shadcn_>
|
|
)}
|
|
/>
|
|
|
|
{shouldShowEnableRlsEventTrigger && (
|
|
<FormField_Shadcn_
|
|
name="enableRlsEventTrigger"
|
|
control={form.control}
|
|
render={({ field }) => (
|
|
<FormItem_Shadcn_ className="flex items-start gap-3">
|
|
<FormControl_Shadcn_>
|
|
<Checkbox_Shadcn_
|
|
checked={field.value}
|
|
disabled={field.disabled}
|
|
onCheckedChange={(value) => field.onChange(value === true)}
|
|
/>
|
|
</FormControl_Shadcn_>
|
|
<div className="space-y-1">
|
|
<FormLabel_Shadcn_ className="text-sm text-foreground">
|
|
Enable automatic RLS
|
|
</FormLabel_Shadcn_>
|
|
<FormDescription_Shadcn_ className="text-foreground-lighter">
|
|
Create an event trigger that automatically enables Row Level Security on all
|
|
new tables in the public schema.
|
|
</FormDescription_Shadcn_>
|
|
</div>
|
|
</FormItem_Shadcn_>
|
|
)}
|
|
/>
|
|
)}
|
|
|
|
{!dataApi && (
|
|
<Admonition type="warning" title="Data API will effectively be disabled">
|
|
You will not be able to query or mutate data via Supabase client libraries like
|
|
supabase-js.
|
|
</Admonition>
|
|
)}
|
|
</div>
|
|
</FormItemLayout>
|
|
</Panel.Content>
|
|
)
|
|
}
|