mirror of
https://github.com/supabase/supabase.git
synced 2026-10-06 01:45:10 +03:00
<img width="1510" height="860" alt="image" src="https://github.com/user-attachments/assets/36a748b7-bdeb-4685-8bb1-da911711874b" /> Introduces a new OAuth consent block in preparation for offering more MCP focused blocks that require authentication and consent. The general approach for this is to decouple consent block from authentication block but provide guidance on how to use both. The alternative is to add auth as a dependency to consent but apps may already have their own authentication UI / flows. The block is also positioned as a general OAuth Consent vs MCP Consent as it can be put to use for other use cases outside of MCP on projects who want to make use of the OAuth 2.1 Server offering. A couple of changes outside of the block itself were required: - Updated the Auth blocks to allow for a `next` param to redirect users to after signing in - Updated middleware so next param is correctly passed through to sign in ## How to test Requires Docker and a Supabase CLI recent enough to support `[auth.oauth_server]` (verified on 2.109.0 / GoTrue v2.192.0). ### 1. Local Supabase with the OAuth server enabled In your `supabase/config.toml`, edit the existing `[auth.oauth_server]` section — `supabase init` already writes one, and adding a second fails with `table oauth_server already exists`: ```toml [auth.oauth_server] enabled = true authorization_url_path = "/oauth/consent" allow_dynamic_registration = true ``` Set `site_url` to wherever your test app runs (e.g. `http://localhost:3100`), then `supabase start`. Grab the API URL and publishable key from `supabase status`. ### 2. A consumer app with the blocks installed The consent block ships no login route by design, so pair it with an auth block: ```bash npx create-next-app@latest consent-test --ts --tailwind --app --yes ``` ```bash cd consent-test && npx shadcn@latest init -d -y && npx shadcn@latest add https://supabase.com/library/r/password-based-auth-nextjs.json https://supabase.com/library/r/oauth-consent-nextjs.json ``` To test this branch before it deploys, run `pnpm --filter ui-library dev` and use `http://localhost:3004/library/r/...` instead. If you changed anything under `registry/default/blocks/oauth-consent/**`, run `pnpm --filter ui-library build:registry` first — shadcn fetches the generated `public/r/*.json`, not the source. Put `NEXT_PUBLIC_SUPABASE_URL` and `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY` in `.env.local` and start the app on the port you set as `site_url`. ### 3. Register an OAuth client and start a real authorization request ```bash curl -s -X POST http://127.0.0.1:54321/auth/v1/oauth/clients/register -H "Content-Type: application/json" -d '{"client_name":"Test Client","redirect_uris":["http://localhost:3100/callback"],"grant_types":["authorization_code"],"response_types":["code"],"scope":"openid profile email"}' ``` Then open the authorize URL in a browser (not curl — you need the redirect chain and cookies): ``` http://127.0.0.1:54321/auth/v1/oauth/authorize?client_id=<id>&response_type=code&redirect_uri=http://localhost:3100/callback&scope=openid+profile+email&state=xyz&code_challenge=<challenge>&code_challenge_method=S256 ``` Auth mints the `authorization_id` and redirects to `<site_url>/oauth/consent?authorization_id=…`. An MCP client pointed at your app is an even better driver, since that's the real consumer shape. ### 4. Cases to walk | Case | Expected | | --- | --- | | Signed out, hit the authorize URL | Lands on `/auth/login?next=%2Foauth%2Fconsent%3Fauthorization_id%3D…`; after login, returns to the consent screen | | Consent screen | Shows client name, redirect URI, signed-in email, and requested scopes from `getAuthorizationDetails` | | Allow access | Redirects to `redirect_uri` with `code` and your original `state`; the code exchanges at `/oauth/token` for a real access token | | Deny | Redirects with `error=access_denied` and your `state` | | Re-run the same authorize URL after approving | Skips the screen, straight to callback with a new code | | Visit `/oauth/consent` with no `authorization_id` | "This page needs an authorization_id" | | Stale or bogus `authorization_id` | Error shown, buttons still usable | | Double-click Allow | Exactly one `POST /oauth/authorizations/<id>/consent` | Test the react, react-router, or tanstack variant the same way if you're touching them — the hook is duplicated per framework, so a fix in one doesn't carry. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an OAuth 2.1 consent experience with client details, requested scopes, redirect URI, and approve/deny actions. * Added OAuth consent examples and registry blocks for Next.js, React, React Router, and TanStack Start. * Added OAuth documentation, navigation, and framework support across the UI library. * **Bug Fixes** * Login flows now safely preserve valid same-origin redirect destinations while rejecting unsafe URLs. * OAuth routes can handle consent flows before authentication and redirect safely to sign-in. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
112 lines
4.1 KiB
TypeScript
112 lines
4.1 KiB
TypeScript
import Link from 'next/link'
|
|
|
|
import { CommandMenu } from './command-menu'
|
|
import { ThemeSwitcherDropdown } from './theme-switcher-dropdown'
|
|
import NavigationItem from '@/components/side-navigation-item'
|
|
import { componentPages, gettingStarted, oauthBlocks, platformBlocks } from '@/config/docs'
|
|
|
|
function SideNavigation() {
|
|
return (
|
|
<nav className="flex flex-col h-full min-w-[220px]">
|
|
<div className="p-6">
|
|
<div className="flex items-start justify-between mb-4">
|
|
<Link href="/">
|
|
<svg
|
|
xmlns="http://www.w3.org/2000/svg"
|
|
width="109"
|
|
height="113"
|
|
viewBox="0 0 109 113"
|
|
fill="none"
|
|
className="w-6 h-6"
|
|
>
|
|
<path
|
|
d="M63.7076 110.284C60.8481 113.885 55.0502 111.912 54.9813 107.314L53.9738 40.0625L99.1935 40.0625C107.384 40.0625 111.952 49.5226 106.859 55.9372L63.7076 110.284Z"
|
|
fill="url(#paint0_linear)"
|
|
/>
|
|
<path
|
|
d="M63.7076 110.284C60.8481 113.885 55.0502 111.912 54.9813 107.314L53.9738 40.0625L99.1935 40.0625C107.384 40.0625 111.952 49.5226 106.859 55.9372L63.7076 110.284Z"
|
|
fill="url(#paint1_linear)"
|
|
fillOpacity="0.2"
|
|
/>
|
|
<path
|
|
d="M45.317 2.07103C48.1765 -1.53037 53.9745 0.442937 54.0434 5.041L54.4849 72.2922H9.83113C1.64038 72.2922 -2.92775 62.8321 2.1655 56.4175L45.317 2.07103Z"
|
|
fill="#3ECF8E"
|
|
/>
|
|
<defs>
|
|
<linearGradient
|
|
id="paint0_linear"
|
|
x1="53.9738"
|
|
y1="54.9738"
|
|
x2="94.1635"
|
|
y2="71.8293"
|
|
gradientUnits="userSpaceOnUse"
|
|
>
|
|
<stop stopColor="#249361" />
|
|
<stop offset="1" stopColor="#3ECF8E" />
|
|
</linearGradient>
|
|
<linearGradient
|
|
id="paint1_linear"
|
|
x1="36.1558"
|
|
y1="30.5779"
|
|
x2="54.4844"
|
|
y2="65.0804"
|
|
gradientUnits="userSpaceOnUse"
|
|
>
|
|
<stop />
|
|
<stop offset="1" stopOpacity="0" />
|
|
</linearGradient>
|
|
</defs>
|
|
</svg>
|
|
</Link>
|
|
<ThemeSwitcherDropdown />
|
|
</div>
|
|
<Link href="/" className="mb-4 block">
|
|
<h1>Supabase Library</h1>
|
|
</Link>
|
|
{/* <TopNavigationSearch /> */}
|
|
<CommandMenu />
|
|
</div>
|
|
<div className="pb-6 space-y-0.5">
|
|
<div className="font-mono uppercase text-xs text-foreground-lighter/75 mb-2 px-6 tracking-widest">
|
|
{gettingStarted.title}
|
|
</div>
|
|
{gettingStarted.items.map((item, i) => (
|
|
<NavigationItem item={item} key={`${item.href}-${i}`} />
|
|
))}
|
|
</div>
|
|
<div className="pb-6">
|
|
<div className="font-mono uppercase text-xs text-foreground-lighter/75 mb-2 px-6 tracking-widest">
|
|
UI Blocks
|
|
</div>
|
|
<div className="space-y-0.5">
|
|
{/* Render items based on component definitions */}
|
|
{componentPages.items.map((component, i) => (
|
|
<NavigationItem
|
|
item={component}
|
|
key={`${component.href?.toString() || component.title}-${i}`}
|
|
/>
|
|
))}
|
|
</div>
|
|
</div>
|
|
<div className="pb-6">
|
|
<div className="font-mono uppercase text-xs text-foreground-lighter/75 mb-2 px-6 tracking-widest">
|
|
{oauthBlocks.title}
|
|
</div>
|
|
{oauthBlocks.items.map((item, i) => (
|
|
<NavigationItem item={item} key={`${item.href}-${i}`} />
|
|
))}
|
|
</div>
|
|
<div className="pb-6">
|
|
<div className="font-mono uppercase text-xs text-foreground-lighter/75 mb-2 px-6 tracking-widest">
|
|
{platformBlocks.title}
|
|
</div>
|
|
{platformBlocks.items.map((item, i) => (
|
|
<NavigationItem item={item} key={`${item.href}-${i}`} />
|
|
))}
|
|
</div>
|
|
</nav>
|
|
)
|
|
}
|
|
|
|
export default SideNavigation
|