mirror of
https://github.com/supabase/supabase.git
synced 2026-10-12 04:45:08 +03:00
kemal.earthandClaude Sonnet 5
33482bdc88
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Extracts the token view sheet slice of #48742
(w3b6x9/scoped-pat-access-feedback, commit 56ef87a). The role-evaluation
logic (estimateRoleLevel, computeTokenRoleContext,
applySelectionToRoleContext, groupFailingResources) already landed on
master via #48805 and #48809 — this PR only wires the view sheet up to
it:
- Bindings whose project/org was deleted (FGA bindings erased) render a
"resources no longer exist" state; bindings the user can no longer reach
render an anonymous count with a "No longer accessible" badge and a
"removed from" admonition.
- Accessible resources list their name plus ref/slug; capabilities show
"Exceeds your role" pills and the risk badge reflects what the owner's
current role actually allows.
- Header split into separate "Access control" and "API docs" buttons.
- Everything recomputes from live org/project/permission queries (no
stored state) and degrades to no warnings while loading or on
self-hosted.
Also gives DocsButton an optional `label` prop (defaults preserve
existing behavior for every other consumer) so the two header buttons
can carry distinct text.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced access-token details with permission categories, risk
summaries, endpoint, and MCP information.
* Added warnings for permissions exceeding the token’s role.
* Clearly identifies inaccessible, deleted, or unavailable organizations
and projects.
* Added resource details and remediation guidance for unusable tokens.
* Documentation links can now display custom labels.
* **Bug Fixes**
* Improved access evaluation when organization or project data is
incomplete or access has changed.
* Deferred resource loading until token details are opened.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
68 lines
2.2 KiB
TypeScript
68 lines
2.2 KiB
TypeScript
import { useMemo } from 'react'
|
|
|
|
import type { PermissionSelection, ResourceAccessMode } from '../AccessToken.permissions'
|
|
import {
|
|
applySelectionToRoleContext,
|
|
computeTokenRoleContext,
|
|
type TokenAccessEvaluation,
|
|
} from '../AccessToken.roles'
|
|
import { useOrgAndProjectData } from './useOrgAndProjectData'
|
|
import { usePermissionsQuery } from '@/data/permissions/permissions-query'
|
|
|
|
interface UseTokenAccessEvaluationArgs {
|
|
selection: PermissionSelection
|
|
resourceAccess: ResourceAccessMode
|
|
organizationSlugs: string[]
|
|
projectRefs: string[]
|
|
enabled?: boolean
|
|
}
|
|
|
|
/**
|
|
* Evaluates a token's scope selection and bound resources against the current user's live access.
|
|
* Advisory only — actual enforcement is the per-request intersection on the API side. While the
|
|
* underlying queries load (or on self-hosted), the evaluation reports `status: 'unknown'` and
|
|
* callers must show no warnings rather than flash false ones.
|
|
*
|
|
* Role resolution (the expensive part) is memoized separately from the selection, so toggling
|
|
* permissions in the form only re-runs the cheap selection pass.
|
|
*/
|
|
export const useTokenAccessEvaluation = ({
|
|
selection,
|
|
resourceAccess,
|
|
organizationSlugs,
|
|
projectRefs,
|
|
enabled = true,
|
|
}: UseTokenAccessEvaluationArgs): TokenAccessEvaluation => {
|
|
const { data: permissions } = usePermissionsQuery({ enabled })
|
|
const { organizations, projects, isLoadingOrgs, isLoadingProjects } = useOrgAndProjectData({
|
|
enabled,
|
|
})
|
|
|
|
// Org/project lists still loading: resources the user *does* have access to would read as
|
|
// inaccessible, so report unknown instead.
|
|
const hasCompleteResourceLists = !isLoadingOrgs && !isLoadingProjects
|
|
|
|
const context = useMemo(
|
|
() =>
|
|
computeTokenRoleContext({
|
|
resourceAccess,
|
|
organizationSlugs,
|
|
projectRefs,
|
|
permissions: hasCompleteResourceLists ? permissions : undefined,
|
|
organizations,
|
|
projects,
|
|
}),
|
|
[
|
|
resourceAccess,
|
|
organizationSlugs,
|
|
projectRefs,
|
|
permissions,
|
|
organizations,
|
|
projects,
|
|
hasCompleteResourceLists,
|
|
]
|
|
)
|
|
|
|
return useMemo(() => applySelectionToRoleContext(context, selection), [context, selection])
|
|
}
|