mirror of
https://github.com/supabase/supabase.git
synced 2026-10-09 11:25:06 +03:00
Users who set a database password with special characters (\`@\`, \`#\`, \`%\`, \`+\`, etc.) get no warning that it must be percent-encoded when used in a connection URL, which leads to confusing connection failures ([FE-3379](https://linear.app/supabase/issue/FE-3379)). <img width="700" height="200" alt="Screenshot 2026-07-03 at 6 26 43 PM" src="https://github.com/user-attachments/assets/48608d65-8057-4abe-96fc-c0ede3550951" /> <img width="1002" height="395" alt="Screenshot 2026-07-03 at 6 27 14 PM" src="https://github.com/user-attachments/assets/1366b985-7d80-4e7d-97f0-c79d5c84cefd" /> <img width="548" height="303" alt="Screenshot 2026-07-03 at 6 27 26 PM" src="https://github.com/user-attachments/assets/b042101a-0e88-4730-adb8-1b490018f208" /> **Changed:** - `PasswordStrengthBar` now shows a warning-colored callout (with a docs link) whenever the entered password contains characters that need percent-encoding — this covers project creation, reset database password, restore-to-new-project, and the Vercel deploy-button flow - Replaced `DATABASE_PASSWORD_REGEX` (only caught `@`, `:`, `/`) with a `passwordNeedsPercentEncoding()` helper based on `encodeURIComponent`, so `#`, `%`, `+`, `?`, `&`, spaces etc. are caught too - Moved `SpecialSymbolsCallout` from `ProjectCreation/` to `components/ui/` since it's now shared **Added:** - Info admonition in the Connect sheet next to connection strings that still contain `[YOUR-PASSWORD]` (direct connection + `.env`-based file setups; hidden for psql and .NET where percent-encoding doesn't apply, and after a password reset since the substituted password is already encoded) ## To test - Project creation → type a password containing \`#\` or \`@\` → warning callout appears above the strength bar; disappears for alphanumeric passwords - Database Settings → Reset database password → same behaviour - Connect sheet → Direct connection → note shows under the connection string for URI/JDBC types, not for psql; after resetting the password from the sheet, the note disappears (password is substituted already encoded) - Connect sheet → Node.js/Python/Go/SQLAlchemy file setups show the note; .NET does not - \`pnpm vitest run lib/password-strength.test.ts\` passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added a dedicated password encoding note (with documentation link) on direct connection screens when the password is embedded in a URL. * Added an encoding hint to the password strength area when percent-encoding is required. * **Bug Fixes** * Removed regex-based “invalid password” callout and replaced it with safer percent-encoding detection logic. * **Tests** * Added test coverage for `passwordNeedsPercentEncoding`. * Removed obsolete Project Creation password regex tests. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
52 lines
1.7 KiB
TypeScript
52 lines
1.7 KiB
TypeScript
import { InlineLinkClassName } from './InlineLink'
|
|
import { SpecialSymbolsCallout } from './SpecialSymbolsCallout'
|
|
import { PASSWORD_STRENGTH_COLOR, PASSWORD_STRENGTH_PERCENTAGE } from '@/lib/constants'
|
|
import { passwordNeedsPercentEncoding, PasswordStrengthScore } from '@/lib/password-strength'
|
|
|
|
interface Props {
|
|
passwordStrengthScore: PasswordStrengthScore
|
|
passwordStrengthMessage: string
|
|
password: string
|
|
generateStrongPassword: () => void
|
|
}
|
|
|
|
export const PasswordStrengthBar = ({
|
|
passwordStrengthScore = 0,
|
|
passwordStrengthMessage = '',
|
|
password = '',
|
|
generateStrongPassword,
|
|
}: Props) => {
|
|
return (
|
|
<>
|
|
{passwordNeedsPercentEncoding(password) && <SpecialSymbolsCallout />}
|
|
{password && (
|
|
<div
|
|
aria-valuemax={100}
|
|
aria-valuemin={0}
|
|
aria-valuenow={PASSWORD_STRENGTH_PERCENTAGE[passwordStrengthScore]}
|
|
aria-valuetext={`${PASSWORD_STRENGTH_PERCENTAGE[passwordStrengthScore]}%`}
|
|
role="progressbar"
|
|
className="mb-2 overflow-hidden transition-all border rounded-sm bg-200 w-full"
|
|
>
|
|
<div
|
|
style={{
|
|
width: `${PASSWORD_STRENGTH_PERCENTAGE[passwordStrengthScore]}%`,
|
|
}}
|
|
className={`relative h-1 w-full ${PASSWORD_STRENGTH_COLOR[passwordStrengthScore]} transition-all duration-500 ease-out shadow-inner`}
|
|
/>
|
|
</div>
|
|
)}
|
|
<p>
|
|
{(passwordStrengthMessage
|
|
? passwordStrengthMessage
|
|
: 'This is the password to your Postgres database, so it must be strong and hard to guess.') +
|
|
' '}
|
|
<button type="button" className={InlineLinkClassName} onClick={generateStrongPassword}>
|
|
Generate a password
|
|
</button>
|
|
.
|
|
</p>
|
|
</>
|
|
)
|
|
}
|