Files
supabase/apps/studio/data/database/retrieve-index-advisor-result-query.ts
Charis 2d4e87f579 studio: SafeSql for reports, query performance, privileges (4/7) (#45998)
## Summary

Part 4 of the SafeSql migration stack
([#45897](https://github.com/supabase/supabase/pull/45897),
[#45903](https://github.com/supabase/supabase/pull/45903),
[#45990](https://github.com/supabase/supabase/pull/45990), this PR, …).

Converts the remaining reports, query performance, observability, index
advisor, and privileges call sites of `executeSql` to produce
`SafeSqlFragment` values. The `ReportQuery.sql` field flips from
`string` to `SafeSqlFragment`, which cascades into every consumer —
landed here atomically so each branch typechecks cleanly.

Touched areas:

- `interfaces/Reports/*` — `ReportQuery.sql: SafeSqlFragment`, plus all
report definitions/utilities updated
- `interfaces/QueryPerformance/useQueryPerformanceQuery.ts`
- `interfaces/Database/IndexAdvisor/*` and
`data/database/{table-index-advisor,retrieve-index-advisor-result}-query.ts`
-
`data/privileges/{table-api-access,update-exposed-entities}-mutation.ts`
- `interfaces/Storage/StoragePolicies/StoragePolicies.tsx`
- `hooks/analytics/useDbQuery.tsx`
- `Observability/useSlowQueriesCount.ts` +
`useQueryInsightsIssues.utils.test.ts`

## Test plan

- [x] `pnpm typecheck` passes
- [x] `useQueryInsightsIssues.utils.test.ts` passes
- [x] Dev-server smoke test: reports pages, query performance, index
advisor, storage policies

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Reworked SQL construction and typings across reporting, query
performance, index advisor, and privilege features to use safer SQL
fragments, improving reliability and preventing query composition
issues.
* **Types**
* Reporting query types were split to distinguish database vs. logs
queries, enabling correct handling and validation.
* **Docs/Utils**
  * Added a helper to consistently generate logs SQL for report hooks.
* **Tests**
  * Updated tests to exercise the new SQL-building API.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45998)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-05-15 14:50:38 -04:00

104 lines
3.3 KiB
TypeScript

import { literal, safeSql, type SafeSqlFragment } from '@supabase/pg-meta/src/pg-format'
import { useQuery } from '@tanstack/react-query'
import { z } from 'zod'
import { databaseKeys } from './keys'
import { filterProtectedSchemaIndexAdvisorResult } from '@/components/interfaces/QueryPerformance/IndexAdvisor/index-advisor.utils'
import { executeSql } from '@/data/sql/execute-sql-query'
import type { ResponseError, UseCustomQueryOptions } from '@/types'
export type GetIndexAdvisorResultVariables = {
projectRef?: string
connectionString?: string | null
query: string
}
const IndexAdvisorResultSchema = z.object({
errors: z.array(z.string()),
index_statements: z.array(z.string()),
startup_cost_before: z
.number()
.nullable()
.transform((v) => v ?? 0),
startup_cost_after: z
.number()
.nullable()
.transform((v) => v ?? 0),
total_cost_before: z
.number()
.nullable()
.transform((v) => v ?? 0),
total_cost_after: z
.number()
.nullable()
.transform((v) => v ?? 0),
})
export type GetIndexAdvisorResultResponse = z.infer<typeof IndexAdvisorResultSchema> & {
index_statements: SafeSqlFragment[]
}
function markDatabaseSqlSafe(
indexAdvisorResult: z.infer<typeof IndexAdvisorResultSchema>
): GetIndexAdvisorResultResponse {
return indexAdvisorResult as GetIndexAdvisorResultResponse
}
export async function getIndexAdvisorResult({
projectRef,
connectionString,
query,
}: GetIndexAdvisorResultVariables) {
if (!projectRef) throw new Error('Project ref is required')
const { result: results } = await executeSql({
projectRef,
connectionString,
sql: safeSql`set search_path to public, extensions; select * from index_advisor(${literal(query)});`,
})
if (!results || results.length === 0) {
console.error('[index_advisor > getIndexAdvisorResult] No results from index_advisor')
return null
}
const parsed = IndexAdvisorResultSchema.safeParse(results[0])
if (!parsed.success) {
const firstError = parsed.error.errors[0]
const errorPath = firstError.path.length > 0 ? ` at path: ${firstError.path.join('.')}` : ''
console.error(
`Invalid index advisor response${errorPath}: ${firstError.message}. Received: ${JSON.stringify(results[0])}`
)
return null
}
return filterProtectedSchemaIndexAdvisorResult(markDatabaseSqlSafe(parsed.data))
}
export type GetIndexAdvisorResultData = Awaited<ReturnType<typeof getIndexAdvisorResult>>
export type GetIndexAdvisorResultError = ResponseError
export const useGetIndexAdvisorResult = <TData = GetIndexAdvisorResultData>(
{ projectRef, connectionString, query }: GetIndexAdvisorResultVariables,
{
enabled = true,
...options
}: UseCustomQueryOptions<GetIndexAdvisorResultData, GetIndexAdvisorResultError, TData> = {}
) => {
const formattedQuery = (query ?? '').trim().toLowerCase()
const isValidQueryForIndexing =
formattedQuery.startsWith('select') || formattedQuery.startsWith('with pgrst_source')
return useQuery<GetIndexAdvisorResultData, GetIndexAdvisorResultError, TData>({
queryKey: databaseKeys.indexAdvisorFromQuery(projectRef, query),
queryFn: () => getIndexAdvisorResult({ projectRef, connectionString, query }),
retry: false,
enabled:
enabled &&
typeof projectRef !== 'undefined' &&
typeof query !== 'undefined' &&
isValidQueryForIndexing,
...options,
})
}