mirror of
https://github.com/supabase/supabase.git
synced 2026-10-14 05:39:11 +03:00
Orgs with the HIPAA add-on had the Assistant's opt-in level forced to `disabled` on any project marked High Compliance, regardless of what the org picked in its AI settings. The restriction predated our AI provider BAAs. The consequence is those users see the Assistant failing to answer questions about their data w/ no clear path how to fix it, even though the LLM provider supports this use case. This PR removes these Assistant restrictions on the server and client so those projects honor the org's chosen level. Braintrust conversation tracing is unchanged and still blocked for these projects, see [this test case](https://github.com/supabase/supabase/blob/b9800ccf16/apps/studio/lib/ai/braintrust-logger.test.ts#L16-L20). See [comments](https://linear.app/supabase/issue/AI-1153/allow-hipaa-orgs-to-opt-in-to-assistant-data-access-for-high#comment-485a0d46) for legal approval and conditions. The client-side changes enable features like "Debug with AI" on SQL query failures, “Generate/Rename with AI” for snippet titles, and generated Assistant chat titles for these customers. The AI opt-in copy now adds a reminder to obtain consent from data subjects, linking the [shared responsibility model](https://supabase.com/docs/guides/deployment/shared-responsibility-model) based also on [this comment](https://linear.app/supabase/issue/AI-1153/allow-hipaa-orgs-to-opt-in-to-assistant-data-access-for-high#comment-f81ee610). <img width="400" alt="CleanShot 2026-09-17 at 5 01 02 PM@2x" src="https://github.com/user-attachments/assets/d02123f2-3e32-4d83-9f98-7d15e59222ef" /> To test with a HIPAA-enabled project in staging, you can use this [Plan Change [Staging]](https://app.hex.tech/supabase/app/Plan-Change-Staging-032BD32jo1EaisCS85qunf/latest) Hex to add the HIPAA add-on. Once the add-on is present, you can turn on High Compliance from a project's settings. Also in org settings, crank up the Assistant data opt-in level and verify the Assistant is able to answer questions about the project's data. My results testing with opt-in level "Schema, Logs & Database Data": | High compliance setting | Data opt-in working | |--------|--------| | <img width="1302" height="422" alt="CleanShot 2026-09-17 at 5 03 36 PM@2x" src="https://github.com/user-attachments/assets/c416371b-2eb8-49df-9c07-6d8eababb443" /> | <img width="1566" height="1516" alt="CleanShot 2026-09-17 at 5 05 14 PM@2x" src="https://github.com/user-attachments/assets/39624355-7f8f-46ce-9f08-a8acfb9da830" /> | Closes AI-1153 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## New Features - AI-assisted query renaming, snippet title generation, debugging, and tools now follow organization AI opt-in settings rather than project HIPAA status. - Debugging assistance and AI actions remain available for eligible users without additional HIPAA-based blocking. - AI metadata warnings consistently show standard opt-in messaging and permission settings. - AI settings remind users to obtain consent before entering personal data and link to shared responsibility guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
102 lines
4.0 KiB
TypeScript
102 lines
4.0 KiB
TypeScript
import { beforeEach, describe, expect, it, vi } from 'vitest'
|
|
|
|
import { getTools } from './index'
|
|
import { getMcpTools } from './mcp-tools'
|
|
|
|
vi.mock('common', () => ({ IS_PLATFORM: true }))
|
|
|
|
vi.mock('./mcp-tools', () => ({ getMcpTools: vi.fn() }))
|
|
vi.mock('./studio-tools', () => ({ getStudioTools: vi.fn(() => ({ studio_tool: {} })) }))
|
|
vi.mock('./schema-tools', () => ({ getSchemaTools: vi.fn(() => ({ schema_tool: {} })) }))
|
|
vi.mock('./incident-tools', () => ({ getIncidentTools: vi.fn(() => ({ incident_tool: {} })) }))
|
|
vi.mock('./fallback-tools', () => ({ getFallbackTools: vi.fn(() => ({ fallback_tool: {} })) }))
|
|
// Identity filter so assertions can check the raw merged tool set
|
|
vi.mock('../tool-filter', () => ({ filterToolsByOptInLevel: vi.fn((tools) => tools) }))
|
|
|
|
const BASE_PARAMS = {
|
|
projectRef: 'abcdefghijklmnopqrst',
|
|
connectionString: 'postgresql://localhost',
|
|
authorization: 'Bearer token',
|
|
aiOptInLevel: 'schema_and_log_and_data' as const,
|
|
accessToken: 'access-token',
|
|
baseUrl: 'https://supabase.com/dashboard',
|
|
signal: new AbortController().signal,
|
|
}
|
|
|
|
describe('ai/tools getTools', () => {
|
|
beforeEach(async () => {
|
|
vi.mocked(getMcpTools).mockResolvedValue({ list_tables: {} } as any)
|
|
// Reset to platform each test; the self-hosted test overrides to false.
|
|
// Done here (not afterEach) so the spy can't leak across tests via order.
|
|
const common = await import('common')
|
|
vi.spyOn(common, 'IS_PLATFORM', 'get').mockReturnValue(true)
|
|
})
|
|
|
|
it('includes studio, MCP, schema and incident tools on platform', async () => {
|
|
const tools = await getTools(BASE_PARAMS)
|
|
|
|
expect(getMcpTools).toHaveBeenCalledWith({
|
|
accessToken: BASE_PARAMS.accessToken,
|
|
projectRef: BASE_PARAMS.projectRef,
|
|
aiOptInLevel: BASE_PARAMS.aiOptInLevel,
|
|
signal: BASE_PARAMS.signal,
|
|
})
|
|
expect(tools).toHaveProperty('studio_tool')
|
|
expect(tools).toHaveProperty('list_tables')
|
|
expect(tools).toHaveProperty('schema_tool')
|
|
expect(tools).toHaveProperty('incident_tool')
|
|
})
|
|
|
|
it('degrades gracefully to the remaining tools when remote MCP fetch fails', async () => {
|
|
const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
|
|
vi.mocked(getMcpTools).mockRejectedValueOnce(new Error('remote MCP unreachable'))
|
|
|
|
const tools = await getTools(BASE_PARAMS)
|
|
|
|
// The assistant still works with the non-MCP tools instead of throwing
|
|
expect(tools).toHaveProperty('studio_tool')
|
|
expect(tools).toHaveProperty('schema_tool')
|
|
expect(tools).toHaveProperty('incident_tool')
|
|
expect(tools).not.toHaveProperty('list_tables')
|
|
expect(consoleSpy).toHaveBeenCalled()
|
|
|
|
consoleSpy.mockRestore()
|
|
})
|
|
|
|
it('does not fetch MCP tools when no access token is provided', async () => {
|
|
const tools = await getTools({ ...BASE_PARAMS, accessToken: undefined })
|
|
|
|
expect(getMcpTools).not.toHaveBeenCalled()
|
|
expect(tools).toHaveProperty('studio_tool')
|
|
expect(tools).not.toHaveProperty('list_tables')
|
|
})
|
|
|
|
it('uses fallback tools and skips MCP when self-hosted', async () => {
|
|
const common = await import('common')
|
|
vi.spyOn(common, 'IS_PLATFORM', 'get').mockReturnValue(false)
|
|
|
|
const tools = await getTools(BASE_PARAMS)
|
|
|
|
expect(getMcpTools).not.toHaveBeenCalled()
|
|
expect(tools).toHaveProperty('studio_tool')
|
|
expect(tools).toHaveProperty('fallback_tool')
|
|
expect(tools).not.toHaveProperty('list_tables')
|
|
})
|
|
|
|
it('excludes notebook tools when isExplorerEnabled is not set', async () => {
|
|
const tools = await getTools(BASE_PARAMS)
|
|
|
|
expect(tools).not.toHaveProperty('list_notebooks')
|
|
expect(tools).not.toHaveProperty('get_notebook')
|
|
expect(tools).not.toHaveProperty('run_notebook')
|
|
})
|
|
|
|
it('includes notebook tools only when isExplorerEnabled is true', async () => {
|
|
const tools = await getTools({ ...BASE_PARAMS, isExplorerEnabled: true })
|
|
|
|
expect(tools).toHaveProperty('list_notebooks')
|
|
expect(tools).toHaveProperty('get_notebook')
|
|
expect(tools).toHaveProperty('run_notebook')
|
|
})
|
|
})
|