mirror of
https://github.com/supabase/supabase.git
synced 2026-10-06 09:55:06 +03:00
Users who set a database password with special characters (\`@\`, \`#\`, \`%\`, \`+\`, etc.) get no warning that it must be percent-encoded when used in a connection URL, which leads to confusing connection failures ([FE-3379](https://linear.app/supabase/issue/FE-3379)). <img width="700" height="200" alt="Screenshot 2026-07-03 at 6 26 43 PM" src="https://github.com/user-attachments/assets/48608d65-8057-4abe-96fc-c0ede3550951" /> <img width="1002" height="395" alt="Screenshot 2026-07-03 at 6 27 14 PM" src="https://github.com/user-attachments/assets/1366b985-7d80-4e7d-97f0-c79d5c84cefd" /> <img width="548" height="303" alt="Screenshot 2026-07-03 at 6 27 26 PM" src="https://github.com/user-attachments/assets/b042101a-0e88-4730-adb8-1b490018f208" /> **Changed:** - `PasswordStrengthBar` now shows a warning-colored callout (with a docs link) whenever the entered password contains characters that need percent-encoding — this covers project creation, reset database password, restore-to-new-project, and the Vercel deploy-button flow - Replaced `DATABASE_PASSWORD_REGEX` (only caught `@`, `:`, `/`) with a `passwordNeedsPercentEncoding()` helper based on `encodeURIComponent`, so `#`, `%`, `+`, `?`, `&`, spaces etc. are caught too - Moved `SpecialSymbolsCallout` from `ProjectCreation/` to `components/ui/` since it's now shared **Added:** - Info admonition in the Connect sheet next to connection strings that still contain `[YOUR-PASSWORD]` (direct connection + `.env`-based file setups; hidden for psql and .NET where percent-encoding doesn't apply, and after a password reset since the substituted password is already encoded) ## To test - Project creation → type a password containing \`#\` or \`@\` → warning callout appears above the strength bar; disappears for alphanumeric passwords - Database Settings → Reset database password → same behaviour - Connect sheet → Direct connection → note shows under the connection string for URI/JDBC types, not for psql; after resetting the password from the sheet, the note disappears (password is substituted already encoded) - Connect sheet → Node.js/Python/Go/SQLAlchemy file setups show the note; .NET does not - \`pnpm vitest run lib/password-strength.test.ts\` passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added a dedicated password encoding note (with documentation link) on direct connection screens when the password is embedded in a URL. * Added an encoding hint to the password strength area when percent-encoding is required. * **Bug Fixes** * Removed regex-based “invalid password” callout and replaced it with safer percent-encoding detection logic. * **Tests** * Added test coverage for `passwordNeedsPercentEncoding`. * Removed obsolete Project Creation password regex tests. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
85 lines
2.7 KiB
TypeScript
85 lines
2.7 KiB
TypeScript
import { UseFormReturn } from 'react-hook-form'
|
|
import { FormControl, FormField } from 'ui'
|
|
import { Input } from 'ui-patterns/DataInputs/Input'
|
|
import { FormItemLayout } from 'ui-patterns/form/FormItemLayout/FormItemLayout'
|
|
|
|
import { CreateProjectForm } from './ProjectCreation.schema'
|
|
import Panel from '@/components/ui/Panel'
|
|
import { PasswordStrengthBar } from '@/components/ui/PasswordStrengthBar'
|
|
import { passwordStrength } from '@/lib/password-strength'
|
|
import { generateStrongPassword } from '@/lib/project'
|
|
|
|
interface DatabasePasswordInputProps {
|
|
form: UseFormReturn<CreateProjectForm>
|
|
}
|
|
|
|
const updatePasswordStrength = async (form: UseFormReturn<CreateProjectForm>, value: string) => {
|
|
try {
|
|
const { warning, message, strength } = await passwordStrength(value)
|
|
form.setValue('dbPassStrength', strength, { shouldValidate: false, shouldDirty: false })
|
|
form.setValue('dbPassStrengthMessage', message ?? '', {
|
|
shouldValidate: false,
|
|
shouldDirty: false,
|
|
})
|
|
form.setValue('dbPassStrengthWarning', warning ?? '', {
|
|
shouldValidate: false,
|
|
shouldDirty: false,
|
|
})
|
|
|
|
form.trigger('dbPass')
|
|
} catch (error) {
|
|
console.error(error)
|
|
}
|
|
}
|
|
|
|
export const DatabasePasswordInput = ({ form }: DatabasePasswordInputProps) => {
|
|
// [Refactor] DB Password could be a common component used in multiple pages with repeated logic
|
|
async function generatePassword() {
|
|
const password = generateStrongPassword()
|
|
form.setValue('dbPass', password)
|
|
|
|
updatePasswordStrength(form, password)
|
|
}
|
|
|
|
return (
|
|
<Panel.Content>
|
|
<FormField
|
|
control={form.control}
|
|
name="dbPass"
|
|
render={({ field }) => {
|
|
return (
|
|
<FormItemLayout
|
|
label="Database password"
|
|
layout="horizontal"
|
|
description={
|
|
<PasswordStrengthBar
|
|
passwordStrengthScore={form.getValues('dbPassStrength')}
|
|
password={field.value}
|
|
passwordStrengthMessage={form.getValues('dbPassStrengthMessage')}
|
|
generateStrongPassword={generatePassword}
|
|
/>
|
|
}
|
|
>
|
|
<FormControl>
|
|
<Input
|
|
copy={field.value.length > 0}
|
|
type="password"
|
|
placeholder="Type in a strong password"
|
|
{...field}
|
|
autoComplete="off"
|
|
onChange={async (event) => {
|
|
const newValue = event.target.value
|
|
field.onChange(event)
|
|
|
|
updatePasswordStrength(form, newValue)
|
|
}}
|
|
/>
|
|
</FormControl>
|
|
</FormItemLayout>
|
|
)
|
|
}}
|
|
/>
|
|
</Panel.Content>
|
|
)
|
|
}
|