mirror of
https://github.com/supabase/supabase.git
synced 2026-10-19 08:09:11 +03:00
Gildas Garcia
1e26457bac
Fifth stacked PR for scoped PAT extracted from the prototype #47783 to ease reviewing. Previous stacked PR is #47999 Next stacked PR is #48359 This PR refactor how we get the map of which scopes enable which endpoint or mcp tool. Previously it was an hardcoded file. We now compute it from the OpenAPI specs of our API. This ensure the map stays up to date when the API changes. However, we don't have an always up-to-date equivalent for mcp tools so we duplicated code from platform that map the OAuth scopes they check with the FGA permissions. ## Notes The react-hook-form usage is not great. A follow up PR will fix it ## How to test - On https://studio-staging-git-scopedpat-scope-permissions-api-supabase.vercel.app/dashboard/account/tokens - Create a new token with a few permissions (their risk marker should be displayed: (_High risk_, _Medium risk_ or _Low risk_) - You should see the available endpoints and mcp tools in the review step <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added dynamic permission mapping for scoped access tokens, covering Management API endpoints and MCP tools. * Added a permissions endpoint with hosted-platform support and caching. * Updated scoped token creation and review screens to show capabilities based on granted permissions. * Added permission-aware risk indicators and tool visibility. * **Bug Fixes** * Improved authorization checks so endpoints and tools require all necessary scopes. * **Tests** * Added coverage for endpoint, scope, and MCP tool mapping behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Writing components
Where to create your components
- For components that declare the general structure and layout of a page:
/components/layouts/xxx
- For components that are tightly coupled to a specific interface:
/components/interfaces/xxx
- For components that are meant to be reusable across multiple pages:
/components/ui/xxx
- Note: We're gradually moving files out of the
to-be-cleanedfolder into the respective folders as we refactor
Component structure
- If a component has constants and utility methods that are tightly coupled to itself, keep them close to the component and enclose them in a folder with an
index.tsxas an entry point - Otherwise it can just be a file on its own
- For example:
-
components/ui - SampleComponentA - SampleComponentA.tsx - SampleComponentA.constants.ts - SampleComponentA.utils.ts - SampleComponentA.types.ts - index.ts - SampleComponentB.tsx
-
Template for building components
// Declare the prop types of your component
interface ComponentAProps {
sampleProp: string
}
// Name your component accordingly — use a named export, not a default export
export const ComponentA = ({ sampleProp }: ComponentAProps) => {
return <div>ComponentA: {sampleProp}</div>
}