Charis 1d2817da9b feat(logs): brand ServiceFlow.sql.ts with SafeLogSqlFragment (#46336) ...

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Refactor / security hardening (part 3 of stacked analytics safe-SQL
series; stacks on top of PR 2: "feat(logs): route unified-logs hooks
through executeAnalyticsSql")

## What is the current behavior?

`ServiceFlow.sql.ts` interpolates `logId` and `serviceType` as raw
template-literal strings directly into SQL (e.g. `` `WHERE el.id =
'${logId}'` ``). The legacy BigQuery branch of
`unified-log-inspection-query.ts` calls `post()` directly with a plain
`string`-typed SQL value, bypassing the `executeAnalyticsSql`
wire-boundary.

## What is the new behavior?

- Add `SAFE_SERVICE_LITERAL: Record<EdgeServiceType,
SafeLogSqlFragment>` — pre-branded SQL string literals for each service
type, built with `analyticsLiteral`.
- Rewrite `getBaseEdgeServiceFlowQuery`,
`getEdgeFunctionServiceFlowQuery`, and `getPostgresServiceFlowQuery` to
use `safeSql` template tag with `analyticsLiteral(logId)` and
`SAFE_SERVICE_LITERAL[serviceType]`. Return types changed to
`SafeLogSqlFragment`.
- Update the four thin wrappers (`getPostgrestServiceFlowQuery`,
`getAuthServiceFlowQuery`, `getStorageServiceFlowQuery`) to return
`SafeLogSqlFragment`.
- Replace `let sql = ''` + direct `post()` call in
`unified-log-inspection-query.ts`'s legacy BigQuery branch with `let
sql: SafeLogSqlFragment` + `executeAnalyticsSql`, eliminating the last
direct `post()` call to the analytics endpoint in this file.

`pnpm typecheck` passes cleanly.

## Additional context

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Secured analytics and log inspection queries through parameterized SQL
execution, preventing potential SQL injection vulnerabilities.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46336?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

2026-05-25 10:16:40 -04:00

..

ServiceFlow.sql.ts

feat(logs): brand ServiceFlow.sql.ts with SafeLogSqlFragment (#46336)

2026-05-25 10:16:40 -04:00