skills/supabase__supabase
1
0
Fork 0
mirror of https://github.com/supabase/supabase.git synced 2026-09-22 13:37:53 +08:00
Code Issues Packages Projects Releases Wiki Activity
38,659 Commits 1,712 Branches 0 Tags
docs/cli-deploy-next-step
Commit Graph

676 Commits

Author SHA1 Message Date
Joshen Lim 5104754018 Fix types master (#50345) 
## Context

Just needed to adjust the API types import - the name likely changed
somewhere
`AnalyticsResponse` -> `AnalyticsResponse_Output`

Verified the typecheck locally

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Updated analytics test typing to align with the current analytics
response schema.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-14 23:02:16 +08:00
Jordi Enric d2ed60da27 fix(auth): migrate overview errors to clickhouse (#50174) 
## Problem

Auth overview error tables call the legacy logs endpoint through
fetchLogs defaults, even with the ClickHouse migration enabled.
Success-rate cards also show zero when there are no requests and
misleading relative changes between small rates.

## Fix

Select matching BigQuery or ClickHouse queries with otelLegacyLogs,
separate caches by engine, and normalize numeric results.

Show No data for success rates without requests and omit comparisons
when either period has no requests. Show success-rate changes in
percentage points: 0% to 0.2% displays +0.2 pp. Omit undefined relative
changes from a zero baseline for activity and sign-up counts. Show
explicit errors for failed log requests, including error payloads
returned with HTTP 200, instead of empty tables.

## Validation

- Auth overview error tables compared against staging with matching
data.
- 84 focused tests passed across four suites, including 25 direct
formatter tests.
- 12 MSW integration tests exercise both endpoint/SQL pairs, HTTP and
embedded API failures, and rendered No data, genuine 0%, and +0.2 pp
states.
- Unit tests cover missing periods, zero requests, percentage-point and
relative changes, SQL structure, and numeric result parsing.
- Formatting and diff checks passed; code review found no actionable
issues.
- Full local lint/typecheck are limited by shared checkout dependencies.
Browser comparison confirmed the deployed rate display uses percentage
points and shows No data without a comparison for absent server
requests; populated error rows match staging. The final formatter
extraction (9886b78682) was also deployed and verified in the browser;
CI completion remains outstanding.

Split from #50173.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **New Features**
- Added OpenTelemetry support for authentication error and metrics
reporting.
- Added clearer handling of missing metric data, including “No data”
states.
- Improved success-rate change calculations using percentage-point
differences.
  - Added user-visible error states when analytics requests fail.

- **Bug Fixes**
- Improved validation and handling of authentication metrics and error
data.
  - Corrected formatting and rounding for metric values and changes.

- **Tests**
- Expanded coverage for legacy and OpenTelemetry analytics, error
handling, empty data, formatting, and edge cases.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-14 15:35:03 +02:00
Danny White 476d4a5851 refactor(ui): drop redundant Button variant="default" props (#50161) 
## What kind of change does this PR introduce?

Mechanical cleanup on top of the Button default-variant change (#50160).

## What is the current behavior?

Many callsites still pass `variant="default"` even though that is now
the component default.

## What is the new behavior?

Removes redundant static `variant="default"` from legacy `Button` and
`ButtonTooltip` callsites. Keeps explicit defaults where they document
the API:

- `button-default.tsx` and `button-sizes.tsx` demos
- `DocsButton`, which pins neutral styling at the wrapper boundary

## To test

Studio:

- [Auth → Rate
Limits](https://studio-staging-2s957kwc4-supabase.vercel.app/dashboard/project/_/auth/rate-limits):
dirty the form so Cancel appears; Cancel stays neutral, Save stays green
- [Project Settings → API
Keys](https://studio-staging-2s957kwc4-supabase.vercel.app/dashboard/project/_/settings/api-keys):
`DocsButton` in the header actions stays neutral

Design system:

- [Design system →
Button](https://design-system-git-dnywh-dc924ac1-supabase.vercel.app/design-system/docs/components/button):
`button-default` / `button-sizes` still show explicit default styling;
Primary (green) is restricted to the Primary section (and `asChild`)

WWW:

- [www → Brand
assets](https://zone-www-dot-com-git-dnywh-dc924ac1-supabase.vercel.app/brand-assets):
Download logo kit / Download button kit stay neutral
 2026-09-11 17:05:26 +10:00
Alaister Young 1966209483 chore(deps): upgrade vitest to v5 (#49994) 
Upgrades Vitest from 4.1.4 to 5.0.0 across the monorepo, fixes the
handful of things v5 turned into hard errors, and drops the
`vi.clearAllMocks()` boilerplate that v5's `clearMocks` default makes
redundant.

**Changed:**
- `vitest`, `@vitest/ui`, `@vitest/coverage-v8` 4.1.4 → 5.0.0 (catalog)
- `vi.mock` calls that lived inside `beforeAll`/`beforeEach`/test bodies
moved to module scope (v5 throws on nested calls). Affects the Studio
and docs setup files and four Studio tests.
- `detectBrowser` test restores `navigator` via `vi.unstubAllGlobals()`
instead of assigning `global.navigator`, which now reaches jsdom's
getter-only property.
- `RowEditor.utils.test.ts` restores its `JSON.stringify` spy. It used
to leak a throwing mock for the rest of the file, which v5's coverage
provider now trips over. A later test in the same file had been
asserting the leak's side effect (valid JSON reported as invalid) and
now asserts the correct behavior.
- `@testing-library/jest-dom` 6.6 → 7.0.1. Its vitest type augmentation
resolves through a peer now, so it lands on each package's own `vitest`
instead of whichever copy pnpm hoisted. Fixes `toBeInTheDocument` type
errors in dev-tools after the reshuffle.
- `@testing-library/react` 16.0.0 → 16.3.3 for the React 19 peer range.
- `vite: catalog:` added to dev-tools, www, and common. Without it they
resolved a newer vite than the catalog pin, which forked a second vitest
instance in the lockfile. There's now one.
- ai-commands custom matcher types use v5's `Matchers<R, T>` form.
- 110 test files: `vi.clearAllMocks()` removed from
`beforeEach`/`afterEach` hooks, along with hooks that only did that and
the imports they left unused. Calls that also reset/restore mocks are
untouched. Second commit, mechanical.

**Added:**
- `.vitest/` to the root gitignore (v5 writes JSON/JUnit/HTML reporter
output there)

**Removed:**
- `vite-tsconfig-paths` catalog entry and deps. Vitest 5 resolves
tsconfig paths itself.

Release-age note: this sat in draft with a temporary
`minimumReleaseAgeExclude` entry for `vitest` and `@vitest/*` while
5.0.0 was inside the workspace's 3-day `minimumReleaseAge` window. That
window has closed, so the exclusion is gone and nothing bypasses the
release-age gate.

**Perf** (local, medians of 3 runs, same machine):

| Suite | v4.1.4 | v5.0.0 |
|---|---|---|
| studio | 144.1s | 141.7s (-2%) |
| studio `--coverage` | 156.9s | 146.4s (-7%) |
| ui-patterns | 6.27s | 5.07s (-19%) |
| ui `--coverage` | 3.35s | 2.14s (-36%) |
| www | 0.89s | 0.47s (-47%) |

Studio is dominated by jsdom environment setup per file, which v5
doesn't change. `vitest doctor` recommends keeping the current pool
config: the vm pools and `isolate: false` all break tests.

## To test

- `pnpm install --frozen-lockfile` succeeds with no
`minimumReleaseAgeExclude` entry for vitest.
- CI: Studio unit tests, ui, ui-patterns, www, docs, and typecheck/lint
should all be green. The lint ratchet was checked locally: warning
counts on touched Studio files are identical to master.
- `pnpm test:studio` locally passes with coverage (588 files, 6240
tests).
- Open a Studio test that uses `toBeInTheDocument` in your editor and
confirm no type errors on jest-dom matchers, in Studio and in
`packages/dev-tools`.
- Known pre-existing failures unrelated to this PR: one dev-tools test
(`getEventCountBadge` capped pill) fails on master too.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Tests
- Improved test coverage for JSON validation and mobile navigation
behavior.
- Updated test setup, cleanup, environment configuration, and matcher
support across application and shared package suites.
- Removed obsolete coverage for alternate MCP transport selection.

## Chores
- Streamlined TypeScript path resolution and Vitest reporter output
handling.
- Updated testing libraries and Vitest tooling across documentation,
Studio, website, and shared packages.
- Added Vitest reporter output to ignored files.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
 2026-09-10 16:45:54 +08:00
Danny White 1131e3e2ce fix(ui): default Button variant to default instead of primary (#50160) 
## What kind of change does this PR introduce?

Bug fix / design-system alignment for the legacy `Button` from `ui`.

## What is the current behavior?

Omitting `variant` on the legacy `Button` falls back to brand-green
`primary`. That makes accidental greens easy, and it is hard to spot the
real main action on busy pages.

## What is the new behavior?

- Legacy `Button` now defaults to neutral `default`
- Intentional primary CTAs (create, save, submit, marketing CTAs, and
matching `ButtonTooltip` usages) now set `variant="primary"` so their
appearance is unchanged
- Neutral actions that previously relied on the old fallback (cancel,
close, back, dashboard nav, and similar) become grey/white
- Design-system docs updated; regression tests cover the new default

`Button_Shadcn_` is unchanged. It already uses its own CVA default.

This is PR 1 of 2 in a stack. PR 2 drops now-redundant
`variant="default"` props.

## To test

Studio (http://localhost:8082):

- `/sign-in`: Sign in stays green
- Open a project → Database → Tables: New table stays green
- Auth → Users → Invite: Invite user stays green; Cancel / dismiss
controls stay neutral
- Project Settings → General: edit a field so Cancel and Save appear.
Cancel is neutral, Save is green

Design system (http://localhost:3003):

- Components → Button: default demo is neutral; primary demo is green;
featured preview is the default variant

Marketing (optional):

- www header: Start your project stays green; logged-in Dashboard is
neutral

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Style**
- Buttons now default to a neutral style, while primary actions across
Studio, documentation, marketing pages, forms, dialogs, and error states
use prominent primary styling.
- Updated button examples and previews clarify the distinction between
default and primary variants.
  - Event registration now includes a directional arrow icon.

- **Tests**
- Added coverage confirming default button styling and explicit primary
styling behave as expected.
- Updated related test fixtures to use primary styling where
appropriate.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-10 11:23:17 +10:00
Danny White fce9d475ee chore(studio): migrate combobox triggers (#50157) 
## What kind of change does this PR introduce?

Studio UI consistency refactor.

## What is the current behaviour?

Several Studio comboboxes still build their triggers from `Button` and
supply their own double-chevron icon. This duplicates trigger styling
and allows these controls to drift from selects and other comboboxes.

## What is the new behaviour?

- Migrates the PITR timezone, AWS region, and account timezone controls
to `ComboboxTrigger`
- Migrates the shared `SchemaSelector` and `FunctionSelector`, updating
their Studio callsites together
- Preserves the globe icon in both timezone controls
- Exposes the correct combobox role and open state through the shared
trigger
- Tightens the tiny schema selector end padding so its chevron aligns
with adjacent controls
- Leaves organisation and project context switchers unchanged

| Before | After |
| --- | --- |
| <img width="504" height="490" alt="CleanShot 2026-09-09 at 13 56
56@2x"
src="https://github.com/user-attachments/assets/117a9169-88bf-4f9e-8302-9df9b911a307"
/> | <img width="496" height="512" alt="CleanShot 2026-09-09 at 11 31
26@2x"
src="https://github.com/user-attachments/assets/bc98cded-2723-4d20-9d8c-49630ea018af"
/> |
| <img width="1250" height="394" alt="CleanShot 2026-09-09 at 13 58
34@2x"
src="https://github.com/user-attachments/assets/9106f924-88fd-40d4-88e3-8d0ddbb61d12"
/> | <img width="1246" height="376" alt="CleanShot 2026-09-09 at 13 58
09@2x"
src="https://github.com/user-attachments/assets/7894a254-f6f9-40bb-a312-9f1a5079f096"
/> |

## To test

On the [Studio
preview](https://studio-staging-git-dnywh-choremigrate-combobox-680102-supabase.vercel.app):

1. Open **Database > Tables** and use the schema selector above the
table. It should use a single down chevron, open normally, and update
the selected schema.
2. Open **Authentication > Hooks > Add hook**, then select **Postgres**
as the hook type. The **Postgres schema** and **Postgres function**
selectors should use a single down chevron and continue to open and
select normally.

The PITR, AWS region, and account timezone callsites require the
relevant plan, integration, or feature flag. When available, their
triggers should use the same single down chevron, and both timezone
controls should retain the globe icon.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **UI Improvements**
* Standardized timezone, AWS region, database backup, function, and
schema selectors with a consistent combobox interface.
  * Added clear visual feedback for open and closed selector states.
* Preserved contextual icons and labels, including globe icons for
timezone selections.
* Improved accessibility with appropriate combobox semantics, accessible
names, and state information.
* Timezone settings are now available without an optional feature flag.
* **Tests**
  * Updated end-to-end coverage for the standardized combobox controls.
* Added coverage confirming schema selectors expose the selected schema
as an accessible name.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-09-09 15:36:35 +08:00
Danny White f5d0bf5d98 fix(ui): let command dropdowns scroll on touch inside overlays (#50103) 
## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

A command dropdown cannot be scrolled by touch when it sits inside a
dialog or sheet.

Radix wraps a modal dialog's overlay in a scroll lock that cancels wheel
and touch events whose target is not inside the sheet. A dropdown
portals to the body, so it falls outside that boundary and its scroll
events get cancelled.

Callers have been rediscovering this one at a time and fixing only half
of it. `MultiSelectorList` stops wheel events reaching the document, and
`SchemaSelector` and `FunctionSelector` expose a `stopScrollPropagation`
prop that does the same. None of them handle touch, so the desktop
symptom is fixed everywhere and the mobile one is fixed nowhere.

## What is the new behavior?

`CommandList` keeps wheel and touch events off the document itself. That
covers every command dropdown in the monorepo, in an overlay or not,
with no call-site changes. A caller's own `onWheel` or `onTouchMove`
still runs.

The workarounds this replaces are removed: the handler in
`MultiSelectorList`, and the `stopScrollPropagation` prop on
`SchemaSelector` and `FunctionSelector` along with its four call sites.

One behavior change worth naming: overscrolling past the end of a
dropdown no longer scrolls the page behind it. That is what a dropdown
should do, and it is what the four `stopScrollPropagation` call sites
were already opting into.

#50072 depends on this. It swaps two selects for comboboxes, and Radix
Select brings its own scroll lock, so without this the swap would
regress touch scrolling.

## To test

- On the deploy preview, [open a project's Connect
sheet](https://studio-staging-git-dnywh-fix-multi-select-scrol-63608b-supabase.vercel.app/dashboard/project/_)
and pick the MCP tab.
- Narrow the window to phone width and switch on touch emulation in
devtools.
- Open the features dropdown and drag the list. It should scroll, and
the sheet behind it should stay put.
- Repeat with a mouse wheel to confirm desktop scrolling still works.
- [Open Authentication >
Hooks](https://studio-staging-git-dnywh-fix-multi-select-scrol-63608b-supabase.vercel.app/dashboard/project/_/auth/hooks)
> Create hook, open the schema picker, and confirm it still scrolls by
wheel now that `stopScrollPropagation` is gone.
- [Open the SQL
editor](https://studio-staging-git-dnywh-fix-multi-select-scrol-63608b-supabase.vercel.app/dashboard/project/_/sql/new)'s
schema picker on a page with no overlay and confirm the list scrolls
normally.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Bug Fixes**
- Improved wheel and touch scrolling behavior in command lists,
selectors, and multi-select menus.
- Reduced unwanted scroll-lock interference when using selectors inside
overlays such as dialogs and sheets.
  - Preserved support for supplied scroll event callbacks.

- **Accessibility**
- Added clearer accessible labels to the Connect and mobile navigation
menu buttons.
- Updated the Connect button text behavior for icon-only and standard
presentations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-09-08 19:21:19 +08:00
Danny White 4a5db160be feat(studio): extract shared zod number input helpers (#50102) 
## What kind of change does this PR introduce?

Refactor. Extracts zod number input preprocessing into a shared Studio
helper and migrates existing call sites.

## What is the current behavior?

Number input clearing logic for controlled `type="number"` fields is
duplicated across Studio forms. The pipeline destination form had local
helpers, while Auth and settings forms inline the same `z.preprocess`
pattern.

## What is the new behavior?

Adds `apps/studio/lib/forms/zod-number-input.ts` with:

- `requiredNumberInputSchema` for required `z.number()` fields (`''` →
`NaN`)
- `optionalNumberInputSchema` for optional number fields (`''`/`null` →
`undefined`)
- `preprocessEmptyNumberInput` for `z.coerce.number()` schemas

Migrates:

- Pipeline destination form
- Connection pooling settings
- Auth provider validation (email and SMS OTP fields)
- SMTP settings
- MFA settings
- Protection settings

## To test

1. Open **Authentication > Providers > Email**, clear **Email OTP
expiration** or **Minimum password length**, and confirm the field stays
empty and shows validation on save.
2. Open **Authentication > Providers > Phone**, select a provider, clear
**SMS OTP Expiry**, and confirm validation still works.
3. Open **Authentication > Emails > SMTP settings**, clear **Port** or
**Rate limit**, and confirm validation on save.
4. Open **Authentication > Multi-factor authentication**, clear **Max
enrolled factors** or **Phone OTP length**, and confirm validation on
save.
5. Open **Database > Replication**, start a new pipeline, select
**BigQuery**, expand **Advanced settings**, clear a required numeric
field, and confirm it stays empty until filled.
6. (Optional, hosted non-HA projects only) Open **Database > Settings**,
scroll to **Connection pooling**, clear **Connection pool size**, and
confirm the value does not snap back before save.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved handling of empty numeric fields across authentication, SMTP,
database replication, and connection pooling settings.
* Optional numeric settings can now be cleared without triggering
unnecessary validation errors.
* Required numeric fields continue to display appropriate validation
errors when left incomplete.
* Standardized validation behavior for OTP settings, password
requirements, SMTP limits, replication configuration, and pool sizing.
* Refined protection settings to focus on CAPTCHA and leaked-password
options.
* **Tests**
  * Added coverage for empty and optional numeric input behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-09-08 18:26:41 +08:00
Gildas Garcia bfb0737d14 Fix to ensure labels, descriptions and validation errors are correctly linked to their inputs (#50080) 
## Problem

`FormItemLayout` does not correctly binds inputs descriptions and
validation messages to their inputs. This is because the input ids are
generated and not correctly propagated to the `FormMessage` and
`FormDescription` components. Besides, we still pass `name` or `id`
directly to the inputs or `FormItemLayout` in some places.

## Solution

- Fix `FormItemLayout` to correctly binds inputs descriptions and
validation messages to their inputs
- Fix incorrect usages
- Fix Design System documentation

## How to test

The issue is visible in production:
- Open https://supabase.com/design-system/docs/ui-patterns/forms
- Open the devtool and check the labels `for`, the description `id` and
the input `id` or `aria-describedby` attributes. You'll see they often
don't match

Do the same on staging:
- Open
https://design-system-git-fix-a11y-form-input-descriptions-supabase.vercel.app/design-system/docs/ui-patterns/forms
- Open the devtool and check the labels `for`, the description `id` and
the input `id` or `aria-describedby` attributes. They now match

Dashboard fixes:
-
https://studio-staging-git-fix-a11y-form-input-descriptions-supabase.vercel.app/dashboard/account/tokens:
_Expires in_ select button is now correctly linked to its label
-
https://studio-staging-git-fix-a11y-form-input-descriptions-supabase.vercel.app/dashboard/account/me:
the switches are now correctly linked to their label
- In Database/Indexes: the select buttons when creating an index are now
correctly linked to their label
- All other changes are the same things
 2026-09-08 09:47:32 +02:00
Ivan Vasilov 02cf09212e chore: Remove tsconfig paths (#49770) 
This PR removes all `paths` in `tsconfig.json` for all apps and
packages. They were added previosly because some of the components had a
`_Shadcn` suffix because of an ongoing migration. How that the migration
is done, the paths can be removed.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Standardized shared UI component, utility, and icon imports across
design-system examples and application screens.
  * Simplified shared component access and project configuration.
  * Added shared access to anchor-link helpers and animation styles.

* **Compatibility**
* Updated component exports and imports without changing existing
behavior.
  * No changes to user-facing workflows, screens, or functionality.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-01 13:13:30 +02:00
Gildas Garcia 4f92790587 fix: FormItemLayout does not apply item id correctly (#49637) 
## Problem

`<FormItemLayout>` does not apply item id correctly. This can be seen on
https://supabase.com/design-system/docs/ui-patterns/forms: open the
devtool and check the form items labels. They have no `for` attribute.
This makes it harder to correctly test and is an accessibility issue.

Axe devtool actually report it

## Solution

When inside React Hook Form, `<FormItemLayout>` actually generate an
`id` (via `<FormItem>`). However, this `id` is overridden in
`<FormLayout>` and read from context by `<FormLabel>`. Ensure we use the
generated id unless one was provided.

Also updated the paths filters for the CI check so that any changes in
either `ui` or `ui-patterns` triggers the studio unit and e2e tests.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Bug Fixes**
- Improved form accessibility by ensuring labels consistently connect to
their corresponding input fields.
- React-based forms now correctly preserve field-specific identifiers
when associating labels with inputs.
- Added support for explicitly specifying a label’s input target,
improving compatibility with customized form layouts.
- Updated Studio forms to use consistent control identifiers and
labeling behavior.

- **Quality Improvements**
- Automated validation now also runs when shared UI components and
patterns are updated.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-31 10:32:45 +02:00
Ali Waseem bfbe71bc3b Allow pasting multiple redirect URLs at once (#49490) 
Redirect URLs had to be added one at a time through the modal, and a
whitespace-separated paste silently saved as a single malformed allow
list entry.

Adds an opt-in `pasteSeparator` prop to `SingleValueFieldArray` that
expands a multi-value paste into one row per value, and wires it up in
the auth redirect URL modal so commas, spaces and line breaks all work.
Each URL lands on its own row, so the existing per-row validation
applies individually.

Fixes FE-4220

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Redirect URL fields now support pasting multiple URLs separated by
commas, spaces, or line breaks.
* Pasted values are automatically split into separate rows for easier
editing and individual validation.
* Supported URL formats are retained, including when multiple values are
pasted together.
  * Existing single-value paste behavior remains unchanged.
* Duplicate values are preserved so they can be reviewed and validated
individually.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-25 08:59:25 -06:00
Ayaan Gazali 18896e33de fix(studio): give two DropdownMenuTriggers asChild so they stop nesting buttons (#49264) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix. Two `DropdownMenuTrigger`s wrap a `Button` without `asChild`,
so each renders a `<button>` inside a `<button>`. One of them also loses
its `aria-label`, leaving an icon-only menu trigger with no accessible
name.

## What is the current behavior?

`DropdownMenuTrigger` forwards to `DropdownMenuPrimitive.Trigger`, which
renders its own `<button>` unless `asChild` is set. So this:

```tsx
<DropdownMenuTrigger>
  <Button variant="default" className="px-1" icon={<MoreVertical />}
          aria-label={`Open actions for ${hook.title}`} />
</DropdownMenuTrigger>
```

produces `<button><button/></button>`, which is invalid HTML, and puts
the props on the inner element rather than on the thing that actually
opens the menu.

Measured by rendering `HookCard` before and after, rather than reasoning
about it:

| | before | after |
| --- | --- | --- |
| `container.querySelectorAll('button button').length` | 1 | 0 |
| `aria-label` on `[aria-haspopup="menu"]` | `null` | `Open actions for
Send Email` |

That second row is the part worth caring about. The `aria-label` was
written deliberately for a button whose only content is a `MoreVertical`
icon, and it lands on the nested inner button instead of the trigger, so
a screen reader gets no name for the control it actually operates.

Two sites:

- `components/interfaces/Auth/Hooks/HookCard.tsx`, the per-hook actions
menu. This is the one with the orphaned `aria-label`.
- `components/layouts/ProjectLayout/PauseFailedState.tsx`, the overflow
menu next to "Download backup".

## What is the new behavior?

Both get `asChild`, so the `Button` becomes the trigger. No nesting, and
the props land where they were meant to.

## Additional context

#48948 fixed exactly this in `RestoreFailedState.tsx`, which sits in the
same directory as `PauseFailedState.tsx` and has the same overflow-menu
shape. This is that fix applied to the two places it was not.

I swept all 4398 `.tsx` files across studio, www, docs, design-system,
ui-library, `packages/ui` and `packages/ui-patterns` for any Radix-style
trigger (`DropdownMenu`, `Tooltip`, `Popover`, `Dialog`, `Sheet`,
`AlertDialog`, `HoverCard`, `Collapsible`, `ContextMenu`, `Menubar`,
`Select`, `Tabs`, `Accordion`) that wraps a button-like element without
`asChild`. After discarding one false positive in
`EdgeFunctionDetails.tsx`, where the `Button` is a sibling of
`TabsTrigger` inside `TabsList` rather than its child, these two are the
only ones left. So this should be the end of the pattern rather than the
start of a series.

No test added, matching what #48948 did for the same change. The
`asChild` behaviour belongs to Radix, and a test asserting DOM nesting
around two JSX attributes would be testing the library. I did verify it
the other way round while developing: a throwaway render assertion
failed on unmodified master with a nested-button count of 1 and a null
trigger `aria-label`, and passed after the change. Happy to commit that
assertion if you would rather have it in the suite.

Gates: `test:prettier` passes repo wide, `typecheck --filter=studio
--force` passes 9/9, `--filter studio run lint:ratchet` reports rules
improved, and the tests covering both touched directories pass (18
files, 143 tests, including the `RestoringState` suite that came in with
#48948).

Freshman contributor. Found this with Claude Code's help by checking
whether the `asChild` fix in #48948 had siblings, and I confirmed the
nesting and the missing accessible name myself before touching anything.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved dropdown menu trigger behavior in the authentication hooks
and project layout interfaces.
* Existing buttons now correctly serve as menu triggers without changing
available actions or menu behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-24 10:43:56 +02:00
fadymak 344656edc5 fix(auth): add limits to session timouts and reuse inverval (#49312) 
Currently, sessions timeouts and reuse interval inputs accepted any
values. This PR caps:

- absolute session timeout to 1 year
- inactivity timeout to 1 year
- refresh token reuse interval to 300 seconds

Since these maximums are introduced _after_ some projects have values
that exceed the new limits, we allow the users to save the form if their
values exceed the max but are unchanged. However, if they decide to
change the value, it must fit within the limits.

<img width="1195" height="402" alt="Screenshot 2026-08-20 at 15 45 49"
src="https://github.com/user-attachments/assets/192420e8-4878-4e4b-9d82-0d1cc4074728"
/>

<img width="1194" height="512" alt="Screenshot 2026-08-20 at 15 46 06"
src="https://github.com/user-attachments/assets/bb333c54-daa3-46ac-b144-96263428f4d7"
/>

<img width="1168" height="323" alt="Screenshot 2026-08-20 at 15 46 35"
src="https://github.com/user-attachments/assets/ae38fcf6-bc73-453f-a61b-2d6f2d0ecfee"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Added clear maximum-value guidance for session and refresh-token
settings.
* Existing projects with previously configured values above new limits
can retain those values while making unrelated changes.
* Removed session-related settings from the protection authentication
form.

* **Bug Fixes**
* Improved validation for session timeouts, JWT expiration, and
refresh-token reuse intervals.
* Added clearer validation messages and support for reducing previously
over-limit values.

* **Tests**
* Expanded coverage for boundary values, invalid inputs, saved settings,
and submitted configuration updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-20 14:30:41 +00:00
claude[bot] 2bc6144aec fix(studio): guard unguarded requester.name reads on the OAuth authorize and apps pages (#49267) 
<!-- ccr-slack-attribution -->
_Requested by **Ali Waseem** · [Slack
thread](https://supabase.slack.com/archives/C063LNYJJKS/p1787146439389169)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

Opening `/authorize` for an OAuth app whose `name` the platform API
omitted crashed the entire page with `TypeError: Cannot read properties
of undefined (reading 'toLowerCase')`
([SUPABASE-APP-K7E](https://supabase.sentry.io/issues/7679644991/)). The
user got a full-page error instead of a consent screen, and could
neither authorize nor decline.

The same class of crash hit the project-level OAuth apps list
([SUPABASE-APP-JB1](https://supabase.sentry.io/issues/7502074939/)).
Typing in the search box called `.toLowerCase()` on `client_name` for
every app, so one app registered without a name broke search for the
whole list.

The project-claim page crashed the same way, reading the first character
of the name for the fallback avatar.

## What is the new behavior?

The trusted-partner helpers treat a missing name as "no trusted partner
matched" and return `null`. The apps filter treats a missing name or
client ID as "does not match the search string". The claim page falls
back to a placeholder initial instead of indexing into `undefined`.

The authorize page now renders normally, minus the optional
partner-impersonation caution, which cannot be evaluated without a name.

Three changes:

-
`apps/studio/components/interfaces/Organization/OAuthApps/OAuthApps.utils.ts`
— `findTrustedPartnerByName` accepts `string | null | undefined` and
returns `null` early on a falsy name; `getOAuthImpersonationWarning`'s
`name` param widened to match (its existing `if (!namedPartner) return
null` already handles the rest).
- `apps/studio/components/interfaces/Auth/OAuthApps/oauthApps.utils.ts`
— `filterOAuthApps` optional-chains `client_name` and `client_id` before
`.toLowerCase()`, defaulting each match to `false`.
-
`apps/studio/components/interfaces/Organization/ProjectClaim/confirm.tsx`
— `{requester.name?.[0] ?? '?'}` for the fallback avatar initial.

Each is a separate commit so any one can be dropped independently.

## Additional context

### Root cause, not fixed here

`apps/studio/data/api-authorization/api-authorization-query.ts:37`
returns `data as ApiAuthorizationResponse`, an unchecked cast with no
runtime validation, even though the openapi-fetch client already types
the endpoint from the generated schema. Both the generated
`GetOAuthAuthorizationResponse` and the hand-written local type declare
`name: string` as required, so this was invisible to TypeScript.

The durable fix is to derive the type from the schema and drop the cast,
which is the house pattern elsewhere in `apps/studio/data`, and to
correct the OpenAPI spec at source if the API can legitimately omit
`name`. Left out deliberately to keep this cherry-pickable.

### Not in scope

`requester.scopes` is optional in the schema but required in the local
type, and is read unguarded in several places. Defaulting it to `[]`
would tell a user an app requested no permissions on a live consent
screen, so it needs a product decision rather than a drive-by guard.

### Testing

No local checks were run. This clone has no `node_modules` and `pnpm
install` is blocked in the environment, so `npm run build`, typecheck,
lint, Prettier and tests were all left to CI. Please treat CI as the
verification for this PR.

There is also a coverage gap worth noting:
`apps/studio/tests/components/ApiAuthorization.test.tsx:48-62` hardcodes
`name: 'Test App'` in `createMockAuthResponse`, and no test omits the
field, which is why none of these crashes were caught.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01P489vrPdHcJfMfzCGM9rZ5)_

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ali Waseem <waseema393@gmail.com>
 2026-08-19 14:23:54 -06:00
Danny White 14fe0c0cc8 fix(studio): slightly round split-button corners on focus (#49129) 
## What kind of change does this PR introduce?

UI polish for split buttons (primary action + dropdown chevron).
Follow-up to #49055.

## What is the current behavior?

The focus ring sits above the neighbouring half, but the inner edge
stays square, so the ring has two sharp corners at the join.

## What is the new behavior?

On keyboard focus, the squared-off edge uses a slight radius so the ring
matches the outer corners more closely. Resting state is unchanged.
Split-button callsites now share the same join classes as the
design-system example.

| Before | After |
| --- | --- |
| <img width="1030" height="296" alt="43471"
src="https://github.com/user-attachments/assets/9df3bd72-c7ac-4419-ae18-a7e649dc2d66"
/> | <img width="1056" height="276" alt="CleanShot 2026-08-17 at 10 45
09@2x"
src="https://github.com/user-attachments/assets/52e8a4dc-9c52-45ce-b4d0-f0e7b1b75935"
/> |

## To test

Tab to each half (labelled button, then chevron). Inner corners of the
focus ring should be slightly rounded, not square.

1. [Split with
dropdown](https://design-system-git-fix-split-button-focus-radius-supabase.vercel.app/design-system/docs/components/button#split-with-dropdown)
(no login)
2. [Access
Tokens](https://studio-staging-git-fix-split-button-focus-radius-supabase.vercel.app/dashboard/account/tokens)
→ Generate new token
3. Any project on [studio
staging](https://studio-staging-git-fix-split-button-focus-radius-supabase.vercel.app/dashboard/_/settings/general)
→ Settings → General → Restart project

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Accessibility**
  - Added accessible labels to dropdown and export controls.
- Improved keyboard-focus visibility, layering, and rounded edge
treatment across joined buttons and menus.
  - Removed misleading or redundant screen-reader text and titles.

- **Bug Fixes**
- Prevented split-button controls from shrinking or displaying awkward
borders and corners.
- Refined hover and focus behavior for action buttons throughout
settings, database, storage, account, and documentation interfaces.

- **Documentation**
- Clarified guidance for using overflow menus and responsive
split-button actions.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-17 17:28:22 +10:00
kemal.earth 88e916a4c0 fix(studio): focus state for buttons with dropdown (#49055) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

We've quite a few instances where some buttons have a dropdown
appendage. The focus state for these were broken as well as visually
regarding the separator. This first pass fixes the instances we have in
studio, I've left potentially adding this to our design system fragment
components as another PR.

| Before | After |
|--------|--------|
| <img width="531" height="133" alt="Screenshot 2026-08-13 at 11 29 36"
src="https://github.com/user-attachments/assets/70747fd0-11d4-4670-85fa-d76f3564837b"
/> | <img width="519" height="130" alt="Screenshot 2026-08-13 at 11 40
15"
src="https://github.com/user-attachments/assets/5920bebb-81ce-4962-908b-5f61526ca7ca"
/> |
| <img width="538" height="146" alt="Screenshot 2026-08-13 at 11 29 48"
src="https://github.com/user-attachments/assets/f1c7018f-cd43-47fa-b4c0-045af350f80b"
/> | <img width="515" height="148" alt="Screenshot 2026-08-13 at 11 39
56"
src="https://github.com/user-attachments/assets/fee09113-433a-4b5d-ac68-3ab3f2565d34"
/> |
| <img width="538" height="143" alt="Screenshot 2026-08-13 at 11 29 52"
src="https://github.com/user-attachments/assets/3063d391-99b2-4599-9cdf-edd0b2cdfdf0"
/> | <img width="529" height="159" alt="Screenshot 2026-08-13 at 11 40
05"
src="https://github.com/user-attachments/assets/4bdeb9e0-8324-45df-a211-8c7fd0ee11a6"
/> |




<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved keyboard focus visibility across Studio controls, including
token management, email settings, replication, log drains, query
insights, infrastructure, storage, and assistant actions.
* Focused buttons in adjacent or split-button groups now appear above
neighboring controls, preventing borders and overlays from obscuring the
active selection.
* Preserved existing button behavior, layout, and appearance while
improving focus-state clarity.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-13 12:45:06 +01:00
Danny White e7796315d2 fix sheets stealing focus (#48521) 
## What kind of change does this PR introduce?

Bug fix. Resolves DEPR-539.

## What is the current behavior?

When a focused child unmounts, Radix can move focus to the Sheet wrapper
and break the expected tab order. Several callsites suppress the
wrapper's tabindex individually.

## What is the new behavior?

Sheet still focuses its first interactive child when opened, but the
wrapper itself is no longer focusable by default. Callers can opt in
with an explicit `tabIndex` when needed.

## Additional context

### Testing

Compare this Studio experience on both this branch and `master`:

1. Open any project with an Edge Function.
2. Go to **Edge Functions**, open the function, then click **Test**.
3. Under **Headers**, click **Add Headers**. Click the first header key
input, then Tab slowly through the header inputs and remove buttons.

On `master`, focus can jump to the whole Sheet. On this branch, focus
stays on the controls in order.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
  * Improved keyboard focus behavior across sheets and panels.
* Sheets now focus the first available interactive element when opened,
without adding unnecessary focus targets.
* Preserved support for programmatic focus and prevented focus from
unexpectedly moving to the sheet when focused content is removed.
* Updated authentication, integrations, connection, logging, storage,
and other sheet interfaces consistently.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-03 10:01:47 +10:00
Joshen Lim fcfb0f0222 Refactor all usage of form.watch to either useWatch or subscribe (#48436) 
## Context

Replaces all usage of `form.watch()` to use `useWatch` instead + follows
the "name what you watch" convention as specified in the react-hook-form
skills.

There's also a small refactor in `SmtpForm.tsx` which removes the
unnecessary use of a `useState` to track if SMTP is enabled or not

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Updated many Studio forms to watch specific fields more precisely,
improving live UI updates for previews, warnings, conditional sections,
and validation messages.
* Enhanced responsiveness across settings, authentication, billing,
storage, integrations, and support flows while keeping save/update
behavior the same.
* **Refined Experiences**
* Improved the analytics table creation flow with tighter, enum-based
column type validation and structured, type-specific column options.
* **Preserved Behavior**
* Maintained existing permission checks, submission flows, and
account-management workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-30 11:45:40 +08:00
Miranda Limonczenko 0d465e7b5f chore(ui): Remove 'tip' from Admonition (#48419) 
Closes FE-3966

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## Problem

- The admonition uses both 'tip' and 'note', but the visual distinction
has long-ago collapsed.
- 'Note' is used far more frequently than 'tip'
- The two are very similar and it is confusing to know which one to use
when they are visually identical

## Solution

Collapse 'tip' and 'note' into one by removing all places where there is
'tip' and updating all references to 'tip' into 'note'.

**Note:** This PR also resolves new broken links flagged by the E2E docs
checker. It may move to another PR since E2Es keep erroring.

### Specific changes

See below for an AI-generated list of changes:

- **Type system** — removed `'tip'` from `AdmonitionType`, its
`TYPE_TO_VARIANT`/`TYPE_LABEL` entries, and the test case in
[`packages/ui-patterns/src/Admonition/](packages/ui-patterns/src/Admonition/)
- **Remark plugin** —
[remarkAdmonition.ts](apps/docs/lib/mdx/plugins/remarkAdmonition.ts) now
maps mkdocs `tip` → `note`
- **Lint allowlist** — `tip` dropped from `supa-mdx-lint.config.toml`
- **Content migration** — all 109 files with `type="tip"` (across
`apps/docs`, `apps/www`, `apps/studio`) converted to `type="note"`; zero
remaining hits confirmed by repo-wide grep
- **Style guide** — `CONTRIBUTING.md` and `contributing/content.mdx`
updated to describe 4 admonition types instead of 5

### Usage before implementation

See the usage table that points toward 'note' as being dominant across
all apps:

Here's the usage table:

| Location | `note` | `tip` |
|---|---|---|
| apps/docs | ~480 | ~143 |
| apps/studio | 34 | 6 |
| apps/www (blog) | 19 | 3 |
| packages/ui-patterns (tests) | 3 | 1 (parametrized) |
| design-system / ui-library / packages/ui / packages/common | 0–1 (test
fixture only) | 0 |

## Preview links


| App | Page | Search text (Ctrl+F) | Verify |
|---|---|---|---|
| docs |
[/docs/guides/ai-tools/byo-mcp](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/ai-tools/byo-mcp)
| official MCP TypeScript SDK | callout's aria-label="Note" |
| docs |
[/docs/guides/ai-tools/mcp](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/ai-tools/mcp)
| MCP server is available at | callout's aria-label="Note" |
| docs |
[/docs/guides/ai/python-clients](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/ai/python-clients)
| Click Connect at the top of any project page | callout's
aria-label="Note" |
| docs |
[/docs/guides/auth/audit-logs](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/auth/audit-logs)
| Disabling Postgres storage reduces your database storage costs |
callout's aria-label="Note" |
| docs |
[/docs/guides/database/tables](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/database/tables)
| access a custom schema through the Supabase Data API | callout's
aria-label="Note" |
| docs |
[/docs/guides/troubleshooting/edge-function-404-error-response](https://docs-git-admonition-collapse-note-tip-supabase.vercel.app/docs/guides/troubleshooting/edge-function-404-error-response)
| Always configure an appropriate time frame | callout's
aria-label="Note" (was single-quoted type='tip') |
| www | [blog:
cli-v2-config-as-code](https://zone-www-dot-com-git-admonition-collapse-note-tip-supabase.vercel.app/blog/cli-v2-config-as-code)
| Detecting config drift | callout's aria-label="Note" |
| www | [blog:
cli-v2-config-as-code](https://zone-www-dot-com-git-admonition-collapse-note-tip-supabase.vercel.app/blog/cli-v2-config-as-code)
| Setting Edge Function secrets | callout's aria-label="Note" |
| www | [blog:
nosql-mongodb-compatibility-with-ferretdb-and-flydotio](https://zone-www-dot-com-git-admonition-collapse-note-tip-supabase.vercel.app/blog/nosql-mongodb-compatibility-with-ferretdb-and-flydotio)
| If your network supports IPv6 connections | callout's
aria-label="Note" |

Note: the `www` rows use the `zone-www-dot-com` preview host, not the
`docs` one you gave — since blog pages are served from the www app, not
docs.


## Manual testing

1. Open preview links for affected pages.
2. Inspect. Open console.
3. Paste the following in and see there is no 'Tip' on the page:
```
document.querySelectorAll('[role="alert"]').forEach(el => console.log(el.getAttribute('aria-label'), el.textContent.slice(0,60)))
```



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Standardized informational callouts across docs and tutorials from
**“Tip”** to **“Note”**, updating multiple examples and guidance blocks.
* Updated a few related doc references/links and conditional “Next
steps” content.
* **UI Updates**
* Switched various in-app banners and notices to the **“Note”** style
variant.
* **Bug Fixes / Improvements**
* Removed support for the retired **“Tip”** callout type and aligned
docs linting, component behavior, and aria labeling to the remaining
admonition types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-29 09:26:50 -07:00
Alaister Young ca2b50a0a7 chore(ui-patterns): collapse the admonition shim into ui-patterns/Admonition (#48377) 
Follow-up to #48344: collapses the two resolution paths for the
Admonition module into one.

`src/admonition.tsx` was a back-compat shim re-exporting
`src/Admonition/`. Two ways to resolve one module is exactly what
produced the macOS self-import bug fixed in #48344, and the local
typecheck errors that #48374 worked around. This removes the shim and
standardizes on the PascalCase subpath, matching every other export in
the package.

**Changed:**

- Codemodded all 246 `ui-patterns/admonition` imports to
`ui-patterns/Admonition` (240 `.tsx`, 5 `.mdx`, 1 `.ts` across studio,
docs, www, design-system, and lite-studio)
- Pointed the 5 internal `'../admonition'` imports back at the
`'../Admonition'` directory

**Removed:**

- `packages/ui-patterns/src/admonition.tsx`, and its `./admonition`
entry in the exports map (regenerated with `pnpm gen:exports`)

## To test

- `grep -r "ui-patterns/admonition" --include='*.ts*'` → no hits
- `pnpm test:case-hazards` → passes
- `pnpm typecheck` → all 15 tasks green
- `pnpm --filter studio run lint:ratchet` → passes
- `pnpm --filter ui-patterns vitest run src/Admonition` → 11 tests pass

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Standardized Admonition component imports across the application and
documentation.
* Improved compatibility with case-sensitive environments by using the
canonical component path.
  * Removed the legacy Admonition import entry point.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-29 00:48:56 +08:00
fadymak 19dfbd250a feat(auth): expose access token expiry under auth settings (#48236) 
Exposes the access token expiry (`JWT_EXP`) under `Auth -> Sessions`
settings as opposed to the Legacy JWT settings previously used.

<img width="1632" height="1199" alt="Screenshot 2026-07-23 at 10 06 33"
src="https://github.com/user-attachments/assets/85356e57-da95-404c-852a-21cf9cab2b74"
/>
<img width="1198" height="1119" alt="Screenshot 2026-07-23 at 10 06 19"
src="https://github.com/user-attachments/assets/bfa64b3b-1902-45eb-83ed-ca8bc12673af"
/>
<img width="1237" height="513" alt="Screenshot 2026-07-23 at 10 03 44"
src="https://github.com/user-attachments/assets/85779e9b-30f2-48c5-9faa-4c650d450227"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added an **Access Tokens** section to configure JWT expiration with
dedicated Save/Cancel controls and success/error toasts.
* Enforced a maximum JWT expiration value (must be **less than 604800
seconds**).
* **Bug Fixes**
* Updated the Sessions auth page text to better clarify configuration
for access tokens, refresh tokens, and user sessions.
* **Documentation**
* Updated JWT expiration guidance to point to **Auth settings → Access
Tokens** (replacing legacy JWT secret references).
* **Chores**
* Expanded automated tests covering Access Tokens saving and validation.
* **Refactor**
* Removed JWT expiration editing from the legacy JWT Secrets area,
consolidating it under Access Tokens.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-27 10:13:10 +02:00
Danny White 3bca21b3f8 chore(a11y): convert leftover focus recipes to focus-ring (#48219) 
## What kind of change does this PR introduce?

Accessibility cleanup (DEPR-628).

## What is the current behavior?

Leftover call sites still use ad-hoc focus recipes
(`ring-foreground-muted`, `outline-brand`, Dialog/Sheet `focus:` rings,
etc.) instead of the shared utilities from #41575.

## What is the new behavior?

Converts those leftovers across `packages/ui`, Studio, www, docs, and
design-system to `focus-ring`, preferring `focus-visible`. Keeps
documented exceptions (`group-focus-visible`, InputGroup `:has()`).

## To test

Tab through controls (keyboard only). Expect a consistent offset ring on
`:focus-visible`, not a green/brand/custom stack, and no ring animation.

### www (marketing)

Preview:
https://zone-www-dot-com-git-danny-depr-628-focus-ring-fbccf9-supabase.vercel.app

- Global nav on `/`: Product, Developers, Solutions dropdowns; logo;
hamburger + mobile menu
- `/features`: view toggles and feature cards
- `/company`: card links
- `/changelog`: timeline / entry links
- `/partners/catalog`: grid/list toggle and partner cards
- `/pricing`: compute section expand control
- Product / Modules / Solutions sticky navs on product pages (e.g.
`/database`, `/storage`)
- `/state-of-startups`: TwoOptionToggle if present

### docs

Preview:
https://docs-git-danny-depr-628-focus-ring-long-tail-supabase.vercel.app

- Any guide page: top nav dropdowns and items
- Narrow viewport: hamburger, then mobile menu links + close
- Guide with PromptPanel / tabs: tab to prompt actions and tab list

### studio (dashboard)

Preview:
https://studio-staging-git-danny-depr-628-focus-ring-long-tail-supabase.vercel.app

- Project home: Connect section tiles; drag-handle focus on sortable
sections
- Integrations marketplace (`/project/<ref>/integrations`): featured
cards, list/grid toggle, list rows
- Auth (`/project/<ref>/auth/oauth-apps`,
`/project/<ref>/auth/providers`): open create/edit sheet, tab to close
(X)
- Database policies (`/project/<ref>/database/policies`): open policy
editor sheet, tab to close
- Storage policies (`/project/<ref>/storage/files/policies`): bucket
section links; policy modal close
- Query performance (`/project/<ref>/observability/query-performance`):
info icon buttons on metrics
- Replication pipeline detail (if available): slot lag / status info
icons
- Support (`/support/new`): attachment add/remove controls
- Table editor: spreadsheet import preview checkboxes; row text/JSON
editor TwoOptionToggle
- Any Dialog/Sheet/toast close (X): ring on keyboard focus only, not
mouse click

### design-system

Preview:
https://design-system-git-danny-depr-628-focus-ring-long-tail-supabase.vercel.app

- Colour palette swatches (keyboard focus)
- Form patterns sidepanel example: avatar / focusable control in the
example

## Additional context

- Linear: [DEPR-628](https://linear.app/supabase/issue/DEPR-628)
- Follow-ups: form-group CSS (DEPR-629), Storage columns selection
(DEPR-630), ESLint rule (DEPR-632)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Accessibility & Usability**
* Standardized keyboard focus indicators across navigation, dialogs,
forms, buttons, toggles, links, and tooltips using a consolidated focus
style.
* Improved toggle controls to use proper button semantics (instead of
clickable text), including `aria-pressed`/disabled handling and better
keyboard navigation.

* **Visual Updates**
* Harmonized hover/focus ring visuals across the design system, Studio,
documentation, and marketing pages while preserving existing layout and
interaction behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 08:52:22 +10:00
Luiz Felipe Machado b883b102b4 fix(studio): gate user logs tab behind feature flag (#48122) 2026-07-21 15:22:41 +00:00
Ivan Vasilov 3c6ef31959 feat: add User Filter to the unified logs (#47879) 
Offshoot from https://github.com/supabase/supabase/pull/47743.

[Linear
issue](https://linear.app/supabase/issue/FE-3939/add-user-logs-filter-to-the-logs-page)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a `user` filter to Unified Logs with a user picker (email or
ID).
* Added “View user logs” actions from the Users table to jump to Unified
Logs.
* **Bug Fixes**
* Updated Unified Logs searching so default log-type restrictions no
longer block user-attributed results.
* **UI Updates**
* Unified Logs filter bar and reset behavior now include clearing the
user filter.
* Improved empty-state messaging when the selected user filter isn’t
supported.
  * Refreshed highlighted styling in command list items.
* **Tests**
* Expanded coverage for user filter configuration and query edge cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: kemal.earth <606977+kemaldotearth@users.noreply.github.com>
Co-authored-by: kemal <hello@kemal.earth>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-07-17 17:21:55 +08:00
Joshen Lim 22b3419a28 Extract project creation form into its own component (#47957) 
## Context

This is just a pre-requisite to consolidating the project creation UI as
there's another page that has the project creation flow too
[here](https://github.com/supabase/supabase/blob/master/apps/studio/pages/integrations/vercel/%5Bslug%5D/deploy-button/new-project.tsx).
So the next step will just be to use the same `ProjectCreationForm`
there

No functional changes here - just moving things around

## To test
- [ ] Verify that project creation still works



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a full “create project” experience with eligibility-aware
defaults, advanced configuration sections, optional GitHub integration,
and compute-cost confirmation when applicable.
* **Improvements**
  * Enhanced project-creation success/error handling and navigation.
* Refined CLI backup/restore dialogs (better layout/wording,
accessibility updates, and improved section separation).
* **Documentation**
* Standardized all relevant documentation links across the app using a
shared `DOCS_URL` source.
* **Refactor**
* Refactored the “New Project” page to delegate the wizard UI and flow
to a reusable creation component.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-16 14:00:55 +08:00
Cemal Kılıç e90c91e498 fix(studio): show custom OAuth providers in Users table (#45658) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

show provider info in Authentication -> Users page if user is auth'd
with custom providers


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **New Features**
* Added comprehensive support for custom authentication providers with
appropriate type labeling and visual identification
* Improved provider display formatting and icon rendering to properly
recognize custom authentication options
* Enhanced authentication provider interface operations for better
custom provider information handling and management

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-07-14 17:52:32 +02:00
Ali Waseem 652311feb5 fix(studio): guard Auth Performance allocation strategy select against invalid values (#47896) 
## Summary
- The Connection management "Allocation strategy" select on the Auth >
Performance page called its `onValueChange` handler's conversion logic
with whatever value it was given, with no validation. If that handler
ever fired with a value outside the `'percent' | 'connections'` enum, it
would silently overwrite a correctly loaded config, converting it to the
wrong absolute connection count and leaving the strategy dropdown in a
blank/inconsistent state.
- Extracted the percent/connections conversion into a pure, unit-tested
`convertPoolSize()` helper (`PerformanceSettingsForm.utils.ts`) and
added a guard so `onValueChange` ignores any value that isn't a
recognized allocation unit.

## How to test
1. Under **Connection management**, switch **Allocation strategy** back
and forth between "Absolute number of connections" and "Percent of max
connections" — the value should convert correctly each time and the
dropdown should never render blank.
2. Save, then hard-reload the page — the saved strategy and value should
persist as shown.

## Test plan
- [x] `PerformanceSettingsForm.utils.test.ts` — unit tests covering both
conversion directions, clamping, and the invalid-value guard
- [x] `PerformanceSettingsForm.test.tsx` — MSW-backed component test
verifying persisted percent/absolute configs render correctly on load
- [x] `pnpm test:studio`
- [x] `pnpm typecheck`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Switching database pool allocation strategies now automatically
converts values between percentage and connection-based units.
* Values are rounded and constrained appropriately to remain within
supported limits.
  * Allocation settings now handle invalid or zero values more safely.
* **Tests**
* Added coverage verifying persisted allocation strategies and pool-size
conversion behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 14:16:52 -06:00
Ali Waseem 000bdd0684 fix(studio): trim leading whitespace in site URL form (#47748) 
## Changes

- **SiteUrl.tsx**: Added `.trim()` to the Zod schema so whitespace is
stripped before validation and before the value reaches the mutation.
All-whitespace input now correctly fails with "Must have a Site URL"
instead of being silently accepted. This matches the existing pattern in
the sibling Redirect URLs form (AddNewURLModal.tsx).
- **SiteUrl.test.tsx** (new): MSW component test with two cases:
- Trims leading/trailing whitespace before submitting to PATCH
/platform/auth/:ref/config
- Shows a validation error and does not submit when the value is only
whitespace

## Test plan

- [x] `npx vitest --run
components/interfaces/Auth/SiteUrl/SiteUrl.test.tsx` — 2/2 pass
- [x] `npm run typecheck` — clean
- [x] `npx eslint` on both files — no new warnings


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved site URL validation so leading and trailing whitespace is
ignored before saving.
* Prevents whitespace-only values from being submitted and shows a
validation error instead.

* **Tests**
* Added coverage for site URL saving, including trimmed input,
validation failures, request payloads, and success feedback.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 13:06:56 -06:00
Danny White fa20667ec1 fix(studio): migrate email template reset dialog to async AlertDialog (#47705) 
## What kind of change does this PR introduce?

Bug fix / refactor. Resolves DEPR-573.

## What is the current behavior?

`ResetTemplateDialog` (added in #45572) confirms the Auth email template
reset using the old `AlertDialog` workaround: an `AlertDialogAction`
with `asChild` + `event.preventDefault()` and a manual loading `Button`,
driven by `mutate` plus inline callbacks. Reset failures are only
reported via a toast from the mutation's default `onError`, so the error
disappears from the dialog context.

This predates #45960, which added first-class async handling to
`AlertDialogAction` (promise-returning handlers, controlled `loading`,
and `AlertDialogBody` for inline feedback). #45960 explicitly flagged
`ResetTemplateDialog` as needing this follow-up migration.

## What is the new behavior?

`ResetTemplateDialog` now uses the async `AlertDialogAction` pattern:

- The confirm handler uses `mutateAsync` and returns the reset promise,
so the dialog stays open with a loading state while the mutation is
pending and closes only after it succeeds.
- Reset failures surface inline via a destructive `Admonition` inside
`AlertDialogBody`, and the mutation's toast-only error path is
suppressed (`onError: () => {}`). The inline error clears when the
dialog closes.
- `Cancel` is disabled while the reset is in flight.
- The `asChild` + `preventDefault()` workaround and the manual loading
`Button` are removed; `loading={isResetting}` is retained for
parent-controlled loading.

This matches the established usage in `DisablePipelinesDialog` /
`JitDbAccessDeleteDialog` and the design-system
`alert-dialog-async-error` example.

## To test

- [ ] Customise an Auth email template, click **Reset template**,
confirm the dialog shows loading until the reset succeeds and then
closes with the editor refreshed to the default subject/body.
- [ ] In DevTools → Network, block `*/templates/*/reset`, click
**Reset**, and confirm the dialog stays open with an inline destructive
admonition and no toast.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved email template reset error handling by showing reset failures
inline in the confirmation dialog (with a destructive alert message).
* The dialog remains open on reset failure so users can review the error
and retry.
* “Cancel” is disabled while resetting; success behavior and existing
success toast behavior remain unchanged.
* **Tests**
* Updated reset mutation mock to use async behavior and added coverage
for reset failure UI/error handling (including that error toasts are not
triggered).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-08 14:43:31 +08:00
Alaister Young 9af6e65df4 fix(studio): DOM-nesting hydration errors, ghost deleted-snippet nav, and migrations query 400s (#47667) 
App-level fixes that reproduce on BOTH the Next and TanStack builds —
split out of #47657 (which stays TanStack-only) for reviewability. All
were found by a full-site click-through of the dashboard.

## Invalid HTML nesting (React 19 "will cause a hydration error" console
errors)

- **FormLayout description rendered in a `<p>`**
(`packages/ui-patterns`): consumers pass arbitrary JSX (the RowEditor's
`created_at` timezone note passes a `<div>` with `<p>`s) →
`<p>`-in-`<p>` / `<div>`-in-`<p>`. Container is now a `<div>` with
identical classes (Tailwind preflight makes them render the same).
- **Switch toggles nested inside Tooltip trigger buttons**
(button-in-button) in ColumnEditor ("Allow Nullable" + "Is Unique"),
ExtensionRow, and PublicationsTableItem → repo-standard `TooltipTrigger
asChild` + `<div>` wrapper.
- **Saved log queries rendered a `<div>` directly inside `<tbody>`**
(`/logs/explorer/saved`) → rows are now proper `<tr><td colSpan>`
wrappers; the component itself is untouched (it's valid in its sidebar
usage).
- **Nested anchors in observability metric cards**: a card-level
`<Link>` wrapped MetricCard's "More information" `<Link>` (identical
URLs) → the chevron affordance renders as a `<span>` when no `href` is
passed; clicks bubble to the card link, tooltips preserved.
Design-system standalone usage unaffected.
- **`objectFit="cover"` passed to modern `next/image`** on the featured
integration card (unknown-prop warning) — the className already had
`object-cover`; prop dropped.

## Ghost dead-snippet after deletion

Deleting the active SQL snippet left its id in `useDashboardHistory`
(`history.sql`), so the "SQL Editor" nav item navigated to
`/sql/<deleted-id>` — content fetch 404s, no editor pane renders, and a
phantom tab reappears. Fixed both ends: delete flows now purge dashboard
history (and the tabs store clears a stale `previewTabId`), and
`/sql/[id]` treats a snippet 404 as "clean up + `router.replace` to
`/sql/new` + toast" instead of rendering the dead state. Unit tests for
the store/history cleanup.

## `pg-meta` migrations query 400s on every project load

`ActivityStats` on project home runs the migrations list query, whose
SQL was a bare `select * from supabase_migrations.schema_migrations` —
that table only exists once a migration has run, so every other project
logged a failed `?key=migrations` request on every load (visible in
production consoles too). The SQL is now guarded with `to_regclass` +
`query_to_xml` (same pattern as the advisor lints' `storage.buckets`
guard), returning zero rows instead of erroring; legacy version-only
tables still work. Tested against real dockerized Postgres (absent
table, populated ordering, special chars, legacy schema) + MSW hook
tests.

Found and verified via /test-supabase-local (browser click-through +
console audit on both builds).

## To test

Console must stay free of React DOM-nesting errors ("cannot be a
descendant of" / "cannot contain a nested") on each surface:

1. Table editor → Insert row panel (`created_at` field renders its
timezone note) and Edit column panel ("Allow Nullable"/"Is Unique"
tooltips still hover).
2. `/database/extensions` and `/database/publications` → toggle switches
render, tooltips hover.
3. `/logs/explorer/saved` (with ≥1 saved query) → rows render full-width
inside the table, hover shows Actions.
4. `/observability` → no nested-anchor error on load; card body click
and the chevron both navigate; label help-icons still show tooltips.
5. `/integrations` → no `objectFit` unknown-prop warning; featured card
images still cover.
6. **Ghost snippet**: open a SQL snippet → delete it via the sidebar →
click the "SQL Editor" nav item → lands on `/sql/new` (no phantom tab,
no 404 content fetch). Direct-load `/sql/<random-uuid>` → toast +
redirect to `/sql/new`.
7. **Migrations 400**: load project home with a project that has never
run a migration → the `pg-meta/<ref>/query?key=migrations` request
returns **200** with `[]` (previously a 400 on every load). Database →
Migrations still lists real migrations when they exist.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Bug Fixes**
* Deleted SQL snippets are fully removed from dashboard history and
stale editor/tab state; users are redirected with a toast.
  * Closing preview tabs no longer leaves stale references.
* Improved toggle/tooltip/dialog interactions to avoid broken UI,
including metric headers showing tooltips even without direct links.
* Migrations display safely when migration tables/relations are missing.

* **UI Improvements**
* Refreshed layout for saved queries, form descriptions, and integration
imagery.

* **Tests**
* Added coverage for snippet history cleanup, tab removal, migrations
SQL behavior, and query edge cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->


---

### Review feedback: `query_to_xml` breaks on Multigres (Ivan)

The defensive migrations query (added here to stop the `?key=migrations`
400 when the table doesn't exist yet) originally guarded with
`query_to_xml`, which is forbidden through Multigres's pooler (MUL-736 /
PSQL-1318). Rewritten without `query_to_xml`/`xmltable` using the
splinter#170 pattern: a PL/pgSQL `do` block guarded by `to_regclass`
(PL/pgSQL defers planning, so a missing table never errors) stashes the
rows into a transaction-local GUC via `set_config`, and a trailing
`select` reads them back with `jsonb_array_elements`. Verified that
postgres-meta sends the whole SQL as one simple-query string → single
implicit transaction → the local GUC survives to the `select` and
doesn't leak into the pooled connection. 6/6 dockerized-Postgres tests
(absent table → `[]`, populated/ordered/special-chars, legacy
version-only table, full pg-meta-shaped multi-statement string, GUC
non-leakage).

Note (out of scope, pre-existing):
`packages/pg-meta/src/sql/studio/advisor/lints.ts` still uses
`query_to_xml` — a separate pre-existing Multigres risk that should get
its own splinter-pattern sync.

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Saxon Fletcher <saxonafletcher@gmail.com>
 2026-07-08 12:32:11 +08:00
Gildas Garcia cabe14e5ca chore: remove _Shadcn_ suffix from ui tabs components (#47628) 
## Problem

Now that we migrated all usages of the deprecated `Tabs` component, we
don't need the `_Shadcn_` suffix anymore.

## Solution

Remove `_Shadcn_` suffix from `ui` tabs components. That's all this PR
does, no visual nor functional changes

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Standardized tab components across the app so pages and dialogs now
use the same consistent tab UI.
* Improved tab-based views in design, docs, studio, learn, and website
experiences for a more uniform interface.

* **Chores**
* Updated shared UI exports to expose tab components directly,
simplifying future usage across the product.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-06 15:29:16 +02:00
Vaibhav 804475fd3a fix: redirect urls (#47487) 
## TL;DR

fixes redirect url  normalization..

## PS:

| Before | After |
| --- | --- |
| Broken: whitespace could make the same redirect URL appear as a
separate entry and break delete behavior | Fixed: equivalent redirect
URLs are normalized consistently, so display, save, and delete behavior
stay in sync |
| <img width="800" height="274" alt="Before redirect URLs behavior"
src="https://github.com/user-attachments/assets/47dbb1ca-7c7d-482b-a67e-08c2eb2cd030"
/> | ![After redirect URLs
behavior](https://github.com/user-attachments/assets/b90dfad3-9ec2-4431-8412-34d4faca62da)
|

## ref:
- closes https://github.com/supabase/supabase/issues/47478

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved redirect URL handling so saved and displayed URLs are
consistently trimmed, normalized, deduplicated, and parsed from
comma-separated allow lists.
* Tightened redirect URL validation to better catch invalid formats and
prevent duplicates both against the existing allow list and within a new
submission.
* Fixed redirect URL deletion to remove the exact set of URLs confirmed
by the user.
* **Tests**
* Added/updated tests to cover redirect URL normalization and parsing
behavior for stored comma-separated allow lists.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-01 08:24:17 -06:00
Joshen Lim 1de298ff31 Reinstate https://github.com/supabase/supabase/pull/45143 into latest master (#47433) 
## Context

Previous PR was [here](https://github.com/supabase/supabase/pull/45143)
but it got stale with lots of conflicts so figured it'll be easier redo
it off the latest master

Moves policies page from Auth to Database under an Access Control
section along with Roles. This moves all existing files, applies
redirects, and updates urls to point to the new route

<img width="274" height="412" alt="image"
src="https://github.com/user-attachments/assets/7952c185-64ae-4355-ba36-45397efe1787"
/>

<img width="453" height="471" alt="image"
src="https://github.com/user-attachments/assets/04b3dcb3-48a5-4049-9893-d01109fb46a9"
/>


## To test
- [ ] Verify that policies now live under Database correctly

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a quick navigation shortcut to open **Database > Policies
(RLS)**.
* **Bug Fixes**
* Updated Policies and RLS-related links across the product to open the
**Database policies** area (menus, command palette, context actions,
alerts, and link-outs).
* Added a permanent redirect from the old **auth policies** URL to the
new **database policies** URL.
* **Documentation**
* Updated RLS Dashboard and security checklist instructions to reference
**Database > Policies**.
* **Tests**
  * Adjusted automated tests to validate the new Policies route.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-30 18:49:33 +08:00
Gildas Garcia b30db91d71 chore: cleanup UI patterns exports (#47406) 
## Problem

We now export components under a subpath in ui-patterns to avoid barrel
files as they slow down every tools (from IDE to linters, etc.) and may
also affect bundles our users have to download.

## Solution

- Remove the UI patterns index file
- Fix invalid impors
 2026-06-30 09:23:17 +02:00
Danny White 3acc53cca3 chore(studio): minor database UI polish (#47356) 
## What kind of change does this PR introduce?

Chore

## What is the current behavior?

- Add-column uses implicit button styling
- Replication row tooltip says "Open in Table Editor"

## What is the new behavior?

- Add-column explicitly uses `variant="default"`
- Auth Users explicitly uses `variant="default"`
- Replication row tooltip says "Table Editor"

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-30 03:47:35 +10:00
Ivan Vasilov fd85c81e6c chore: Bump all rate limits in Auth to match the API (#47405) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Increased the allowed maximum values for rate-limit settings, enabling
much larger numeric inputs.
* Updated validation messages so error text matches the new limits and
time-window wording.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-29 15:54:11 +00:00
Gildas Garcia c6fc456910 chore: cleanup duplicate exports studio (#47387) 
## Problem

Knip reports many duplicate exports (both named and default). Besides,
we're moving away from default exports and even have an eslint rule to
enforce it on new code.

## Solution

- Cleanup those exports
- Update imports when necessary

No functional changes. If it builds, it's fine
 2026-06-29 15:46:16 +02:00
Danny White 8192d97008 feat: surface send-email hook status in template UI and hook deletion dialog (#46319) 
## What kind of change does this PR introduce?

Feature. Implements
[AUTH-1215](https://linear.app/supabase/issue/AUTH-1215/improve-studio-ui-when-send-email-hook-is-active-or-deleted).
Follow-up to #45396.

## What is the current behavior?

When a send-email hook is configured, email templates are bypassed
entirely. Auth passes event metadata to the hook, not rendered HTML. The
template list and editor give no indication of this.

Deleting the send-email hook silently reverts Auth to using email
templates with no warning. For post-cutoff Free plan projects without
custom SMTP, this also locks template editing.

## What is the new behavior?

### Admonition when send-email hook is active

A new `SendEmailHookActiveAdmonition` is shown on both the template list
and individual template editor pages when `HOOK_SEND_EMAIL_ENABLED` and
`HOOK_SEND_EMAIL_URI` are set:

> **Email templates are not used**
> A Send Email hook is active. Event metadata is passed directly to your
hook, meaning these templates are bypassed entirely.

With a **Manage hook** link to the hooks page.

### AlertDialog for Send Email hook deletion

Deleting the Send Email hook now uses a dedicated
`DeleteSendEmailHookConfirmationDialog`:

- **Always:** "The {default or built-in} email templates will be used to
send auth emails."
- **Post-cutoff Free plan, no custom SMTP:** adds "Email templates
cannot be edited on the Free plan without custom SMTP."

The dialog stays open with a loading state while the deletion is
in-flight and closes on success.

| After |
| --- |
| <img width="1862" height="880" alt="CleanShot 2026-05-25 at 15 57
41@2x"
src="https://github.com/user-attachments/assets/8a441bb2-9112-4b19-bd0b-02c9d1989ec1"
/> |
| <img width="884" height="578" alt="CleanShot 2026-05-25 at 15 57
21@2x"
src="https://github.com/user-attachments/assets/44e5bd79-2bd9-44ee-8f53-5fdaeefd68c6"
/> |

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a Send Email hook warning in the template editor with “Manage
hook” and “Learn more” links.
* **UI Improvements**
* Refined template editor alerts to reflect when templates are bypassed
vs blocked.
* Updated hook cards/actions to a dropdown with separate Edit and Delete
flows, including documentation links.
* **Bug Fixes**
* Improved template editor and hook deletion flows to better reflect
pending states and current authentication configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-29 17:09:31 +08:00
Chris Stockton d46a9c43fd feat(Auth/EmailTemplates): Add SiteURL variable for notifications (#46393) 
This will make email templates more consistent and may be merged after
https://github.com/supabase/auth/pull/2532 is deployed.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Authentication notification emails now include access to site URL
references. This enhancement applies to multiple notification types:
password change alerts, email change confirmations, phone number change
notifications, identity linking and unlinking events, and multi-factor
authentication enrollment and unenrollment notifications.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46393?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
 2026-06-25 15:20:01 +00:00
Nik Richers 32d1bdd534 fix(studio): reduce doc link density in auth email template builder (#47250) 
## I have read the CONTRIBUTING.md file.

YES

## What kind of change does this PR introduce?

- Studio UI update (auth email template builder)
- Docs update (hosted email templates guide + local dev cross-link)

Closes DOCS-1086.

## What is the current behavior?

- Linear item: Reduce link density in the template builder UI
- Page header shows a **Terminology** link and **Docs** button (local
development guide)
- Template variables footer shows **Terminology** · **Local
development**
- Local development editing is only mentioned in one sentence on the
hosted docs page; easy to miss once Studio no longer links there
directly

## What is the new behavior?

- Page header: **Docs** button only →
`/guides/auth/auth-email-templates`
- Template variables: single **Terminology** link → `#terminology`
(variable pills still have hover tooltips)
- Hosted docs: **Editing email templates** split into hosted vs
local/self-hosted, with a callout linking to the local development guide
- Local dev guide: opening paragraph links back to the hosted guide for
shared terminology and patterns

### Proof: Template builder has fewer outbound doc links

| Before | After |
|--------|-------|
| Header Terminology + Docs (local dev guide); footer Terminology ·
Local development <img width="1440" height="1100" alt="image"
src="https://github.com/user-attachments/assets/3325f43b-5830-4b85-ba56-2ba4c5b04bcd"
/> | Docs button only (hosted guide); single Terminology link above
variables <img width="1440" height="1100" alt="image"
src="https://github.com/user-attachments/assets/90c8cfff-89bd-46d5-b336-2f9dd50d37e3"
/> |

**Before (`origin/master`)**

- Header: **Terminology** link + **Docs** button → local development
guide
- Template variables: **Terminology** · **Local development**

**After (this PR)**

- Header: **Docs** button only → [Email
templates](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/auth/auth-email-templates)
(preview)
- Template variables: single **Terminology** link →
[Terminology](https://supabase.com/docs/guides/auth/auth-email-templates#terminology)
- Local development path documented at [Editing email
templates](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/auth/auth-email-templates#editing-email-templates)
(preview; replacing the in-builder Local development link)

**Capture notes:** Content-area screenshots were captured locally from
component markup because the template editor body requires platform auth
config in self-hosted Studio. Local files: worktree
`.pr-screenshots/template-builder-links-{before,after}.png`.

### Proof: Docs clarify local development path

**Verified:** Vercel docs preview (pass) · `supa-mdx-lint` (pass)

| Page | Before (production) | After (PR preview) |
|------|---------------------|--------------------|
| Email templates — Editing | [Editing email
templates](https://supabase.com/docs/guides/auth/auth-email-templates#editing-email-templates)
| [Editing email
templates](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/auth/auth-email-templates#editing-email-templates)
|
| Customizing email templates | [Customizing email
templates](https://supabase.com/docs/guides/local-development/customizing-email-templates)
| [Customizing email
templates](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/local-development/customizing-email-templates)
|

## Additional context

### Test plan

- [ ] Open **Authentication → Emails → Confirm sign up** on a hosted
project
- [ ] Confirm header has **Docs** only (no Terminology link)
- [ ] Confirm **Docs** opens `/docs/guides/auth/auth-email-templates`
- [ ] In source view, confirm template variables show one
**Terminology** link (no Local development)
- [ ] Hover variable pills — tooltips still explain each placeholder
- [ ] Compare [production Editing email
templates](https://supabase.com/docs/guides/auth/auth-email-templates#editing-email-templates)
vs
[preview](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/auth/auth-email-templates#editing-email-templates)
— hosted vs local/self-hosted sections and local dev callout are clear
- [ ] Compare [production Customizing email
templates](https://supabase.com/docs/guides/local-development/customizing-email-templates)
vs
[preview](https://docs-git-nikrichers-docs-1086-reduce-link-densi-bf6705-supabase.vercel.app/docs/guides/local-development/customizing-email-templates)
— intro links back to hosted email templates guide

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Documentation**
* Clarified how to edit authentication email templates for hosted vs.
self-hosted and local development setups.
* Added clearer navigation to template terminology and customization
guidance, with updated examples and notes.

* **New Features**
* Updated the email template UI to use centralized documentation links
for the terminology section.

* **Tests**
* Added coverage to ensure the “Terminology” docs anchor stays
consistent.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Nik Richers <nik@validmind.ai>
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-25 08:50:05 +02:00
Joshen Lim 3db42a805f Joshen/fe 3652 replace direct renders of editor component from monaco to (#47268) 
## Context

Part of consolidating all our code editors - removes all direct renders
of the `Editor` component and use `CodeEditor` instead

## UIs affected
- [ ] Query performance advisor -> query block
- [ ] Table Editor -> Table definition
- [ ] Table Editor -> Text + JSON editor (From RowEditorSidePanel,
expand input field)
- [ ] Auth -> RLS -> Create/edit policy code sections
- [ ] Storage policies -> Anywhere that has a code section

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Rolled out a consistent PostgreSQL code editor experience across
policy, storage policy, trigger function, table definitions, and query
performance screens.
* Updated policy/template previews to use the shared editor for cleaner
read-only viewing.

* **Bug Fixes**
  * Removed extra left padding in the query performance editor wrapper.
  * Improved the JSON editor action control with clearer icon behavior.

* **Refactor**
* Standardized editor usage by replacing legacy SQL/Monaco-based editors
with the shared CodeEditor and simplifying related editor components.
* Updated CodeEditor capabilities (read-only handling, wrapper styling,
markdown support) and tightened editor prop contracts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-25 14:48:19 +08:00
Joshen Lim f2e20eac34 Joshen/fe 3651 deprecate monacoeditor from grid folder to use codeeditor (#47179) 
## Context

Part of efforts to consolidate all the code editors that we have in the
repository

`CodeEditor` will serve as the base monaco editor file that all UIs
should consume from
It's aimed to be generic and just stores the common logic that will be
generally used where-ever we need a code editor (editor options, base
editor set up on mount, etc)

The idea is that `CodeEditor` holds just 3 default actions (run queyr,
format document and placeholder fill)
If any editor needs specific behaviours (e.g SQL Editor), they can
declare them in the `onMount` prop of `CodeEditor` which gives some
flexibility

## Changes involved
- Use `CodeEditor` component for SQL Editor's `MonacoEditor`
- Shifted Cmd K behaviour into `CodeEditor` since that's probably needed
everywhere that we render that UI
- Deprecate `MonacoEditor` from the table editor's `grid` folder
- All files that were using that component to use `CodeEditor` component
instead

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **Refactor**
* Migrated the studio’s code editing UI (including JSON, text, and
payload viewers) to a unified CodeEditor experience.
* **New Features**
  * Added plaintext language support for read-only/truncated views.
* **Behavior Changes**
* Improved editor startup by setting cursor position consistently and
deferring autofocus.
* Streamlined editor context-menu actions to the core set (run query,
format, placeholder fill).
* Updated SQL editor wiring for more consistent command/menu and
selection handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-23 11:39:24 +08:00
Nik Richers 516dc12676 fix(docs): improve email template terminology table readability (#47143) 
## I have read the CONTRIBUTING.md file.
YES

## What kind of change does this PR introduce?
Bug fix, docs update, Studio UX improvement.

Closes DOCS-400.

## What is the current behavior?
- Linear item: Docs: can't read Terminology table name column
- `break-all` on all `.prose td code` breaks `{{ .ConfirmationURL }}`
mid-token
- Studio template editor only linked to local-development
customizing-email-templates

## What is the new behavior?
- First-column code uses `break-words`; other columns keep `break-all`
- First column `min-width: 12rem` / `width: 30%`
- Studio TemplateEditor: **Terminology** + **Local development** links
- Template detail page: **Terminology** InlineLink beside Docs button
- `Table.tsx` MDX wiring deferred

On desktop:

<img width="864" height="1086" alt="image"
src="https://github.com/user-attachments/assets/f8439d1a-f607-4925-a250-ff142a357a2a"
/>

On mobile:

<img width="400" height="1383" alt="image"
src="https://github.com/user-attachments/assets/334769e8-3821-4bf4-8256-f4fae9ce45ea"
/>

Correct link:

<img width="1502" height="710" alt="Capto_Capture
2026-06-22_03-34-48_PM"
src="https://github.com/user-attachments/assets/87506751-d72b-4892-a8fb-63ef298a8260"
/>


## Additional context
- Verification (author): CSS diff only; table fixture screenshots
captured
- Frontend note: docs-only CSS in `apps/docs/styles/globals.css`; Studio
shadcn tables unchanged

### Test plan
- [ ] Check out worktree branch and run docs app locally (`cd apps/docs
&& pnpm dev`)
- [ ] Open `/docs/guides/auth/auth-email-templates#terminology` at
desktop width — Name column readable
- [ ] Same page at mobile/narrow width — first column has adequate
min-width
- [ ] Spot-check 1–2 other docs pages with code in table first column —
no regression
- [ ] Open Studio → Auth → Email Templates → edit any template
- [ ] Confirm new link to
`/guides/auth/auth-email-templates#terminology` opens correct anchor
- [ ] Confirm existing link to `customizing-email-templates` still works
- [ ] Confirm `apps/docs/components/Table.tsx` was **not** wired into
MDX

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Improved table cell code wrapping behavior in documentation to prevent
width expansion

* **Documentation & UI**
* Updated email templates editor with enhanced documentation links for
Terminology and Local development
* Added Terminology documentation link to email templates page header
for convenient access to reference materials

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Nik Richers <nik@validmind.ai>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
 2026-06-22 16:42:04 -07:00
Gildas Garcia 7f1298e35e chore: dead code cleanup (#47129) 
## Problem

We have many unused files, left overs from features refactoring

## Solution

- Remove unused files
- Move some files closer to their usage

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Removed multiple legacy Studio UI components and placeholders to
streamline the interface (including onboarding panels, navigation
elements, docs layout helpers, and various UI building blocks).
* **UI Updates**
* Updated the layout’s API keys section to use the Project-specific
presentation.
* **Maintenance**
* Adjusted internal sourcing for documentation tab menu logic without
changing visible behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-22 10:36:21 +02:00
fadymak 5babf1092a feat(auth): accept Android app origins for WebAuthn RP origins (#47043) 
Allow `android:apk-key-hash:<base64url SHA-256>` entries in
`WEBAUTHN_RP_ORIGINS` alongside https/localhost-http origins.

Non-http(s) origins are matched as-is downstream and Android is
responsible to binding the origin to the RP ID via digital asset links.
 2026-06-17 18:10:30 +02:00
Joshen Lim 097f220c5c Add support for managing stored procedures under database functions (#46977) 
## Context

Dashboard currently doesn't have any support for managing stored
procedures. In the event that the security advisor surfaces a warning
about a stored procedure, users hence run into a dead-end as there's
currently no way to self-remediate via the dashboard

## Changes involved

We're hence adding support for managing stored procedures within
Database Functions
<img width="1082" height="546" alt="image"
src="https://github.com/user-attachments/assets/2598a5fe-e58f-4e8a-ad2f-9cb6d0eb2f53"
/>

Creating a function now shows a dropdown to select the type
<img width="500" alt="image"
src="https://github.com/user-attachments/assets/acc9249d-7b25-4416-aae8-89c630e1c62b"
/>

In which if stored procedure is selected, the following fields will be
hidden since they're irrelevant for stored procedures
- Return type
- Behaviour (Under advanced settings)

Some other minor UI changes as well:
- Field inputs are re-ordered a little, opting to group "Schema" and
"Name" into one section, followed by "Type" and "Return type"
- Opting to show "Return type" when editing a function but disabled
- Add schema filter for fetching database functions to reduce
unnecessary load on the database

## To test
- [ ] Can create, update, delete, read stored procedures via database
functions page

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary

- **New Features**
- Added PostgreSQL **procedure** support alongside functions, including
a **Type** selector in the create/edit flow.
- Updated Functions UI with a new **Type** column and procedure-aware
return/argument details.

- **Improvements**
- Refreshed create/edit headers and language help text for clearer
context.
- Improved argument parsing/display, including better handling of
procedure argument modes.

- **Bug Fixes**
- Corrected routine-type handling during function/procedure delete and
update SQL operations.

- **Tests**
- Updated unit snapshots and end-to-end UI flows/labels for the new “New
function” control.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 19:15:54 +08:00
Gildas Garcia 96d43099bb chore: refactor Button API so that it can be used a standard button (#46880) 
## Problem

Our `<Button>` component breaks the default `button` contract by
redefining the `type` prop to set its variant (`primary`, `default`,
etc) instead of the button type (`submit`, `button`, etc).
This is confusing and forces to write more code when using it with
shadcn components that expect/inject the standard button props.

## Solution

- rename the `type` prop to `variant`
- rename the `htmlType` prop to `type`
- propagate the changes where necessary
- format code

## How to test

As this is just prop renaming, if it builds it's ok

---------

Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
 2026-06-16 23:59:58 +02:00
Danny White 7e25c27e02 fix(studio): map email template anchors to docs (#46952) 
## What kind of change does this PR introduce?

Bug fix. Resolves FE-3469.

## What is the current behavior?

On auth email template pages, the Docs button builds anchor hashes from
the Studio URL slug (derived from user-facing titles), not from
canonical template IDs.

E.g. **Reset password** links to `#authemailtemplateresetpassword`, but
the docs section is `#authemailtemplaterecovery`.

12 of 13 templates had broken Docs links.

## What is the new behavior?

Docs links use an explicit `EMAIL_TEMPLATE_DOCS_ANCHORS` map keyed by
`template.id`, matching the anchors in
[customizing-email-templates.mdx](https://supabase.com/docs/guides/local-development/customizing-email-templates).

Examples:
- Reset password → `#authemailtemplaterecovery`
- Magic link or OTP → `#authemailtemplatemagic_link`
- Password changed → `#authemailnotificationpassword_changed`

Dashboard URL slugs (`reset-password`, etc.) are unchanged.

## Additional context

- Added `EMAIL_TEMPLATE_DOCS_ANCHORS` in `EmailTemplates.constants.ts`
with `satisfies Record<AuthTemplateType, string>` for exhaustiveness
- Added `EmailTemplates.constants.test.ts` to verify all template types
are covered and anchors match docs heading paths

**Test plan**
- [x] `pnpm --filter studio test EmailTemplates.constants`
- [ ] Spot-check Docs button on Reset password, Magic link or OTP, and
Password changed templates

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Tests**
* Added automated checks to ensure every authentication email template
has the correct documentation anchor mapping.

* **Chores**
* Updated the documentation link behavior for email templates to use a
consistent, predefined anchor mapping—improving reliability and
maintainability of the docs button.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-15 13:39:53 -06:00
Joshen Lim 1baaded0bb Consolidate execute-sql-query into execute-sql-mutation (#46944) 
## Context

Just some clean up as I was going through stuff
- `useExecuteSqlQuery` is deprecated and not used at all
- As such `execute-sql-query` is technically irrelevant, the more
relevant file is `execute-sql-mutation`
- Hence opting to consolidate `execute-sql-query` into
`execute-sql-mutation`
- Also removing `ExecuteSqlError` since its just re-exporting the
`ResponseError` type

There's a lot of file changes but its essentially just updating the
importing statements across the files
 2026-06-16 00:07:16 +08:00