## What kind of change does this PR introduce?
Surface the new scoped personal access token permissions published in
`@supabase/shared-types` 0.1.95 (added by
https://github.com/supabase/platform/pull/38060, now deployed).
**Stacked on #50234**, which regenerates the Management API types so
Studio's scope type includes the new ids. This PR targets that branch
and will retarget to `master` when it merges.
## What's in here
- Bump `@supabase/shared-types` to 0.1.95 (Studio and shared-data).
- Catalog entries in
`packages/shared-data/scoped-access-token-permissions.ts`:
- **API Key Secrets** (`api_gateway_keys_secret_read`): gates
`?reveal=true` on the API keys endpoints. Renamed from "JWT secret",
which described the wrong thing.
- **Data API JWT Secret** (`data_api_config_secret_read`): gates the
`jwt_secret` field on the PostgREST config endpoint.
- **Compute** (`workers_read` / `workers_write`): shared-types 0.1.95
also publishes the workers scopes, so they surface in the catalog now.
Named to match Studio's product naming (#50208).
- Minimum roles for the four new ids in `FGA_SCOPE_MINIMUM_ROLE`,
transcribed from the OpenFGA model (secret reads: developer; workers
read: readonly; workers write: developer).
- Docs generator (`generateAccessControlPartials.mts`):
- Drop the workers exclusion now that the scopes are live.
- When an endpoint lists alternative permission sets (for example API
keys read alone, or read plus secret read for reveal), a row's footnote
now only considers the alternatives that include that row's own scope.
Previously the API Key Secrets row would have said "Requires API Keys
(Read), or API Keys (Read) and API Key Secrets (Read)".
- Regenerated PAT guide tables. The committed Management API specs
predate the secret scopes, so this also includes the same spec refresh
the weekly docs bot performs (`chore(docs): refresh the Management API
specs`, kept as its own commit). Besides the new rows it picks up two
new upstream endpoints under Advisors and the branch rows.
## Verified
- `pnpm --filter studio typecheck` clean on top of #50234.
- Access token test suite passes, including the guard that the role
table covers exactly the ids shared-types publishes.
- Partial regeneration is idempotent, so the Docs Tests stale-table gate
passes.
## Follow-ups (not in this PR)
- `apps/docs/content/guides/getting-started/api-keys.mdx` says a
fine-grained token needs `api_gateway_keys_read` for the `?reveal=true`
example. It now also needs `api_gateway_keys_secret_read`.
- `project:api_gateway_keys` still says "Read exposes API keys" in its
risk reason, which overstates it now that secret values sit behind a
separate scope. Rewording may mean revisiting its risk level.
- The comment in `ComputeLayout.tsx` about shared-types not exposing
`workers_read` is stale.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added permission support for API key secrets, Data API JWT secrets,
and compute workers.
* Added API endpoints to run project advisors and create branches.
* Added support for additional log-drain destinations, including S3,
Last9, and OTLP.
* Added storage object versioning information to project configuration
responses.
* **Documentation**
* Updated access-control documentation for new permissions, worker
operations, advisor runs, and branch creation.
* Clarified Data API configuration and secret descriptions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## What kind of change does this PR introduce?
Revert
## What is the current behavior?
#48282 auto-updated the mgmt API docs spec files
(`apps/docs/spec/api_v1_openapi.json`,
`apps/docs/spec/api_v2_openapi.json`,
`apps/docs/spec/common-api-sections.json`, and the deparsed transform
files).
## What is the new behavior?
Reverts those spec/transform files back to their state prior to #48282.
This reverts commit 4adef69037.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated API reference documentation with clearer authorization
requirements and more accurate request and response schemas.
* Improved validation details, examples, required fields, and response
variations across projects, authentication, storage, backups, SSO,
analytics, and functions.
* Documented separate paginated listing and count operations for action
runs.
* Added clearer JIT response definitions and refined API behavior
descriptions.
* Removed documentation entries for several retired analytics,
organization, invitation, and private-link operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Include the v2 mgmt API spec in the official docs. This PR merges the v1
and v2 specs when generating the reference, with v2 taking precedence on
conflicts.
Fixes API-1215
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Docs now include API v2 reference: log-drain management
(list/create/update/delete) and project transfer (preview/transfer).
* **Documentation**
* Generated API reference now merges v1 and v2 specs so both appear in
the docs and section listings.
* New v2 operations added to Analytics and Projects documentation
sections.
* **Chores**
* Docs generation pipeline updated to accept and process multiple API
spec inputs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Gildas Garcia