mirror of
https://github.com/supabase/supabase.git
synced 2026-09-22 13:37:53 +08:00
master
237 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Jordi Enric
|
24e81e543e |
ci(api-types): summarize production type differences (#50263)
## Problem The production API types check reports mismatched filenames without showing which declarations differ, making drift difficult to diagnose. ## Fix <img width="1771" height="1012" alt="Shotbase Capture-AB6E5CC9-905B-46E3-AD7B-A2DE868D9E95" src="https://github.com/user-attachments/assets/81666e89-b79f-4456-a187-43af16ce2bec" /> Print a unified diff for each mismatched file with line numbers and committed/production labels. Append escaped, bounded previews to the GitHub Actions summary, with full diffs in the step logs, while preserving the failing check. ## How to test - Run `node --test packages/api-types/scripts/verify-production-types.test.mjs` (all six tests pass). - Tests cover diff direction and line numbers, multiple files, summary appending and escaping, preview truncation, local logging without an Actions summary, and diff command failures. - Both changed files were formatted with the repository Prettier configuration. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added detailed difference reporting when generated production types do not match committed types. * CI logs now include readable unified diffs, with large outputs safely truncated and escaped. * GitHub Actions summaries can include mismatched type files and their differences while preserving existing summary content. * **Bug Fixes** * Improved diagnostics for missing type files and type verification failures. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi Enric
|
fa7c223209 |
fix(studio): use Compute management endpoints FUNC-896 (#50393)
## Problem Studio still called the legacy `/workers` Management API routes and used the old `project_worker` response contract, so Compute instances could not be listed or retrieved after the API rename. The production API type check also detected drift in the v1 and platform declarations. ## Fix - Regenerate the v1, v2, and platform API declarations from the deployed schemas. - Update Studio list and detail queries to `/compute`. - Align typed fixtures with the Compute response schemas and `project_compute_instance` resource type. - Update platform response type references to the generated `_Output` schema names. ## How to test - Run `pnpm api:verify-types`. - Run `pnpm --filter api-types test`. - Run `pnpm --filter studio test data/compute/compute.utils.test.ts "tests/pages/project/[ref]/compute/index.test.tsx"`. - Run `pnpm --filter studio typecheck`. - Run `pnpm --filter common typecheck`. - Run `pnpm --filter studio lint:ratchet`. Expected result: production API declarations are synchronized, and Studio requests the `/compute` list and detail endpoints and renders `project_compute_instance` responses successfully. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Updated API response handling across profiles, backups, notifications, integrations, warehouses, access tokens, payments, and other Studio workflows for more accurate serialized data. * Compute instance pages and queries now use the compute-specific API endpoints and response data. * Improved feature-flag type handling when disabled feature data is unavailable. * **Tests** * Updated automated coverage and fixtures to reflect current compute and API response formats. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
737b8595f2 |
Update API types (#50234)
## Problem platform, v1 and v2 have been already completely migrated and introduced some changes. Some types have been renamed, some outputs and inputs updated. ## Solution - Update the API types - Fix the TS errors ## Update Taking this over to unblock #50134, which needs the new scoped token permission ids from the regenerated types. - Merged `master`. - Regenerated `api-v2.d.ts` from the production spec. The previous files came from a local API that exposed a webhook events endpoint production doesn't have yet. Production has since added standardized 400 error responses on the v2 organization endpoints. `api-v1.d.ts` and `platform.d.ts` already matched production. - Fixed `verify-production-types`. It formatted the regenerated files in a temp directory outside the repository, so Prettier fell back to its defaults and the comparison could never match the committed files. It now passes the repository config explicitly. `pnpm api:verify-types` passes on this branch. - Verified locally: `pnpm typecheck`, `pnpm api:verify-types`, Studio unit tests. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Preserved descriptions when saving, sharing, moving, or unsharing notebooks, reports, SQL snippets, and saved queries. * Improved handling of empty or null values across notebook descriptions, billing usage, pooler settings, and infrastructure fields. * Improved read-replica connection handling, including read-only connection strings. * Updated storage configuration and capability handling to match current settings. * **API and Compatibility** * Updated organization, project, storage, OAuth, billing, and infrastructure data handling to match current API responses. * OAuth app creation and updates now require scopes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Jordi Enric
|
84db103ebb | ci(api): verify generated types against production (#49993) | ||
|
Danny White
|
8dd97d75aa |
refactor(studio): use v2 replication publication APIs (#49844)
## What kind of change does this PR introduce? Studio data-layer migration. ## What is the current behavior? Studio loads complete publication details through the original bulk endpoint and creates publications by executing SQL against the source database. Publication and source-table data use names where stable table IDs are available. ## What is the new behavior? Uses the v2 publication-name, publication-detail, publication mutation, and source-table endpoints. The existing creation sheet continues to behave the same, including publishing partition changes through the parent table by default. Initial-sync selection and Analytics Bucket associations now consume the selected publication detail. Generated platform API types and their required nullability updates are included. The generated Platform contract accounts for roughly 10,000 changed lines in this PR. ## Dependency Depends on the v2 source table, table column, and publication endpoints from [supabase/platform#37505](https://github.com/supabase/platform/pull/37505), which are deployed to production. ## To test 1. Open the pipeline creation sheet and select an existing publication. 2. Create a publication with mixed-case schema and table names, then confirm the table names are shown while stable IDs are submitted. 3. Exercise all four initial-sync policies, including selecting individual tables. 4. Reopen the publication and table selectors and confirm they refresh without replacing populated options. 5. Edit and delete a publication. 6. Open an Analytics Bucket associated with a pipeline and confirm its publication tables resolve correctly. 7. Confirm unlimited WAL retention renders as Unlimited on pipeline status. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Improved replication publication setup with on-demand table loading, refresh controls, clearer table labels, and streamlined publication selection. - Publication creation and updates now use the latest replication API and table-based configurations. - Added clearer handling for tables removed from publications, including stale-selection warnings. - **Bug Fixes** - Prevented table selections from carrying over when switching publications. - Improved replication status displays when lag or WAL metrics are unavailable. - Updated replication deletion and table management for the latest API behavior. - **Tests** - Expanded coverage for publication creation, table selection, stale tables, loading states, and replication metrics. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Saxon Fletcher
|
ad33b16f8c |
feat(studio): show health advisors on the project home (#49661)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature ## Summary - Add a `useProjectHealthLintsQuery` that runs the live health checks (database down, unreachable, connection limit, service error rate, infrastructure alerts) - Surface those results on the project home advisor row alongside security and performance errors - Register health lint metadata (titles, docs links, entity icon) so homepage cards can render them Bottom of the stack. The advisor sidebar still uses tabs; health items show under All until #49662. ## To test 1. Open any project home in Studio. 2. Find the Advisor row (the cards under “Advisor found N issues”). 3. If the project has a real health problem, you should see a **HEALTH** card (for example “Database process is down” or “Database connection limit reached”), not only SECURITY / PERFORMANCE. 4. If the project is healthy, you should **not** see a HEALTH card. Existing security and performance cards should still appear as before. 5. Click a HEALTH card (or any advisor card). Advisor Center should open on that item. 6. In Advisor Center on this PR, health items only show under the **All** tab — Health is not its own tab yet. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a Health category to Advisor, with a dedicated tab and activity icon. - Added health checks for database availability, connection limits, service errors, and infrastructure alerts. - Health issues now appear alongside security and performance recommendations with relevant troubleshooting links. - **Bug Fixes** - Health-related advisor findings are now correctly categorized and displayed. - **Tests** - Added coverage for health checks, categorization, filtering, and project health query behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Utkarash Kumar Singh
|
0c8dc73bf4 |
feat(upgrade): surface btree_gist NaN reindex warning (#49684)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — studio counterpart of supabase/platform#37696 (PG 15.19/17.11 release, PSQL-1247). ## What is the current behavior? The pre-upgrade warnings panel handles `ltree_reindex_required` and `operator_estimator_gate` only. ## What is the new behavior? Adds the `btree_gist_nan_reindex` warning (title, description, docs link) emitted by the eligibility endpoint when a project has btree_gist indexes on float columns and the upgrade crosses the 15.19/17.11 NaN-handling fix. Non-blocking, same pattern as #47003. `api-v1.d.ts` union extended to match the platform spec. ## Additional context Docs anchor targets the section added in #49621 — merge that first (or together). Refs PSQL-1247. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an upgrade warning for the `btree_gist_nan_reindex` requirement. * Included a description and link to relevant documentation for guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan Vasilov
|
26e89b36c3 |
chore: Regenerate API types and fix all issues (#49646)
A bunch of small issues have showed up where the API types are breaking the FE repo: - Regenerate the API types. - For the removed Response types, use the return types from the operations instead. - Fix some types which now have a suffix `_Output`. - Add `requires_indirect_tax_declaration` property to Organization instances in mocks. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Updated Studio and shared type references to use generated API definitions consistently. * Improved typing for SSO configuration creation and updates. * Aligned telemetry lint categories with API-provided values. * Marked the legacy API type re-export as deprecated. * **Tests** * Updated test fixtures and response types to reflect current API contracts. * Added indirect tax declaration data to organization test scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan Vasilov
|
df002b4018 |
fix: Fix a type error in List JIT access API (#49612)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved database access rule handling by excluding records without an associated user. * Preserved valid user-rule mappings while preventing incomplete entries from being included. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan Vasilov
|
4c37eb4ac0 |
chore: Update API types (#49598)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Updated configuration drift test data to include the database major version, improving coverage for current project configuration responses. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Filipe Cabaço
|
29e47821f5 |
fix(realtime): add pg changes pool to realtime settings (#49256)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — adds a new Realtime setting to configure the Postgres Changes connection pool size. ## What is the current behavior? The Realtime settings page only exposes the connection pool used for Realtime Authorization (`connection_pool`). The pool that Realtime uses for Postgres Changes is not surfaced anywhere in the dashboard, so projects that need to tune it have no self-serve way to do so — the only option is to contact support. ## What is the new behavior? The Realtime settings page now includes a **Postgres Changes connection pool size** field: - Reads `postgres_changes_pool` from the project's Realtime config, falling back to a default of `2` when no override is stored. - Validates input from `1` through `20` (`MAX_POSTGRES_CHANGES_POOL`), and submits the value as a number in the config `PATCH` payload. - Docs (`apps/docs/content/guides/realtime/settings.mdx`) are expanded with sizing guidance for both connection pools, plus limits, resource-usage notes, and the operational error codes to look for. <img width="1160" height="166" alt="Screenshot 2026-08-19 at 13 59 04" src="https://github.com/user-attachments/assets/fd3ee29e-e9bf-438b-970f-8008ec57020f" /> ## Additional context The named `RealtimeConfigResponse` / `UpdateRealtimeConfigBody` schemas in the generated `api-types` package do not carry `postgres_changes_pool` yet, so both the query and mutation types extend the generated schema locally — the same pattern already used elsewhere in `apps/studio/data/`. Once the platform OpenAPI spec ships the field and `api-types` is regenerated, those two local intersections can be dropped. Covered by component tests in `RealtimeSettings.test.tsx` for both the fetch and save paths. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a Realtime setting to configure the Postgres Changes connection pool size. * Connection pools support 1–20 connections, with a default of 2. * Saving the setting now applies the configured value correctly. * **Documentation** * Expanded Realtime Settings guidance with configuration limits, resource usage, channel access, payload and presence limits, plan ceilings, spend-cap restrictions, and operational error codes. * Added guidance for sizing authorization and Postgres Changes connection pools. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Charis
|
8bdfe03fe7 |
refactor(studio): drop notebook type widening now that the API supports it (#49272)
## Summary - Regenerates `packages/api-types` for the content endpoints now that the Platform API's `notebook` content type has landed (list/get/upsert `type` enums, plus `UpsertContentBody`'s notebook cell shape with `_id`/`y_series`). Unrelated schema drift from the same regen (Warehouse, SSO, notification exceptions, etc.) is excluded — only the content-endpoint hunks are applied. - Removes every local widening cast added while the API support was pending (`content-query.ts`, `content-infinite-query.ts`, `notebook-query.ts`, `notebook-upsert-mutation.ts`, `sql-folders-query.ts`). - What remains is scoped and renamed to match: draft ids (`generateDraftId`/`isDraftId`), used only for cells created client-side in the editor before their first save, dropped before they'd ever reach the backend as a fake `_id`. ## Test plan - [x] `pnpm typecheck` — clean - [x] `pnpm --filter studio test` — full suite passes (518 files / 5471 tests) - [x] `pnpm --filter studio run lint:ratchet` — no new warnings - [x] `pnpm format` / prettier — clean <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved notebook cell tracking during editing, reordering, insertion, and deletion. * Preserved existing cell identifiers while removing temporary draft identifiers before saving. * Improved chart configuration for selecting and displaying multiple Y-axis series. * Strengthened notebook validation and content persistence behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Ivan Vasilov
|
628c7e08d6 |
Add generation for v2 APIs. (#48983)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added comprehensive type support for API v1, API v2, and platform endpoints. * Improved access to API v2 webhook and schema definitions. * Enabled separate type outputs for API v1 and API v2, making version-specific integrations easier to manage. * **Improvements** * Updated shared API types to combine definitions across supported API versions and platform services. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan Vasilov
|
b5477a89a3 |
chore: Update API types (#48981)
Update the API types by running `api:codegen`. Some of the changes are fixed in code, some of the type changes had to be reverted (JIT Access, SSO features). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Billing** * Updated subscription messaging to reflect AWS Marketplace billing. * Removed outdated partner-billing downgrade notices. * **Bug Fixes** * Improved request handling for API keys, custom domains, SQL snippets, branches, and storage operations. * Improved legacy signing-key compatibility. * Refined temporary database access availability messaging. * **Updates** * Removed Fly as an available cloud provider for region selection. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Riccardo Busetti
|
21919ec9b8 | feat(pipelines): Use new restart endpoint (#48737) | ||
|
Thomas
|
63a74d488f | chore(billing): rework texts on aws marketplace onboarding page (#47735) | ||
|
Riccardo Busetti
|
b2b150fa3c |
feat(pipelines): Add UI selector for choosing which tables to skip copy of (#47808)
## Summary Adds initial-copy scoping to Pipelines in Studio. Users can copy all existing rows, skip all initial copies, copy only selected publication tables, or skip selected table copies. All publication tables continue streaming new changes regardless of the initial-copy policy. The policy now round-trips through create, edit, validation, and the generated Management API contract. Initial-copy estimates and table-restart confirmations use the same scope. Edit requests also preserve redacted credentials and pipeline settings that Studio does not own. This completes the Studio layer of the [ETL API change](https://github.com/supabase/etl/pull/897) and [Management API change](https://github.com/supabase/platform/pull/35479). ## Screenshots ### Selector <img width="1153" height="465" alt="image" src="https://github.com/user-attachments/assets/bf615e82-ee61-4222-979d-a8695a957e82" /> ### Select certain tables only <img width="1153" height="465" alt="image" src="https://github.com/user-attachments/assets/28adaa24-f239-4d1d-8fb8-fdb1988320cd" /> ### Confirm copy costs As the final step before the pipeline is created: <img width="597" height="619" alt="image" src="https://github.com/user-attachments/assets/a660bd87-bfb8-41c5-8099-4cdbdef943bf" /> ### Policy-aware initial-copy estimate #### Copy no table is selected <img width="407" height="464" alt="image" src="https://github.com/user-attachments/assets/99d859ec-2ec3-452a-ab69-11924a8db260" /> #### Some tables are selected <img width="407" height="464" alt="image" src="https://github.com/user-attachments/assets/e68aedf4-66bc-4372-98ef-0dd7fecef324" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added configurable “initial table copy” policies (copy/skip all and copy/skip selected) during replication setup, including table-picker behavior, pruning of stale selections, and updated restart/cost estimates. - **Bug Fixes** - Improved restart flows to consistently use `schema.table` identity and simplified “errored tables” targeting to match error-state tables. - Reduced unnecessary loading by gating publication/table fetches to when panels are visible; improved validation/toast handling when publication tables are unavailable. - **Tests** - Added/expanded coverage for destination form submission, table-copy selection, restart/cost dialogs, and copy-estimate summarization. - **Style** - Refreshed warning/label text for clearer configuration and confirmation messaging. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Victor Farazdagi <simple.square@gmail.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Etienne Stalmans
|
05d5da0340 |
chore: add ssl_enforcement_required for jit (#48032)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? chore / bug fix ## What is the current behavior? The new `ssl_enforcement_required` state is not handled ## What is the new behavior? Displays the correct message <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved temporary database access messaging when SSL enforcement is required. * Added a direct action to open database settings and enable SSL enforcement before activating temporary access. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan Vasilov
|
24ce0ba5f8 |
chore: migrate repo to pnpm v11 (#48033)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Chore / dependency tooling update. ## What is the current behavior? The repo is pinned to pnpm 10.24.0. Closes https://linear.app/supabase/issue/FE-3673/migrate-the-repo-to-use-pnpm-v11. ## What is the new behavior? The repo is pinned to pnpm 11.13.1, pnpm v11 workspace settings are migrated to `allowBuilds`, and the Studio Dockerfile installs pnpm 11.13.1. ## Additional context Validated with `CI=true mise exec node@22 -- pnpm install --frozen-lockfile`, `mise exec node@22 -- pnpm run typecheck`, and `mise exec node@22 -- pnpm run lint`; full Prettier check still fails on existing generated docs/router files outside this migration. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated tooling requirements (pnpm **11.13.1**, Node **>=22.13**) and aligned container build tooling accordingly. * Adjusted package manager behavior (scoped registry override, update notifications disabled) and workspace build/engine validation settings. * **Maintenance** * Updated `clean` scripts across apps/packages to remove only build/cache artifacts (no longer delete installed dependencies). * Reduced Turbo `clean` task output to **errors-only** for cleaner logs. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Riccardo Busetti
|
c9eb33abc7 | feat(pipelines): Add new cost estimation dialog (#47915) | ||
|
Jordi Enric
|
4096267623 |
feat(api-keys): migrate last-used indicator to ClickHouse endpoint (#47458)
## Problem The "last used" indicator for the legacy `anon` / `service_role` API keys (Project API keys settings) was disabled because it ran a BigQuery `edge_logs` query. It is now re-enabled against the ClickHouse-backed `api_keys.last_used.otel` analytics endpoint. ## Current behavior - The `anon` / `service_role` "last used" indicator is off (the BigQuery-backed query was disabled). ## New behavior - New `useApiKeysLastUsedQuery` hook calls the `api_keys.last_used.otel` endpoint (timestamp params only, no SQL sent), plus its query key and the generated platform API type. - `DisplayApiSettings` reads last-used from this hook instead of posting BigQuery `edge_logs` SQL. The pure `getLastUsedAPIKeys` shaper is kept and unit-tested. Still gated by the `showApiKeysLastUsed` flag. - Removed the disabled secret-keys (`sb_secret_`) BigQuery last-used path, which has no ClickHouse endpoint to migrate to: drops the dead `useLastSeen` query, the `APIKeyRow` "Last Used" column, and the unused `showLastSeen` prop. - Reworded the delete-confirmation copy to be accurate for both secret and publishable keys. ## Additional context - Backed by the platform endpoint in supabase/platform#34892 (merged and deployed). - Scope: `anon` / `service_role` legacy keys. Secret/publishable and JWT signing-key "last used" are follow-ups, pending the endpoint returning those key types. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Updated API key settings to show “last used” activity for the past 24 hours using a dedicated data source and time window. * Added clearer messaging when recent API key activity fails to load. * Removed the “Last Used” column from API key management tables. * **Bug Fixes** * Improved mapping so “last used” values correctly match the intended key and role. * Updated API key deletion confirmation to explain required backend changes and resulting unauthorized behavior. * **Tests** * Added unit tests to validate “last used” computation and edge-case filtering. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Alaister Young
|
a3f2c4ffc1 |
chore(deps): upgrade to TypeScript 7 (native compiler) (#47757)
Upgrades the monorepo to TypeScript 7.0.2, released 2026-07-08. `tsc` is now the native Go compiler ([announcement](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/)) — full turbo typecheck drops from ~56s to ~19s locally. TS 7.0 ships **without a programmatic API** (it lands in 7.1), so this uses Microsoft's recommended side-by-side setup: the `typescript` name resolves to `@typescript/typescript6` (the 6.0 API republished) for API consumers — typescript-eslint and Next.js build typechecking — while `@typescript/native` (the real `typescript@7.0.2`) owns the `tsc` bin that typecheck scripts run. Exactly one version of each is in the lockfile; nothing imports the native package as a library. When 7.1 + tool support lands we can collapse back to a single `typescript` dep in the catalog. **Changed:** - `pnpm-workspace.yaml`: catalog aliases for `typescript` / `@typescript/native` - 17 package.json files: `@typescript/native` added beside each `typescript` dep so every package's `tsc` is the native binary - `apps/studio/tsconfig.json`: exclude `dist/` (gitignored build output) from typechecking **Fixed** (real type errors TS 6 under-reported): - `packages/ui-patterns` CodeBlock: `borderLeft: null` → `undefined` (`CSSProperties` doesn't accept null) - `apps/www` CodeBlock: removed a JSX `@ts-ignore` comment that tsgo doesn't honor and fixed what it masked (untyped `.js` theme objects, possibly-undefined highlighter children) ⚠️ **Merge timing:** the new packages are inside pnpm's 3-day `minimumReleaseAge` window until ~July 11. Installs from the committed lockfile are unaffected (resolution is skipped), but anything that forces a re-resolution before then will fail — hold off merging until the window passes. Note for editors: the compat package has no `lib/tsserver.js`, so VS Code's "Use Workspace Version" won't work — use the bundled TS or the TypeScript Native Preview extension. ## To test - `pnpm install && pnpm typecheck` — all 15 tasks green, and `./node_modules/.bin/tsc --version` prints 7.0.2 - `pnpm lint --filter=studio` — typescript-eslint still parses (resolves the 6.0 API) - `pnpm build --filter=design-system` (or any Next app) — Next's tsconfig validation and build typecheck still work - CodeBlock rendering on www (syntax highlighting, line highlights with/without border) — the two fixes are behavior-neutral but worth an eyeball <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements / New Features** * Enhanced TypeScript tooling support across the workspace for smoother development builds and checks. * **Bug Fixes** * Code blocks render more reliably when content is empty or missing. * Highlighted code line styling applies more consistently. * **Maintenance** * Studio TypeScript builds now avoid including generated output (such as `dist`) during compilation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Utkarash Kumar Singh
|
a5b820d51b |
feat(upgrade): surface ltree reindex + operator estimator upgrade warnings (#47003)
## What Studio + docs support for two **non-blocking** upgrade-eligibility warnings for the PG 15.18 / 17.10 release: - **`ltree_reindex_required`** — ltree indexes on a multibyte / non-libc database must be `REINDEX`ed after upgrade. - **`operator_estimator_gate`** — operators referencing a non-built-in selectivity estimator (CVE-2026-2004) can't be recreated by a non-superuser. ## Changes - `UpgradeWarnings.tsx` — title/description/link for both types; unrecognized warning types are skipped rather than rendering an empty admonition. - `apps/docs/.../platform/upgrading.mdx` — two upgrade-guide sections (with detection + remediation SQL) that the warnings link to. - `api-types` — the two types added to `ProjectUpgradeEligibilityResponse.warnings`. ## Server side Detection/emission lives in the platform repo: **supabase/platform#34161**. Both warnings are version-gated there (only fire when upgrading to ≥ 15.16 / 17.8). Refs: PSQL-1247 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Upgrade warnings now support additional warning types, with type-specific titles, descriptions, and optional “Read upgrade notes” links. * The project upgrade eligibility response now returns these additional warning types. * **Bug Fixes** * Upgrade warnings are rendered consistently for all warning entries (no special-casing). * **Documentation** * Added Postgres `ltree` upgrade warnings, including detection queries and `REINDEX INDEX CONCURRENTLY` remediation guidance. * Added operator selectivity estimator warnings, including superuser requirements and how to detect affected operators. * **Chores** * Updated spelling lint exceptions for common terms. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Coenen Benjamin
|
2ce01473bb |
feat(replication): add better form to create ducklake replication (#47069)
## What kind of change does this PR introduce? Add support to use supabase projects as a pg catalog and storage when adding a ducklake replication. ## What is the current behavior? Only simple form with raw input text for custom parameters is available. ## What is the new behavior? Being able to select supabase project to directly use projects in supabase for the ducklake. I also fixed a warning we had in the console for this form (cf screenshot) ## Additional context [API Changes ](https://github.com/supabase/platform/pull/34282) https://github.com/user-attachments/assets/4ff9ee65-6ba4-4f17-9ea1-9aebad34171c <img width="862" height="228" alt="Capture d’écran 2026-06-18 à 09 58 50" src="https://github.com/user-attachments/assets/1592c3be-807e-426f-9a5a-84979e05d93c" /> ### Test scenario Follow the screencast, go to your supabase project (better if it's in ap-southeast-1) Create a test table with 1 row for example -> Database -> Replication -> New destination -> Select ducklake and use supabase option -> Keep the same current supabase project selected for both catalog and storage -> Create destination -> You'll get a warning about the storage and credentials -> Confirm creation -> Wait until it's in status Running, if it's runing then it works <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added DuckLake replication destination with **Use Supabase** and **Custom parameters** modes. * Added DuckLake bucket selection with a **“New bucket”** creation dialog. * Added/expanded BigQuery, Analytics Bucket, and Snowflake destination configuration. * **Improvements** * Updated DuckLake create vs edit behavior: mode selection is hidden in edit mode and configuration is mapped correctly for the selected variant. * Enhanced field-level validation (including whitespace-only handling) and added clearer validation issue messages. * Added a cross-region warning for DuckLake when catalog and storage regions differ. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Benjamin <5719034+bnjjj@users.noreply.github.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Riccardo Busetti
|
cb6c361f25 | feat(replication): Improve replication validation and fix scroll (#46943) | ||
|
K-Dog (Kevin)
|
b347c8341d |
chore(etl): etl add-on forward compat (#46869)
Prep work for new ETL pipeline add-on, forward compatible |
||
|
Riccardo Busetti
|
324c724117 |
ref(replication): Improve replication copy and UI (#46793)
This PR improves the replication UI in the following ways: - Adds a new selecion picker for destinations which is split by the destination location and it's clearer and can scale more when we add more destinations. - Adds a much improved section on lag, highlighting new metrics that could help debug issues more easily. - Improves the copy across the whole code. - Fixes the 2d topological view of replication with better status handling. ### Screenshots <img width="1270" height="777" alt="image" src="https://github.com/user-attachments/assets/0ffc890e-2f80-47e5-bdb1-75071adda024" /> <img width="1665" height="656" alt="image" src="https://github.com/user-attachments/assets/23a27a02-acb2-4891-af95-5bc1d6ec7bfe" /> <img width="1454" height="247" alt="image" src="https://github.com/user-attachments/assets/c8799983-aa63-42b2-9370-ae4e009c1573" /> <img width="1120" height="340" alt="image" src="https://github.com/user-attachments/assets/20a18ad6-e5a9-40ec-80d4-42d6f783d868" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Live slot health indicators, legend, and connection badges. * Grouped destination type dropdown with alpha badges. * **Improvements** * Clearer UI copy for external destinations, alpha disclaimers, and onboarding flows. * Consolidated "n/a" handling for lag displays and richer metric tooltips. * Simplified replication diagram visuals and clearer table/row status/lag presentation. * Replication status responses now include expanded slot health and lag metrics. * **Tests** * New test suites covering destination selection and destination row states. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Victor Farazdagi
|
61754a0eec |
feat(studio): add Snowflake replication destination (#46767)
## Details of change
Adds Snowflake to the Studio replication destination flow:
- destination selection and display
- create/edit form fields
- validate/create/update payload serialization
- generated Platform API types
Snowflake remains gated behind `etlEnableSnowflakePrivateAlpha`.
**Note:** I have configured `etlEnableSnowflakePrivateAlpha` in
ConfigCat ("all" in staging and tied to my own org id in prod).
## Details of Verification Process
- Studio focused Vitest coverage for form serialization and diagram
mapping
- Studio typecheck
- ESLint on changed Studio replication files
- Local `mise fullstack:dev` smoke test to confirm the Snowflake form
renders ok.
<img width="937" height="569" alt="image"
src="https://github.com/user-attachments/assets/8d6b3a87-1f9d-4a59-91da-be719714ea49"
/>
Full create/validate E2E depends on the Platform PR and ETL runtime
rollout.
## Review Requests
Please check the Snowflake wire payload matches the Platform/ETL
contract and that gating/edit/display behavior follows the existing ETL
destination patterns.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Snowflake added as a supported replication destination (private-alpha
gated), including UI for selecting and configuring connection and auth
(account, user, database, schema, role, private key, optional
passphrase).
* **Validation**
* Form validation and submission now handle Snowflake-specific
required/optional fields.
* **Tests**
* Unit tests added for Snowflake form behavior and replication-type
detection.
* **API**
* Destination create/update/validate flows extended to accept Snowflake
payloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Danny White
|
00afaeac73 |
feat(studio): Issuer field in SSO form (#46187)
> [!CAUTION] > This new SSO field is UI-only until `oidc_issuer` is added to the `config` object. ## What kind of change does this PR introduce? Feature ## What is the current behavior? The SAML SSO provider config form has no way to supply an OIDC Issuer URL, which is required for enterprise-managed MCP authentication. ## What is the new behavior? - Adds an **OIDC Issuer URL** field to the SAML SSO provider config form (`/org/_/sso`) inside an "Advanced settings" collapsible. - Minor UI touch-ups to that SSO form. | After | | --- | | <img width="1434" height="2458" alt="94962" src="https://github.com/user-attachments/assets/e56f83cd-6e30-4a3f-a78d-330fc053953a" /> | The `oidcIssuer` field is UI-only right now; it renders but does not write. Before merging: 1. Add `oidc_issuer` to the SSO config API type (removes the `as any` cast in `SSOConfig.tsx:219`) 2. Add `oidc_issuer: values.oidcIssuer || undefined` to the `onSubmit` payload at `SSOConfig.tsx:183` 3. Wire the backend endpoint to persist and return the field <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * SSO settings now include an "Advanced settings" collapsible with an OIDC issuer field. * **UX / Bug Fixes** * Small UI/description refinements in SSO forms and attribute-mapping layouts. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46187?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Cemal Kilic <cemalkilic96@gmail.com> Co-authored-by: Cemal Kılıç <cemalkilic@users.noreply.github.com> |
||
|
Hieu
|
c713508fce |
fix: check token.scope for access resource display (#46603)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix ## What is the current behavior? Scoped PAT access message checks `organization_slugs`/`project_refs` to determine display text. This breaks when an org/project is deleted; its tuple is removed and consequently from the token's slugs/refs, causing a scoped token to incorrectly show "This token has access to all resources." ## What is the new behavior? Check the `token.scope` directly: - `user` → "This token has access to all resources." - `organization` → "This token has access to specific organizations." (or "This token has no accessible organizations." if all scoped orgs were removed) - `project` → "This token has access to specific projects." (or "This token has no accessible projects." if all scoped projects were removed) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved clarity of access token scope messaging. The resource access information now displays more specific and accurate details based on token type, distinguishing between organization-level, project-level, and user-level access permissions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alex Hall
|
99f4b4230a |
feat: detect integration install state based on partner callbacks (#46488)
Adds support for the new `integration_status` installation identification method for OAuth marketplace integrations, which will use the new integration state stored in Marketplace DB and updated via partner callbacks. Fixes INT-123 |
||
|
Paul Cioanca
|
bc6a459fd2 |
feat(upgrades): prevent upgrades for hibernated projects (#46109)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? * Prevents hibernated projects from undergoing database version upgrades <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for hibernating projects in upgrade warnings. Users will now see a clear message indicating their project is hibernating and will resume on the next supported request. * **Chores** * Extended log drain configuration to support additional destination types. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46109?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Kevin Grüneberg <k.grueneberg1994@gmail.com> |
||
|
Coenen Benjamin
|
71775c368e |
refactor(replication): remove useless expire snapshot configuration (#46341)
Remove useless expire snapshot configuration > This is an alpha feature not already deployed to any of our customers so breaking changes are not an issue. Signed-off-by: Benjamin <5719034+bnjjj@users.noreply.github.com> |
||
|
Jordi Enric
|
4ca7e66153 |
feat(observability): migrate overview to service-health endpoint (#46100)
## Problem
The observability overview page fetched service health data by making
six separate calls to the generic \`logs.all\` endpoint with
hand-crafted SQL (via \`genChartQuery\`). This coupled the overview to
SQL internals and missed out on the purpose-built \`service-health\`
endpoint that accepts structured \`lql\` filters and a \`granularity\`
parameter.
## Fix
- Added \`/platform/projects/{ref}/analytics/endpoints/service-health\`
to \`platform.d.ts\`, including the \`ProjectServiceHealthResponse\`
schema and \`UsageApiController_getProjectServiceHealth\` operation.
- Created \`apps/studio/data/analytics/service-health-query.ts\` with a
\`getServiceHealth\` fetch function and \`useServiceHealthQuery\` hook
following the same pattern as other analytics query files.
- Added a \`serviceHealth\` key factory to
\`apps/studio/data/analytics/keys.ts\`.
- Rewrote \`useServiceHealthMetrics.ts\` to call the new endpoint per
service using \`lql\` selectors (\`s:postgres_logs\`, \`s:auth_logs\`,
etc.) and a \`granularity\` value derived from the selected interval
(\`1hr\` -> \`minute\`, \`1day\` -> \`hour\`, \`7day\` -> \`day\`). The
timeseries normalisation and chart data pipeline is unchanged.
- Updated the refresh handler in \`ObservabilityOverview.tsx\` to
invalidate the new query key prefix and removed the now-unused
\`postgrest-overview-metrics\` invalidation.
## How to test
- Navigate to a project's Observability > Overview page.
- Verify that the Service Health table loads data for all six services
(Database, Auth, Edge Functions, Realtime, Storage, Data API).
- Switch between the 1hr, 1day, and 7day interval selectors and confirm
the charts update.
- Click the Refresh button and confirm the charts reload.
- Click a bar in any chart and confirm navigation to the corresponding
logs page scoped to that time window.
- Confirm no regressions in the Database Infrastructure section (CPU,
RAM, disk, connections).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Centralized service‑health fetching for consistent cross‑service
metrics and improved charting.
* New analytics key and backend endpoint for project service‑health; API
schemas added.
* Backend support for an additional log‑drain type (hidden from the UI).
* **Bug Fixes**
* Improved refresh behavior for service‑health data.
* Clear "No requests in this period" fallback and correct charts when
totals are zero.
* **Tests**
* Added unit tests for service‑health data extraction and
transformation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46100?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
|
||
|
Utkarash Kumar Singh
|
08c0fc247b |
feat(studio): warn about pg_graphql introspection change on upgrade (#46096)
<img width="1512" height="818" alt="introspection" src="https://github.com/user-attachments/assets/5c0e4c6a-c0e9-496d-8768-4a55a2433268" /> ## Summary Adds an in-product admonition on the Infrastructure Settings page when a project has pg_graphql < 1.6.0 installed, warning users that GraphQL introspection will be disabled by default after upgrading. Links to upgrade notes docs with the opt-in SQL. The admonition is purely informational — it renders alongside the upgrade button, does not block the upgrade. ## Context pg_graphql 1.6.0 disables GraphQL introspection by default. The change is upgrade-triggered (not backported), so users on 1.5.x will only encounter it when their AMI bundles 1.6.0+. To prevent surprise breakage of tools that rely on `__schema`/`__type` (GraphiQL, codegen, Relay compiler, etc.), Studio surfaces this admonition before they upgrade. Design discussion in [PSQL-1199](https://linear.app/supabase/issue/PSQL-1199/prepare-dashboard-notification-for-pg-graphql-breaking-change). ## Companion PR This depends on the schema change in [supabase/platform#32954](https://github.com/supabase/platform/pull/32954) which adds the new `warnings` field to `ProjectUpgradeEligibilityResponse`. ## Admonition copy - **Title:** \"GraphQL introspection will be disabled by default after upgrade\" - **Body:** \"After upgrading, queries to \`__schema\` and \`__type\` will return an error unless introspection is explicitly re-enabled on the schema. Regular data queries are not affected.\" - **CTA:** \"Read upgrade notes\" → links to the new docs section ## Related - Linear: [PSQL-1199](https://linear.app/supabase/issue/PSQL-1199/prepare-dashboard-notification-for-pg-graphql-breaking-change) - Parent rollout: [PSQL-1163](https://linear.app/supabase/issue/PSQL-1163/breaking-change-pg-graphql-introspection-rollout) - Companion platform PR: https://github.com/supabase/platform/pull/32954 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added “Upgrading to pg_graphql 1.6.0” and updated pg_graphql docs: introspection is disabled by default, how to re-enable per schema, verification steps, and affected tools. * **New Features** * Upgrade settings UI now shows validation warnings about introspection with links to upgrade notes. * **Chores** * Added "GraphiQL" to MDX spelling allow list and added upgrade-warning types to API surface. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46096?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Danny White
|
f45a6085f4 |
feat(studio): add auth email template reset flow (#45572)
## What kind of change does this PR introduce? Feature. Resolves AUTH-879. ## What is the current behavior? Studio does not provide a way to reset an Auth email template back to the default subject and body once it has been customised. ## What is the new behavior? Studio shows a `Reset template` action when Platform reports that the selected Auth email template subject or body has been customised. The action opens a confirmation dialog, calls the dedicated Platform reset endpoint, and refreshes the editor with the default subject and body returned by the API. The Auth config save/reset mutations now run their user-facing success handling before refreshing Auth lint data, so the success toast and local editor cleanup are not delayed by lint refetches. ## Additional context Depends on supabase/platform#32417. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Reset email templates to defaults via a confirmation dialog; button appears when custom content is detected and respects update permissions. * Typed email-template definitions and improved template variable display and descriptions. * **Tests** * Added tests covering template reset visibility, confirmation flow, state updates, permission handling, and toast notifications. * **Documentation** * Example email template placeholders updated for internationalization and provider snippets. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45572) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Joshen Lim
|
88c43b31b9 |
Support optionally remove custom domain addon when deleting custom domain after activated (#45880)
## Context Related BE PR: https://github.com/supabase/platform/pull/32693 Add support to remove the custom domain add-on when deleting a custom domain after the custom domain is activated. <img width="411" height="310" alt="image" src="https://github.com/user-attachments/assets/23d57fc0-f760-42d4-8383-480ff2b2ec5a" /> We previously had this behaviour by default to address some customer feedback RE confusion that they were still being charged for custom domain add-on despite deleting the custom domain, but not removing the add-on. However this was a bit of confusing UX (RE deleting the add-on implicitly), so this makes the deleting of the custom domain add-on an explicit action instead. ## To test - [ ] Set up custom domain on a project - [ ] Trying deleting the custom domain after activating _without_ removing the add-on - [ ] Trying deleting the custom domain after activating _with_ removing the add-on |
||
|
Ignacio Dobronich
|
a4f964e452 |
fix: in-arrears transition in upcoming invoice (#45765)
## Show notice when plan fee is prepaid for the upcoming invoice When a subscription's plan fee has already been billed for the current period (e.g. transitioning to in-arrears billing), the upcoming invoice no longer contains a plan line item. Previously this rendered as an empty plan row with a `-`, which was confusing. <img width="2178" height="538" alt="image" src="https://github.com/user-attachments/assets/1fa289d9-60ae-48b1-b779-34770bc2c242" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Billing breakdown now detects when the plan fee was already paid upfront, hides the redundant plan line, and notes only usage will be invoiced; shows the organization plan name when available. * Backup restoration: added an optional recovery time target for physical backups. * Expanded supported AWS instance types for deployments. * **UI** * Compute and Replica Compute docs links now use inline linking for a smoother in-app experience. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45765) <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Wen Bo Xie
|
f648c0c274 | feat: restore a physical backup by id only (#45631) | ||
|
Danny White
|
bedb2efb87 |
chore(studio): JIT access UI improvements (#44161)
## What kind of change does this PR introduce? UI and copywriting improvements for temporary access. ## What is the current behavior? The temporary access UI still used older JIT/ephemeral naming in some places, did not clearly explain the setup requirements, and had to infer unavailable states from Platform error message text. ## What is the new behavior? The settings UI now uses temporary access naming consistently, explains that temporary access uses short-lived tokens for manual database connections, and renders clearer unavailable states for projects that require either a Postgres upgrade or a platform migration. The Studio query now consumes Platform’s structured `unavailableReason` contract instead of parsing human-readable error strings, so the UI owns the copy while Platform owns the eligibility reason. Validation: - `pnpm eslint components/interfaces/Settings/Database/JitDatabaseAccess/JitDbAccessConfiguration.tsx data/jit-db-access/jit-db-access-query.ts` - `pnpm tsc --noEmit --pretty false` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * IP range input now supports one CIDR range per row with add/remove rows and form integration. * **Documentation** * Replaced “JIT” wording with “Temporary” / “Ephemeral token-based” access across UI, dialogs, toasts, and help links. * Added minimum PostgreSQL version requirement (17.6.1.081+). * **Improvements** * Per-row CIDR validation with precise nested error messages. * Refined layout spacing and moved the temporary-access configuration earlier in Database settings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Etienne Stalmans <etienne@supabase.io> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Danny White
|
9e3a10d557 |
feat(studio): payment method states for Stripe Projects orgs (#44965)
## What kind of change does this PR introduce? UI changes for Stripe-managed billing surfaces. - Resolves DEPR-537 - Related to DEPR-538 ## What is the current behaviour? Stripe-connected organisations still look too self-serve in Studio. - Payment Methods still reads mostly like ordinary Supabase card management, even though billing is handled through a Shared Payment Token via Stripe Projects - invoice messaging still implies support is the path to changing payment methods, even for Stripe-managed orgs - the Subscription Plan flow still needs Stripe-specific guardrails so users are redirected to the correct upgrade path rather than trying to self-serve everything in Studio - the base branch now correctly separates `integration_source` from `billing_partner`, but this stacked work still needs to carry that split through the Stripe billing-token surfaces ## What is the new behaviour? This PR makes the Stripe-managed billing surfaces behave like Stripe-managed billing surfaces, while leaving AWS and Vercel on the existing `billing_partner` path. - Payment Methods now keeps the familiar saved-card row, but augments Stripe-managed rows with Shared Payment Token context, token status, and Stripe Projects affordances - Stripe-managed invoice messaging now points users to Stripe Projects rather than to support for payment-method changes - the Subscription Plan flow keeps the existing managed-billing shape, with Stripe-specific guardrails layered in where plan changes should be handled outside Studio - AWS and Vercel continue to use the existing partner-managed alerts and CTAs driven by `billing_partner` / `billing_via_partner` | Subscription plan sheet | | --- | | <img width="1780" height="448" alt="CleanShot 2026-04-24 at 17 21 43@2x" src="https://github.com/user-attachments/assets/34c0f3ba-fc42-4d07-97a2-0e4f4cefc55e" /> | | _Upgrade instructions_ | | <img width="1786" height="460" alt="CleanShot 2026-04-24 at 17 20 12@2x" src="https://github.com/user-attachments/assets/bb67c835-b9b2-4648-b0e1-9c2f8d2317d3" /> | | _Downgrade instructions_ | > [!NOTE] > The below screenshots are outdated. The _Shared Payment Token_ terminology has been removed in favour of more generic copy such as _Stripe Projects token_. | Stripe payment method states | | --- | | <img width="1436" height="234" alt="CleanShot 2026-04-23 at 19 03 49@2x" src="https://github.com/user-attachments/assets/52ed7a00-dfba-4b66-9a07-a6346692d3c8" /> | | _Healthy_ | | <img width="1434" height="224" alt="CleanShot 2026-04-23 at 19 04 50@2x" src="https://github.com/user-attachments/assets/94efd943-b7bf-4da2-9e1b-1828aae97126" /> | | _Card expiring soon_ | | <img width="1436" height="236" alt="CleanShot 2026-04-23 at 19 06 51@2x" src="https://github.com/user-attachments/assets/272cb707-c724-4629-890e-853972e53a18" /> | | _Card expired_ | | <img width="1308" height="238" alt="CleanShot 2026-04-23 at 19 07 21@2x" src="https://github.com/user-attachments/assets/3eadd2a9-def3-4f43-850e-7d82adfb0b57" /> | | _Token expired_ | ## Dependencies This PR is stacked on: - #44328 It also depends on the private platform work that exposes Stripe project connection state and SPT details: - https://github.com/supabase/platform/pull/31874 - https://github.com/supabase/platform/pull/31940 ## Platform dependency status Most of the remaining platform work for this stack is now covered by the private dependency below: - https://github.com/supabase/platform/pull/31940 That PR is expected to provide the SPT details and paid-flow fixes this Studio work depends on. In practice, the main caveat here is less “Studio still needs a bunch of new platform work” and more “do not merge this until `platform#31940` has landed and the end-to-end Stripe-managed flow has been rechecked”. ## Local testing Use the same local Stripe setup as the base branch, with `integration_source: 'stripe_projects'` returned consistently for: - `/platform/organizations` - `/platform/organizations/:slug/projects` - `/platform/projects/:ref` For payment method demos, the temporary local mock currently lives in private `platform` on: - `/platform/organizations/:slug/payments` That mock can be flipped between: - healthy token + healthy underlying card - healthy token + card expiring soon - healthy token + expired card - expired token Then verify: - the org and project connection affordances from #44328 still render correctly - Payment Methods shows Stripe-managed token context rather than implying ordinary self-serve card management - regression test ordinary non-Stripe payment methods too, to confirm the standard saved-card row still renders with the existing `Expires:` copy and no Shared Payment Token affordances - invoice messaging points Stripe-managed orgs to Stripe Projects rather than support - Subscription Plan keeps the managed-billing guardrails for Stripe - AWS and Vercel orgs still show the existing partner-managed messaging rather than the Stripe-specific notices <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Stripe-managed organizations show Stripe Projects billing guidance, replace in-app payment management with Stripe links, and adjust billing copy. * Payment methods support Shared Payment Tokens (SPTs): token expiry/status badges with tooltips, “Handled via Stripe Projects” indicator, token last4/expiry display, and disabled local update/delete actions for SPTs. * **API** * Payments response now includes optional shared payment token details for payment methods. * **Documentation** * Added links to Stripe Projects billing docs in relevant flows. * **Tests** * Updated and added tests covering Stripe-managed and SPT behaviors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Raúl Barroso <code@raulb.dev> |
||
|
Kanishk Dudeja
|
9d2807e19b |
feat(billing): include prepaid credits in credit balance (#45177)
### Summary This PR updates the logic to include `prepaid_credits_balance` while showing the existing customer balance. This changes the credit balance shown in: - Billing Settings > Credit Balance - Credit code redemption modal The displayed amount now reflects the total credit balance across prepaid credits and the customer balance. ### Testing - Open an org billing page with prepaid credits and verify Credit Balance includes both sources. - Open the credit redemption modal and verify Current Balance matches the combined credit amount. - Verify an org with only customer balance still shows the same credit amount as before. - Verify an org with only prepaid credits balance and no customer balance now shows credits correctly. - Verify an org with no credits shows 0.00 and does not show /credits. - Verify an org where net balance is debt still shows a negative amount without the /credits suffix. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Credit balance display now includes purchased and prorated credits for a complete account view. * Credit redemption and current-balance screens now show combined credit totals (prepaid + existing) for clearer availability. * UI descriptive text clarified to explain how credits are applied and how charges occur once credits are exhausted. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Riccardo Busetti
|
8347877957 | feat(etl): Add UI elements to disable external replication (#45035) | ||
|
Ignacio Dobronich
|
e6ca2766ff |
feat: show tax preview for credit top-ups (#45005)
## Summary
- Add tax preview to the credit top-up flow by integrating the new `POST
/organizations/{slug}/billing/credits/preview` endpoint
- Show a price breakdown (credit amount, tax line item, total) in the
top-up dialog before the user confirms payment
- Handle all three `tax_status` states: show tax when `calculated`, hide
the line when `not_applicable`, show an inline warning when `failed`
## Behavior
- Preview fires as soon as a valid amount (300–2000) is entered; address
and tax ID are optional and refine the estimate
- Amount and address changes are debounced at 1s to avoid excessive API
calls
## Test plan
- [ ] Open credit top-up dialog - verify preview appears with default
$300 amount
- [ ] Change amount within 300–2000 - verify preview updates after
debounce
- [ ] Enter amount outside range (e.g. 100 or 3000) - verify preview
hides and validation error shows
- [ ] Add a new payment method with a billing address in a taxed region
- verify tax line item appears
- [ ] Add a new payment method with no tax jurisdiction - verify no tax
line, just total
- [ ] Complete a top-up - verify the charge goes through and dialog
closes
<img width="571" height="551" alt="image"
src="https://github.com/user-attachments/assets/d3357752-f913-4a4a-b84a-f78e2f457c7b"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Credit top-up preview with charge breakdown (credit, tax or tax note,
total).
* Onboarding survey endpoint and ISO 27001 certificate availability for
organizations.
* **Updates**
* Improved top-up UX: debounced address/tax inputs, enforced min/max
amount validation, preview-driven form state, and submit disabled while
preview is loading/stale.
* API docs wording changed to “temporary access configuration.”
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Danny White
|
1ab7251060 |
chore(studio): clarify partnered orgs and projects (#44328)
## What kind of change does this PR introduce? UI improvements. - Resolves DEPR-401 - Resolves DEPR-424 - Resolves DEPR-425 ## What is the current behaviour? Studio currently blurs two different concepts together: - `billing_partner` / `billing_via_partner`, which represent real billing ownership for marketplace-managed organisations such as AWS and Vercel - Stripe connection state, which is not actually partner billing in the same sense, but was previously being mocked through the same UI paths That made the Stripe work harder to reason about and left some local behaviour dependent on temporary overrides rather than the API shape we want to ship. ## What is the new behaviour? This PR separates those concerns while keeping the existing AWS and Vercel marketplace experience intact. - AWS and Vercel continue to use `billing_partner` / `billing_via_partner` for billing ownership, lockouts, and manage CTAs - Stripe display state now comes from `integration_source`, which lets Studio show Stripe-specific badges and alerts without treating Stripe as a billing partner - organisation-level partner UI is unified across AWS, Vercel, and Stripe, including the org banner, navbar icon treatment, and organisation cards - project-level Stripe UI now appears only when the project itself is marked as Stripe-connected, including the project switcher, project list surfaces, and a project-level banner - Stripe-connected organisations are no longer incorrectly blocked behind the AWS/Vercel-style billing management alerts for invoices, billing address, payment methods, or plan changes - banner dismissal is scoped to the relevant org/project and partner/integration state ## Review order Most of the diff size here is regression tests and generated types. The behavioural changes are concentrated in a smaller set of files. Recommended review order: 1. `integration_source` vs `billing_partner` data-model split and org/project query mapping 2. org-level UI: partner icon, org banner, org dropdown/card treatment 3. billing gating updates for Stripe vs AWS/Vercel 4. project-level Stripe UI: dropdown, list surfaces, banner 5. tests and generated types | Stripe Org(s) | | --- | | <img width="1024" height="759" alt="Organizations Supabase" src="https://github.com/user-attachments/assets/d0ef338c-3b41-4c6d-b3bd-f21a2c182840" /> | | Vercel Org(s) | | --- | | <img width="1024" height="759" alt="Organizations Supabase" src="https://github.com/user-attachments/assets/1dc57770-3f24-45ac-840f-34680555cde8" /> | | AWS Org(s) | | --- | | <img width="1024" height="759" alt="Organizations Supabase" src="https://github.com/user-attachments/assets/7847dad0-ee30-4a65-ab0b-b3b16af0d34f" /> | | Stripe Org, Non-Stripe Project | | --- | | <img width="1152" height="885" alt="Mallet Toolshed Supabase-1673E019-792C-462C-B6F8-C5DDB810B331" src="https://github.com/user-attachments/assets/556fbea3-b5ae-4f2f-96b9-6f66c6654e4a" /> | | Stripe Org, Stripe Project | | --- | | <img width="1152" height="885" alt="Hammer Toolshed Supabase-7E86C17C-561F-4221-BD16-EAFF7D41AAE0" src="https://github.com/user-attachments/assets/94f8daf6-0320-413e-8d56-59f9acaaea15" /> | | Vercel Org | | --- | | <img width="1024" height="759" alt="Projects Toolshed Supabase-A7891653-9366-4B99-89DD-789D70CD52E3" src="https://github.com/user-attachments/assets/c87ee6e8-4451-4866-a905-23a38b2593e3" /> | | AWS Org | | --- | | <img width="1024" height="759" alt="Projects Toolshed Supabase-58A43ECE-569E-4541-9463-346A90B02CFF" src="https://github.com/user-attachments/assets/9350a180-4d58-42a1-ad1a-95893c2e8b12" /> | This also removes the old Stripe mock override path in Studio so the frontend matches the intended API model more closely. ## ~~Dependencies~~ (merged!) This work depends on the private platform change that exposes `integration_source` on the relevant organisation and project payloads: - https://github.com/supabase/platform/pull/31874 _Update: now merged._ ## Local testing ### Stripe If you have the private `platform` repo checked out locally, make sure your local API returns `integration_source: 'stripe_projects'` consistently for the Stripe-linked org/project you are testing. Important responses: - `/platform/organizations` - `/platform/organizations/:slug/projects` - `/platform/projects/:ref` Verify: - org banner and org icon show the Stripe connected state - unopened and opened project switcher both show Stripe only for Stripe-linked projects - project cards / table rows show the Stripe chip only for Stripe-linked projects - the project-level Stripe banner appears across project surfaces - billing address, tax ID, invoices, payment methods, and plan changes remain editable in Studio for Stripe orgs ### Vercel Use a Vercel Marketplace org with real `billing_partner` / `billing_via_partner` values. Important org-level endpoints for local mocking in `platform`: - `/platform/organizations` - `/platform/organizations/:slug` - `/platform/organizations/:slug/billing/subscription` Project-level Vercel indicators still come from `/platform/integrations/:slug`, not `integration_source`. ### AWS Use an AWS Marketplace org with real `billing_partner` / `billing_via_partner` values. Important org-level endpoints for local mocking in `platform`: - `/platform/organizations` - `/platform/organizations/:slug` - `/platform/organizations/:slug/billing/subscription` AWS does not currently have a Stripe-like project-level indicator in these org/project payloads. ## Notes - `billing_partner` is no longer the right abstraction for the Stripe-connected case in this PR. It remains the source of truth for marketplace billing ownership, while Stripe currently uses `integration_source` as a connection/display signal. - I re-ran `pnpm api:codegen` while tightening this PR and kept only the generated type changes this branch actually depends on, to avoid unrelated API drift in the review. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Stripe Projects integration added for billing and project flows * Partner icons/badges shown across org and project lists, dropdowns, and rows * Dismissible, partner-specific marketplace/integration banners with contextual CTA behavior * Improved partner-billing detection to drive billing UI and invoice/plan availability * **Tests** * Extensive new test coverage for billing UI, partner-managed fallbacks, banners, icons, and related flows <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Stephen Morgan
|
bd55ad23a6 |
feat: iso27001 certificate (#44963)
Edit: Can be merged, mgmt api deployed Dashboard addition to frontend for access to the ISO 27001 certificate. View for Team customers: <img width="1737" height="1151" alt="image" src="https://github.com/user-attachments/assets/cd62d24f-8b6e-4600-9ded-943a170cd124" /> Resolves SEC-799 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * ISO 27001 certificate added to Documents with a Download action, confirmation modal, new-tab open on success, and error toast on failure. * Users without billing permission see a no-permission view; users missing entitlement see an “Upgrade to Team” prompt. * **Refactor** * Upgrade-to-Team flows for SOC2 and related upgrade UI standardized to use the shared upgrade component. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Raminder Singh
|
0cb71a2497 |
feat: new marketplace db (#44574)
This PR integrates with the new marketplace db to allow Grafana (and other partners) OAuth apps to install from the integrations page. A demo of this working locally is available here: https://supabase.slack.com/archives/C01GN60J0BS/p1775551752479709. End to end flow is documented here: https://www.notion.so/supabase/Grafana-Integration-Flow-33a5004b775f80eeaf91c098beb8071f. TODO: - [ ] Make sure `NEXT_PUBLIC_MARKETPLACE_API_URL` variable is set to the new marketplace db. - [x] Test with the `marketplaceIntegrations` enabled and disabled in staging once https://github.com/supabase/platform/pull/31298 is merged and available in staging. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Add OAuth "Install integration" button that detects installed integrations and supports GET/POST install flows * Marketplace listings now include install links, installation method, partner info, and listing assets/logos * **Infrastructure** * Allow marketplace API origin for images and content in security and image config * Centralize marketplace types and switch marketplace data source for more reliable listings <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Ignacio Dobronich
|
35478cf47b |
feat: expose tax in upcoming invoice (#44732)
Display tax information in the upcoming invoice breakdown. - Show a "Tax" line item with amount and rate tooltip when tax is successfully calculated - Show a warning row when tax estimation fails, prompting users to verify their billing address - Update Current Costs and Projected Costs tooltips to indicate whether tax is included or could not be estimated ## Test plan - [ ] Verify tax row appears with correct amount when `tax_status` is `calculated` - [ ] Verify tax rate percentage shows in the tooltip (e.g., "Estimated tax at 10%...") - [ ] Verify warning row appears when `tax_status` is `failed` - [ ] Verify no tax row appears when `tax_status` is `not_applicable` - [ ] Verify "Applicable tax included." appears in Current/Projected Costs tooltips when tax is calculated - [ ] Verify "Tax could not be estimated and is not included." appears in tooltips when tax fails <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Upcoming invoices now include tax details and a tax status. * Billing breakdown shows projected tax and conditionally displays projected totals excluding tax when applicable. * If tax estimation fails, a “Tax — Could not be estimated” row appears and totals reflect the failure. * Added "Stripe Projects" as a billing partner option and clarified that projected amounts may be explicitly null. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Francesco Sansalvadore
|
31794b83f2 |
feat: passkeys config page (#44718)
## Summary by CodeRabbit * **New Features** * Added Passkeys configuration page to manage WebAuthn relying-party settings and enable/disable passkey auth. * Added a Beta "Passkeys" item to the Auth settings menu. * Enabled saving passkey-related authentication parameters. * **Tests** * Added test coverage to ensure the Passkeys menu appears or is omitted based on feature flags. * **Chores** * Removed an unused import to tidy the code. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: fadymak <dev@fadymak.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Raúl Barroso
|
1797842ee5 |
refactor(stripe projects): always create a new org (#44634)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor based on https://github.com/supabase/platform/pull/31325 ## What is the current behavior? We presented a page to Stripe users to let them either pick an existing org or create one. ## What is the new behavior? We're forcing them to create a new one (or show that there was one already linked). - It also adds the option to sign out when there's a conflict. Fixes https://linear.app/supabase/issue/API-963/add-a-button-to-logout-from-the-page-you-must-be-logged-in-as-x-to - And adds the link to root from the logo. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added organization preview creation endpoint for billing workflows. * **Bug Fixes** * Removed organization-picking flow from Stripe Projects login; users now proceed directly with confirmation. * Added a "Sign out" button on error pages. * **Refactor** * Removed a legacy billing partner option. * Made the Supabase logo clickable for quick navigation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
