[pull] master from supabase:master - #1213
Merged
Merged
Conversation
## What kind of change does this PR introduce? Shared UI pattern and Studio UX improvement. ## What is the current behavior? Async selectors use bespoke loading and error layouts. Some replace the entire field while fetching, and opening a selector does not consistently refresh its options. ## What is the new behavior? Adds shared loading, error, and empty states for Select, command, and MultiSelector lists, including a persistent polite live region and reduced-motion support. Analytics Bucket and DuckLake selectors keep their controls in place, retain populated options during background refreshes, and refresh when reopened. ## To test Open the [Replication preview](https://studio-staging-git-dnywh-featasync-selection-feedback-supabase.vercel.app/dashboard/project/_/database/replication?destinationType=Analytics%20Bucket). The destination sheet should already be open on **Analytics Bucket**. You do not need to create a bucket, configure a destination, or start a pipeline. Open **Select a bucket**, then review these outcomes: 1. **The trigger stays put.** Opening the picker must not replace the form field with a full-width loading placeholder. 2. **Loading belongs inside the menu.** While options are fetched, the open menu shows a compact skeleton list. 3. **No resources has a clear explanation.** If the project has no Analytics Buckets, the menu says **No buckets available**. It still offers **Create a new bucket** beneath that message. 4. **Existing options do not disappear on refresh.** If the project does have buckets, close and reopen the picker. Its current options remain visible while the refresh happens in the background, rather than flashing back to skeletons. 5. **The pattern is consistent.** If convenient, select a bucket and open the namespace or access-key picker. The same in-menu loading, empty, and error treatment applies there too. The deterministic request-error and reduced-motion cases are covered by focused unit tests because the deploy preview cannot reliably force those states.
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — a new UI Library block. Bottom of a two-PR stack; #49579 builds on it. ## What is the new behavior? Adds an `mcp-server` block: a Supabase Edge Function that exposes MCP tools scoped to the signed-in user. It is backend-only, so every file has an explicit target and no `components.json` is needed. - `withSupabase({ auth: 'user' })` verifies the access token and gives each tool an RLS-scoped client. Both product session tokens and OAuth tokens work; only the latter carry `client_id`. - `withOAuthProtectedResource` serves RFC 9728 metadata and adds a `WWW-Authenticate` challenge to `401`s, so external MCP clients can discover the authorization server. - Tools are composed in `tools/index.ts`. One is included, `whoami`, which shows the caller's identity and OAuth client. Docs at `/library/docs/headless/mcp-server`, under a new MCP group in the sidebar. `BlockItem` gained a `showOpenInV0` flag (v0 cannot take Deno functions), and the file-tree viewer now picks a language per file instead of always TypeScript. ## To test 1. `npx shadcn@latest add http://localhost:3004/library/r/mcp-server.json` into a Supabase project or empty directory. 2. Add `[functions.mcp-server] verify_jwt = false` to `supabase/config.toml`, then: ```bash supabase start supabase functions serve mcp-server --env-file supabase/functions/.env ``` 3. **Unauthenticated:** `curl -i localhost:54321/functions/v1/mcp-server` returns `401` with a `WWW-Authenticate` header, and `/functions/v1/mcp-server/oauth-protected-resource` returns the metadata document. 4. **Product session:** sign up a user, then call the endpoint with `Authorization: Bearer <their access token>`. `tools/list` shows `whoami`; calling it returns that user's id and `client_id: null`. 5. **External client:** enable `[auth.oauth_server]` with `allow_dynamic_registration = true`, install the OAuth Consent block, point an MCP client (Claude Code, Codex) at the function URL, approve the consent screen, and call `whoami` again. `client_id` is now populated. 6. Confirm RLS holds: add a table with a user-scoped policy and a tool that reads it, then check a second user cannot see the first user's rows. 7. Docs page renders at `/library/docs/headless/mcp-server`, and `deno.json` / `.env.example` in the folder tree highlight as JSON and bash rather than TypeScript. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added an installable Supabase MCP Server block with user-scoped authentication and a read-only identity tool. - Added MCP Blocks to documentation navigation and setup guidance. - Code blocks now automatically detect syntax highlighting from file names. - Added an option to hide the “Open in v0” button. - **Documentation** - Expanded MCP Server guidance covering installation, configuration, validation, deployment, OAuth, and security. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com>
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? The scoped-access-token project selector fetched a single page of the user's projects across all orgs and filtered client-side, so switching to an org whose projects weren't in that page left the list empty with no way to load more. Use the org-scoped projects query instead, keyed on the selected org, and fix project search to match by name. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Project selection now displays projects belonging to the currently selected organization. * Switching organizations refreshes the available project list, preventing projects from another organization from appearing. * **Tests** * Added coverage for organization-specific project loading, organization switching, pagination, and empty project lists. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Small update of the Projects overview UI to resolve the competing CTA's as well as alignment. Open to tweak a little more here. | Before | After | |--------|--------| | <img width="1287" height="346" alt="Screenshot 2026-09-01 at 15 08 33" src="https://github.com/user-attachments/assets/a0911d8c-7be9-4a70-ab37-8842093423c9" /> | <img width="1252" height="430" alt="Screenshot 2026-09-01 at 15 05 40" src="https://github.com/user-attachments/assets/cd75a8bd-9378-483b-96b8-2272a9990b4c" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Refined the plan usage card layout with larger metric values and cleaner labels. * Added dividers between usage metrics for improved readability. * Simplified card and loading-state styling by removing unnecessary borders, backgrounds, and padding. * Updated the upgrade button’s visual treatment. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES/NO ## What kind of change does this PR introduce? Bug fix, feature, docs update, ... ## What is the current behavior? Please link any relevant issues here. ## What is the new behavior? Feel free to include screenshots if it includes visual changes. ## Additional context Add any other context or screenshots. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added Warda Bibi to the team member list. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? docs update <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added Dion Zeneli to the alphabetical list of Supabase team members in the project’s public team information. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
github-actions
Bot
added
the
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )