[pull] master from supabase:master - #1214
Merged
Merged
Conversation
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Improvement in docs ## What is the current behavior? Not shown ## What is the new behavior? Displays min / max when available in OpenAPI specs for integers and numbers ## Additional context <img width="630" height="183" alt="image" src="https://github.com/user-attachments/assets/eb4e917a-d961-456c-810a-cba6aa2b0388" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * API reference documentation now displays minimum and maximum constraints for numeric schema parameters, including `number` and `integer` types. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
The /sign-in page emitted only a pageview on entry and the success-side `sign_in` event on exit: failed or abandoned attempts were invisible, so "never interacted" and "tried and failed silently" could not be told apart in the sign-in funnel. I added an unsampled `sign_in_submitted` event at every initiation point and classified failure capture via `dashboard_error_created` with a new `signin` origin. **Changed:** - **Submit attempts observable**: `sign_in_submitted` (method: `email`, provider id, `sso`, or partner) fires from the DOM submit handler on the password and SSO forms (so submits that fail client-side validation still count), and from the OAuth, custom-provider, and partner initiation handlers. - **Failures classified**: each sign-in error path feeds the existing funnel-error pipe with origin `signin` and a controlled reason slug (`invalid_credentials`, `email_not_confirmed`, `captcha_failed`, `sso_provider_not_found`, ...). GoTrue auth errors now classify via their numeric `status`, guarded so transport failures (`status: 0`) stay `network_error`. - **Attempt events survive the OAuth redirect**: the telemetry event POST sends with `keepalive` (scoped to `sign_in_submitted`, since keepalive requests share a per-page in-flight body quota), so a dispatched request is no longer aborted by the provider navigation; send rejections are caught centrally instead of surfacing as unhandled rejections. The fetch still dispatches after an async token lookup, so preview testing verifies the GitHub-path event actually lands on the wire. - **Captcha rejection is no longer silent**: a rejected hCaptcha challenge resolves the stuck loading toast with an error message, emits `captcha_challenge_failed` (distinct from `captcha_failed`, which stays reserved for the auth server rejecting a submitted token), reports to error monitoring, and resets the captcha widget (previously: unhandled promise rejection and a spinner that never resolved). - **Partner method validated**: the partner sign-in page resolves the URL-hash value against the provider registry and forwards the canonical provider id into `method` on both `sign_in_submitted` and `sign_in`; anything unregistered records as `unregistered_partner`, so a crafted link can't poison the breakdown on either event. **Note:** failure events stay on the shared 10% `dashboard_error_created` sampling rate (a per-origin carve-out would break cross-source volume comparability); the unsampled attempt event carries the tried-vs-never-interacted signal at full volume. ## To test Tested on Vercel preview (studio-staging, wire-level network capture + staging ingestion check): - [x] On `/sign-in`, submit a bogus email + password: expect a `POST */platform/telemetry/event` request with `action: sign_in_submitted`, `method: email` in the network tab, plus an error toast. Observed: 201, auth returned 400 as expected. - [x] Submit with an empty password: expect `sign_in_submitted` to still fire (validation failures count as attempts). Observed: event fired with 201 and no auth call followed. - [x] Click "Continue with GitHub": expect `sign_in_submitted` with `method: github` on the wire before the provider redirect. Observed: the POST completed (201) before the browser landed on github.com, so the keepalive path holds. - [x] Negative case: fresh page load with no interaction fires no `sign_in_submitted`. - [x] Ingestion: all fired events (methods `email`, `github`, plus organic `sso` submits from a real login on the same preview) arrived in the staging project with the expected properties. - [x] Re-ran the email and GitHub paths on the scoped-keepalive build (`129bf8d`): both `sign_in_submitted` POSTs returned 201 (the GitHub one completed despite the provider redirect), and both events ingested into the staging project with the expected `method`/`category` properties. ## Linear - GROWTH-1165 (no `fixes` keyword on purpose: the evidence checks run on prod data post-deploy, and the issue closes manually after they pass) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved sign-in protection with more reliable invisible CAPTCHA handling. * Added sign-in submission tracking across password, SSO, partner, custom OAuth, and external-provider flows. * Added detailed classification for authentication, validation, CAPTCHA, provider, and network errors. * **Bug Fixes** * Sign-in now stops safely and resets CAPTCHA when verification fails. * Improved error reporting for failed sign-in attempts, including redirects and OAuth flows. * Ensured sign-in telemetry is delivered reliably during OAuth redirects. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Wire middleware sdk docs (`@supabase/middleware`) https://github.com/supabase/middleware Preview ref here: https://docs-git-docs-supabase-middleware-sdk-supabase.vercel.app/docs/reference/middleware/introduction <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a Middleware SDK reference section to the documentation. * Added installation guidance for npm, Yarn, pnpm, Deno, and Bun. * Documented framework-agnostic middleware composition, typed shared context, ordering, trust, and environment access across supported runtimes. * Added Middleware documentation to navigation and search. * Identified the Middleware SDK as an alpha release. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES/NO ## What kind of change does this PR introduce? Bug fix, feature, docs update, ... ## What is the current behavior? Please link any relevant issues here. ## What is the new behavior? Feel free to include screenshots if it includes visual changes. ## Additional context Add any other context or screenshots. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added Tomohiro Mitani to the project’s team listing. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…9891) ### What is the current behavior? Fixes FE-4056. In the Storage Explorer, if you edit a bucket's access level (public/private) via "Edit bucket", the "Get URL" action keeps generating the old signed/public URL type. Clicking the in-explorer refresh button doesn't fix it either, since it only re-lists objects and never refetches bucket metadata. Only a full browser reload resolves it. ### What is the new behavior? selectedBucket in the Storage Explorer's Valtio store is now kept in sync with the bucket query on every change, not just on project switch. "Get URL" now always reads the current public/private state, so it correctly returns a public URL or a signed URL immediately after the bucket's access level is changed - no reload required. ### Additional context Added a second effect to sync selectedBucket whenever the bucket query value changes. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated bucket selection state when bucket settings change, preventing stale bucket information in actions such as “Get URL.” <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem The Workers view can remain stale after a worker is deployed through the CLI, because the dashboard has no deployment mutation to invalidate its list query. ## Fix Add a manual Refresh action to the Workers header and force the Workers list query to refetch whenever the browser regains focus. ## How to test - Open a project’s Workers view and select Refresh. - Expected result: the list requests current worker data and renders it. - Deploy a worker through the CLI, then return focus to the Workers view. - Expected result: the Workers list refreshes even when its cached data is fresh. Closes FE-4323. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added Refresh buttons to the Workers page and worker list. - Refreshing displays the latest worker information and shows a loading state while data is retrieved. - Worker data now automatically refreshes when the browser window regains focus. - Added a Refresh action to unexpected-error messages, allowing failed requests to be retried without leaving the page. - **Bug Fixes** - Improved recovery from failed worker data requests through in-page retry support. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…buttons (#49898) ## Summary Add PostHog event tracking for the two new buttons introduced in PR #49698 that allow users to temporarily switch between the Explorer and SQL Editor: * **Explorer button**: "Back to SQL Editor" button in the Explorer sidebar title bar now fires `explorer_temp_access_sql_editor_clicked` event * **SQL Editor button**: "Back to Explorer" button in the SQL Editor title bar (shown during temporary visits) now fires `sql_editor_back_explorer_clicked` event Both event interfaces follow the repo's telemetry-standards conventions, carrying only `groups: TelemetryGroups` property with no additional custom properties. ## Test plan - [X] Verify `explorer_temp_access_sql_editor_clicked` event fires in PostHog when clicking "Back to SQL Editor" button in Explorer - [X] Verify `sql_editor_back_explorer_clicked` event fires in PostHog when clicking "Back to Explorer" button in SQL Editor - [X] Run typecheck: `pnpm typecheck` passes without errors - [X] Run lint: `pnpm lint --filter=studio` passes ## Issue Resolves [FE-4213](https://linear.app/supabase/issue/FE-4213/explorer-set-up-telemetry-for-metrics-where-appropriate) ## Summary by CodeRabbit * **Analytics** * Added tracking for navigation from the Explorer to the SQL Editor. * Added tracking for returning from the SQL Editor to the Explorer.
…49904) High Availability projects run Multigres and don't have Supavisor, so the Shared Pooler (Supavisor) client connections chart in the database report only ever rendered an "Unable to load data" error for them. This hides the chart for HA projects, following the same pattern as the Disk IO Burst Balance chart. **Changed:** - `supavisor-connections-active` chart is now hidden when `project.high_availability` is true **Added:** - Unit tests covering the shared pooler chart's visibility for standard, HA, and unentitled projects ## To test - Open Reports → Database on a High Availability project – the Shared Pooler (Supavisor) client connections chart should no longer appear - Open the same report on a standard Pro project – the chart should still render as before <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * The active connection chart is now hidden for High Availability projects and projects without the database entitlement, preventing empty or unavailable data from being displayed. * **Tests** * Added coverage to verify the chart appears only for eligible standard projects. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## Summary Fixed a bug in the AI Assistant notebook-update proposal preview where a `replace_cell` operation that only changed a cell's view (table ↔ chart) or chart parameters (type, x/y columns, cumulative, scale, labels) would show as a "Replaced" row but the expanded diff would appear empty. **Root cause:** The diff editor only compared the cell's SQL text; view and chart configuration were never considered, so changes to those aspects showed no diff. **Solution:** * Refactored `getCellMetadata` to return structured `NotebookCellFields` with separate `source` (database/time range) and `view` (table/chart) fields instead of a single concatenated string * Added `formatChartConfig` and `formatCellView` helpers to describe chart cells * Updated `getEntryMetadata` to diff source and view independently, showing only the fields that actually changed (e.g., "Table → Chart (bar, ...)" when only the view changed, with the unchanged database omitted) * If neither field changed, metadata is hidden entirely ## Test plan * Added test cases for: chart-view cells reporting a `view` field, view-only changes surfacing without the unchanged database, chart-parameter-only changes surfacing without the unchanged database, database-only changes surfacing without the unchanged view, and fully-unchanged replacements hiding metadata entirely * All 43 tests in the touched test file pass * `tsc --noEmit` on apps/studio shows no new type errors ## Summary by CodeRabbit * **Enhancements** * Improved AI Assistant notebook previews with clearer cell details, including source content and table or chart views. * Chart previews now show key configuration details, such as chart type and selected dimensions * Replacement previews highlight only the fields that changed and hide entries with no visible changes. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Notebook previews now distinguish cell content from its view, including table and chart details. * Chart previews display relevant configuration, such as chart type and axes. * Log previews include their formatted time range. * Replacement previews now show only the fields that changed. * **Bug Fixes** * Unchanged replacements are now hidden instead of displaying misleading content. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem Workers log views were limited to the most recent 24 hours and could not be narrowed by event text or HTTP method. ## Fix Adds selectable time ranges, event-message search, and an HTTP-method filter for invocation logs. Filters are applied in the analytics query and included in the cache key. ## How to test - Open a worker and select the Invocations tab. - Change the time range, enter an event message, and select a method. - Expected result: only matching invocation logs are shown. - Open Logs or Activity. - Expected result: message and time filters are available; the method filter is hidden. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added worker log filtering by date range and event message. * Applied a default 24-hour time range to log searches. * Improved filter controls and updated empty-state messaging to reflect the selected range. * **Bug Fixes** * Improved filtering accuracy and safer handling of special characters in event messages. * **Tests** * Added coverage for date-range and message-filter query behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem The dashboard's Workers snippets said that the CLI could only deploy public Workers and generated the obsolete access configuration field. ## Fix Use the CLI and backend exposure field in generated config, CLI, and AI snippets so private Worker deployments are supported. ## How to test - Run: pnpm --filter studio test components/interfaces/Workers/workerSnippets.test.ts - Expected result: all 11 tests pass, including private Worker snippets using --exposure private. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Improvements** - Worker deployment snippets now pass the selected exposure setting directly to the CLI. - Generated `config.toml` files now use the `exposure` setting. - AI deployment guidance now documents the exposure flag, helping clarify deployment configuration. - **Changes** - Removed the previous private-worker warning and public-only deployment note from deployment guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. Yup 🫡 ## What kind of change does this PR introduce? This PR adds my name, `Safa Orhan`, to humans.txt ## What is the current behavior? `humans.txt` does not have my name :( ## What is the new behavior? `humans.txt` has my name! Yaay! <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Added Safa Orhan to the alphabetical team member list. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Safa <safa@Safa-M5-Pro.local>
github-actions
Bot
added
the
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )