[pull] master from supabase:master by pull[bot] · Pull Request #961 · code/lib-supabase

pull · 2026-05-28T16:13:08Z

See Commits and Changes for more details.

Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

## Problem <img width="720" height="796" alt="image" src="https://github.com/user-attachments/assets/830530e2-d0a0-49cd-a036-85fce7ec9bc3" /> ## Solution <img width="706" height="808" alt="image" src="https://github.com/user-attachments/assets/1170eb0f-89a5-4642-98e9-7e9349312bc0" /> ## How to test - Fixed: https://zone-www-dot-86t6fdcat-supabase.vercel.app/blog/supabase-series-a - Fixed: https://zone-www-dot-86t6fdcat-supabase.vercel.app/blog/supabase-enterprise - Should work as before: https://zone-www-dot-86t6fdcat-supabase.vercel.app/company - Should work as before: https://zone-www-dot-86t6fdcat-supabase.vercel.app/ga  ## Summary by CodeRabbit * **Style** * Updated styling classes in the image grid component for improved consistency and layout alignment.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46451?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

Adds documentation for Passkey registration and authentication flows.

## Problem In the unified logs UI, the status badge for a Postgres row showed a different color in the detail view than in the table view. The table view colors by the row's pre-computed `level` (derived in SQL from `severity_text`), so a Postgres ERROR row's SQL state code (e.g. `42P01`) renders red. The detail view re-derived the level via `getStatusLevel(value)` which only handles HTTP numeric codes. `Number('42P01')` is `NaN`, every branch fell through, and the badge always rendered neutral regardless of severity. ## Fix Color the status badge in the detail view by `data.level`, the same canonical row level the table view uses. Threaded `level` through `FieldValue` and used `data.level` directly in `BlockField`. `getStatusLevel` is still used by the Webhooks platform views, where `responseCode` is always a numeric HTTP status, so those callers stay correct. ## How to test - Open the dashboard and navigate to a project's unified logs page. - Filter to `log_type: postgres` and find an ERROR row. - Confirm the status code (a SQL state like `42P01`) is colored red in the table. - Click the row to open the detail pane and confirm the Status field in the Postgres block is also red. - Repeat with a WARNING-severity Postgres row, confirming both views render warning color. - Sanity check a 5xx HTTP row (PostgREST or Storage) still shows red in both views, and a 2xx row stays neutral in both.  ## Summary by CodeRabbit * **Refactor** * Improved consistency in how log level context is propagated through logging interface components, enabling more uniform formatting and rendering behavior across the unified logs display.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46450?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

@jordienr

## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Right now our tests for API mocking is using vi.mock and mocking that query or fetch handler. This is not the right approach IMO, 2 years ago @jordienr added MSW with some very powerful helpers. The idea is to move component test that rely on API using MSW within ViteTest. Principles are simple: - Mock API responses - Mount your component that uses API responses - Tests and assert on UI - Added Skill for Clanker This pattern is 100 times better than what we have  ## Summary by CodeRabbit * **Tests** * Expanded and strengthened test suites for secrets, org lookup, support flows, OAuth auth, and onboarding; mocks now use contract-backed responses for more realistic coverage. * **Documentation** * Added a comprehensive guide describing a standardized pattern for component tests that mock network requests. * **Chores** * Improved test helpers, typing for API mocks, and test runner configuration for more reliable and maintainable tests.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46439?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   --------- Co-authored-by: Alaister Young <alaister@users.noreply.github.com> Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>

## Problem The Swap usage chart in the database report (Observability > Database) displays inaccurate data. ## Fix Set the swap-usage chart's `hide` flag to `true` in [`database-charts.ts`](apps/studio/data/reports/database-charts.ts) so it no longer renders. The chart definition is kept so it can be re-enabled once the underlying metric is reliable. ## Test plan - [ ] Open Observability > Database report and confirm the Swap usage chart is no longer shown - [ ] Confirm other charts (Memory, CPU, Disk, etc.) continue to render 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Bug Fixes** * Corrected the visibility of the swap usage chart in reports—it is now properly hidden from display.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46465?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

## TL;DR fixes delete titles getting dropped in queue, cron job, hook, function, and replication dialogs ## ref: - closes #46446 - extends #46428  ## Summary by CodeRabbit * **Bug Fixes** * Fixed alert title display in confirmation dialogs to ensure titles render correctly with proper prop alignment.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46447?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

## Context Original task was to support searching `!=` on `event_message`, but this PR addresses some things regarding searching on `event_message` in unified logs that I found while working on this. ### `=` and `!=` are technically inaccurate We're doing pattern matching when searching on event_message rather than a strict equality check, so a more accurate operator would be `ilike (~~*)` and `not ilike(!~~*)` - both of which would be case insensitive for easier checking. Am thus swapping to use these 2 operators when filtering on `event_message`: <img width="430" height="134" alt="image" src="https://github.com/user-attachments/assets/c8a320b6-e016-44ae-aed0-1e7b6cefbda9" /> ### Filtering on `event_message` was never server side It seems like we have been only doing client side searching on `event_message` which is inaccurate as we're only filtering against rows that are on the current page. The `event_message` filtering was never appended to the URL state as well so the changes in this PR ensures that all search including `event_message` is server side. ### Rework on unified logs filtering via URL params Because we're now supporting more than just `=` in unified logs, the current filter system is insufficient (e.g can't just be `status=x&method=y`). Am opting to use the same system as per how we do filtering in the table editor where search params follow the syntax: `{column}:{operator}:{value}` <img width="521" height="46" alt="image" src="https://github.com/user-attachments/assets/54e72eb2-1581-4c1a-910e-58d993da1766" /> ## To test - [ ] Verify that searching for logs in unified logs still works - [ ] Verify that searching against event_message in unified logs works as expected (both ilike and not ilike)  ## Summary by CodeRabbit * **New Features** * Repeatable URL-based column filters with operator support (e.g., equals, not-equals, pattern matching). * Expanded pattern-style operators for message searches (case-insensitive/contains, negation). * **Improvements** * Unified filter handling across logs list, charts, and counts for consistent results. * Range/slider filters and pagination remain supported and round-trip via URL parameters.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46457?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

## Context Opting for just a loading spinner as the skeleton loader for charts <img width="1468" height="952" alt="image" src="https://github.com/user-attachments/assets/d6c291c8-9151-40c8-bfbe-f838431dd6dc" />  ## Summary by CodeRabbit * **New Features** * Added a loading spinner to the unified logs view that displays while logs are being fetched, providing clear visual feedback during data retrieval.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46460?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

…ment (#8) (#46466) ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / security hardening — continues the analytics SQL provenance-tracking series (PR 8). ## What is the current behavior? - `generateRegexpWhere` (unsafe: interpolates user-controlled filter keys/values without escaping) still exists alongside `generateRegexpWhereSafe` and its tests only cover the old function. - `usePostgrestOverviewMetrics` builds a SQL query string with plain string interpolation and calls the analytics endpoint directly via `get()`. - `edge-functions-last-hour-stats-query` builds a SQL query with `functionIds` escaped via Postgres-only `quoteLiteral` and calls the analytics endpoint directly via `post()`. - `executeAnalyticsSql` has no way to pass a `key` query-string param for network-tool identification. - `rawSql('minute')` / `rawSql('hour')` / `rawSql('day')` and `rawSql(value ? 'true' : 'false')` are used for static strings that could be expressed with the `safeSql` template tag. ## What is the new behavior? - `generateRegexpWhere` is deleted; its tests are replaced with `generateRegexpWhereSafe` coverage including injection-attempt cases (`level OR id IS NOT NULL`, `request.method); DROP TABLE edge_logs; --`) that verify predicates are silently dropped rather than emitted. - `usePostgrestOverviewMetrics` returns `SafeLogSqlFragment` from its SQL builder and routes through `executeAnalyticsSql`. - `edge-functions-last-hour-stats-query` uses `analyticsLiteral` (BigQuery/ClickHouse-correct escaping) instead of `quoteLiteral` (Postgres-only) and routes through `executeAnalyticsSql`. - `executeAnalyticsSql` accepts an optional `key?: string` forwarded as a query-string param on both GET and POST requests; `key: 'last-hour-stats'` is restored on the edge-functions query. - Static `rawSql('...')` calls replaced with `safeSql\`...\`` template literals throughout. ## Additional context  ## Summary by CodeRabbit ## Bug Fixes - Removed legacy unsafe SQL-filter utility from Reports ## Chores - Enhanced analytics SQL execution infrastructure with improved error handling - Added optional request identification parameter to analytics query execution - Refined SQL filtering mechanisms in reporting features  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46466?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

## Context Addresses DEBUG-126 Making some adjustments to the service flow panel in unified logs - Row action will be via a `...` button instead of the whole row <img width="487" height="207" alt="image" src="https://github.com/user-attachments/assets/cd0f6d41-aace-41c2-872b-60071fd6b986" /> - Fields with no values will show a `-` (previously didn't show anything) <img width="501" height="130" alt="image" src="https://github.com/user-attachments/assets/3b62c44e-7fd9-497b-8261-ca5e1c975bc2" /> - Opting to close the dropdown menu when scrolling to prevent overflow of the dropdown menu content with the parent component - However, IMO this needs to be addressed at the UI component level RE how we want to handle dropdown menu content when scrolling. The content is portalled hence why its happening - (Not user facing) Clean up usage of `FieldValue` and `DataTableSheetRowAction` - Was confusing to be passing `value` as a react node when declaring `DetailRow` from `PostgresFlowDetail` and `Block` - Opting to render the UI inside `DetailRow` instead, which gives us better control on the UI  ## Summary by CodeRabbit * **Bug Fixes** * Dropdown menus now close when the page is scrolled while open. * **Improvements** * Cleaner, more consistent log value formatting and status code display. * Loading placeholders for log fields are handled more consistently. * Dropdown content area widened for better visibility. * Row actions only appear when a value is present; copy action shown as fallback. * **UI Behavior** * Collapsible section headers receive improved layout, transition, and hover styling.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46462?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

## Context Just removing unified logs related dead code (Not used, not imported)  ## Summary by CodeRabbit * **Refactor** * Streamlined the Service Flow view by removing legacy timeline, collapsible sections, and some detailed step UI for a cleaner visualization. * Simplified the Unified Logs surface by reducing exposed types, consolidating query logic, and removing an internal event bus. * Removed legacy list/detail and sheet UI pieces to tighten the logs interface and public API surface.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46459?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

#46415) Studio is on `react@^19.2.6`, and `useEffectEvent` shipped stable in React 19.2 with the same signature as the userland polyfill. This drops the local hook in `apps/studio` and `apps/www` in favor of the built-in. **Removed:** - `apps/studio/hooks/useStaticEffectEvent.ts` - `apps/www/hooks/useStaticEffectEvent.ts` - `.claude/skills/use-static-effect-event/` — skill is obsolete **Changed:** - 26 call sites: dropped the `useStaticEffectEvent` import, added `useEffectEvent` to the existing `react` import, renamed call sites - `.claude/CLAUDE.md`: `apps/studio` row updated React 18 → React 19 - `.claude/skills/vercel-composition-patterns/SKILL.md`: removed stale "Studio uses React 18, skip these patterns" warning ## To test - `pnpm typecheck --filter=studio` — passes locally - `pnpm typecheck --filter=www` — passes locally - `grep -rn "useStaticEffectEvent"` returns nothing outside `node_modules` - Smoke-test areas that use the hook: schema visualizer edges (intersection check), spreadsheet import, sign-in/CLI login flows, side panels with unsaved-changes prompts **Out of scope:** pre-existing Tailwind lint warning on `DefaultEdge.tsx:141` (`outline` + `outline-1` conflict) — unrelated to this migration  ## Summary by CodeRabbit * **Refactor** * Internal event handling migrated to React’s built-in event hooks across the Studio app; no user-facing changes. * **Documentation** * Clarified React 19 compatibility and noted Studio now targets React 19. * Removed obsolete documentation for a deprecated internal hook.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46415?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>

## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Chore, CI hardening ## Additional context Hardens all GitHub actions to recommendations of [zizmor](https://docs.zizmor.sh/audits/)  ## Summary by CodeRabbit * **Chores** * Disabled persistence of checkout credentials across many CI workflows to reduce credential exposure. * Upgraded GitHub App token tooling and tightened generated token permissions for automation. * Added cooldown/rate-limiting to dependency update automation to reduce update churn. * Adjusted workflow-level permissions, required secret inputs for workflow callers, and refactored some job step logic.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46454?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   --------- Co-authored-by: Ali Waseem <waseema393@gmail.com>

## What kind of change does this PR introduce? Feature. Resolves FE-3470. ## What is the current behavior? Organization surfaces have a `G then ,` shortcut to enter org settings, but once inside there is no keyboard navigation, sidebar tooltips, or action shortcuts for the various org pages. | Area | Current behaviour | | --- | --- | | Org Settings sidebar | Routes are click-only once users are inside Settings. | | OAuth Apps | Publish / confirm actions have no keyboard shortcuts. | | Private Apps | Create app has no keyboard shortcut. | | Team | Invite / send actions have no keyboard shortcuts. | | Integrations | Add project connection has no keyboard shortcut. | | Org Projects | New project and search have no keyboard shortcuts. | | Audit Logs | Refresh has no keyboard shortcut. | ## What is the new behavior? Mirrors the Project Settings shortcut pattern (#46352) across all Organization surfaces. | Area | New shortcut coverage | | --- | --- | | Org Settings sidebar | `S then G/C/S/A/P/W/L/D` for General, Security, SSO, OAuth apps, Private apps, Webhooks, Audit logs, Legal documents. Shortcut badge appears on hover in the sidebar. | | Org Settings entry | `G then ,` (remapped from `G then O`) to match the Project Settings chord. | | OAuth Apps | `Shift+N` opens Publish app panel; `Mod+Enter` confirms the open panel. | | Private Apps | `Shift+N` opens Create app sheet (works in both empty-state and list-state). | | Team | `Shift+N` opens Invite members dialog; `Mod+Enter` sends the invitation(s). | | Integrations | `Shift+N` triggers Add project connection when permitted. | | Org Projects | `Shift+N` navigates to new project; `Shift+F` focuses the search input. | | Audit Logs | `Shift+R` refreshes the log list. | ### Implementation notes - Threads `shortcutId` through the `WithSidebar` pipeline (`SidebarLink` → `SubMenuSection` → `ProductMenuGroup`) so tooltip display is automatic — no new rendering logic. - Layout-scoped chords mount only while `OrganizationSettingsLayout` is active, so `S then G` in org settings does not conflict with `S then G` in project settings. - Cheatsheet reference groups promoted to typed constants with readable labels (was: bare strings like `'org-oauth-apps'`).  ## Summary by CodeRabbit * **New Features** * System-wide keyboard shortcuts for org areas: project search & new project, private app creation, OAuth app publish/confirm, add GitHub integration, invite members (open/submit), and refresh audit logs. * Sidebar and product menu now show assigned shortcuts for faster navigation; org settings navigation shortcut remapped. * **Tests** * Added coverage for org shortcut registry behavior, sequences, and ordering. * **Chores** * New shortcut reference groups and ordering for improved discoverability.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46356?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Ali Waseem <waseema393@gmail.com>

## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor (naming consistency cleanup). ## What is the current behavior? `ReportQueryLogs` exposed its SQL builder under a `sql:` field while `ReportQueryDb` used `safeSql:`. Both already returned branded fragments (`SafeLogSqlFragment` / `SafeSqlFragment`), so should consolidate on `safeSql`. ## What is the new behavior? Renames `sql:` → `safeSql:` on `ReportQueryLogs` so the two report-query shapes use the same field name. Updates every Logs preset under `PRESET_CONFIG[API|STORAGE]`, every entry and call site in `SharedAPIReport.constants.ts`, and `getLogsSql` in `Reports.utils.tsx`. Part of the analytics SQL safety series; PRs 10 (remaining analytics callers) and 11 (ESLint rules) still to follow. ## Additional context  ## Summary by CodeRabbit * **Refactor** * Enhanced query handling across API analytics reports (requests, top routes, errors, performance metrics) and Storage analytics reports (cache metrics) for improved consistency in query processing.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46469?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

djhi and others added 15 commits May 28, 2026 12:17

feat(docs): passkey registration and authentication (#46340)

d9d6a42

Adds documentation for Passkey registration and authentication flows.

pull Bot locked and limited conversation to collaborators May 28, 2026

pull Bot added the ⤵️ pull label May 28, 2026

pull Bot merged commit edf946a into code:master May 28, 2026
1 of 17 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[pull] master from supabase:master#961

[pull] master from supabase:master#961
pull[bot] merged 15 commits into
code:masterfrom
supabase:master

pull Bot commented May 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

Conversation

pull Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

pull Bot commented May 28, 2026 •

edited

Loading