[pull] master from supabase:master - #1128
Merged
Merged
Conversation
…48221) ## What kind of change does this PR introduce? Bug fix / a11y cleanup ([DEPR-629](https://linear.app/supabase/issue/DEPR-629)). ## What is the current behavior? `apps/studio/styles/globals.css` still styles `.form-group` / `.form-control` inputs with a legacy soft green focus glow (`box-shadow: … rgba(62, 207, 142, …)` plus `ring-current`). That can fight modern focus rings if those classes are ever present. ## What is the new behavior? Those legacy focus rules are removed. Matching inputs use `@apply focus-ring` instead. | Before | After | | --- | --- | | <img width="882" height="246" alt="CleanShot 2026-07-31 at 13 28 42@2x" src="https://github.com/user-attachments/assets/3aa00e2f-918f-4e72-9db0-4ad75864cc58" /> | <img width="864" height="244" alt="CleanShot 2026-07-31 at 13 28 57@2x" src="https://github.com/user-attachments/assets/4a96439d-16de-4ebb-ab07-2ae7cbf46c0b" /> | ## To test These CSS selectors are legacy. Easiest before/after is a one-line probe in the browser. 1. Open the **Studio preview** for this PR (and, for comparison, production Studio or `master`). 2. Go to any project (any page is fine). 3. Open DevTools → Console and paste: ```js document.body.insertAdjacentHTML( 'beforeend', `<div class="form-group" style="position:fixed;right:16px;bottom:16px;z-index:9999;padding:12px;background:var(--background);border:1px solid var(--border);border-radius:8px"> <label style="display:block;margin-bottom:8px">Legacy form-group probe</label> <input type="text" value="Tab to me" /> </div>` ) ``` 4. Click the injected input (or Tab to it). | | Focus look | | --- | --- | | **Before** (production / `master`) | Soft **green** halo | | **After** (this PR) | Shared **`focus-ring`** only (no green glow, no double stack) | Optional smoke (no visual change expected): **Project Settings → General → Project name** — Tab into the field; normal shared focus ring still works. ## Additional context - Related: #41575, DEPR-628
…enabled yet (#48518) ## Context Addresses 2 issues found for the Replication UI - "Disable Pipelines" CTA was still being shown despite Pipelines not being enabled yet - Opting to show the "Enable Pipelines" CTA instead in this case, which will open the `EnablePipelinesModal` <img width="269" height="162" alt="image" src="https://github.com/user-attachments/assets/41e5ec7d-11b1-4008-ae9d-64def00329eb" /> - Fixes "Disable Pipelines" being incorrectly disabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added options to enable or disable Pipelines directly from the replication destinations menu. * Added an enablement modal with messaging and upgrade actions based on available access. * Added support for opening the Pipelines modal through external controls. * **Bug Fixes** * Corrected action disabled states and destination-removal guidance. * Improved error handling when disabling Pipelines, including a reliable fallback message. * Refined modal and dialog layout spacing for a more consistent presentation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
… for Multigres (#48433) Multigres (high-availability) projects only accept TLS connections with direct SSL negotiation, and they don't support connection pooling at all — neither Supavisor nor the dedicated PgBouncer pooler exists for them. Studio previously showed pooler connection strings that would fail with "server closed the connection unexpectedly". This PR makes every connection-string surface direct-only for HA projects and appends `?sslmode=require&sslnegotiation=direct` to the examples. Non-HA projects are unchanged. Addresses [FE-4019](https://linear.app/supabase/issue/FE-4019/append-ssl-params-to-multigres-connection-string-examples-in-ui) **Changed:** - `buildConnectionStringPooler` gets an HA branch that collapses every slot in the bag to the direct connection string with the SSL params appended (mirroring the existing CLI branch, which also has no pooler) — dedicated slots come back `undefined` and `ipv4SupportedForDedicatedPooler` is forced off. Since HA never reaches the pooler layout anymore, the earlier per-URI SSL-append logic on pooler strings is removed - `useConnectState` coerces `connectionMethod` to `direct` and `useSharedPooler` to `false` for HA projects. The Connect sheet restores the last-used method from localStorage shared across projects, so a "Transaction pooler" selection made on a regular project could otherwise leak pooler-flavored notices, badges, and telemetry into an HA project - Prisma and Drizzle ORM tabs get an HA branch: `DATABASE_URL`/`DIRECT_URL` both use the direct connection, no `?pgbouncer=true` appended, with a comment explaining Multigres doesn't support pooling. The 5-arm nested ternaries in both files are flattened into `getEnvCode` helpers that switch on a shared `resolveOrmConnectionScenario` helper (`OrmConnection.utils.ts`), so the deployment-mode/HA branching lives in one tested place and each file keeps only its own formatting - The PgBouncer and Supavisor config queries are disabled (`enabled: !isHighAvailability`) in the Connect sheet — those endpoints serve pooler config that doesn't exist on Multigres - `parseConnectionParams` keeps the URI's query string in a new `search` field so formats rebuilt from parsed parts can carry it - psql switches from the `-h/-p/-d/-U` flag form to the quoted-URI form when query params are present (flags can't express them; psql still prompts for the password) - JDBC appends the params using pgJDBC's casing (`sslNegotiation`, supported since 42.7.4) - Prisma's `?pgbouncer=true` appends are query-aware (join with `&` when the URI already has a query string) via a new `appendConnectionStringParams` helper - The project home "Direct connection string" copy item also appends the params for HA projects **Added:** - Unit tests for the HA collapse behavior (all slots direct, dedicated config and IPv4 add-on ignored, no SSL params on non-HA output), the `useConnectState` coercion, the psql/JDBC builders (moved from `content.tsx` into `ConnectionString.utils.ts` so they're testable), and `resolveOrmConnectionScenario` (every deployment-mode/HA/pooler branch) **Known gaps (left out deliberately):** - The grid ExportDialog psql/pg_dump commands, the .NET `appsettings.json` (Npgsql only supports direct negotiation from v9 via `SSL Negotiation=Direct`), and the SQLAlchemy keyword-style `.env` are flag/keyword forms that can't carry the URI params — these would still fail against Multigres and need a follow-up - Settings > Database's Connection Pooling section and the pooler logs page have no HA gating yet — they'd still render pooler config UI for a Multigres project and should be hidden in a follow-up ## To test On a **Multigres (HA) project** (staging only supports `us-east-1` for Multigres): - Open the Connect sheet → Direct tab: there's no connection-method picker, and the connection string is the direct one ending with `?sslmode=require&sslnegotiation=direct` for the URI, PHP, and psql (quoted-URI form) types; JDBC includes `&sslmode=require&sslNegotiation=direct` - ORM tab → Prisma: both `DATABASE_URL` and `DIRECT_URL` are the direct connection string with the SSL params, no `pgbouncer=true`, with a "Multigres does not support connection pooling" comment. Drizzle likewise shows the direct string only - Framework tabs (e.g. Next.js): every `DATABASE_URL` carries the direct string with the params exactly once - Open the network tab: no requests to `/config/pgbouncer` or `/config/supavisor` while using the Connect sheet - To check the localStorage coercion: on a **regular** project pick "Transaction pooler" in the Connect sheet, then open the sheet on the Multigres project — no pooler badge/notices, string is still direct - Copy the URI, substitute your password, and `psql "<string>"` — it should connect - Project home → Copy dropdown → "Direct connection string" includes the params On a **regular (non-Multigres) project** — confirm nothing changed: - Connect sheet: direct/session/transaction strings for all connection types (URI, psql flag form, JDBC, PHP) look the same as before, no SSL params appended - Prisma/Drizzle tabs render identically (`?pgbouncer=true` still appended with `?`, dedicated-pooler alternatives still shown per IPv4 add-on state) - Project home copy dropdown is unchanged <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced connection-string generation for high-availability projects, including required SSL settings for direct connections. * Preserved URI query parameters in PostgreSQL, `psql`, JDBC, and generated environment configurations. * Improved ORM environment templates with clearer handling for pooler and high-availability connection scenarios. * **Bug Fixes** * High-availability projects now consistently use direct connections instead of pooler options. * Connection strings and generated templates update correctly when availability settings change. * **Tests** * Expanded coverage for query parameters, high-availability behavior, and connection scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## Context Adds support for branching off from an Assistant's Response - which creates a new chat with all the previous messages including from where we're branching off from <img width="204" height="97" alt="image" src="https://github.com/user-attachments/assets/0b171ae6-f2b4-4b58-87fa-0010ad45f777" /> Branched conversations will have an indication of where it was branched off from <img width="404" height="427" alt="image" src="https://github.com/user-attachments/assets/bed8502f-3f83-4f76-bc00-feac86fa57a6" /> ## Other changes - Also added support for copying an Assistant's Response <img width="190" height="115" alt="image" src="https://github.com/user-attachments/assets/5e4aa0b8-eb6e-485f-80c0-3028b95720f7" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Branch conversations from assistant messages into a new chat. * View the originating conversation and navigate back to it. * Copy assistant message content with visual confirmation. * Access branching and copying actions from message controls. * **UI Updates** * Added “Branched from” indicators for branched conversations. * Updated the assistant disclaimer text to “The Assistant.” <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Currently it's an autogenerated name. We want users to explicitly enter a name for their authenticator so that: - They can remember that they took the action of registering an authenticator - They can see a meaningful name during sign-in if they have multiple TOTP authenticators <img width="536" height="269" alt="Screenshot 2026-07-30 at 16 05 10" src="https://github.com/user-attachments/assets/e43de27f-b4ca-4d4f-969a-578267eeebe4" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Bug Fixes** * Improved TOTP enrollment: confirmation is no longer enabled unless an authenticator app name is provided (validated beyond whitespace). * **UI Improvements** * Updated the authenticator app name label/description, added an example placeholder, and auto-focused the field when the confirmation step appears. * Refined the on-screen guidance for suggested authenticator apps (e.g., Google Authenticator or 1Password). <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Terms of Service v3 (effective August 1, 2026, #48482) incorporates the Data Processing Addendum by reference, and Legal asked for an in-app notice announcing the change. The subprocessor list page that the new Terms, DPA, and notice all point at was merged as an intentionally hidden draft (#48100) and never un-hidden. **Changed:** - **Dashboard ToS-update banner**: re-enables `BannerTOSUpdate` with the v3 copy provided by Legal (DPA incorporation, subprocessor list location, fees provisions). New expiry (August 29) and a new localStorage key, since anyone who dismissed the May v2 banner would otherwise never see this one. - **Subprocessor list page published**: removes `noindex,nofollow` and links the page from the Legal Hub index, so the page customers are told to subscribe on is actually discoverable. - **Studio e2e fixture updated**: the global Playwright fixture suppressed the banner via the old localStorage key; with the gate live again it would have rendered the banner into every e2e run. It now sets the new key. ## To test Verified on the Vercel previews : - [x] Studio: banner renders on dashboard load with the Notice badge and new copy; Learn more dialog shows the three changes with correct hrefs (DPA page, subprocessor list, /terms); Understood dismisses and persists across reload via `terms-of-service-update-2026-08-01` - [x] www: `/legal` lists Subprocessor List under Customer Legal Resources; `/legal/customer-resources/subprocessor-list` serves `robots` meta `index,follow` and renders the download button + subscribe form; zero console errors on all tested pages ## Linear - fixes GROWTH-1067 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a publicly accessible Subprocessor List to the legal resources. * Updated the Terms of Service notice to reflect the August 1, 2026 update, including data processing, subprocessors, fraud prevention, and consumer provisions. * **Documentation** * Made the Subprocessor List discoverable through standard search indexing and the legal resources page. * Extended the Terms of Service banner availability through August 29, 2026. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Terms of Service v3 (effective August 1, 2026, #48482) incorporates the Data Processing Addendum by reference, so customers no longer sign a separate DPA. Legal confirmed the PandaDoc signing flow can go; previously signed DPAs remain binding. This removes the frontend flow only. I'll remove the platform endpoint (`POST /platform/organizations/{slug}/documents/dpa`) separately once the PandaDoc contract conversation wraps. **Changed:** - **Dashboard DPA card no longer requests PandaDoc documents**: the Request DPA button and confirm modal are replaced with a View DPA link to the canonical legal page, with evergreen copy explaining the DPA is part of the Terms. Tracked via the same `document_view_button_clicked` event the other document cards use. - **Legacy `/legal/dpa` page retired**: the page told users to request a signed DPA from the dashboard, which no longer exists. It now permanently redirects to `/legal/customer-resources/data-processing-addendum` (the follow-up already flagged in #48483), and the footer link is removed. The `dpa_pdf_opened` and `dpa_request_button_clicked` events are removed with their last call sites. The latest privacy version links the canonical page directly; archived v1/v2 keep their original `/legal/dpa` link, served by the redirect. - **Orphaned DPA PDFs removed**: the four dated `Supabase+DPA+*.pdf` files under `/downloads/docs` had zero remaining references once the signing flow is gone. No redirect: nothing links these URLs, so they 404. - **Subscription tracking**: the subprocessor updates form now fires `www_subprocessor_updates_subscribed` on successful submit, so we can measure uptake of the notification list that replaces per-customer DPA emails. ## To test Verified on the Vercel previews (Playwright): - [x] Studio: `/org/_/documents` shows the DPA card with the incorporation copy and a working View DPA link (href = canonical page); no Request DPA button, no PandaDoc mention; TIA/SOC2/ISO27001/HIPAA cards unaffected - [x] www: `/legal/dpa` permanently redirects to `/legal/customer-resources/data-processing-addendum`; footer no longer shows DPA; zero console errors - [x] www: subscribing on the subprocessor page succeeds (200 from the form route, profile created with topic_4) and fires `www_subprocessor_updates_subscribed` (201 from the telemetry endpoint); test profile unsubscribed afterwards - [x] www: `/downloads/docs/Supabase+DPA+260601.pdf` returns 404 with no redirect; DPA card copy verified without the effective date ## Linear - fixes GROWTH-1068
## Summary - Adds four missing content cards to the existing `security.mdx` using the same `Section` component and grid already on the page — no new UI components or features - Cards added: **GDPR & European Compliance**, **Data Residency**, **Data Processing Agreement**, **Shared Responsibility** - Also fixes the HIPAA shared responsibility link path (`/deployment/` not `/platform/`) Worth validating still. ## What this is A content-only drop-in that addresses some gaps ## What's out of scope here - No sticky nav, tables, plan comparison grids, or new components - No DPA request automation — just a plain link to `/legal/dpa` - No plan-gating claims (removed — accuracy unconfirmed) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Reorganized the security page into clearer, grouped sections (Compliance, Data, Configuration, and Misc) for easier navigation. * Expanded compliance coverage with HIPAA, ISO 27001, GDPR & European compliance, and updated shared responsibility details. * Added new content for data residency and a Data Processing Agreement section. * Reordered configuration items (multi-factor authentication, role-based access, vulnerability management, DDoS) and moved payment processing into the Misc section. * Updated icons and card layout visuals throughout the page. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Nik Richers <nrichers@gmail.com>
## What Brings the C# client reference in line with `supabase-csharp` 1.5. The reference spec had drifted ~2 years and was missing most of the Auth, MFA, Admin, and Storage surface. ## Changes - **Fix example errors** in the v1 reference spec — corrected the `From<T>()`/`Table<T>()` model example, `ListenType` realtime enum, a mislabeled code fence, and other small mismatches. - **Backfill release notes** from 1.0.1 through 1.5.0, reconstructed by diffing the `Supabase.csproj` dependency pins across git tags and pulling highlights from each sub-package changelog. - **Document the undocumented API surface** (~27 new entries): Auth (anonymous, ID token, SSO, refresh, link/unlink identity, code exchange, reauthenticate, scoped sign-out), the full MFA API, the Admin API via `AdminAuth`, and Storage (`Copy`, signed URLs, signed uploads). - **Fix a latent bug**: the `ResetPasswordForEmail()` entry used a spec id that matched no canonical section, so it never rendered. Renamed to `reset-password-for-email`. ## Notes - All signatures verified against the 1.5 SDK source. - Entries render only when their spec id matches a slot in the shared `common-client-libs-sections.json`; ids were mapped against that set. - Spec YAML is Prettier-clean under the repo config. Closes SDK-1369. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added C# release notes covering versions 1.0.1–1.5.0. * Updated C# client documentation with current initialization patterns and expanded authentication, session, identity, PKCE, MFA, Realtime, Storage, and admin operation examples. * Added Storage examples for file copying, signed URLs, signed uploads, and uploads through signed URLs. * Corrected code samples and clarified scoped sign-out and password-reset guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…y if (#48432) ## Context Realised that if the project has a GH integration, but the user's account is not connected to GH - the branch validation in the "Sync with Git Branch" field will not work. The Edit branch modal also obfuscates the error being returned from the validation API so its not clear what the issue is <img width="500" alt="image" src="https://github.com/user-attachments/assets/739dfe7c-8920-4edf-a751-63d7f6273db4" /> Opting to show an "Authorize" CTA for this scenario so it's clear from the user's POV what to do (Refer to "To test" below for screenshots) ## To test - [ ] Verify that on an account which isn't connect to GH + project with no GH integration - CTA is as per normal ("Configure") which should direct you to the settings -> integrations page (Same for edit branch) <img width="500" alt="image" src="https://github.com/user-attachments/assets/9a010fde-8ab0-43d6-b5c9-ced9fed1426e" /> <img width="500" alt="image" src="https://github.com/user-attachments/assets/d129cccf-7238-4305-913b-0cf78c7dcc26" /> - [ ] Set up a GH integration and check Create / Edit branch - the branch input field should work with proper branch name validation <img width="500" alt="image" src="https://github.com/user-attachments/assets/4d643956-2d11-406b-b198-193f3221b7a9" /> - [ ] Now go to Account settings and remove the GH connection, then check the Create / Edit branch modals - should have the "Authorize" CTA (instead of the input field) <img width="500" alt="image" src="https://github.com/user-attachments/assets/ac152c0d-2e9c-4d89-95bc-36127c0fc8df" /> <img width="500" alt="image" src="https://github.com/user-attachments/assets/d1f50d38-d801-4546-96fd-8cf3b5d0f805" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a “Sync with a GitHub branch” connection entry with an inline authorize flow. * Integrated GitHub authorization awareness into branch create/edit modals so users are guided to authorize or proceed to syncing. * **Bug Fixes** * Unified loading, success, and error handling for GitHub authorization/connection checks across create and edit flows. * Improved Git branch validation messaging to show cleaner error text. * **Accessibility/UX** * Updated modal UI text and added an explicit label for the “Include data” toggle. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
* Update realtime error codes * Add new troubleshooting page for client presence rate error * Fix references from error codes to work with relative paths
github-actions
Bot
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )