## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix - config hardening
## What is the current behavior?
CORS is applied at the global level in a permissive mode
## What is the new behavior?
Self-hosted envoy config should apply CORS to the `/pg` routes. These
should only be called from the studio dashboard (when called via a
browser).
uses `SUPABASE_PUBLIC_URL`, which should mean this isn't a breaking
change.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security & Access**
* Added stricter CORS controls for the `/pg/` route.
* Requests are limited to the configured public URL and localhost
origins.
* Standard HTTP methods and headers are supported, with preflight
responses cached for one hour.
* **Documentation**
* Updated self-hosting guidance to describe the `/pg/` route’s CORS
policy.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
* add routes for local remote mcp
* add additional plugins to kong to restrict mcp
* prohibit access to /api/mcp and /mcp by default
* add comments to warn the user about local access only
Exposes the API routes for Realtime appropriately via Kong configuration.
Also alters the analytics configuration to avoid extra logs due to having only one analytics server instead of a cluster
Co-authored-by: Rodrigo Mansueli <rodrigo@mansueli.com>
* using slack clone to test
* updates auth functions to handle new GUC commands
* move postgREST to new version
* testing with todo list
* makeing our mount setup far more robust
* Adds some usage commands
* cleans up the auth functions
* test with todos app
* fix env var for GUC
* new auth functions - changed for performance improvement
* Adds some integration tests for RLS
* anon volume on postgres
* remove unused helpers
* fix broken docusaurus build
* Fix complaining vercel
* test instructions
* Use named imports
* Fixes imports
* all relative
* chore: add in tsconfig.json to /web
* finding these all over the place
* Update docker/docker-compose.yml
Co-authored-by: Steve Chavez <stevechavezast@gmail.com>
Co-authored-by: Jonathan Summers-Muir <MildTomato@users.noreply.github.com>
Co-authored-by: Steve Chavez <stevechavezast@gmail.com>
