Files
supabase/apps/studio/lib/hosted-api-allowlist.ts
Charis 27e6259a39 chore(studio): remove legacy status banner and incidentIoStatusPage flag (#51852)
## Summary

The incident.io status page is now the only status banner for everyone,
so the legacy status banner path is removed:

- Removed the `incidentIoStatusPage` ConfigCat flag. The incident.io
path is unconditional.
- Deleted the legacy status banner code (`StatusPageBanner` and its
utils/visibility hook) and its tests.
- Deleted the legacy API endpoints `/api/incident-banner`,
`/api/incident-status`, and `/api/status-override` (pages, app, and
routes variants), along with their data hooks, query keys, and lib
helpers.
- Removed `STATUSPAGE_*` env vars from the Turbo config and the
`INCIDENT_BANNER_DISMISSED_IDS` local storage key from
`packages/common`.
- Updated the AI tools and SQL generation endpoint that read the flag.

`NEXT_PUBLIC_ONGOING_INCIDENT` / the `ongoingIncident` override is kept.

The `incident_status_cache` table and its migration are intentionally
untouched. Studio no longer reads it, and dropping it is a separate
cleanup.

## Testing

- Studio typecheck passes.
- Related vitest suites pass (414 tests).
2026-10-16 14:18:32 -04:00

37 lines
1.2 KiB
TypeScript

// [Joshen] Allowlist of API endpoints supported in hosted (platform) mode.
// Every other /api/* route must 404 in platform mode. Shared by the Next
// middleware (proxy.ts) and the TanStack request middleware (start.ts) so
// the list can't drift between the two frameworks while both run in parallel.
export const HOSTED_SUPPORTED_API_URLS = [
'/ai/sql/generate-v4',
'/ai/sql/policy',
'/ai/feedback/rate',
'/ai/code/complete',
'/ai/sql/cron-v2',
'/ai/sql/title-v2',
'/ai/sql/filter-v1',
'/ai/onboarding/design',
'/ai/feedback/classify',
'/ai/docs',
'/ai/sql/parse-client-code',
'/get-ip-address',
'/get-utc-time',
'/get-deployment-commit',
'/check-cname',
'/edge-functions/test',
'/edge-functions/body',
'/generate-attachment-url',
'/status-page',
'/api/integrations/stripe-sync',
'/content/graphql',
'/parse-query',
'/scoped-access-token-permissions',
]
// `pathname` must be basePath-relative — Next's `nextUrl.pathname` already is,
// and the TanStack guard strips BASE_PATH before calling. Entries are path
// suffixes, so `endsWith` stays correct regardless.
export function isHostedSupportedApiPath(pathname: string): boolean {
return HOSTED_SUPPORTED_API_URLS.some((url) => pathname.endsWith(url))
}