mirror of
https://github.com/supabase/supabase.git
synced 2026-06-18 05:33:50 +08:00
## What kind of change does this PR introduce? Feature. Resolves DEPR-430. ## What is the current behaviour? The homepage Advisor summary, shared Advisor panel, and top-nav Advisor indicator only surface lints and notifications. Banned IPs are not represented as dismissible Advisor items, so network bans are easy to miss unless a user visits Database Settings directly. The `public bucket allows listing` warning is no longer part of this PR. That warning will move to a follow-up Splinter `WARN` lint so it can flow through the standard lint surfaces instead of a bespoke Studio signal path. ## What is the new behaviour? - adds a new Advisor `signal` source for banned IPs on the platform homepage, in the shared Advisor panel, and in the top-nav Advisor indicator - keeps dismissals client-side only for now, scoped by project and exact IP fingerprint - keeps banned IP signals at `warning` severity because they still indicate suspicious traffic and remain actionable if a user wants to review or remove a ban - leaves `/project/[ref]/advisors/security` as follow-up work because that surface is still lint-native, and banned IPs are management-plane signals rather than Splinter lints | After | | --- | | <img width="1728" height="997" alt="Mallet Toolshed Supabase-65A60B4A-107E-4D79-B9A8-23F754BEAB08" src="https://github.com/user-attachments/assets/c08ecbbb-c302-43bd-81bb-6ba7eb18b7b3" /> | ## Reviewer testing notes 1. Use a throwaway project. 2. Get the database connection string for that project. 3. Attempt to connect with the wrong password 3-4 times until you hit an `ECONNREFUSED`-style error, which should mean your IP has been banned. 4. Refresh Studio and confirm the project overview shows the new `Banned IP address` signal. 5. Open the Advisor Center and confirm: - the top-nav Advisor dot turns warning yellow - the signal detail shows `Entity`, `Issue`, and `Resolve` - `Edit network bans`, `Dismiss`, and `Learn more` are present 6. Open Database Settings > Network bans and confirm your banned IP appears there and can be unbanned. 7. Note that `/project/[ref]/advisors/security` will not show this item. That page is still lint-only, and this banned IP work is a short-term client-side signal rather than a true lint. Longer term, we likely want a more durable event model here so banned IPs can power notifications, webhooks, emails, and other project-level alerts. --------- Co-authored-by: kemal <hello@kemal.earth> Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
80 lines
2.0 KiB
TypeScript
80 lines
2.0 KiB
TypeScript
import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
|
|
import { act, renderHook, waitFor } from '@testing-library/react'
|
|
import { PropsWithChildren } from 'react'
|
|
import { beforeEach, describe, expect, it, vi } from 'vitest'
|
|
|
|
import { useAdvisorSignals } from './useAdvisorSignals'
|
|
|
|
const { mockUseBannedIPsQuery } = vi.hoisted(() => ({
|
|
mockUseBannedIPsQuery: vi.fn(),
|
|
}))
|
|
|
|
vi.mock('@/data/banned-ips/banned-ips-query', () => ({
|
|
useBannedIPsQuery: mockUseBannedIPsQuery,
|
|
}))
|
|
|
|
const createWrapper = () => {
|
|
const queryClient = new QueryClient({
|
|
defaultOptions: {
|
|
queries: {
|
|
retry: false,
|
|
},
|
|
},
|
|
})
|
|
|
|
return function Wrapper({ children }: PropsWithChildren) {
|
|
return <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
|
|
}
|
|
}
|
|
|
|
describe('useAdvisorSignals', () => {
|
|
beforeEach(() => {
|
|
window.localStorage.clear()
|
|
vi.clearAllMocks()
|
|
})
|
|
|
|
it('resurfaces a dismissed banned-IP signal after the IP disappears and is banned again', async () => {
|
|
let bannedIPs = ['203.0.113.10']
|
|
|
|
mockUseBannedIPsQuery.mockImplementation(() => ({
|
|
data: {
|
|
banned_ipv4_addresses: bannedIPs,
|
|
},
|
|
isPending: false,
|
|
isError: false,
|
|
}))
|
|
|
|
const { result, rerender } = renderHook(
|
|
() => useAdvisorSignals({ projectRef: 'project-ref' }),
|
|
{
|
|
wrapper: createWrapper(),
|
|
}
|
|
)
|
|
|
|
expect(result.current.data).toHaveLength(1)
|
|
|
|
act(() => {
|
|
result.current.dismissSignal('signal:banned-ip:203.0.113.10:v1')
|
|
})
|
|
|
|
await waitFor(() => {
|
|
expect(result.current.data).toEqual([])
|
|
})
|
|
|
|
bannedIPs = []
|
|
rerender()
|
|
|
|
await waitFor(() => {
|
|
expect(window.localStorage.getItem('advisor-signal-dismissals:project-ref')).toBe('[]')
|
|
})
|
|
|
|
bannedIPs = ['203.0.113.10']
|
|
rerender()
|
|
|
|
await waitFor(() => {
|
|
expect(result.current.data).toHaveLength(1)
|
|
expect(result.current.data[0].sourceData.ip).toBe('203.0.113.10')
|
|
})
|
|
})
|
|
})
|