Files
supabase/apps/studio/data/ai/parse-client-code-mutation.ts
Charis 0433eeb5f5 feat(studio): mark sql provenance for safety (#45336)
Mark provenance of SQL via the branded types SafeSqlFragment and
UntrustedSqlFragment. Only SafeSqlFragment should be executed;
UntrustedSqlFragments require some kind of implicit user approval (show
on screen + user has to click something) before they are promoted to
SafeSqlFragment.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Editor and RLS tester show loading states for inferred/generated SQL
and include a dedicated user SQL editor for safer edits.

* **Refactor**
* Platform-wide SQL handling tightened: snippets and AI-generated SQL
are treated as untrusted/display-only until promoted, improving safety
and consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-05-04 13:08:06 -04:00

66 lines
2.1 KiB
TypeScript

import { untrustedSql, type UntrustedSqlFragment } from '@supabase/pg-meta'
import { useMutation } from '@tanstack/react-query'
import { toast } from 'sonner'
import { constructHeaders, fetchHandler } from '@/data/fetchers'
import { BASE_PATH } from '@/lib/constants'
import { ResponseError, UseCustomMutationOptions } from '@/types'
export type ParseClientCodeResponse = {
// Named unchecked_sql to highlight that this SQL must never be run
// automatically without user confirmation — it is AI-generated and may not
// be correct.
unchecked_sql: UntrustedSqlFragment | undefined
valid: boolean
}
export type ParseClientCodeVariables = {
code: string
}
export async function generateSqlTitle({ code }: ParseClientCodeVariables) {
try {
const url = `${BASE_PATH}/api/ai/sql/parse-client-code`
const headers = await constructHeaders({ 'Content-Type': 'application/json' })
const response = await fetchHandler(url, {
headers,
method: 'POST',
body: JSON.stringify({ code }),
}).then((res) => res.json())
if (response.error) throw new Error(response.error)
return {
valid: response.valid as boolean,
unchecked_sql: response.sql != null ? untrustedSql(response.sql as string) : undefined,
} satisfies ParseClientCodeResponse
} catch (error) {
throw error
}
}
type ParseClientCodeData = Awaited<ReturnType<typeof generateSqlTitle>>
export const useParseClientCodeMutation = ({
onSuccess,
onError,
...options
}: Omit<
UseCustomMutationOptions<ParseClientCodeData, ResponseError, ParseClientCodeVariables>,
'mutationFn'
> = {}) => {
return useMutation<ParseClientCodeData, ResponseError, ParseClientCodeVariables>({
mutationFn: (vars) => generateSqlTitle(vars),
async onSuccess(data, variables, context) {
await onSuccess?.(data, variables, context)
},
async onError(data, variables, context) {
if (onError === undefined) {
toast.error(`Failed to parse client code: ${data.message}`)
} else {
onError(data, variables, context)
}
},
...options,
})
}