mirror of
https://github.com/supabase/supabase.git
synced 2026-09-06 09:59:03 +08:00
cddb430310
## Description This is the Scoped PAT stacked PRs root branch ## How to test ### With the `scopedPAT` enabled (default on staging) Go to https://studio-staging-git-scopedpat-merge-token-lists-supabase.vercel.app/dashboard/account/tokens. - You shouldn't see two tabs anymore - If you had classic tokens, they should have the _Legacy_ badge - You can create scoped tokens - You have a way to copy newly created tokens before closing the form side panel ### With the `scopedPAT` disabled (use the devtool to override) - You shouldn't see two tabs anymore - If you had classic tokens, they should **not** have the _Legacy_ badge - You can create classic tokens - You have a way to copy newly created tokens above the list upon form submission <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Show classic and scoped access tokens together in one list, with classic tokens labeled “Legacy” when the scoped experience is enabled. * Add scoped access token creation with a two-step configure → review → success flow (when enabled). * Add a dismissible migration notice about scoped tokens with a link to API docs. * Show “View permissions” only for scoped tokens. * **Bug Fixes** * Token deletion now supports both classic and scoped tokens with the correct confirmation and success handling. * The scoped tokens page now redirects to the unified access tokens page. * **Accessibility** * Improved accessibility by adding a label to the token “more options” action. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ali Waseem <waseema393@gmail.com> Co-authored-by: kemal.earth <606977+kemaldotearth@users.noreply.github.com>
39 lines
1.3 KiB
TypeScript
39 lines
1.3 KiB
TypeScript
// [Joshen] Allowlist of API endpoints supported in hosted (platform) mode.
|
|
// Every other /api/* route must 404 in platform mode. Shared by the Next
|
|
// middleware (proxy.ts) and the TanStack request middleware (start.ts) so
|
|
// the list can't drift between the two frameworks while both run in parallel.
|
|
export const HOSTED_SUPPORTED_API_URLS = [
|
|
'/ai/sql/generate-v4',
|
|
'/ai/sql/policy',
|
|
'/ai/feedback/rate',
|
|
'/ai/code/complete',
|
|
'/ai/sql/cron-v2',
|
|
'/ai/sql/title-v2',
|
|
'/ai/sql/filter-v1',
|
|
'/ai/onboarding/design',
|
|
'/ai/feedback/classify',
|
|
'/ai/docs',
|
|
'/ai/sql/parse-client-code',
|
|
'/get-ip-address',
|
|
'/get-utc-time',
|
|
'/get-deployment-commit',
|
|
'/check-cname',
|
|
'/edge-functions/test',
|
|
'/edge-functions/body',
|
|
'/generate-attachment-url',
|
|
'/incident-status',
|
|
'/incident-banner',
|
|
'/status-override',
|
|
'/api/integrations/stripe-sync',
|
|
'/content/graphql',
|
|
'/parse-query',
|
|
'/scoped-access-token-permissions',
|
|
]
|
|
|
|
// `pathname` must be basePath-relative — Next's `nextUrl.pathname` already is,
|
|
// and the TanStack guard strips BASE_PATH before calling. Entries are path
|
|
// suffixes, so `endsWith` stays correct regardless.
|
|
export function isHostedSupportedApiPath(pathname: string): boolean {
|
|
return HOSTED_SUPPORTED_API_URLS.some((url) => pathname.endsWith(url))
|
|
}
|