Files
supabase/apps/www/components/SubprocessorUpdatesForm.tsx
claude[bot] ffd5a93f37 feat(www): add hidden Legal Hub subprocessor list page (draft) (#48100)
<!-- ccr-slack-attribution -->
_Requested by **Nicole Kramer** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1783431374242039?thread_ts=1783431374.242039&cid=C0161K73J1J)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature (`apps/www`).

## What is the current behavior?

No public page for Supabase's subprocessor list, and no way for
customers to be notified when it changes.

## What is the new behavior?

A new hidden page at `/legal/customer-resources/subprocessor-list` shows
the current dated subprocessor PDF and lets anyone subscribe with their
name and email to receive an email whenever the list is updated. The
page is `noindex` and not linked from any nav, so it's shareable by
direct URL only for now. Mirrors Wiz's sub-processor-list page.

**How:**

- **Page**
`apps/www/pages/legal/customer-resources/subprocessor-list.tsx` —
pages-router, mirrors the existing Legal Hub pages (`DefaultLayout`,
`NextSeo`, `PageHeader` + breadcrumb, `SectionContainer` prose). Embeds
the PDF (inline preview + download link) and renders the subscribe form.
Marked `NextSeo` noindex/nofollow and intentionally left unlinked.
- A single `CURRENT_PDF` constant (filename + display date) is the only
thing to change when Legal hands over a new dated PDF.
- **Form** `apps/www/components/SubprocessorUpdatesForm.tsx` — mirrors
`SecurityNewsletterForm` (First name, Last name, Email; `ui`
primitives). Carries the framing copy verbatim, with **Subscribe to
updates** bold and Privacy Policy linked to
https://supabase.com/privacy.
- **API route**
`apps/www/app/api-v2/submit-form-subprocessor-updates/route.tsx` — exact
mirror of `submit-form-security-newsletter`; subscribes the user to the
Customer.io "Subprocessor Alerts" subscription (topic 4) via
`cio_subscription_preferences.topics.topic_4: true`.
- **PDF** `apps/www/public/legal/subprocessor-list/June-1-2026.pdf`.

**Updating the list in future:** Drop the new dated PDF into
`apps/www/public/legal/subprocessor-list/` and update the `CURRENT_PDF`
constant. Nothing else changes.

## Additional context

**Notes / to confirm:**

- Customer.io topic id `4` → `topic_4` (per Prashant); not independently
verified against Customer.io.
- Draft: page is intentionally unlinked and noindex until Legal signs
off.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01D9WS2QWQ8Y3o7PqDZabS3F)_

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-07-22 11:19:14 +01:00

127 lines
4.2 KiB
TypeScript

import { useState } from 'react'
import Link from 'next/link'
import { Button, Input, Label } from 'ui'
const isValidEmail = (email: string): boolean => {
const emailPattern = /^[\w-\.+]+@([\w-]+\.)+[\w-]{2,8}$/
return emailPattern.test(email)
}
/**
* Subscribe form for subprocessor update notifications.
* Mirrors components/SecurityNewsletterForm.tsx, posting to the
* /api-v2/submit-form-subprocessor-updates route (Customer.io "Subprocessor Alerts", topic_4).
*/
const SubprocessorUpdatesForm = () => {
const [firstName, setFirstName] = useState('')
const [lastName, setLastName] = useState('')
const [email, setEmail] = useState('')
const [status, setStatus] = useState<'idle' | 'loading' | 'success' | 'error'>('idle')
const [errorMessage, setErrorMessage] = useState('')
const handleSubmit = async (e: React.FormEvent) => {
e.preventDefault()
setErrorMessage('')
if (!firstName || !lastName || !email) {
setErrorMessage('All fields are required.')
return
}
if (!isValidEmail(email)) {
setErrorMessage('Please enter a valid email address.')
return
}
setStatus('loading')
try {
const res = await fetch('/api-v2/submit-form-subprocessor-updates', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ firstName, lastName, email }),
})
if (!res.ok) {
const data = await res.json()
throw new Error(data.message || 'Something went wrong')
}
setStatus('success')
} catch (err: any) {
setStatus('error')
setErrorMessage(err.message || 'Something went wrong. Please try again.')
}
}
return (
<div className="border rounded-xl bg-surface-75 p-4 md:p-6 w-full max-w-lg not-prose">
<p className="text-foreground-light text-sm text-pretty mb-6">
<strong className="text-foreground">Subscribe to updates</strong>. Receive an email
notification when Supabase updates its sub-processors. By submitting this form, you
acknowledge and agree that Supabase will process your personal information in accordance
with our{' '}
<Link
href="https://supabase.com/privacy"
className="text-brand-link hover:underline"
target="_blank"
rel="noopener noreferrer"
>
Privacy Policy
</Link>
.
</p>
{status === 'success' ? (
<p className="text-foreground text-sm">
Thanks for subscribing! You'll receive an email when Supabase updates its sub-processors.
</p>
) : (
<form onSubmit={handleSubmit} className="flex flex-col gap-4">
<div className="grid grid-cols-1 md:grid-cols-2 gap-4">
<div className="flex flex-col gap-2">
<Label htmlFor="subprocessor-first-name">First name</Label>
<Input
id="subprocessor-first-name"
type="text"
value={firstName}
onChange={(e) => setFirstName(e.target.value)}
placeholder="First name"
required
/>
</div>
<div className="flex flex-col gap-2">
<Label htmlFor="subprocessor-last-name">Last name</Label>
<Input
id="subprocessor-last-name"
type="text"
value={lastName}
onChange={(e) => setLastName(e.target.value)}
placeholder="Last name"
required
/>
</div>
</div>
<div className="flex flex-col gap-2">
<Label htmlFor="subprocessor-email">Email</Label>
<Input
id="subprocessor-email"
type="email"
value={email}
onChange={(e) => setEmail(e.target.value)}
placeholder="Email"
required
/>
</div>
{errorMessage && <p className="text-destructive text-sm">{errorMessage}</p>}
<Button variant="primary" size="large" type="submit" loading={status === 'loading'}>
Subscribe
</Button>
</form>
)}
</div>
)
}
export default SubprocessorUpdatesForm