mirror of
https://github.com/supabase/supabase.git
synced 2026-05-08 18:00:20 -04:00
Danny White
b721a2d780
## What kind of change does this PR introduce? Feature. Resolves DEPR-430. ## What is the current behaviour? The homepage Advisor summary, shared Advisor panel, and top-nav Advisor indicator only surface lints and notifications. Banned IPs are not represented as dismissible Advisor items, so network bans are easy to miss unless a user visits Database Settings directly. The `public bucket allows listing` warning is no longer part of this PR. That warning will move to a follow-up Splinter `WARN` lint so it can flow through the standard lint surfaces instead of a bespoke Studio signal path. ## What is the new behaviour? - adds a new Advisor `signal` source for banned IPs on the platform homepage, in the shared Advisor panel, and in the top-nav Advisor indicator - keeps dismissals client-side only for now, scoped by project and exact IP fingerprint - keeps banned IP signals at `warning` severity because they still indicate suspicious traffic and remain actionable if a user wants to review or remove a ban - leaves `/project/[ref]/advisors/security` as follow-up work because that surface is still lint-native, and banned IPs are management-plane signals rather than Splinter lints | After | | --- | | <img width="1728" height="997" alt="Mallet Toolshed Supabase-65A60B4A-107E-4D79-B9A8-23F754BEAB08" src="https://github.com/user-attachments/assets/c08ecbbb-c302-43bd-81bb-6ba7eb18b7b3" /> | ## Reviewer testing notes 1. Use a throwaway project. 2. Get the database connection string for that project. 3. Attempt to connect with the wrong password 3-4 times until you hit an `ECONNREFUSED`-style error, which should mean your IP has been banned. 4. Refresh Studio and confirm the project overview shows the new `Banned IP address` signal. 5. Open the Advisor Center and confirm: - the top-nav Advisor dot turns warning yellow - the signal detail shows `Entity`, `Issue`, and `Resolve` - `Edit network bans`, `Dismiss`, and `Learn more` are present 6. Open Database Settings > Network bans and confirm your banned IP appears there and can be unbanned. 7. Note that `/project/[ref]/advisors/security` will not show this item. That page is still lint-only, and this banned IP work is a short-term client-side signal rather than a true lint. Longer term, we likely want a more durable event model here so banned IPs can power notifications, webhooks, emails, and other project-level alerts. --------- Co-authored-by: kemal <hello@kemal.earth> Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
75 lines
2.4 KiB
TypeScript
75 lines
2.4 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
|
|
import type { AdvisorSignalItem } from './AdvisorPanel.types'
|
|
import {
|
|
createAdvisorLintItems,
|
|
createAdvisorNotificationItems,
|
|
getAdvisorItemSecondaryText,
|
|
sortAdvisorItems,
|
|
} from './AdvisorPanel.utils'
|
|
import type { Lint } from '@/data/lint/lint-query'
|
|
import type { Notification } from '@/data/notifications/notifications-v2-query'
|
|
|
|
const createLint = (overrides: Partial<Lint> = {}): Lint =>
|
|
({
|
|
cache_key: 'lint-1',
|
|
name: 'unknown_lint',
|
|
detail: 'Critical lint detail',
|
|
level: 'ERROR',
|
|
categories: ['SECURITY'],
|
|
metadata: {},
|
|
...overrides,
|
|
}) as Lint
|
|
|
|
const createNotification = (overrides: Partial<Notification> = {}): Notification =>
|
|
({
|
|
id: 'notification-1',
|
|
inserted_at: '2026-03-01T00:00:00.000Z',
|
|
priority: 'Info',
|
|
status: 'seen',
|
|
data: {
|
|
title: 'Notification title',
|
|
message: 'Notification body',
|
|
actions: [],
|
|
},
|
|
...overrides,
|
|
}) as Notification
|
|
|
|
const createBannedIPSignalItem = (ip: string): AdvisorSignalItem => ({
|
|
id: `signal:banned-ip:${ip}:v1`,
|
|
dismissalKey: `signal:banned-ip:${ip}:v1`,
|
|
source: 'signal',
|
|
type: 'banned-ip',
|
|
severity: 'warning',
|
|
tab: 'security',
|
|
title: 'Banned IP address',
|
|
summary: `The IP address \`${ip}\` is temporarily blocked.`,
|
|
docsUrl: 'https://supabase.com/docs/reference/cli/supabase-network-bans',
|
|
actions: [],
|
|
sourceData: { type: 'banned-ip', ip },
|
|
})
|
|
|
|
describe('AdvisorPanel.utils', () => {
|
|
it('orders mixed lint, signal and notification items by severity and recency', () => {
|
|
const lintItems = createAdvisorLintItems([
|
|
createLint({ cache_key: 'lint-critical', detail: 'Critical lint detail' }),
|
|
])
|
|
const signalItems = [createBannedIPSignalItem('203.0.113.10')]
|
|
const notificationItems = createAdvisorNotificationItems([
|
|
createNotification({
|
|
id: 'notification-info',
|
|
data: { title: 'Notification title', message: 'Body', actions: [] },
|
|
}),
|
|
])
|
|
|
|
const sorted = sortAdvisorItems([...notificationItems, ...signalItems, ...lintItems])
|
|
|
|
expect(sorted.map((item) => item.source)).toEqual(['lint', 'signal', 'notification'])
|
|
})
|
|
|
|
it('uses database surface-area metadata and the IP address for banned IP signals', () => {
|
|
const bannedIpSignal = createBannedIPSignalItem('203.0.113.10')
|
|
expect(getAdvisorItemSecondaryText(bannedIpSignal)).toBe('Database · 203.0.113.10')
|
|
})
|
|
})
|