Files
supabase/apps/studio/data/database-functions/database-functions-query.ts
Charis 0433eeb5f5 feat(studio): mark sql provenance for safety (#45336)
Mark provenance of SQL via the branded types SafeSqlFragment and
UntrustedSqlFragment. Only SafeSqlFragment should be executed;
UntrustedSqlFragments require some kind of implicit user approval (show
on screen + user has to click something) before they are promoted to
SafeSqlFragment.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Editor and RLS tester show loading states for inferred/generated SQL
and include a dedicated user SQL editor for safer edits.

* **Refactor**
* Platform-wide SQL handling tightened: snippets and AI-generated SQL
are treated as untrusted/display-only until promoted, improving safety
and consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-05-04 13:08:06 -04:00

58 lines
1.8 KiB
TypeScript

import pgMeta, { type SafeSqlFragment } from '@supabase/pg-meta'
import { useQuery } from '@tanstack/react-query'
import { z } from 'zod'
import { databaseKeys } from '@/data/database/keys'
import { executeSql } from '@/data/sql/execute-sql-query'
import type { ResponseError, UseCustomQueryOptions } from '@/types'
export type DatabaseFunctionsVariables = {
projectRef?: string
connectionString?: string | null
}
export type DatabaseFunction = z.infer<typeof pgMeta.functions.pgFunctionZod>
export type SavedDatabaseFunction = Omit<DatabaseFunction, 'complete_statement'> & {
complete_statement: SafeSqlFragment
}
const pgMetaFunctionsList = pgMeta.functions.list()
export async function getDatabaseFunctions(
{ projectRef, connectionString }: DatabaseFunctionsVariables,
signal?: AbortSignal,
headersInit?: HeadersInit
) {
let headers = new Headers(headersInit)
const { result } = await executeSql(
{
projectRef,
connectionString,
sql: pgMetaFunctionsList.sql,
queryKey: ['database-functions'],
},
signal,
headers
)
return result as SavedDatabaseFunction[]
}
export type DatabaseFunctionsData = Awaited<ReturnType<typeof getDatabaseFunctions>>
export type DatabaseFunctionsError = ResponseError
export const useDatabaseFunctionsQuery = <TData = DatabaseFunctionsData>(
{ projectRef, connectionString }: DatabaseFunctionsVariables,
{
enabled = true,
...options
}: UseCustomQueryOptions<DatabaseFunctionsData, DatabaseFunctionsError, TData> = {}
) =>
useQuery<DatabaseFunctionsData, DatabaseFunctionsError, TData>({
queryKey: databaseKeys.databaseFunctions(projectRef),
queryFn: ({ signal }) => getDatabaseFunctions({ projectRef, connectionString }, signal),
enabled: enabled && typeof projectRef !== 'undefined',
...options,
})