Files
supabase/apps/studio/data/database-policies/database-policies-query.ts
T
Charis 0433eeb5f5 feat(studio): mark sql provenance for safety (#45336)
Mark provenance of SQL via the branded types SafeSqlFragment and
UntrustedSqlFragment. Only SafeSqlFragment should be executed;
UntrustedSqlFragments require some kind of implicit user approval (show
on screen + user has to click something) before they are promoted to
SafeSqlFragment.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Editor and RLS tester show loading states for inferred/generated SQL
and include a dedicated user SQL editor for safer edits.

* **Refactor**
* Platform-wide SQL handling tightened: snippets and AI-generated SQL
are treated as untrusted/display-only until promoted, improving safety
and consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-05-04 13:08:06 -04:00

71 lines
2.4 KiB
TypeScript

import { DEFAULT_PLATFORM_APPLICATION_NAME } from '@supabase/pg-meta/src/constants'
import { useQuery } from '@tanstack/react-query'
import { databasePoliciesKeys } from './keys'
import type { Policy } from '@/components/interfaces/Auth/Policies/PolicyTableRow/PolicyTableRow.utils'
import { get, handleError } from '@/data/fetchers'
import { useSelectedProjectQuery } from '@/hooks/misc/useSelectedProject'
import { PROJECT_STATUS } from '@/lib/constants'
import type { ResponseError, UseCustomQueryOptions } from '@/types'
type DatabasePoliciesVariables = {
projectRef?: string
connectionString?: string | null
schema?: string
}
export async function getDatabasePolicies(
{ projectRef, connectionString, schema }: DatabasePoliciesVariables,
signal?: AbortSignal,
headersInit?: HeadersInit
) {
if (!projectRef) throw new Error('projectRef is required')
let headers = new Headers(headersInit)
if (connectionString) headers.set('x-connection-encrypted', connectionString)
const { data, error } = await get('/platform/pg-meta/{ref}/policies', {
params: {
header: {
'x-connection-encrypted': connectionString!,
'x-pg-application-name': DEFAULT_PLATFORM_APPLICATION_NAME,
},
path: { ref: projectRef },
query: {
included_schemas: schema || '',
excluded_schemas: '',
},
},
headers,
signal,
})
if (error) handleError(error)
return data
}
export type DatabasePoliciesData = Awaited<ReturnType<typeof getDatabasePolicies>>
export type DatabasePoliciesError = ResponseError
function markSavedPolicySafe(policy: DatabasePoliciesData[number]): Policy {
return policy as Policy
}
export const useDatabasePoliciesQuery = <TData = Policy[]>(
{ projectRef, connectionString, schema }: DatabasePoliciesVariables,
{ enabled = true, ...options }: UseCustomQueryOptions<Policy[], DatabasePoliciesError, TData> = {}
) => {
const { data: project } = useSelectedProjectQuery()
const isActive = project?.status === PROJECT_STATUS.ACTIVE_HEALTHY
return useQuery<Policy[], DatabasePoliciesError, TData>({
queryKey: databasePoliciesKeys.list(projectRef, schema),
queryFn: ({ signal }) =>
getDatabasePolicies({ projectRef, connectionString, schema }, signal).then((data) =>
data.map(markSavedPolicySafe)
),
enabled: enabled && typeof projectRef !== 'undefined' && isActive,
...options,
})
}