[pull] master from supabase:master

apps/docs/content/guides/api/securing-your-api.mdx

@@ -68,6 +68,12 @@ alter default privileges for role postgres in schema public
   revoke execute on functions from public;
 ```
 
+<Admonition type="tip">
+
+These default privileges pose no direct security risk. They appear in [pg_default_acl](https://www.postgresql.org/docs/current/catalog-pg-default-acl.html), granted by [supabase_admin](/docs/guides/database/postgres/roles#supabaseadmin) to `anon`, `authenticated`, and `service_role`. The default privileges are intentional and part of Supabase's standard permission model. The `supabase_admin` role is an internal management role that can't authenticate through the Data API.
+
+</Admonition>
+
 ## Use a dedicated API schema
 
 If you want an extra boundary around your Data API, lock down the `public` schema and expose a dedicated schema, such as `api`, instead. You can control access with grants in any schema, but this can make the surface easier to reason about: objects in `api` represent your Data API, while internal tables and helper functions stay in schemas that are not exposed. See [Using Custom Schemas](/docs/guides/api/using-custom-schemas) for setup steps.

apps/studio/components/interfaces/Account/AccessTokens/Scoped/ViewTokenSheet.tsx

@@ -22,6 +22,7 @@ import { formatAccessText, getRealAccess } from '../AccessToken.utils'
 import { useOrgAndProjectData } from '../hooks/useOrgAndProjectData'
 import { DocsButton } from '@/components/ui/DocsButton'
 import { useScopedAccessTokenQuery } from '@/data/scoped-access-tokens/scoped-access-token-query'
+import { DOCS_URL } from '@/lib/constants'
 
 interface ViewTokenSheetProps {
   visible: boolean
@@ -110,7 +111,7 @@ export function ViewTokenSheet({ visible, tokenId, onClose }: ViewTokenSheetProp
             <p className="truncate" title={`Manage access for ${token?.name}`}>
               View access for {token?.name}
             </p>
-            <DocsButton href="https://supabase.com/docs/reference/api/introduction" />
+            <DocsButton href={`${DOCS_URL}/reference/api/introduction`} />
           </SheetHeader>
           <ScrollArea className="flex-1 max-h-[calc(100vh-60px)]">
             <div className="space-y-8 px-5 sm:px-6 py-6">

apps/studio/components/interfaces/Auth/AuthProvidersForm/index.tsx

@@ -18,6 +18,7 @@ import { AlertError } from '@/components/ui/AlertError'
 import { ResourceList } from '@/components/ui/Resource/ResourceList'
 import { HorizontalShimmerWithIcon } from '@/components/ui/Shimmers'
 import { useAuthConfigQuery } from '@/data/auth/auth-config-query'
+import { DOCS_URL } from '@/lib/constants'
 
 export const AuthProvidersForm = () => {
   const { ref: projectRef } = useParams()
@@ -59,7 +60,7 @@ export const AuthProvidersForm = () => {
                       hour.
                     </p>
                     <Button asChild variant="default" className="w-min" icon={<ExternalLink />}>
-                      <Link href="https://supabase.com/docs/guides/platform/going-into-prod#security">
+                      <Link href={`${DOCS_URL}/guides/platform/going-into-prod#security`}>
                         View security recommendations
                       </Link>
                     </Button>
@@ -89,17 +90,17 @@ export const AuthProvidersForm = () => {
                       : provider
                   let isActive = false
                   if (providerSchema.title === 'SAML 2.0') {
-                    isActive = authConfig && (authConfig as any)['SAML_ENABLED']
+                    isActive = authConfig && authConfig['SAML_ENABLED']
                   } else if (providerSchema.title === 'LinkedIn (OIDC)') {
-                    isActive = authConfig && (authConfig as any)['EXTERNAL_LINKEDIN_OIDC_ENABLED']
+                    isActive = authConfig && authConfig['EXTERNAL_LINKEDIN_OIDC_ENABLED']
                   } else if (providerSchema.title === 'Slack (OIDC)') {
-                    isActive = authConfig && (authConfig as any)['EXTERNAL_SLACK_OIDC_ENABLED']
+                    isActive = authConfig && authConfig['EXTERNAL_SLACK_OIDC_ENABLED']
                   } else if (providerSchema.title.includes('Web3')) {
-                    isActive = authConfig && (authConfig as any)['EXTERNAL_WEB3_SOLANA_ENABLED']
+                    isActive = authConfig && authConfig['EXTERNAL_WEB3_SOLANA_ENABLED']
                   } else if (providerSchema.title.includes('X / Twitter (OAuth 2.0)')) {
                     isActive = authConfig && (authConfig as any)['EXTERNAL_X_ENABLED']
                   } else if (providerSchema.title === 'Twitter (Deprecated)') {
-                    isActive = authConfig && (authConfig as any)['EXTERNAL_TWITTER_ENABLED']
+                    isActive = authConfig && authConfig['EXTERNAL_TWITTER_ENABLED']
                   } else {
                     isActive =
                       authConfig &&

apps/studio/components/interfaces/ConnectSheet/ConnectStepsSection.tsx

@@ -286,10 +286,7 @@ export function ConnectStepsSection({ steps, state, projectKeys }: ConnectStepsS
             title="MCP for self-hosted Supabase requires extra setup"
             description="The configuration below points at the hosted Supabase MCP server. To use MCP against your self-hosted instance, follow the self-hosted MCP guide."
             actions={[
-              <DocsButton
-                key="docs"
-                href="https://supabase.com/docs/guides/self-hosting/enable-mcp"
-              />,
+              <DocsButton key="docs" href={`${DOCS_URL}/guides/self-hosting/enable-mcp`} />,
             ]}
           />
         )}

apps/studio/components/interfaces/ConnectSheet/content/steps/direct-connection/content.tsx

@@ -28,12 +28,14 @@ import {
 } from '@/components/interfaces/ConnectSheet/ConnectionString.utils'
 import { PasswordEncodingNote } from '@/components/interfaces/ConnectSheet/PasswordEncodingNote'
 import { ResetDbPasswordDialog } from '@/components/interfaces/Settings/Database/DatabaseSettings/ResetDbPasswordDialog'
+import { InlineLink } from '@/components/ui/InlineLink'
 import { usePgbouncerConfigQuery } from '@/data/database/pgbouncer-config-query'
 import { useSupavisorConfigurationQuery } from '@/data/database/supavisor-configuration-query'
 import { useReadReplicasQuery } from '@/data/read-replicas/replicas-query'
 import { useProjectAddonsQuery } from '@/data/subscriptions/project-addons-query'
 import { useCheckEntitlements } from '@/hooks/misc/useCheckEntitlements'
 import { useIsHighAvailability } from '@/hooks/misc/useSelectedProject'
+import { DOCS_URL } from '@/lib/constants'
 import { pluckObjectFields } from '@/lib/helpers'
 import { useTrack } from '@/lib/telemetry/track'
 
@@ -275,14 +277,11 @@ function DirectConnectionContent({ state, deploymentMode }: StepContentProps) {
       {showSelfHostedDirectNotice && (
         <p className="text-sm text-foreground-light">
           Manually{' '}
-          <a
-            href="https://supabase.com/docs/guides/self-hosting/docker#exposing-your-postgres-database"
-            target="_blank"
-            rel="noopener noreferrer"
-            className="underline hover:text-foreground"
+          <InlineLink
+            href={`${DOCS_URL}/guides/self-hosting/docker#exposing-your-postgres-database`}
           >
             configurable
-          </a>{' '}
+          </InlineLink>{' '}
           for self-hosted Supabase.
         </p>
       )}

apps/studio/components/interfaces/ErrorHandling/README.md

@@ -73,6 +73,7 @@ import {
   FixWithAITroubleshootingSection,
   TroubleshootingGuideSection,
 } from '../TroubleshootingSections'
+import { DOCS_URL } from '@/lib/constants'
 
 const ERROR_TYPE = 'your-error'
 const BUILD_PROMPT = () => `Describe the issue for the AI assistant.`
@@ -89,7 +90,7 @@ export function YourErrorTroubleshooting() {
       <TroubleshootingGuideSection
         number={1}
         errorType={ERROR_TYPE}
-        href="https://supabase.com/docs/guides/..."
+        href={`${DOCS_URL}/guides/...`}
       />
       <FixWithAITroubleshootingSection
         number={2}

apps/studio/components/interfaces/ErrorHandling/errorMappings/ConnectionTimeout.tsx

@@ -5,6 +5,7 @@ import {
   TroubleshootingGuideSection,
 } from '../TroubleshootingSections'
 import { SIDEBAR_KEYS } from '@/components/layouts/ProjectLayout/LayoutSidebar/LayoutSidebarProvider'
+import { DOCS_URL } from '@/lib/constants'
 import { useAiAssistantStateSnapshot } from '@/state/ai-assistant-state'
 import { useSidebarManagerSnapshot } from '@/state/sidebar-manager-state'
 
@@ -30,7 +31,7 @@ export function ConnectionTimeoutTroubleshooting() {
       <TroubleshootingGuideSection
         number={2}
         errorType={ERROR_TYPE}
-        href="https://supabase.com/docs/guides/troubleshooting/failed-to-run-sql-query-connection-terminated-due-to-connection-timeout"
+        href={`${DOCS_URL}/guides/troubleshooting/failed-to-run-sql-query-connection-terminated-due-to-connection-timeout`}
         description="Follow step-by-step instructions for diagnosing connection timeout issues."
       />
       <FixWithAITroubleshootingSection

apps/studio/components/interfaces/Functions/EdgeFunctionOverview/EdgeFunctionRecentErrors.utils.ts

@@ -8,6 +8,7 @@ import {
   unixMicroToIsoTimestamp,
 } from '@/components/interfaces/Settings/Logs/Logs.utils'
 import type { AlertErrorProps } from '@/components/ui/AlertError'
+import { DOCS_URL } from '@/lib/constants'
 
 dayjs.extend(relativeTime)
 
@@ -72,7 +73,7 @@ export const getDisplayErrorMessage = (group: RecentErrorGroup): string => {
   return summarizeErrorMessage(group.message)
 }
 
-const TROUBLESHOOTING_DOCS_BASE = 'https://supabase.com/docs/guides/troubleshooting'
+const TROUBLESHOOTING_DOCS_BASE = `${DOCS_URL}/guides/troubleshooting`
 
 export const buildTroubleshootingDocsUrl = ({ statusCode }: { statusCode?: string }): string => {
   const numericStatusCode = Number(statusCode)

apps/studio/components/interfaces/Integrations/GraphQL/constants.ts

@@ -1,3 +1,5 @@
+import { DOCS_URL } from '@/lib/constants'
+
 export const PG_GRAPHQL_EXTENSION_NAME = 'pg_graphql'
 
 /**
@@ -7,4 +9,4 @@ export const PG_GRAPHQL_EXTENSION_NAME = 'pg_graphql'
  */
 export const DEFAULT_INTROSPECTION_SCHEMA = 'public'
 
-export const PG_GRAPHQL_CONFIG_DOCS_URL = 'https://supabase.com/docs/guides/graphql#supabase-studio'
+export const PG_GRAPHQL_CONFIG_DOCS_URL = `${DOCS_URL}/guides/graphql#supabase-studio`

apps/studio/components/interfaces/JwtSecrets/jwt-settings.tsx

@@ -72,6 +72,7 @@ import { useJwtSecretUpdatingStatusQuery } from '@/data/config/jwt-secret-updati
 import { useProjectPostgrestConfigQuery } from '@/data/config/project-postgrest-config-query'
 import { useLegacyJWTSigningKeyQuery } from '@/data/jwt-signing-keys/legacy-jwt-signing-key-query'
 import { useAsyncCheckPermissions } from '@/hooks/misc/useCheckPermissions'
+import { DOCS_URL } from '@/lib/constants'
 import { uuidv4 } from '@/lib/helpers'
 
 const MAX_JWT_EXP = 604800
@@ -504,9 +505,9 @@ export const JWTSettings = () => {
                     {disableLegacyJwtSecretRotation ? (
                       <Button variant="default" icon={<ExternalLink className="size-4" />} asChild>
                         <Link
-                          href="https://supabase.com/docs/guides/auth/signing-keys#getting-started"
+                          href={`${DOCS_URL}/guides/auth/signing-keys#getting-started`}
                           target="_blank"
-                          rel="noreferrer"
+                          rel="noopener noreferrer"
                         >
                           Read the full migration guide
                         </Link>