supabase / supabase / 26403554525

73%

push

github

feat(logs): route unified-logs hooks through executeAnalyticsSql (#46333)

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Security / refactor — routes all unified-logs analytics queries through
the `executeAnalyticsSql` wire-boundary wrapper (PR 2 of the
safe-analytics-sql series).

## What is the current behavior?

All five unified-logs query hooks call `post()` directly with a raw SQL
string, bypassing the `SafeLogSqlFragment` type enforcement. The
`getUnifiedLogs` infinite-query also drops the brand by composing with a
plain template literal before sending to the wire.

## What is the new behavior?

- `unified-logs-infinite-query`: brand-dropping plain template literal
replaced with `safeSql` + `analyticsLiteral`; `post()` replaced with
`executeAnalyticsSql`
- `unified-logs-count-query`, `unified-logs-chart-query`,
`unified-logs-facet-count-query`: `post()` replaced with
`executeAnalyticsSql`
- `unified-log-inspection-query` (OTEL branch only): both `post()` calls
replaced with `executeAnalyticsSql`; legacy BigQuery branch is unchanged
pending PR 3

The wire boundary now rejects plain strings at compile time for all OTEL
unified-logs paths.

## Additional context

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46333?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

972 of 1368 branches covered (71.05%)

Branch coverage included in aggregate %.

1499 of 2057 relevant lines covered (72.87%)

242.4 hits per line