supabase / supabase / 41523119903

87%

push

github

feat(studio): guard branch update and push with FGA grants (#52377)

Part 6 of 7 in a stack that splits #52331 into reviewable pieces.
Resolves part of
[FE-4693](https://linear.app/supabase/issue/FE-4693/pilot-migrate-branches-to-grants-8-endpoints-createbranchmodal).
There are no functional changes beyond #52331, and the top of the stack
is identical to it. See #52331 for the full rationale.

## Stack
1. #52372 Grant infra for branch variants
2. #52373 Branches list query
3. #52374 Page gates on the list grant
4. #52375 Branch creation
5. #52376 Branch read, delete, reset, and restore
6. 👉 #52377 Branch update and push
7. #52378 Branch diff and merge

## Changes
The update and push mutations take grants. `Overview` (including "Switch
to persistent", which previously had no check), `EditBranchModal`,
`SwitchToPreviewModal`, `MergeRequestButton`, the merge-requests page,
and the merge page use `useBranchGrant`. The "Update branch" button in
`OutOfDateNotice` is disabled without push; previously it did nothing.
The GitHub integration form blocks saving without the production-branch
grant. Previously the connection was saved even when the branch request
failed.

## Testing
New `GitHubIntegrationConnectionForm` test.

1985 of 2356 branches covered (84.25%)

Branch coverage included in aggregate %.

2793 of 3152 relevant lines covered (88.61%)

195.85 hits per line