supabase / supabase / 41651472973

87%

push

github

feat(studio): migrate branches to FGA grants with production/development variants (#52331)

## Problem

Branch actions in Studio were guarded by hand-written permission checks
(`useAsyncCheckPermissionsV2(FGA_PERMISSIONS.PROJECT.BRANCHING_*)`, plus
one legacy `useAsyncCheckPermissions` in `Branch.Commands.tsx`) that
weren't tied to the endpoints they protect. Every branches request in
`data/branches` was marked `unguarded.migrating`.

This is the pilot migration for endpoint-bound FGA grants. Resolves
[FE-4693](https://linear.app/supabase/issue/FE-4693/pilot-migrate-branches-to-grants-8-endpoints-createbranchmodal).

## Solution

### Data layer

* `data/branches` has no `unguarded.migrating` left (was 10).
* The list, detail, and diff queries are now `branchesQueryOptions`,
`branchQueryOptions`, and `branchDiffQueryOptions`. They take a grant,
use `skipToken` without one, and keep the grant out of the query key.
* Mutations take the grant in their variables. The merge mutation also
takes `diffGrant`, because it reads the diff before merging.

### Production and development variants

The backend doesn't treat development and production branching
permissions as interchangeable:

* Actions on a single branch (`/v1/branches/{branch_id_or_ref}` and its
diff, merge, push, reset, and restore) need the production permission
for the default branch and the development permission for preview
branches.
* Creating a default branch or a branch with data needs production
create.

To model this, `lib/fga-refinements.ts` gets its first entries:

* The 8 single-branch endpoints have `production` and `development`
variants. A new `variantRequired` flag makes the fetch wrapper reject a
grant without a variant, at compile time and in `assertGrant`.
* `POST /v1/projects/{ref}/branches` has a `production` variant.
`assertGrant` requires it when the body sets `is_default` or
`with_data`.
* `useBranchGrant(endpoint, { projectRef, isDefault })` picks the
variant from the branc... (continued)

1986 of 2356 branches covered (84.3%)

Branch coverage included in aggregate %.

2794 of 3152 relevant lines covered (88.64%)

195.87 hits per line