fix(supabase): remove non-functional SQL introspection, harden storage encoding, add missing endpoints (#5371)

* fix(supabase): remove non-functional SQL introspection path, harden storage URL encoding, add missing storage endpoints

- introspect.ts no longer attempts raw SQL via a nonexistent PostgREST
  RPC endpoint (always failed); now uses the OpenAPI-spec path directly
  with honest heuristic/best-effort documentation for PK/FK/index fields
- storage tools now trim + URL-encode bucket/path segments before
  building request URLs (download, list, get_public_url,
  create_signed_url, delete_bucket, delete, and the upload API route)
- storage_create_signed_url guards against a missing signedURL field
  in the response instead of silently building a broken URL
- add supabase_storage_create_signed_upload_url, supabase_storage_update_bucket,
  and supabase_storage_empty_bucket tools + block wiring
- change insert/upsert `data` param type from 'array' to 'json' to match
  actual accepted shapes (array or single object)
- bump tool versions to semver (1.0 -> 1.0.0)
- rewrite a BlockMeta template that implied unsupported Supabase Auth
  Admin user-provisioning

(cherry picked from commit 52b655a)

* fix(supabase): address review feedback on update-bucket, signed upload url, and introspect

- storage_update_bucket now fetches the bucket's current config first
  and only overrides isPublic/fileSizeLimit/allowedMimeTypes when the
  caller explicitly provides them, instead of silently forcing
  public: false on every update (the Storage API's PUT is a full
  replace, not a patch)
- storage_create_signed_upload_url and storage_empty_bucket now check
  response.ok before surfacing an error, so a non-2xx response reports
  Supabase's actual error instead of a misleading parse-side message
- introspect.ts drops the spurious ?select=* query param from the
  OpenAPI spec request (meaningless on the root spec endpoint)

(cherry picked from commit 557e407)

* fix(supabase): tri-state bucket visibility on update, empty-string param coercion, introspect schema header

- introspect.ts now sends Accept-Profile when a schema param is given,
  matching the convention used by the other DB tools, so schema-scoped
  introspection actually reads from that schema's spec
- storage_update_bucket.ts treats an empty-string param the same as
  "not provided" (e.g. an untouched file size limit input no longer
  coerces to 0)
- the shared "Public Bucket" dropdown always sent an explicit true/false
  for storage_update_bucket (its default masked "not touched"), which
  could still flip a public bucket private; added a dedicated
  "Keep Current / True / False" control for the update operation so
  omitting a choice genuinely omits the isPublic override

(cherry picked from commit c80567b)

* fix(supabase): check response.ok before parsing storage_create_signed_url

Matches the pattern already applied to the new signed-upload-url tool
this session — a non-2xx response now surfaces Supabase's actual error
message instead of the generic "did not return a signed URL path" one.

(cherry picked from commit 9f40427)

* fix(supabase): correct download param semantics, echoed path field, and schema hint mismatch

Found by a second, per-tool parallel validation pass against live Supabase/PostgREST docs and source:

- storage_get_public_url.ts and storage_create_signed_url.ts sent
  download=true literally, which Supabase's Storage API treats as a
  filename override (renaming the downloaded file to "true") rather
  than a boolean flag; forcing a download while keeping the original
  filename requires an empty download= value
- storage_create_signed_url.ts also sent download in the POST body,
  which the sign endpoint ignores entirely — forcing download only
  works as a query param on the returned URL
- storage_create_signed_upload_url.ts read a `path` field from the API
  response that doesn't exist there; it now echoes the caller-supplied
  path, matching the official storage-js client
- introspect.ts's nullable heuristic didn't disclose that a NOT NULL
  column with a default is misreported as nullable (PostgREST omits it
  from the OpenAPI required list in that case); documented alongside
  the other already-disclosed heuristics, and removed a tautological
  schema-filter check left over from an earlier revision
- insert.ts/upsert.ts's `data` param reverted from 'json' back to
  'array': the 'json' type mapped to an LLM-facing JSON-schema type of
  'object', which contradicted the param's own description ("array of
  objects or a single object")

Author: waleedlatif1

apps/sim/app/api/tools/supabase/storage-upload/route.ts

@@ -11,6 +11,7 @@ import { processSingleFileToUserFile } from '@/lib/uploads/utils/file-utils'
 import { downloadServableFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
 import { docNotReadyResponse } from '@/lib/uploads/utils/servable-file-response'
 import { assertToolFileAccess } from '@/app/api/files/authorization'
+import { encodeStoragePath, encodeStorageSegment } from '@/tools/supabase/utils'
 
 export const dynamic = 'force-dynamic'
 
@@ -185,7 +186,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json({ success: false, error: projectValidation.error }, { status: 400 })
     }
 
-    const supabaseUrl = `https://${projectValidation.sanitized}.supabase.co/storage/v1/object/${validatedData.bucket}/${fullPath}`
+    const encodedBucket = encodeStorageSegment(validatedData.bucket)
+    const encodedPath = encodeStoragePath(fullPath)
+    const supabaseUrl = `https://${projectValidation.sanitized}.supabase.co/storage/v1/object/${encodedBucket}/${encodedPath}`
 
     const headers: Record<string, string> = {
       apikey: validatedData.apiKey,
@@ -248,7 +251,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       path: fullPath,
     })
 
-    const publicUrl = `https://${projectValidation.sanitized}.supabase.co/storage/v1/object/public/${validatedData.bucket}/${fullPath}`
+    const publicUrl = `https://${projectValidation.sanitized}.supabase.co/storage/v1/object/public/${encodedBucket}/${encodedPath}`
 
     return NextResponse.json({
       success: true,

apps/sim/blocks/blocks/supabase.ts

@@ -45,7 +45,10 @@ export const SupabaseBlock: BlockConfig<SupabaseResponse> = {
         { label: 'Storage: Copy File', id: 'storage_copy' },
         { label: 'Storage: Get Public URL', id: 'storage_get_public_url' },
         { label: 'Storage: Create Signed URL', id: 'storage_create_signed_url' },
+        { label: 'Storage: Create Signed Upload URL', id: 'storage_create_signed_upload_url' },
         { label: 'Storage: Create Bucket', id: 'storage_create_bucket' },
+        { label: 'Storage: Update Bucket', id: 'storage_update_bucket' },
+        { label: 'Storage: Empty Bucket', id: 'storage_empty_bucket' },
         { label: 'Storage: List Buckets', id: 'storage_list_buckets' },
         { label: 'Storage: Delete Bucket', id: 'storage_delete_bucket' },
       ],
@@ -686,9 +689,12 @@ Return ONLY the PostgREST filter expression - no explanations, no markdown, no e
           'storage_move',
           'storage_copy',
           'storage_create_bucket',
+          'storage_update_bucket',
+          'storage_empty_bucket',
           'storage_delete_bucket',
           'storage_get_public_url',
           'storage_create_signed_url',
+          'storage_create_signed_upload_url',
         ],
       },
       required: true,
@@ -919,19 +925,53 @@ Return ONLY the PostgREST filter expression - no explanations, no markdown, no e
       value: () => 'false',
       condition: { field: 'operation', value: 'storage_create_bucket' },
     },
+    {
+      id: 'updateIsPublic',
+      title: 'Public Bucket',
+      type: 'dropdown',
+      options: [
+        { label: 'Keep Current', id: '' },
+        { label: 'False (Private)', id: 'false' },
+        { label: 'True (Public)', id: 'true' },
+      ],
+      value: () => '',
+      condition: { field: 'operation', value: 'storage_update_bucket' },
+    },
     {
       id: 'fileSizeLimit',
       title: 'File Size Limit (bytes)',
       type: 'short-input',
       placeholder: '52428800',
-      condition: { field: 'operation', value: 'storage_create_bucket' },
+      condition: { field: 'operation', value: ['storage_create_bucket', 'storage_update_bucket'] },
+      mode: 'advanced',
     },
     {
       id: 'allowedMimeTypes',
       title: 'Allowed MIME Types (JSON array)',
       type: 'code',
       placeholder: '["image/png", "image/jpeg"]',
-      condition: { field: 'operation', value: 'storage_create_bucket' },
+      condition: { field: 'operation', value: ['storage_create_bucket', 'storage_update_bucket'] },
+      mode: 'advanced',
+    },
+    {
+      id: 'path',
+      title: 'Destination Path',
+      type: 'short-input',
+      placeholder: 'folder/file.jpg',
+      condition: { field: 'operation', value: 'storage_create_signed_upload_url' },
+      required: true,
+    },
+    {
+      id: 'upsert',
+      title: 'Allow Overwrite',
+      type: 'dropdown',
+      options: [
+        { label: 'False', id: 'false' },
+        { label: 'True', id: 'true' },
+      ],
+      value: () => 'false',
+      condition: { field: 'operation', value: 'storage_create_signed_upload_url' },
+      mode: 'advanced',
     },
   ],
   tools: {
@@ -955,10 +995,13 @@ Return ONLY the PostgREST filter expression - no explanations, no markdown, no e
       'supabase_storage_move',
       'supabase_storage_copy',
       'supabase_storage_create_bucket',
+      'supabase_storage_update_bucket',
+      'supabase_storage_empty_bucket',
       'supabase_storage_list_buckets',
       'supabase_storage_delete_bucket',
       'supabase_storage_get_public_url',
       'supabase_storage_create_signed_url',
+      'supabase_storage_create_signed_upload_url',
     ],
     config: {
       tool: (params) => {
@@ -1001,6 +1044,10 @@ Return ONLY the PostgREST filter expression - no explanations, no markdown, no e
             return 'supabase_storage_copy'
           case 'storage_create_bucket':
             return 'supabase_storage_create_bucket'
+          case 'storage_update_bucket':
+            return 'supabase_storage_update_bucket'
+          case 'storage_empty_bucket':
+            return 'supabase_storage_empty_bucket'
           case 'storage_list_buckets':
             return 'supabase_storage_list_buckets'
           case 'storage_delete_bucket':
@@ -1009,6 +1056,8 @@ Return ONLY the PostgREST filter expression - no explanations, no markdown, no e
             return 'supabase_storage_get_public_url'
           case 'storage_create_signed_url':
             return 'supabase_storage_create_signed_url'
+          case 'storage_create_signed_upload_url':
+            return 'supabase_storage_create_signed_upload_url'
           default:
             throw new Error(`Invalid Supabase operation: ${params.operation}`)
         }
@@ -1028,6 +1077,7 @@ Return ONLY the PostgREST filter expression - no explanations, no markdown, no e
           functionBody,
           functionHeaders,
           method,
+          updateIsPublic,
           ...rest
         } = params
 
@@ -1200,6 +1250,16 @@ Return ONLY the PostgREST filter expression - no explanations, no markdown, no e
           result.isPublic = parsedIsPublic
         }
 
+        // "Keep Current" (empty string) means the caller didn't choose to
+        // override visibility — omit `isPublic` entirely so the update
+        // tool preserves the bucket's existing public/private setting
+        // instead of defaulting to false.
+        if (operation === 'storage_update_bucket' && updateIsPublic !== undefined) {
+          if (updateIsPublic === 'true' || updateIsPublic === 'false') {
+            result.isPublic = updateIsPublic === 'true'
+          }
+        }
+
         if (normalizedFileData !== undefined) {
           result.fileData = normalizedFileData
         }
@@ -1254,6 +1314,11 @@ Return ONLY the PostgREST filter expression - no explanations, no markdown, no e
     search: { type: 'string', description: 'Search term for filtering' },
     expiresIn: { type: 'number', description: 'Expiration time in seconds for signed URL' },
     isPublic: { type: 'boolean', description: 'Whether bucket should be public' },
+    updateIsPublic: {
+      type: 'string',
+      description:
+        'Visibility override for bucket update: "" keeps the current value, "true"/"false" overrides it',
+    },
     fileSizeLimit: { type: 'number', description: 'Maximum file size in bytes' },
     allowedMimeTypes: { type: 'array', description: 'Array of allowed MIME types' },
   },
@@ -1281,7 +1346,15 @@ Return ONLY the PostgREST filter expression - no explanations, no markdown, no e
     },
     signedUrl: {
       type: 'string',
-      description: 'Temporary signed URL for storage file',
+      description: 'Temporary signed URL for storage file (download or upload)',
+    },
+    token: {
+      type: 'string',
+      description: 'Upload token embedded in the signed upload URL',
+    },
+    path: {
+      type: 'string',
+      description: 'Destination object path for the signed upload URL',
     },
     tables: {
       type: 'json',
@@ -1300,9 +1373,9 @@ export const SupabaseBlockMeta = {
   templates: [
     {
       icon: SupabaseIcon,
-      title: 'Supabase user provisioning',
+      title: 'Supabase customer record sync',
       prompt:
-        'Build a workflow that listens for Stripe new-customer events, provisions a Supabase user with the correct role and metadata, and emails the welcome login link.',
+        'Build a workflow that listens for Stripe new-customer events and upserts a row into a Supabase customers table with the correct plan and metadata, then emails a welcome message.',
       modules: ['agent', 'workflows'],
       category: 'operations',
       tags: ['enterprise', 'automation'],

apps/sim/tools/registry.ts

@@ -3707,14 +3707,17 @@ import {
   supabaseRpcTool,
   supabaseStorageCopyTool,
   supabaseStorageCreateBucketTool,
+  supabaseStorageCreateSignedUploadUrlTool,
   supabaseStorageCreateSignedUrlTool,
   supabaseStorageDeleteBucketTool,
   supabaseStorageDeleteTool,
   supabaseStorageDownloadTool,
+  supabaseStorageEmptyBucketTool,
   supabaseStorageGetPublicUrlTool,
   supabaseStorageListBucketsTool,
   supabaseStorageListTool,
   supabaseStorageMoveTool,
+  supabaseStorageUpdateBucketTool,
   supabaseStorageUploadTool,
   supabaseTextSearchTool,
   supabaseUpdateTool,
@@ -5218,10 +5221,13 @@ export const tools: Record<string, ToolConfig> = {
   supabase_storage_move: supabaseStorageMoveTool,
   supabase_storage_copy: supabaseStorageCopyTool,
   supabase_storage_create_bucket: supabaseStorageCreateBucketTool,
+  supabase_storage_update_bucket: supabaseStorageUpdateBucketTool,
+  supabase_storage_empty_bucket: supabaseStorageEmptyBucketTool,
   supabase_storage_list_buckets: supabaseStorageListBucketsTool,
   supabase_storage_delete_bucket: supabaseStorageDeleteBucketTool,
   supabase_storage_get_public_url: supabaseStorageGetPublicUrlTool,
   supabase_storage_create_signed_url: supabaseStorageCreateSignedUrlTool,
+  supabase_storage_create_signed_upload_url: supabaseStorageCreateSignedUploadUrlTool,
   tailscale_list_devices: tailscaleListDevicesTool,
   tailscale_get_device: tailscaleGetDeviceTool,
   tailscale_delete_device: tailscaleDeleteDeviceTool,

apps/sim/tools/supabase/count.ts

@@ -7,7 +7,7 @@ export const countTool: ToolConfig<SupabaseCountParams, SupabaseCountResponse> =
   id: 'supabase_count',
   name: 'Supabase Count',
   description: 'Count rows in a Supabase table',
-  version: '1.0',
+  version: '1.0.0',
 
   params: {
     projectId: {

apps/sim/tools/supabase/delete.ts

@@ -7,7 +7,7 @@ export const deleteTool: ToolConfig<SupabaseDeleteParams, SupabaseDeleteResponse
   id: 'supabase_delete',
   name: 'Supabase Delete Row',
   description: 'Delete rows from a Supabase table based on filter criteria',
-  version: '1.0',
+  version: '1.0.0',
 
   params: {
     projectId: {

apps/sim/tools/supabase/get_row.ts

@@ -7,7 +7,7 @@ export const getRowTool: ToolConfig<SupabaseGetRowParams, SupabaseGetRowResponse
   id: 'supabase_get_row',
   name: 'Supabase Get Row',
   description: 'Get a single row from a Supabase table based on filter criteria',
-  version: '1.0',
+  version: '1.0.0',
 
   params: {
     projectId: {

apps/sim/tools/supabase/index.ts

@@ -8,14 +8,17 @@ import { queryTool } from '@/tools/supabase/query'
 import { rpcTool } from '@/tools/supabase/rpc'
 import { storageCopyTool } from '@/tools/supabase/storage_copy'
 import { storageCreateBucketTool } from '@/tools/supabase/storage_create_bucket'
+import { storageCreateSignedUploadUrlTool } from '@/tools/supabase/storage_create_signed_upload_url'
 import { storageCreateSignedUrlTool } from '@/tools/supabase/storage_create_signed_url'
 import { storageDeleteTool } from '@/tools/supabase/storage_delete'
 import { storageDeleteBucketTool } from '@/tools/supabase/storage_delete_bucket'
 import { storageDownloadTool } from '@/tools/supabase/storage_download'
+import { storageEmptyBucketTool } from '@/tools/supabase/storage_empty_bucket'
 import { storageGetPublicUrlTool } from '@/tools/supabase/storage_get_public_url'
 import { storageListTool } from '@/tools/supabase/storage_list'
 import { storageListBucketsTool } from '@/tools/supabase/storage_list_buckets'
 import { storageMoveTool } from '@/tools/supabase/storage_move'
+import { storageUpdateBucketTool } from '@/tools/supabase/storage_update_bucket'
 import { storageUploadTool } from '@/tools/supabase/storage_upload'
 import { textSearchTool } from '@/tools/supabase/text_search'
 import { updateTool } from '@/tools/supabase/update'
@@ -45,3 +48,6 @@ export const supabaseStorageListBucketsTool = storageListBucketsTool
 export const supabaseStorageDeleteBucketTool = storageDeleteBucketTool
 export const supabaseStorageGetPublicUrlTool = storageGetPublicUrlTool
 export const supabaseStorageCreateSignedUrlTool = storageCreateSignedUrlTool
+export const supabaseStorageCreateSignedUploadUrlTool = storageCreateSignedUploadUrlTool
+export const supabaseStorageUpdateBucketTool = storageUpdateBucketTool
+export const supabaseStorageEmptyBucketTool = storageEmptyBucketTool

apps/sim/tools/supabase/insert.ts

@@ -7,7 +7,7 @@ export const insertTool: ToolConfig<SupabaseInsertParams, SupabaseInsertResponse
   id: 'supabase_insert',
   name: 'Supabase Insert',
   description: 'Insert data into a Supabase table',
-  version: '1.0',
+  version: '1.0.0',
 
   params: {
     projectId: {