feat: add invite codes

[Pertempto]

No description provided.

[supabase]

Updates to Preview Branch (add-invite-codes) ↗︎

Deployments	Status	Updated
Database	✅	Fri, 21 Nov 2025 13:08:50 UTC
Services	✅	Fri, 21 Nov 2025 13:08:50 UTC
APIs	✅	Fri, 21 Nov 2025 13:08:50 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Fri, 21 Nov 2025 13:08:51 UTC
Migrations	✅	Fri, 21 Nov 2025 13:08:51 UTC
Seeding	✅	Fri, 21 Nov 2025 13:08:52 UTC
Edge Functions	✅	Fri, 21 Nov 2025 13:08:53 UTC

---

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

[github-actions]

Changes Requested

Please address the following before I can approve this PR:

• Fix server-side Supabase client usage:

  • Update src/pages/invites.astro to use a real exported server client factory (implement/export createSupabaseServerClient) or switch to a JWT-based flow (extract JWT from cookies and call a proper client factory). The page currently calls a non-existent createSupabaseServerClient and will break at runtime.
  • Make createSupabaseWithJWT and the API routes consistent: either set the JWT correctly on the server client or call supabase.auth.getUser({ token }) in src/pages/api/invites/create.ts and src/pages/api/invites/revoke.ts. Verify the createServerClient options are valid for your Supabase SDK version.

• Fix API auth and token handling:

  • Ensure the API routes validate the token with the correct Supabase SDK call and do not rely on unsupported global.headers shapes.
  • Add an integration/unit test that exercises /api/invites/create authentication (happy path and missing/invalid token).

• Replace blocking browser dialogs and improve client-side resiliency:

  • In src/components/react/InviteManager.tsx replace confirm() and alert() with a UI modal/toast pattern and guard navigator and clipboard calls. Do not call createSupabaseBrowserClient() before checking for window availability.

• Remove or gate debug artifacts and accidental changes:

  • Remove the Debug author association step and echoed debug lines from .github/workflows/opencode.yml before merging.

• Migration safety:

  • supabase/migrations/20251119112252_update_category_id_type.sql drops a constraint without if exists — revert to if exists or ensure this migration will not fail on target DBs.

Summary of Changes

• Adds invite management UI and InviteManager component with create, copy, share, revoke functionality.
• Introduces API endpoints: src/pages/api/invites/create.ts and src/pages/api/invites/revoke.ts to create/revoke invites.
• Adds DB schema changes: supabase/schemas/08_invites.sql, supabase/schemas/11_storage.sql, new migrations and seeds for invites.
• Adds server helper createSupabaseWithJWT in src/lib/auth.ts and new large src/lib/database.types.ts file.
• Adds layout and UI components: Breadcrumbs, PageHeader, Card, Button variant danger, and updates dashboard.astro.
• Adds new theme error color variables and seeds adjustments.

Overall Feedback

• Concerns (needs work):

  • The server auth flow currently has critical issues that will break the invites page and API routes in production (missing server client function and inconsistent token handling). The API routes also rely on a client setup that may be incompatible with the Supabase SDK — please correct and add tests. The direct use of blocking browser dialogs in InviteManager and unsafely using browser-only APIs reduce reliability and testability. Also revert or gate debugging artifacts in CI/workflow files.

• Positive:

  • The invite feature is implemented thoughtfully: UI, rate-limit check via DB function, collision-safe code generation, and storage RLS policies show good end-to-end design. The InviteManager UX is comprehensive (history, active invites, revoke/share) and the DB types and schemas are thorough. Nice work moving much of the logic into server-controlled checks and using RLS for critical constraints — this is the right approach for invite-security. 🎉

I left a few inline comments with the highest-impact issues. Ping me once you push fixes and tests and I’ll re-review quickly. @Pertempto