@brightweblabs/module-orgs 0.7.1 → 0.7.3

package/brightweb.module.json

@@ -43,7 +43,9 @@
       "touch_organization_invitations_updated_at",
       "trg_touch_organization_invitations_updated_at",
       "normalize_organization_invitation_email",
-      "trg_normalize_organization_invitation_email"
+      "trg_normalize_organization_invitation_email",
+      "accept_organization_invitation",
+      "assign_organization_member_atomic"
     ]
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@brightweblabs/module-orgs",
   "private": false,
-  "version": "0.7.1",
+  "version": "0.7.3",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "files": [
@@ -25,10 +25,10 @@
     "@supabase/supabase-js": "^2.110.8",
     "lucide-react": "^1.26.0",
     "server-only": "^0.0.1",
-    "@brightweblabs/app-shell": "0.16.1",
-    "@brightweblabs/core-auth": "0.12.0",
-    "@brightweblabs/infra": "0.7.0",
-    "@brightweblabs/ui": "1.5.4"
+    "@brightweblabs/app-shell": "0.16.3",
+    "@brightweblabs/core-auth": "0.12.2",
+    "@brightweblabs/ui": "1.5.6",
+    "@brightweblabs/infra": "0.7.0"
   },
   "peerDependencies": {
     "react": "^19.0.0",

package/src/handlers.ts

@@ -25,10 +25,11 @@ import {
   createOrganizationsPostHandler,
 } from "./http";
 
-export function createOrganizationRequestHandlers(options?: { ensureCrmContactForProfile?: EnsureCrmContact }) {
+export function createOrganizationRequestHandlers(options?: { ensureCrmContactForProfile?: EnsureCrmContact; contactIntegration?: "database" }) {
   const inviteMembers: typeof inviteOrganizationMembers = (supabase, organizationId, invites, actorProfileId) =>
     inviteOrganizationMembers(supabase, organizationId, invites, actorProfileId, {
       ensureCrmContactForProfile: options?.ensureCrmContactForProfile,
+      contactIntegration: options?.contactIntegration,
     });
   const writeDependencies = {
     getCreateAccess: requireOrganizationsStaffAccess,

package/src/index.ts

@@ -33,6 +33,7 @@ export {
 } from "./handlers";
 export {
   ORGANIZATION_INVITE_EMAIL_DELIVERY_ERROR,
+  DATABASE_INVITATION_CONTACT_INTEGRATION,
   acceptOrganizationInvitation,
   getOrganizationInvitationDetails,
   inviteOrganizationMembers,

package/src/invitations.ts

@@ -1,5 +1,5 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
-import { syncOrganizationPrimaryContactFromAdmins, type OrganizationMemberRole } from "./data";
+import type { OrganizationMemberRole } from "./data";
 import { sendOrganizationInviteEmail } from "./invite-email";
 
 const INVITE_EXPIRY_DAYS = 14;
@@ -34,6 +34,7 @@ export type OrganizationInvitationDetails = {
   role: OrganizationMemberRole;
   status: OrganizationInvitation["status"];
   expiresAt: string;
+  acceptedByProfileId?: string | null;
 };
 
 export type OrganizationInviteSummary = {
@@ -180,7 +181,7 @@ export async function getOrganizationInvitationDetails(
 ): Promise<OrganizationInvitationDetails | null> {
   const { data, error } = await supabase
     .from("organization_invitations")
-    .select("id, organization_id, invited_email, role, status, expires_at, organizations(name)")
+    .select("id, organization_id, invited_email, role, status, expires_at, accepted_by_profile_id, organizations(name)")
     .eq("id", invitationId)
     .maybeSingle();
   if (error) throw new Error(error.message);
@@ -199,6 +200,7 @@ export async function getOrganizationInvitationDetails(
     role: raw.role === "admin" ? "admin" : "member",
     status: normalizeStatus(raw.status),
     expiresAt: String(raw.expires_at),
+    acceptedByProfileId: typeof raw.accepted_by_profile_id === "string" ? raw.accepted_by_profile_id : null,
   };
 }
 
@@ -264,8 +266,10 @@ export async function inviteOrganizationMembers(
   options?: {
     ensureCrmContactForProfile?: EnsureCrmContact;
     sendInviteEmail?: SendOrganizationInvite;
+    contactIntegration?: "database";
   },
 ): Promise<{ invitations: OrganizationInvitation[]; outcomes: OrganizationInviteOutcome[]; summary: OrganizationInviteSummary }> {
+  assertInvitationContactIntegration(options ?? {});
   const normalized = dedupeInviteDrafts(invites);
   const emptySummary = {
     pendingInvitations: 0,
@@ -280,12 +284,10 @@ export async function inviteOrganizationMembers(
   if (normalized.length === 0) return { invitations: [], outcomes: [], summary: emptySummary };
 
   const emails = normalized.map((invite) => invite.email);
-  const [{ data: existingMembers, error: memberError }, { data: profiles, error: profileError }, { data: existingInvitations, error: invitationError }] = await Promise.all([
-    supabase.from("organization_members").select("profile_id, role, profile:profiles!organization_members_profile_id_fkey(email)").eq("organization_id", organizationId),
+  const [{ data: profiles, error: profileError }, { data: existingInvitations, error: invitationError }] = await Promise.all([
     supabase.from("profiles").select("id, email").in("email", emails),
     supabase.from("organization_invitations").select("id, invited_email, role, status, expires_at").eq("organization_id", organizationId).in("invited_email", emails),
   ]);
-  if (memberError) throw new Error(memberError.message);
   if (profileError) throw new Error(profileError.message);
   if (invitationError) throw new Error(invitationError.message);
   const { data: organization, error: organizationError } = await supabase
@@ -296,14 +298,6 @@ export async function inviteOrganizationMembers(
   if (organizationError) throw new Error(organizationError.message);
   const organizationName = organization?.name?.trim() || "Organização";
 
-  const memberByEmail = new Map<string, { profileId: string; role: OrganizationMemberRole }>();
-  for (const row of existingMembers ?? []) {
-    const rawProfile = Array.isArray(row.profile) ? row.profile[0] ?? null : row.profile;
-    const email = rawProfile && typeof rawProfile.email === "string" ? normalizeEmail(rawProfile.email) : "";
-    if (email && typeof row.profile_id === "string") {
-      memberByEmail.set(email, { profileId: row.profile_id, role: row.role === "admin" ? "admin" : "member" });
-    }
-  }
   const profileByEmail = new Map<string, string>();
   for (const profile of profiles ?? []) {
     if (typeof profile.id === "string" && typeof profile.email === "string") {
@@ -325,76 +319,38 @@ export async function inviteOrganizationMembers(
   }
 
   const pendingRows: Array<Record<string, unknown>> = [];
-  const resolvedProfilesByEmail = new Map<string, string>();
   const outcomes: OrganizationInviteOutcome[] = [];
   let directAssignments = 0;
   let updatedExistingMembers = 0;
   let unchangedExistingMembers = 0;
   for (const invite of normalized) {
-    const member = memberByEmail.get(invite.email);
-    if (member) {
-      if (member.role === invite.role) {
-        if (options?.ensureCrmContactForProfile) {
-          const linked = await options.ensureCrmContactForProfile(member.profileId, {
-            source: "organization_member_direct_access", organizationId, serviceClient: supabase,
-          });
-          if (!linked.success) {
-            outcomes.push({ email: invite.email, role: invite.role, status: "api_failed", profileId: member.profileId, message: "Não foi possível ligar o contacto CRM.", failureKind: "crm_link" });
-            continue;
-          }
-        }
-        unchangedExistingMembers += 1;
-        outcomes.push({ email: invite.email, role: invite.role, status: "already_member", profileId: member.profileId });
-      }
-      else {
-        const { error } = await supabase.from("organization_members").update({ role: invite.role })
-          .eq("organization_id", organizationId).eq("profile_id", member.profileId);
-        if (error) {
-          outcomes.push({ email: invite.email, role: invite.role, status: "api_failed", profileId: member.profileId, message: "Não foi possível atualizar a função do membro.", failureKind: "membership" });
-          continue;
-        }
-        if (options?.ensureCrmContactForProfile) {
-          const linked = await options.ensureCrmContactForProfile(member.profileId, {
-            source: "organization_member_direct_access", organizationId, serviceClient: supabase,
-          });
-          if (!linked.success) {
-            const { error: rollbackError } = await supabase.from("organization_members").update({ role: member.role })
-              .eq("organization_id", organizationId).eq("profile_id", member.profileId);
-            outcomes.push({ email: invite.email, role: invite.role, status: "api_failed", profileId: member.profileId, message: rollbackError ? "Não foi possível ligar o contacto CRM nem reverter a alteração de função; é necessária reconciliação." : "Não foi possível ligar o contacto CRM; a alteração de função foi revertida.", failureKind: "crm_link" });
-            continue;
-          }
-        }
-        updatedExistingMembers += 1;
-        outcomes.push({ email: invite.email, role: invite.role, status: "membership_updated", profileId: member.profileId });
-      }
-      resolvedProfilesByEmail.set(invite.email, member.profileId);
-      continue;
-    }
     const profileId = profileByEmail.get(invite.email);
     if (profileId) {
-      const { error } = await supabase.from("organization_members").upsert({
-        organization_id: organizationId,
-        profile_id: profileId,
-        role: invite.role,
-      }, { onConflict: "organization_id,profile_id" });
-      if (error) {
-        outcomes.push({ email: invite.email, role: invite.role, status: "api_failed", profileId, message: "Não foi possível conceder o acesso à organização.", failureKind: "membership" });
-        continue;
-      }
-      if (options?.ensureCrmContactForProfile) {
-        const linked = await options.ensureCrmContactForProfile(profileId, {
-          source: "organization_member_direct_access", organizationId, serviceClient: supabase,
+      // The database resolves current membership under lock and rolls back only
+      // this transaction's writes. Never compensate from an earlier snapshot.
+      const { data, error } = await supabase.rpc("assign_organization_member_atomic", {
+        p_organization_id: organizationId,
+        p_profile_id: profileId,
+        p_email: invite.email,
+        p_role: invite.role,
+        p_actor_profile_id: actorProfileId,
+      });
+      const status = data?.status;
+      if (error || !["immediate_access", "membership_updated", "already_member"].includes(status)) {
+        const contactFailure = error?.code === "BW001";
+        outcomes.push({
+          email: invite.email, role: invite.role, status: "api_failed", profileId,
+          message: contactFailure
+            ? "Não foi possível ligar o contacto CRM. Nenhuma alteração de acesso foi guardada."
+            : "Não foi possível confirmar a alteração de acesso à organização. Tente novamente.",
+          failureKind: contactFailure ? "crm_link" : "membership",
         });
-        if (!linked.success) {
-          const { error: rollbackError } = await supabase.from("organization_members").delete()
-            .eq("organization_id", organizationId).eq("profile_id", profileId);
-          outcomes.push({ email: invite.email, role: invite.role, status: "api_failed", profileId, message: rollbackError ? "Não foi possível ligar o contacto CRM nem reverter o acesso; é necessária reconciliação." : "Não foi possível ligar o contacto CRM; o acesso não foi mantido.", failureKind: "crm_link" });
-          continue;
-        }
+        continue;
       }
-      resolvedProfilesByEmail.set(invite.email, profileId);
-      directAssignments += 1;
-      outcomes.push({ email: invite.email, role: invite.role, status: "immediate_access", profileId });
+      if (status === "immediate_access") directAssignments += 1;
+      else if (status === "membership_updated") updatedExistingMembers += 1;
+      else unchangedExistingMembers += 1;
+      outcomes.push({ email: invite.email, role: invite.role, status, profileId });
       continue;
     }
     const pendingInvitation = pendingInvitationByEmail.get(invite.email);
@@ -416,21 +372,6 @@ export async function inviteOrganizationMembers(
     });
   }
 
-  if (directAssignments > 0 || updatedExistingMembers > 0) {
-    try { await syncOrganizationPrimaryContactFromAdmins(supabase, organizationId); } catch { /* Retry on the next idempotent member operation. */ }
-  }
-  if (resolvedProfilesByEmail.size > 0) {
-    const acceptedAt = new Date().toISOString();
-    await Promise.all(Array.from(resolvedProfilesByEmail, async ([email, profileId]) => {
-      const { error } = await supabase.from("organization_invitations").update({
-        status: "accepted",
-        accepted_at: acceptedAt,
-        accepted_by_profile_id: profileId,
-      }).eq("organization_id", organizationId).eq("invited_email", email).eq("status", "pending");
-      // Access is already effective. Leave a pending row for the next idempotent call to reconcile.
-      if (error) return;
-    }));
-  }
   if (pendingRows.length > 0) {
     const { error } = await supabase.from("organization_invitations").upsert(pendingRows, {
       onConflict: "organization_id,invited_email",
@@ -467,22 +408,24 @@ export async function inviteOrganizationMembers(
       }),
     })));
     const failedIds = deliveries.filter((result) => !result.delivered).map((result) => result.id);
+    let cleanupFailed = false;
     if (failedIds.length > 0) {
       const { error: deleteError } = await supabase
         .from("organization_invitations")
         .delete()
         .in("id", failedIds)
         .eq("status", "pending");
-      // Preserve the email failure outcome. A remaining row is safe to revoke/retry and stays visible as pending.
-      void deleteError;
+      cleanupFailed = Boolean(deleteError);
     }
     for (const delivery of deliveries) {
       outcomes.push({
         email: delivery.email,
         role: delivery.role,
         status: delivery.delivered ? "pending_invitation" : "email_failed",
-        invitationId: delivery.delivered ? delivery.id : undefined,
-        message: delivery.delivered ? undefined : ORGANIZATION_INVITE_EMAIL_DELIVERY_ERROR,
+        invitationId: delivery.delivered || cleanupFailed ? delivery.id : undefined,
+        message: delivery.delivered ? undefined : cleanupFailed
+          ? "Não foi possível enviar o email. O convite pendente foi mantido; reenvie-o ou revogue-o."
+          : ORGANIZATION_INVITE_EMAIL_DELIVERY_ERROR,
       });
     }
   }
@@ -572,61 +515,22 @@ export async function acceptOrganizationInvitation(
     invitationId: string;
     profileId: string;
     userEmail: string;
-    ensureCrmContactForProfile: EnsureCrmContact;
+    ensureCrmContactForProfile?: EnsureCrmContact;
+    contactIntegration?: "database";
   },
 ): Promise<{ organizationId: string }> {
-  const email = normalizeEmail(params.userEmail);
-  const { data: invitation, error } = await supabase
-    .from("organization_invitations")
-    .select("id, organization_id, invited_email, role, status, expires_at")
-    .eq("id", params.invitationId)
-    .maybeSingle<{ id: string; organization_id: string; invited_email: string; role: string; status: string; expires_at: string }>();
-  if (error) throw new Error(error.message);
-  if (!invitation?.id) throw new Error("Convite não encontrado.");
-  if (normalizeEmail(invitation.invited_email) !== email) throw new Error("Este convite pertence a outro email.");
-  if (invitation.status !== "pending") throw new Error("Este convite já não está disponível.");
-  if (isInvitationExpired(invitation.expires_at)) {
-    const { error: expireError } = await supabase.from("organization_invitations")
-      .update({ status: "expired" }).eq("id", invitation.id);
-    if (expireError) throw new Error(expireError.message);
-    throw new Error("Este convite expirou.");
-  }
-
-  const acceptedContact = await params.ensureCrmContactForProfile(params.profileId, {
-    source: "organization_invitation_accept",
-    organizationId: invitation.organization_id,
-    serviceClient: supabase,
+  assertInvitationContactIntegration(params);
+  const { data, error } = await supabase.rpc("accept_organization_invitation", {
+    p_invitation_id: params.invitationId,
+    p_profile_id: params.profileId,
+    p_user_email: normalizeEmail(params.userEmail),
   });
-  if (!acceptedContact.success) {
-    throw new Error(acceptedContact.error ?? "Não foi possível associar o contacto CRM ao convite.");
+  if (error) throw new Error(error.message);
+  if (data?.status === "expired") throw new Error("Este convite expirou.");
+  if (data?.status !== "accepted" || typeof data.organizationId !== "string") {
+    throw new Error("Não foi possível confirmar a aceitação do convite.");
   }
-  const role: OrganizationMemberRole = invitation.role === "admin" ? "admin" : "member";
-  const { error: memberError } = await supabase.from("organization_members").upsert({
-    organization_id: invitation.organization_id,
-    profile_id: params.profileId,
-    role,
-  }, { onConflict: "organization_id,profile_id" });
-  if (memberError) throw new Error(memberError.message);
-  if (role === "admin") await syncOrganizationPrimaryContactFromAdmins(supabase, invitation.organization_id);
-  const { error: updateError } = await supabase.from("organization_invitations").update({
-    status: "accepted",
-    accepted_at: new Date().toISOString(),
-    accepted_by_profile_id: params.profileId,
-    accepted_contact_id: acceptedContact.contactId ?? null,
-  }).eq("id", invitation.id);
-  if (updateError) throw new Error(updateError.message);
-  await logOrganizationActivity(supabase, {
-    actorProfileId: params.profileId,
-    organizationId: invitation.organization_id,
-    eventType: "crm_organization_invitation_accepted",
-    summary: "Convite de organização aceite.",
-    payload: {
-      invitation_id: invitation.id,
-      organization_id: invitation.organization_id,
-      email,
-    },
-  });
-  return { organizationId: invitation.organization_id };
+  return { organizationId: data.organizationId };
 }
 
 export async function registerUserFromOrganizationInvitation(
@@ -636,13 +540,26 @@ export async function registerUserFromOrganizationInvitation(
     firstName: string;
     lastName: string;
     password: string;
-    ensureCrmContactForProfile: EnsureCrmContact;
+    ensureCrmContactForProfile?: EnsureCrmContact;
+    contactIntegration?: "database";
   },
 ): Promise<{ email: string; organizationId: string }> {
+  assertInvitationContactIntegration(params);
   const invitation = await getOrganizationInvitationDetails(supabase, params.invitationId);
   if (!invitation) throw new Error("INVITATION_NOT_FOUND");
-  if (invitation.status !== "pending") throw new Error("INVITATION_NOT_AVAILABLE");
-  if (isInvitationExpired(invitation.expiresAt)) {
+  if (invitation.status !== "pending" && invitation.status !== "accepted") throw new Error("INVITATION_NOT_AVAILABLE");
+  if (invitation.status === "accepted") {
+    if (!invitation.acceptedByProfileId) throw new Error("INVITATION_NOT_AVAILABLE");
+    const accepted = await acceptOrganizationInvitation(supabase, {
+      invitationId: invitation.id,
+      profileId: invitation.acceptedByProfileId,
+      userEmail: invitation.invitedEmail,
+      ensureCrmContactForProfile: params.ensureCrmContactForProfile,
+      contactIntegration: params.contactIntegration,
+    });
+    return { email: invitation.invitedEmail, ...accepted };
+  }
+  if (invitation.status === "pending" && isInvitationExpired(invitation.expiresAt)) {
     const { error } = await supabase.from("organization_invitations")
       .update({ status: "expired" }).eq("id", invitation.id).eq("status", "pending");
     if (error) throw new Error(error.message);
@@ -658,31 +575,40 @@ export async function registerUserFromOrganizationInvitation(
     user_metadata: { first_name: firstName || null, last_name: lastName || null },
   });
   let userId = data.user?.id ?? null;
-  let createdUserId = userId;
   if (error) {
     if (!isExistingAccountError(error)) throw new Error(error.message);
     userId = await findAuthUserIdByEmail(supabase, invitation.invitedEmail);
     if (!userId) throw new Error("ACCOUNT_ALREADY_EXISTS");
-    createdUserId = null;
   }
   if (!userId) throw new Error("Não foi possível criar utilizador.");
 
-  try {
-    const profile = await ensureInvitationProfile(supabase, {
-      userId,
-      email: invitation.invitedEmail,
-      firstName,
-      lastName,
-    });
-    await acceptOrganizationInvitation(supabase, {
-      invitationId: invitation.id,
-      profileId: profile.id,
-      userEmail: invitation.invitedEmail,
-      ensureCrmContactForProfile: params.ensureCrmContactForProfile,
-    });
-  } catch (caught) {
-    if (createdUserId) await supabase.auth.admin.deleteUser(createdUserId);
-    throw caught;
+  // A failed/unknown RPC response must not delete an identity whose acceptance
+  // may have committed. The next registration attempt resolves the same account.
+  const profile = await ensureInvitationProfile(supabase, {
+    userId,
+    email: invitation.invitedEmail,
+    firstName,
+    lastName,
+  });
+  const accepted = await acceptOrganizationInvitation(supabase, {
+    invitationId: invitation.id,
+    profileId: profile.id,
+    userEmail: invitation.invitedEmail,
+    ensureCrmContactForProfile: params.ensureCrmContactForProfile,
+    contactIntegration: params.contactIntegration,
+  });
+  return { email: invitation.invitedEmail, ...accepted };
+}
+
+/** Marks a stock callback whose invitation behavior is implemented by the shipped SQL hook. */
+export const DATABASE_INVITATION_CONTACT_INTEGRATION = Symbol.for("brightweb.orgs.database-invitation-contact-integration.v1");
+
+function assertInvitationContactIntegration(params: {
+  ensureCrmContactForProfile?: EnsureCrmContact;
+  contactIntegration?: "database";
+}): void {
+  if (params.ensureCrmContactForProfile && params.contactIntegration !== "database" &&
+      Reflect.get(params.ensureCrmContactForProfile, DATABASE_INVITATION_CONTACT_INTEGRATION) !== true) {
+    throw new Error("INVITATION_CONTACT_INTEGRATION_MIGRATION_REQUIRED");
   }
-  return { email: invitation.invitedEmail, organizationId: invitation.organizationId };
 }