@rigstate/mcp 0.7.2 → 0.7.3

package/dist/index.js

@@ -2211,8 +2211,11 @@ including active roadmap steps and council session feedback.`,
   }
 });
 async function getLatestDecisions(supabase, userId, projectId, limit = 5) {
-  const { data: project, error: projectError } = await supabase.from("projects").select("id").eq("id", projectId).eq("owner_id", userId).single();
-  if (projectError || !project) {
+  const { data: hasAccess, error: accessError } = await supabase.rpc("check_project_access_secure", {
+    p_project_id: projectId,
+    p_user_id: userId
+  });
+  if (accessError || !hasAccess) {
     throw new Error("Project not found or access denied");
   }
   const { data: sessionData, error: sessionError } = await supabase.from("council_sessions").select("id, project_id, recruited_agents, feedback_summary, duration_ms, sprints_count, tasks_count, created_at").eq("project_id", projectId).order("created_at", { ascending: false }).limit(limit);
@@ -2767,8 +2770,11 @@ Shows active and locked steps with their step numbers.`,
   }
 });
 async function listRoadmapTasks(supabase, userId, projectId) {
-  const { data: project, error: projectError } = await supabase.from("projects").select("id").eq("id", projectId).eq("owner_id", userId).single();
-  if (projectError || !project) {
+  const { data: hasAccess, error: accessError } = await supabase.rpc("check_project_access_secure", {
+    p_project_id: projectId,
+    p_user_id: userId
+  });
+  if (accessError || !hasAccess) {
     throw new Error("Project not found or access denied");
   }
   const { data: tasks, error } = await supabase.from("roadmap_chunks").select("id, title, priority, status, step_number, prompt_content").eq("project_id", projectId).neq("status", "COMPLETED").order("priority", { ascending: false }).order("step_number", { ascending: true });
@@ -3617,8 +3623,8 @@ registry.register({
 });
 async function saveToProjectBrain(supabase, userId, input) {
   const { projectId, title, content, category, tags } = input;
-  const { data: p, error: pErr } = await supabase.from("projects").select("id").eq("id", projectId).eq("owner_id", userId).single();
-  if (pErr || !p) throw new Error("Access denied");
+  const { data: hasAccess, error: accessError } = await supabase.rpc("check_project_access_secure", { p_project_id: projectId, p_user_id: userId });
+  if (accessError || !hasAccess) throw new Error("Access denied");
   const fullContent = `# ${title}
 
 ${content}`;
@@ -3640,6 +3646,8 @@ ${content}`;
 }
 async function updateRoadmapStatus(supabase, userId, input) {
   const { projectId, chunkId, status } = input;
+  const { data: hasAccess, error: accessError } = await supabase.rpc("check_project_access_secure", { p_project_id: projectId, p_user_id: userId });
+  if (accessError || !hasAccess) throw new Error("Access denied");
   const dbStatus = status === "TODO" ? "LOCKED" : status === "IN_PROGRESS" ? "ACTIVE" : "COMPLETED";
   const { error } = await supabase.from("roadmap_chunks").update({ status: dbStatus }).eq("id", chunkId).eq("project_id", projectId);
   if (error) throw new Error(`Update failed: ${error.message}`);
@@ -3653,6 +3661,8 @@ async function updateRoadmapStatus(supabase, userId, input) {
 }
 async function addRoadmapChunk(supabase, userId, input) {
   const { projectId, title, description, priority } = input;
+  const { data: hasAccess, error: accessError } = await supabase.rpc("check_project_access_secure", { p_project_id: projectId, p_user_id: userId });
+  if (accessError || !hasAccess) throw new Error("Access denied");
   const { data: maxStep } = await supabase.from("roadmap_chunks").select("step_number").eq("project_id", projectId).order("step_number", { ascending: false }).limit(1).single();
   const nextStepNum = (maxStep?.step_number || 0) + 1;
   const { data, error } = await supabase.from("roadmap_chunks").insert({