spine-framework 0.3.133 → 0.3.135

package/.framework/functions/invites.ts

@@ -137,7 +137,7 @@ function isAdminRole(roleSlug: string | undefined): boolean {
 // CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-export const checkFirstUser = createHandler(async (_ctx, _body) => {
+export const checkFirstUser = createPublicHandler(async (_ctx, _body) => {
   const { count, error } = await adminDb
     .from('people')
     .select('*', { count: 'exact', head: true })
@@ -161,7 +161,7 @@ export const checkFirstUser = createHandler(async (_ctx, _body) => {
 // CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-export const checkDomain = createHandler(async (_ctx, _body) => {
+export const checkDomain = createPublicHandler(async (_ctx, _body) => {
   const email = _ctx.query?.email as string | undefined
   if (!email || !email.includes('@')) {
     throw new Error('Valid email is required')
@@ -175,12 +175,13 @@ export const checkDomain = createHandler(async (_ctx, _body) => {
 
   const { data } = await adminDb
     .from('people')
-    .select('id')
+    .select('account_id')
     .ilike('email', `%@${domain}`)
     .eq('status', 'active')
     .limit(1)
 
-  return { match: (data?.length ?? 0) > 0 }
+  const first = data?.[0]
+  return { match: !!first, account_id: first?.account_id ?? null }
 })
 // CIL[END chunk_id="invites_checkdomain_1783968140"]
 // CIL[BEGIN chunk_id="invites_validatetoken_1783968140" type="function" identity="validateToken" parent="none"]
@@ -197,7 +198,7 @@ export const checkDomain = createHandler(async (_ctx, _body) => {
 // CIL[DOC-VECTOR type="constraint" content="No test paths identified."]
 // CIL[DOC-VECTOR type="implementation_pattern" content="" status="pending_human_input"]
 // CIL[DOC-VECTOR type="user_journey" content="" status="pending_human_input"]
-export const validateToken = createHandler(async (_ctx, _body) => {
+export const validateToken = createPublicHandler(async (_ctx, _body) => {
   const token = _ctx.query?.token as string | undefined
   if (!token) throw new Error('Token is required')
 

package/.framework/migrations/010_auth_user_trigger.sql

@@ -0,0 +1,82 @@
+-- Create trigger function to sync new auth users to people records
+CREATE OR REPLACE FUNCTION public.handle_new_auth_user()
+RETURNS TRIGGER LANGUAGE plpgsql SECURITY DEFINER SET search_path = public AS $$
+DECLARE
+  v_account_id         uuid;
+  v_type_id            uuid;
+  v_role_id            uuid;
+  v_is_first           boolean;
+  v_design_schema      jsonb;
+  v_validation_schema  jsonb;
+  v_stub_id            uuid;
+  v_stub_status        text;
+BEGIN
+  SELECT id INTO v_account_id FROM public.accounts WHERE slug = 'spine-system' LIMIT 1;
+  SELECT id, design_schema, validation_schema
+    INTO v_type_id, v_design_schema, v_validation_schema
+  FROM public.types WHERE kind = 'person' AND slug = 'person' LIMIT 1;
+
+  IF v_account_id IS NULL OR v_type_id IS NULL THEN
+    RAISE WARNING 'handle_new_auth_user: spine-system account or person type not found — skipping';
+    RETURN NEW;
+  END IF;
+
+  SELECT id, status
+    INTO v_stub_id, v_stub_status
+  FROM public.people
+  WHERE email = NEW.email
+    AND status IN ('invited', 'pending')
+    AND auth_uid IS NULL
+  LIMIT 1;
+
+  IF v_stub_id IS NOT NULL THEN
+    UPDATE public.people SET
+      auth_uid   = NEW.id,
+      full_name  = COALESCE(NEW.raw_user_meta_data->>'full_name', full_name, split_part(NEW.email, '@', 1)),
+      status     = CASE WHEN v_stub_status = 'invited' THEN 'active' ELSE 'pending' END,
+      updated_at = now()
+    WHERE id = v_stub_id;
+
+    RETURN NEW;
+  END IF;
+
+  SELECT NOT EXISTS (SELECT 1 FROM public.people LIMIT 1) INTO v_is_first;
+  IF v_is_first THEN
+    SELECT id INTO v_role_id FROM public.roles WHERE slug = 'system_admin' LIMIT 1;
+  END IF;
+
+  INSERT INTO public.people (
+    id,
+    auth_uid,
+    email,
+    full_name,
+    account_id,
+    type_id,
+    role_id,
+    status,
+    is_active,
+    design_schema,
+    validation_schema
+  ) VALUES (
+    NEW.id,
+    NEW.id,
+    NEW.email,
+    COALESCE(NEW.raw_user_meta_data->>'full_name', split_part(NEW.email, '@', 1)),
+    v_account_id,
+    v_type_id,
+    v_role_id,
+    'active',
+    true,
+    v_design_schema,
+    COALESCE(v_validation_schema, '{}'::jsonb)
+  )
+  ON CONFLICT (id) DO NOTHING;
+
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS on_auth_user_created ON auth.users;
+CREATE TRIGGER on_auth_user_created
+  AFTER INSERT ON auth.users
+  FOR EACH ROW EXECUTE FUNCTION public.handle_new_auth_user();

package/.framework/migrations/011_spine_system_account.sql

@@ -0,0 +1,15 @@
+-- Seed the Spine system master account required by the auth trigger and existing-account registration flow
+INSERT INTO public.accounts (id, slug, display_name, description, data, is_active, design_schema, validation_schema, type_id)
+SELECT
+  gen_random_uuid(),
+  'spine-system',
+  'Spine System',
+  'Master system account for internal Spine operations',
+  '{}'::jsonb,
+  true,
+  '{}'::jsonb,
+  '{}'::jsonb,
+  id
+FROM public.types
+WHERE kind = 'account' AND slug = 'account'
+ON CONFLICT (slug) DO NOTHING;

package/.framework/src/pages/auth/RegisterPage.tsx

@@ -262,8 +262,8 @@ export function RegisterPage() {
     const result = await callInvitesApi('check-domain', { email })
     setDomainCheckLoading(false)
 
-    if (result.data?.match) {
-      setDomainMatchAccountId('__matched__')
+    if (result.data?.match && result.data?.account_id) {
+      setDomainMatchAccountId(result.data.account_id)
     }
   }, [email, inviteToken, useType, isFirstUser])
 
@@ -323,23 +323,22 @@ export function RegisterPage() {
 
       const completeRegistrationParams: any = {
         email: resolvedEmail,
-        full_name: fullName,
-        app: effectiveApp,
-        role: effectiveRole,
-        redirect: getPostRegistrationRedirect(regConfig, searchParams, false, effectiveRole),
+        path: 'new_account',
+        role_slug: effectiveRole,
       }
 
       if (useType === 'company') {
-        completeRegistrationParams.account_name = companyName
+        completeRegistrationParams.account_name = companyName || fullName || email.split('@')[0]
+      } else {
+        completeRegistrationParams.account_name = fullName || email.split('@')[0]
       }
 
       if (effectiveAccountStrategy === 'existing' && targetAccount) {
-        completeRegistrationParams.account_id = targetAccount
-        completeRegistrationParams.strategy = 'join_request'
-      } else if (domainMatchAccountId === '__matched__' && domainMatchChoice === 'join') {
-        completeRegistrationParams.strategy = 'join_request'
-      } else {
-        completeRegistrationParams.strategy = 'new_account'
+        completeRegistrationParams.path = 'existing_account'
+        completeRegistrationParams.target_account = targetAccount
+      } else if (domainMatchAccountId && domainMatchChoice === 'join') {
+        completeRegistrationParams.path = 'join_request'
+        completeRegistrationParams.target_account_id = domainMatchAccountId
       }
 
       const result = await callInvitesApi('complete-registration', completeRegistrationParams, 'POST')
@@ -367,7 +366,7 @@ export function RegisterPage() {
   const isInvite = !!inviteToken && !tokenError
   const showPersonalCompanyToggle = !isInvite && !isFirstUser
   const showCompanyName = showPersonalCompanyToggle && useType === 'company'
-  const showDomainMatchChoice = domainMatchAccountId === '__matched__' && !isInvite && !isFirstUser
+  const showDomainMatchChoice = !!domainMatchAccountId && !isInvite && !isFirstUser
 
   if (tokenLoading || isFirstUser === null || (!isFirstUser && !isInvite && !regConfig)) {
     return (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spine-framework",
-  "version": "0.3.133",
+  "version": "0.3.135",
   "description": "Multi-tenant, modular application platform for modern SaaS systems",
   "type": "module",
   "bin": {
@@ -25,6 +25,8 @@
     ".framework/migrations/007_kb_article_list.sql",
     ".framework/migrations/008_items_target.sql",
     ".framework/migrations/009_roles_slug_unique.sql",
+    ".framework/migrations/010_auth_user_trigger.sql",
+    ".framework/migrations/011_spine_system_account.sql",
     ".framework/public/",
     ".framework/scripts/",
     ".framework/seeds/",