feat(release): prepare 1.1.0 candidate

server/supabase/functions/team-accept/index.ts

@@ -1,116 +1,105 @@
-// server/supabase/functions/team-accept/index.ts
-// 팀 초대 수락 — token 검증 후 team_members에 추가.
-
+import { createClient } from '@supabase/supabase-js'
+import { requireUser } from '../_shared/auth.ts'
 import { corsHeaders, handleCorsPreflightRequest } from '../_shared/cors.ts'
-import { requireUser, authErrorResponse, type AuthError } from '../_shared/auth.ts'
-import { createServiceRoleClient } from '../_shared/quota.ts'
+import {
+  mapTeamRpcError,
+  parseTeamAcceptInput,
+  TeamContractError,
+} from '../_shared/team-contract.ts'
 
-interface AcceptRequest {
-  token: string
+const JSON_HEADERS = {
+  ...corsHeaders,
+  'Content-Type': 'application/json',
+  'Cache-Control': 'no-store',
+  Pragma: 'no-cache',
+}
+const REQUEST_LIMIT_BYTES = 4 * 1024
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+
+interface AcceptRpcResult {
+  team_id: string
+  role: 'owner' | 'admin' | 'member'
+  duplicate: boolean
+  already_member: boolean
+}
+
+function jsonResponse(body: Record<string, unknown>, status = 200): Response {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS })
+}
+
+async function readJson(req: Request): Promise<unknown> {
+  if (req.headers.get('Content-Type')?.split(';', 1)[0].trim().toLowerCase() !== 'application/json') {
+    throw new TeamContractError('unsupported_media_type', 415)
+  }
+  const declaredLength = Number(req.headers.get('Content-Length') ?? '0')
+  if (Number.isFinite(declaredLength) && declaredLength > REQUEST_LIMIT_BYTES) {
+    throw new TeamContractError('request_too_large', 413)
+  }
+  const text = await req.text()
+  if (new TextEncoder().encode(text).byteLength > REQUEST_LIMIT_BYTES) {
+    throw new TeamContractError('request_too_large', 413)
+  }
+  try {
+    return JSON.parse(text)
+  } catch {
+    throw new TeamContractError('invalid_json', 400)
+  }
+}
+
+function createUserClient(req: Request) {
+  return createClient(
+    Deno.env.get('SUPABASE_URL') ?? '',
+    Deno.env.get('SUPABASE_ANON_KEY') ?? '',
+    {
+      auth: { persistSession: false, autoRefreshToken: false },
+      global: { headers: { Authorization: req.headers.get('Authorization') ?? '' } },
+    },
+  )
+}
+
+function normalizeAcceptResult(value: unknown): AcceptRpcResult {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw new TeamContractError('invalid_accept_response', 502)
+  }
+  const row = value as Record<string, unknown>
+  if (
+    typeof row.team_id !== 'string'
+    || !UUID_PATTERN.test(row.team_id)
+    || (row.role !== 'owner' && row.role !== 'admin' && row.role !== 'member')
+    || typeof row.duplicate !== 'boolean'
+    || typeof row.already_member !== 'boolean'
+  ) {
+    throw new TeamContractError('invalid_accept_response', 502)
+  }
+  return row as unknown as AcceptRpcResult
 }
 
-// @ts-expect-error — Deno 런타임 전역
 Deno.serve(async (req: Request) => {
   const preflight = handleCorsPreflightRequest(req)
   if (preflight) return preflight
-
-  if (req.method !== 'POST') {
-    return new Response(JSON.stringify({ error: 'Method not allowed' }), {
-      status: 405,
-      headers: { ...corsHeaders, 'Content-Type': 'application/json' }
-    })
-  }
+  if (req.method !== 'POST') return jsonResponse({ error: 'method_not_allowed' }, 405)
 
   try {
-    const user = await requireUser(req)
-    const body = (await req.json()) as AcceptRequest
-
-    if (!body.token) {
-      return new Response(
-        JSON.stringify({ error: 'token is required' }),
-        { status: 400, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
-      )
-    }
-
-    const serviceClient = createServiceRoleClient()
-
-    // 토큰으로 초대 조회
-    const { data: invite, error: inviteErr } = await serviceClient
-      .from('team_invites')
-      .select('id, team_id, email, role, expires_at, accepted_at')
-      .eq('token', body.token)
-      .maybeSingle()
-
-    if (inviteErr || !invite) {
-      return new Response(
-        JSON.stringify({ error: 'invalid_token', message: '초대를 찾을 수 없습니다.' }),
-        { status: 404, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
-      )
-    }
-
-    if (invite.accepted_at) {
-      return new Response(
-        JSON.stringify({ error: 'already_accepted', message: '이미 수락된 초대입니다.' }),
-        { status: 409, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
-      )
-    }
-
-    const expiresAt = new Date(invite.expires_at as string).getTime()
-    if (Date.now() > expiresAt) {
-      return new Response(
-        JSON.stringify({ error: 'expired', message: '만료된 초대입니다.' }),
-        { status: 410, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
-      )
-    }
-
-    // 이메일 일치 확인 (대소문자 무시)
-    const invitedEmail = (invite.email as string).toLowerCase()
-    const userEmail = (user.email ?? '').toLowerCase()
-    if (invitedEmail !== userEmail) {
-      return new Response(
-        JSON.stringify({
-          error: 'email_mismatch',
-          message: `이 초대는 ${invitedEmail}에게 발송되었습니다. 올바른 계정으로 로그인하세요.`
-        }),
-        { status: 403, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
-      )
-    }
-
-    // team_members에 추가 (이미 있으면 업데이트)
-    const { error: memberErr } = await serviceClient.from('team_members').upsert(
-      {
-        team_id: invite.team_id as string,
-        user_id: user.id,
-        role: (invite.role as 'admin' | 'member') ?? 'member'
-      },
-      { onConflict: 'team_id,user_id' }
-    )
-
-    if (memberErr) {
-      throw new Error(`멤버 등록 실패: ${memberErr.message}`)
-    }
-
-    // 초대 accepted 표시
-    await serviceClient
-      .from('team_invites')
-      .update({ accepted_at: new Date().toISOString(), accepted_by: user.id })
-      .eq('id', invite.id as string)
-
-    return new Response(
-      JSON.stringify({
-        team_id: invite.team_id,
-        role: invite.role
-      }),
-      { status: 200, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
-    )
-  } catch (err) {
-    if (err && typeof err === 'object' && 'status' in err && 'message' in err) {
-      return authErrorResponse(err as AuthError, corsHeaders)
-    }
-    const message = err instanceof Error ? err.message : 'Unknown error'
-    return new Response(JSON.stringify({ error: message }), {
-      status: 500,
-      headers: { ...corsHeaders, 'Content-Type': 'application/json' }
+    await requireUser(req)
+    const input = parseTeamAcceptInput(await readJson(req))
+    const { data, error } = await createUserClient(req).rpc('accept_team_invite', {
+      invite_token: input.token,
     })
+    if (error) throw mapTeamRpcError('accept', error)
+    const accepted = normalizeAcceptResult(data)
+    return jsonResponse({
+      team_id: accepted.team_id,
+      role: accepted.role,
+      already_member: accepted.already_member,
+      duplicate: accepted.duplicate,
+    })
+  } catch (error) {
+    if (error instanceof TeamContractError) {
+      return jsonResponse({ error: error.code, message: error.code }, error.status)
+    }
+    if (error && typeof error === 'object' && 'status' in error && 'message' in error) {
+      return jsonResponse({ error: 'unauthorized', message: 'unauthorized' }, 401)
+    }
+    return jsonResponse({ error: 'team_accept_failed', message: 'team_accept_failed' }, 500)
   }
 })