feat(V2-3차): pull 확장 + invite flow + Realtime + 테스트 + mobile UI 교체

묶음 E — V2-4b pull 확장: - CloudSyncService.pullAll()에 meetings/meeting_memos/meeting_documents 추가 - meetings: LWW, 모든 컬럼 매핑 (minutes_json JSON 직렬화) - meeting_memos: immutable INSERT-only 전략 - meeting_documents: LWW UPDATE 묶음 F — api-client types: - interface -> type alias 전환 (11개) - Database 타입에 TypedTable<Row, Insert, Update> 유틸 도입 (Row & Record<string, unknown> 교차로 GenericTable 제약 만족) - @supabase/ssr 2.102는 supabase-js 버전 불일치로 제네릭 주입 불가 - 다음 사이클로 이월, api-client index.ts는 types만 재수출 묶음 G — apps/mobile UI 교체: - login.tsx: MetalCard + PhosphorText(hero/label) + PhysicalButton - meetings.tsx: MetalCard + Led(status) + PhosphorText(body/meta) - record.tsx: Led + PhosphorText + PhysicalButton - profile.tsx: MetalCard + PhysicalButton(danger) + d3roNativePalette 묶음 H — V2-7b 이메일 invite flow: - migrations/20260410000001_team_invites.sql - team_invites 테이블 (token, email, role, expires_at 7일) - RLS: 같은 팀 멤버 + 초대 이메일 소유자 SELECT, owner/admin만 INSERT/DELETE - generate_invite_token() SECURITY DEFINER RPC (service_role) - functions/team-invite: 권한 체크 -> 토큰 생성 -> 초대 URL 반환 - functions/team-accept: 토큰 검증 -> expires_at/accepted_at/이메일 일치 -> team_members upsert -> 초대 accepted 표시 - config.toml에 team-invite/team-accept 함수 등록 - InviteMemberForm 재작성: 이메일 입력 + 역할 선택 -> URL 복사 UI - /accept-invite 페이지 신규 (Suspense 내 useSearchParams + token 수락) 묶음 I — Realtime transcripts: - apps/web/components/meetings/live-transcript-list.tsx (client) - supabase.channel('transcripts:meeting:${id}').on('postgres_changes') - INSERT -> 세그먼트 추가, UPDATE -> row 교체 - 중복 방지 segment_index 기준 - edited 배지 표시 - meetings/[id]/page.tsx의 transcript 섹션을 LiveTranscriptList로 교체 묶음 J — 테스트: - packages/api-client/__tests__/client.test.ts (9 tests) - createD3roSupabaseClient, isClientConfigured 팩토리 검증 - packages/api-client/__tests__/types.test.ts (10 tests) - 모든 Row 타입 + 리터럴 union + Database keyof - vitest.config.ts 신규 - apps/web/playwright.config.ts 신규 (baseURL, webServer dev 서버) - apps/web/e2e/smoke.spec.ts 신규 (6 스모크 테스트) - apps/web tsconfig exclude에 e2e/playwright.config.ts 추가 - package.json scripts: test, test:e2e, test:e2e:ui 검증: - desktop typecheck OK - web typecheck OK - web next build OK (12 라우트, /accept-invite Suspense 적용) - desktop build OK - api-client test 19 passed
2026-04-10 08:34:52 +09:00 · 2026-04-10 08:34:52 +09:00 · c167737198
commit c167737198
parent 37f3f4d5bd
26 changed files with 1530 additions and 374 deletions
--- a/server/supabase/config.toml
+++ b/server/supabase/config.toml
@ -93,5 +93,11 @@ verify_jwt = true
 [functions.stripe-webhook]
 verify_jwt = false

+[functions.team-invite]
+verify_jwt = true
+
+[functions.team-accept]
+verify_jwt = true
+
 [analytics]
 enabled = false
--- a/server/supabase/functions/team-accept/index.ts
+++ b/server/supabase/functions/team-accept/index.ts
@ -0,0 +1,116 @@
+// server/supabase/functions/team-accept/index.ts
+// 팀 초대 수락 — token 검증 후 team_members에 추가.
+
+import { corsHeaders, handleCorsPreflightRequest } from '../_shared/cors.ts'
+import { requireUser, authErrorResponse, type AuthError } from '../_shared/auth.ts'
+import { createServiceRoleClient } from '../_shared/quota.ts'
+
+interface AcceptRequest {
+  token: string
+}
+
+// @ts-expect-error — Deno 런타임 전역
+Deno.serve(async (req: Request) => {
+  const preflight = handleCorsPreflightRequest(req)
+  if (preflight) return preflight
+
+  if (req.method !== 'POST') {
+    return new Response(JSON.stringify({ error: 'Method not allowed' }), {
+      status: 405,
+      headers: { ...corsHeaders, 'Content-Type': 'application/json' }
+    })
+  }
+
+  try {
+    const user = await requireUser(req)
+    const body = (await req.json()) as AcceptRequest
+
+    if (!body.token) {
+      return new Response(
+        JSON.stringify({ error: 'token is required' }),
+        { status: 400, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
+      )
+    }
+
+    const serviceClient = createServiceRoleClient()
+
+    // 토큰으로 초대 조회
+    const { data: invite, error: inviteErr } = await serviceClient
+      .from('team_invites')
+      .select('id, team_id, email, role, expires_at, accepted_at')
+      .eq('token', body.token)
+      .maybeSingle()
+
+    if (inviteErr || !invite) {
+      return new Response(
+        JSON.stringify({ error: 'invalid_token', message: '초대를 찾을 수 없습니다.' }),
+        { status: 404, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
+      )
+    }
+
+    if (invite.accepted_at) {
+      return new Response(
+        JSON.stringify({ error: 'already_accepted', message: '이미 수락된 초대입니다.' }),
+        { status: 409, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
+      )
+    }
+
+    const expiresAt = new Date(invite.expires_at as string).getTime()
+    if (Date.now() > expiresAt) {
+      return new Response(
+        JSON.stringify({ error: 'expired', message: '만료된 초대입니다.' }),
+        { status: 410, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
+      )
+    }
+
+    // 이메일 일치 확인 (대소문자 무시)
+    const invitedEmail = (invite.email as string).toLowerCase()
+    const userEmail = (user.email ?? '').toLowerCase()
+    if (invitedEmail !== userEmail) {
+      return new Response(
+        JSON.stringify({
+          error: 'email_mismatch',
+          message: `이 초대는 ${invitedEmail}에게 발송되었습니다. 올바른 계정으로 로그인하세요.`
+        }),
+        { status: 403, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
+      )
+    }
+
+    // team_members에 추가 (이미 있으면 업데이트)
+    const { error: memberErr } = await serviceClient.from('team_members').upsert(
+      {
+        team_id: invite.team_id as string,
+        user_id: user.id,
+        role: (invite.role as 'admin' | 'member') ?? 'member'
+      },
+      { onConflict: 'team_id,user_id' }
+    )
+
+    if (memberErr) {
+      throw new Error(`멤버 등록 실패: ${memberErr.message}`)
+    }
+
+    // 초대 accepted 표시
+    await serviceClient
+      .from('team_invites')
+      .update({ accepted_at: new Date().toISOString(), accepted_by: user.id })
+      .eq('id', invite.id as string)
+
+    return new Response(
+      JSON.stringify({
+        team_id: invite.team_id,
+        role: invite.role
+      }),
+      { status: 200, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
+    )
+  } catch (err) {
+    if (err && typeof err === 'object' && 'status' in err && 'message' in err) {
+      return authErrorResponse(err as AuthError, corsHeaders)
+    }
+    const message = err instanceof Error ? err.message : 'Unknown error'
+    return new Response(JSON.stringify({ error: message }), {
+      status: 500,
+      headers: { ...corsHeaders, 'Content-Type': 'application/json' }
+    })
+  }
+})
--- a/server/supabase/functions/team-invite/index.ts
+++ b/server/supabase/functions/team-invite/index.ts
@ -0,0 +1,106 @@
+// server/supabase/functions/team-invite/index.ts
+// 팀 초대 생성 — 이메일 기반 초대 토큰 발급.
+// 초대 링크는 클라이언트가 이메일로 공유 (추후 Edge Function에서 SMTP/Resend 연동).
+
+import { corsHeaders, handleCorsPreflightRequest } from '../_shared/cors.ts'
+import { requireUser, authErrorResponse, type AuthError } from '../_shared/auth.ts'
+import { createServiceRoleClient } from '../_shared/quota.ts'
+
+interface InviteRequest {
+  team_id: string
+  email: string
+  role?: 'admin' | 'member'
+}
+
+// @ts-expect-error — Deno 런타임 전역
+Deno.serve(async (req: Request) => {
+  const preflight = handleCorsPreflightRequest(req)
+  if (preflight) return preflight
+
+  if (req.method !== 'POST') {
+    return new Response(JSON.stringify({ error: 'Method not allowed' }), {
+      status: 405,
+      headers: { ...corsHeaders, 'Content-Type': 'application/json' }
+    })
+  }
+
+  try {
+    const user = await requireUser(req)
+    const body = (await req.json()) as InviteRequest
+
+    if (!body.team_id || !body.email) {
+      return new Response(
+        JSON.stringify({ error: 'team_id and email are required' }),
+        { status: 400, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
+      )
+    }
+
+    const serviceClient = createServiceRoleClient()
+
+    // 권한 확인: 요청자가 해당 팀의 owner/admin 인가?
+    const { data: membership } = await serviceClient
+      .from('team_members')
+      .select('role')
+      .eq('team_id', body.team_id)
+      .eq('user_id', user.id)
+      .maybeSingle()
+
+    const role = (membership?.role as string | undefined) ?? null
+    if (role !== 'owner' && role !== 'admin') {
+      return new Response(
+        JSON.stringify({ error: 'forbidden', message: '팀 owner/admin만 초대할 수 있습니다.' }),
+        { status: 403, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
+      )
+    }
+
+    // 토큰 생성 (service_role RPC)
+    const { data: tokenData, error: tokenErr } = await serviceClient.rpc('generate_invite_token')
+    if (tokenErr || !tokenData) {
+      throw new Error(`토큰 생성 실패: ${tokenErr?.message ?? 'unknown'}`)
+    }
+    const token = tokenData as string
+
+    // 초대 INSERT
+    const { data: invite, error: insertErr } = await serviceClient
+      .from('team_invites')
+      .insert({
+        team_id: body.team_id,
+        invited_by: user.id,
+        email: body.email.toLowerCase().trim(),
+        role: body.role ?? 'member',
+        token
+      })
+      .select('id, token, expires_at')
+      .single()
+
+    if (insertErr || !invite) {
+      throw new Error(`초대 생성 실패: ${insertErr?.message ?? 'unknown'}`)
+    }
+
+    // 초대 링크 구성 (클라이언트에서 이메일로 공유)
+    // @ts-expect-error — Deno.env
+    const siteUrl = Deno.env.get('SITE_URL') ?? 'https://d3ro.dev'
+    const inviteUrl = `${siteUrl}/accept-invite?token=${encodeURIComponent(token)}`
+
+    // TODO(V2-7c): Resend/SendGrid로 이메일 자동 발송
+    // 현재는 URL만 반환 → 클라이언트가 복사/공유
+
+    return new Response(
+      JSON.stringify({
+        id: invite.id,
+        url: inviteUrl,
+        expires_at: invite.expires_at
+      }),
+      { status: 200, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
+    )
+  } catch (err) {
+    if (err && typeof err === 'object' && 'status' in err && 'message' in err) {
+      return authErrorResponse(err as AuthError, corsHeaders)
+    }
+    const message = err instanceof Error ? err.message : 'Unknown error'
+    return new Response(JSON.stringify({ error: message }), {
+      status: 500,
+      headers: { ...corsHeaders, 'Content-Type': 'application/json' }
+    })
+  }
+})
--- a/server/supabase/migrations/20260410000001_team_invites.sql
+++ b/server/supabase/migrations/20260410000001_team_invites.sql
@ -0,0 +1,74 @@
+-- ============================================================================
+-- Phase V2-7b: 팀 초대 플로우 — team_invites 테이블
+-- 이메일 기반 초대 토큰. accept endpoint에서 토큰 검증 후 team_members에 추가.
+-- ============================================================================
+
+CREATE TABLE public.team_invites (
+  id             uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  team_id        uuid NOT NULL REFERENCES public.teams(id) ON DELETE CASCADE,
+  invited_by     uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  email          text NOT NULL,
+  role           text NOT NULL CHECK (role IN ('admin', 'member')) DEFAULT 'member',
+  token          text NOT NULL UNIQUE,
+  accepted_at    timestamptz,
+  accepted_by    uuid REFERENCES auth.users(id) ON DELETE SET NULL,
+  expires_at     timestamptz NOT NULL DEFAULT (now() + interval '7 days'),
+  created_at     timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX idx_team_invites_team_id ON public.team_invites(team_id);
+CREATE INDEX idx_team_invites_token ON public.team_invites(token);
+CREATE INDEX idx_team_invites_email ON public.team_invites(email);
+
+-- RLS
+ALTER TABLE public.team_invites ENABLE ROW LEVEL SECURITY;
+
+-- SELECT: 같은 팀 멤버는 초대 목록 조회 가능, 본인 이메일로 온 초대도 조회 가능
+CREATE POLICY "team_invites_read" ON public.team_invites
+  FOR SELECT USING (
+    team_id IN (SELECT team_id FROM public.team_members WHERE user_id = auth.uid())
+    OR lower(email) = lower((SELECT email FROM auth.users WHERE id = auth.uid()))
+  );
+
+-- INSERT: 팀 owner/admin만 초대 생성
+CREATE POLICY "team_invites_insert_admin" ON public.team_invites
+  FOR INSERT WITH CHECK (
+    invited_by = auth.uid()
+    AND team_id IN (
+      SELECT team_id FROM public.team_members
+      WHERE user_id = auth.uid() AND role IN ('owner', 'admin')
+    )
+  );
+
+-- DELETE: owner/admin 또는 초대 당사자 취소
+CREATE POLICY "team_invites_delete" ON public.team_invites
+  FOR DELETE USING (
+    invited_by = auth.uid()
+    OR team_id IN (
+      SELECT team_id FROM public.team_members
+      WHERE user_id = auth.uid() AND role IN ('owner', 'admin')
+    )
+  );
+
+-- UPDATE는 Edge Function(service_role)에서 accepted_at/accepted_by 세팅용
+
+-- ============================================================================
+-- 토큰 생성 헬퍼 (service_role RPC) — 암호학적 난수
+-- ============================================================================
+CREATE OR REPLACE FUNCTION public.generate_invite_token()
+RETURNS text
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  v_token text;
+BEGIN
+  v_token := encode(gen_random_bytes(24), 'base64');
+  -- URL-safe 문자로 변환
+  v_token := replace(replace(replace(v_token, '+', '-'), '/', '_'), '=', '');
+  RETURN v_token;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.generate_invite_token FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.generate_invite_token TO service_role;