105 lines
3.6 KiB
TypeScript
105 lines
3.6 KiB
TypeScript
import { createClient } from '@supabase/supabase-js'
|
|
import { requireUser } from '../_shared/auth.ts'
|
|
import { corsHeaders, handleCorsPreflightRequest } from '../_shared/cors.ts'
|
|
import {
|
|
mapTeamRpcError,
|
|
parseTeamAcceptInput,
|
|
TeamContractError,
|
|
} from '../_shared/team-contract.ts'
|
|
|
|
const JSON_HEADERS = {
|
|
...corsHeaders,
|
|
'Content-Type': 'application/json',
|
|
'Cache-Control': 'no-store',
|
|
Pragma: 'no-cache',
|
|
}
|
|
const REQUEST_LIMIT_BYTES = 4 * 1024
|
|
const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
|
|
|
|
interface AcceptRpcResult {
|
|
team_id: string
|
|
role: 'owner' | 'admin' | 'member'
|
|
duplicate: boolean
|
|
already_member: boolean
|
|
}
|
|
|
|
function jsonResponse(body: Record<string, unknown>, status = 200): Response {
|
|
return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS })
|
|
}
|
|
|
|
async function readJson(req: Request): Promise<unknown> {
|
|
if (req.headers.get('Content-Type')?.split(';', 1)[0].trim().toLowerCase() !== 'application/json') {
|
|
throw new TeamContractError('unsupported_media_type', 415)
|
|
}
|
|
const declaredLength = Number(req.headers.get('Content-Length') ?? '0')
|
|
if (Number.isFinite(declaredLength) && declaredLength > REQUEST_LIMIT_BYTES) {
|
|
throw new TeamContractError('request_too_large', 413)
|
|
}
|
|
const text = await req.text()
|
|
if (new TextEncoder().encode(text).byteLength > REQUEST_LIMIT_BYTES) {
|
|
throw new TeamContractError('request_too_large', 413)
|
|
}
|
|
try {
|
|
return JSON.parse(text)
|
|
} catch {
|
|
throw new TeamContractError('invalid_json', 400)
|
|
}
|
|
}
|
|
|
|
function createUserClient(req: Request) {
|
|
return createClient(
|
|
Deno.env.get('SUPABASE_URL') ?? '',
|
|
Deno.env.get('SUPABASE_ANON_KEY') ?? '',
|
|
{
|
|
auth: { persistSession: false, autoRefreshToken: false },
|
|
global: { headers: { Authorization: req.headers.get('Authorization') ?? '' } },
|
|
},
|
|
)
|
|
}
|
|
|
|
function normalizeAcceptResult(value: unknown): AcceptRpcResult {
|
|
if (value === null || typeof value !== 'object' || Array.isArray(value)) {
|
|
throw new TeamContractError('invalid_accept_response', 502)
|
|
}
|
|
const row = value as Record<string, unknown>
|
|
if (
|
|
typeof row.team_id !== 'string'
|
|
|| !UUID_PATTERN.test(row.team_id)
|
|
|| (row.role !== 'owner' && row.role !== 'admin' && row.role !== 'member')
|
|
|| typeof row.duplicate !== 'boolean'
|
|
|| typeof row.already_member !== 'boolean'
|
|
) {
|
|
throw new TeamContractError('invalid_accept_response', 502)
|
|
}
|
|
return row as unknown as AcceptRpcResult
|
|
}
|
|
|
|
Deno.serve(async (req: Request) => {
|
|
const preflight = handleCorsPreflightRequest(req)
|
|
if (preflight) return preflight
|
|
if (req.method !== 'POST') return jsonResponse({ error: 'method_not_allowed' }, 405)
|
|
|
|
try {
|
|
await requireUser(req)
|
|
const input = parseTeamAcceptInput(await readJson(req))
|
|
const { data, error } = await createUserClient(req).rpc('accept_team_invite', {
|
|
invite_token: input.token,
|
|
})
|
|
if (error) throw mapTeamRpcError('accept', error)
|
|
const accepted = normalizeAcceptResult(data)
|
|
return jsonResponse({
|
|
team_id: accepted.team_id,
|
|
role: accepted.role,
|
|
already_member: accepted.already_member,
|
|
duplicate: accepted.duplicate,
|
|
})
|
|
} catch (error) {
|
|
if (error instanceof TeamContractError) {
|
|
return jsonResponse({ error: error.code, message: error.code }, error.status)
|
|
}
|
|
if (error && typeof error === 'object' && 'status' in error && 'message' in error) {
|
|
return jsonResponse({ error: 'unauthorized', message: 'unauthorized' }, 401)
|
|
}
|
|
return jsonResponse({ error: 'team_accept_failed', message: 'team_accept_failed' }, 500)
|
|
}
|
|
})
|