Step 9: Sharing & Workspace Management

import type { Server } from "@modelcontextprotocol/sdk/server/index.js";
import type { SupabaseClient } from "@supabase/supabase-js";
import { z } from "zod";
import type { AuthedUser } from "../auth.ts";
 
type Ctx = { user: AuthedUser; supabase: SupabaseClient };
 
export function registerWorkspaceTools(server: Server, ctx: Ctx) {
  const { user, supabase } = ctx;
 
  // ---------------------------------------------------------------------
  // list_workspaces
  // ---------------------------------------------------------------------
  server.tool(
    "list_workspaces",
    {
      description:
        "List the workspaces the caller belongs to, with their role. " +
        "Use to know which workspace_id to pass to save_snippet, or to " +
        "answer 'what teams am I in?'.",
      inputSchema: z.object({}),
    },
    async () => {
      const { data, error } = await supabase
        .from("workspace_members")
        .select("role, workspace:workspace_id(id, name, created_at)")
        .order("joined_at", { ascending: true });
 
      if (error) throw new Error(error.message);
 
      const rows = (data ?? []).map((m) => ({
        workspace_id: (m.workspace as { id: string }).id,
        name:         (m.workspace as { name: string }).name,
        role:         m.role,
        created_at:   (m.workspace as { created_at: string }).created_at,
      }));
 
      return {
        content: [{ type: "text", text: JSON.stringify(rows, null, 2) }],
      };
    }
  );
 
  // ---------------------------------------------------------------------
  // create_workspace
  // ---------------------------------------------------------------------
  server.tool(
    "create_workspace",
    {
      description:
        "Create a new workspace and add the caller as its owner. " +
        "Use when the user says 'create a team' or 'make a new workspace'.",
      inputSchema: z.object({
        name: z.string().min(1).max(80),
      }),
    },
    async ({ name }) => {
      // 1. Create the workspace (RLS workspaces_insert requires created_by = auth.uid())
      const { data: ws, error: wsErr } = await supabase
        .from("workspaces")
        .insert({ name, created_by: user.sub })
        .select("id, name, created_at")
        .single();
 
      if (wsErr) throw new Error(wsErr.message);
 
      // 2. Add the creator as an owner
      const { error: memErr } = await supabase
        .from("workspace_members")
        .insert({ workspace_id: ws.id, user_id: user.sub, role: "owner" });
 
      if (memErr) throw new Error(memErr.message);
 
      return {
        content: [{
          type: "text",
          text: `Created workspace "${ws.name}" (${ws.id}). You are the owner.`,
        }],
      };
    }
  );
 
  // ---------------------------------------------------------------------
  // invite_to_workspace
  // ---------------------------------------------------------------------
  server.tool(
    "invite_to_workspace",
    {
      description:
        "Invite an existing user to a workspace by their email. " +
        "Owners only. Use when the user says 'add Alice to the team' or " +
        "'share this workspace with bob@example.com'. The invitee must " +
        "already have a Brain Drip account; if not, ask them to sign up first.",
      inputSchema: z.object({
        workspace_id: z.string().uuid(),
        email: z.string().email(),
        role:  z.enum(["owner", "member"]).default("member"),
      }),
    },
    async ({ workspace_id, email, role }) => {
      // Find the invitee's user id. We can read auth.users only via the
      // service_role; instead, we use a public.profiles table or a
      // Supabase RPC. Simplest path here: a SECURITY DEFINER function
      // that looks up the user by email.
      //
      // Add this SQL once, in a new migration:
      //
      //   create or replace function public.user_id_for_email(p_email text)
      //     returns uuid language sql security definer
      //     set search_path = public, auth as $$
      //       select id from auth.users where email = lower(p_email) limit 1;
      //     $$;
      //   grant execute on function public.user_id_for_email(text) to authenticated;
 
      const { data: invitee, error: lookupErr } = await supabase
        .rpc("user_id_for_email", { p_email: email });
 
      if (lookupErr) throw new Error(lookupErr.message);
      if (!invitee)  throw new Error(`No Brain Drip account for ${email}. Ask them to sign up first.`);
 
      // RLS members_insert requires the caller to be an owner of workspace_id.
      const { error: insErr } = await supabase
        .from("workspace_members")
        .insert({ workspace_id, user_id: invitee, role });
 
      if (insErr) {
        // RLS violation surfaces as "new row violates row-level security policy".
        // Surface a friendlier message.
        if (insErr.code === "42501" || insErr.message.includes("row-level security")) {
          throw new Error("Only workspace owners can invite members.");
        }
        if (insErr.code === "23505") {
          throw new Error(`${email} is already a member of this workspace.`);
        }
        throw new Error(insErr.message);
      }
 
      return {
        content: [{
          type: "text",
          text: `Invited ${email} to workspace ${workspace_id} as ${role}.`,
        }],
      };
    }
  );
}

supabase migration new add_user_lookup_helper

-- Look up a user_id by email — used by invite_to_workspace.
-- SECURITY DEFINER so the helper can read auth.users without granting the
-- whole authenticated role access to it.
create or replace function public.user_id_for_email(p_email text)
  returns uuid language sql security definer
  set search_path = public, auth as $$
    select id from auth.users where email = lower(p_email) limit 1;
  $$;
 
grant execute on function public.user_id_for_email(text) to authenticated;

server.tool(
  "share_snippet",
  {
    description:
      "Change a snippet's visibility between private, workspace, and public. " +
      "Use when the user says 'share this with the team' or 'make this private'.",
    inputSchema: z.object({
      id: z.string().uuid(),
      visibility: z.enum(["private", "workspace", "public"]),
    }),
  },
  async ({ id, visibility }) => {
    const { data, error } = await supabase
      .from("snippets")
      .update({ visibility })
      .eq("id", id)
      .select("id, title, visibility")
      .maybeSingle();
 
    if (error) throw new Error(error.message);
    if (!data)  throw new Error("snippet not found or you can't change its visibility");
 
    return {
      content: [{
        type: "text",
        text: `"${data.title}" is now ${data.visibility}.`,
      }],
    };
  }
);

import { registerSnippetTools }   from "./tools/snippets.ts";
import { registerWorkspaceTools } from "./tools/workspaces.ts";
 
// ...
 
app.all("/", requireAuth, async (c) => {
  // ...existing...
  registerSnippetTools(server, { user, supabase });
  registerWorkspaceTools(server, { user, supabase });
  // ...rest...
});