feat: add supabase jwt auth context

scripts/smoke-seed.js

@@ -6,6 +6,10 @@ const databaseUrl = process.env.DATABASE_URL || 'postgresql://postgres:postgres@
 const tenantId = process.env.TENANT_ID || '00000000-0000-0000-0000-000000000001';
 
 const ids = {
+  authUser: '00000000-0000-0000-0000-00000000a101',
+  authTenantAdminUser: '00000000-0000-0000-0000-00000000a102',
+  authTenantOperatorUser: '00000000-0000-0000-0000-00000000a103',
+  authPlatformAdminUser: '00000000-0000-0000-0000-00000000a999',
   user: '00000000-0000-0000-0000-000000000101',
   tenantAdminUser: '00000000-0000-0000-0000-000000000102',
   tenantOperatorUser: '00000000-0000-0000-0000-000000000103',
@@ -51,6 +55,7 @@ const ids = {
   partnerInvoice: '00000000-0000-0000-0000-000000000903',
   partnerInvoiceItem: '00000000-0000-0000-0000-000000000904',
   partnerInvoicePayment: '00000000-0000-0000-0000-000000000905',
+  platformAdminUser: '00000000-0000-0000-0000-000000000999',
 };
 
 const pool = new Pool({ connectionString: databaseUrl });
@@ -212,46 +217,83 @@ async function main() {
 
     await client.query(
       `
-      insert into public.platform_users (id, username, phone, name, primary_role, raw_profile)
-      values ($1, 'smoke_student', '13800000000', 'Smoke Student', 'student', '{"source":"smoke-seed"}'::jsonb)
-      on conflict (id)
-      do update set username = excluded.username,
-                    phone = excluded.phone,
-                    name = excluded.name,
-                    updated_at = now()
-      `,
-      [ids.user],
-    );
-
-    await client.query(
-      `
-      insert into public.platform_users (id, username, phone, name, primary_role, raw_profile)
-      values ($1, 'smoke_tenant_admin', '13800000001', 'Smoke Tenant Admin', 'tenant_admin', '{"source":"smoke-seed"}'::jsonb)
-      on conflict (id)
-      do update set username = excluded.username,
-                    phone = excluded.phone,
-                    name = excluded.name,
-                    primary_role = excluded.primary_role,
-                    updated_at = now()
-      `,
-      [ids.tenantAdminUser],
-    );
-
-    await client.query(
-      `
-      insert into public.platform_users (id, username, phone, name, primary_role, raw_profile)
+      insert into auth.users (
+        id, aud, role, phone, phone_confirmed_at, raw_app_meta_data, raw_user_meta_data,
+        created_at, updated_at
+      )
       values
-        ($1, 'smoke_tenant_operator', '13800000003', 'Smoke Tenant Operator', 'tenant_operator', '{"source":"smoke-seed"}'::jsonb),
-        ($2, 'smoke_tenant_sales', '13800000004', 'Smoke Tenant Sales', 'sales', '{"source":"smoke-seed"}'::jsonb),
-        ($3, 'smoke_tenant_agent', '13800000005', 'Smoke Tenant Agent', 'agent', '{"source":"smoke-seed"}'::jsonb)
+        ($1, 'authenticated', 'authenticated', '13800000000', now(), '{"provider":"phone","providers":["phone"]}'::jsonb, '{}'::jsonb, now(), now()),
+        ($2, 'authenticated', 'authenticated', '13800000001', now(), '{"provider":"phone","providers":["phone"]}'::jsonb, '{}'::jsonb, now(), now()),
+        ($3, 'authenticated', 'authenticated', '13800000003', now(), '{"provider":"phone","providers":["phone"]}'::jsonb, '{}'::jsonb, now(), now()),
+        ($4, 'authenticated', 'authenticated', '13999999999', now(), '{"provider":"phone","providers":["phone"],"app_role":"platform_admin"}'::jsonb, '{}'::jsonb, now(), now())
+      on conflict (id)
+      do update set phone = excluded.phone,
+                    raw_app_meta_data = excluded.raw_app_meta_data,
+                    updated_at = now()
+      `,
+      [ids.authUser, ids.authTenantAdminUser, ids.authTenantOperatorUser, ids.authPlatformAdminUser],
+    );
+
+    await client.query(
+      `
+      insert into public.platform_users (id, auth_user_id, username, phone, name, primary_role, raw_profile)
+      values ($1, $2, 'smoke_student', '13800000000', 'Smoke Student', 'student', '{"source":"smoke-seed"}'::jsonb)
       on conflict (id)
       do update set username = excluded.username,
+                    auth_user_id = excluded.auth_user_id,
+                    phone = excluded.phone,
+                    name = excluded.name,
+                    updated_at = now()
+      `,
+      [ids.user, ids.authUser],
+    );
+
+    await client.query(
+      `
+      insert into public.platform_users (id, auth_user_id, username, phone, name, primary_role, raw_profile)
+      values ($1, $2, 'smoke_tenant_admin', '13800000001', 'Smoke Tenant Admin', 'tenant_admin', '{"source":"smoke-seed"}'::jsonb)
+      on conflict (id)
+      do update set username = excluded.username,
+                    auth_user_id = excluded.auth_user_id,
                     phone = excluded.phone,
                     name = excluded.name,
                     primary_role = excluded.primary_role,
                     updated_at = now()
       `,
-      [ids.tenantOperatorUser, ids.tenantSalesUser, ids.tenantAgentUser],
+      [ids.tenantAdminUser, ids.authTenantAdminUser],
+    );
+
+    await client.query(
+      `
+      insert into public.platform_users (id, auth_user_id, username, phone, name, primary_role, raw_profile)
+      values
+        ($1, $2, 'smoke_tenant_operator', '13800000003', 'Smoke Tenant Operator', 'tenant_operator', '{"source":"smoke-seed"}'::jsonb),
+        ($3, null, 'smoke_tenant_sales', '13800000004', 'Smoke Tenant Sales', 'sales', '{"source":"smoke-seed"}'::jsonb),
+        ($4, null, 'smoke_tenant_agent', '13800000005', 'Smoke Tenant Agent', 'agent', '{"source":"smoke-seed"}'::jsonb)
+      on conflict (id)
+      do update set username = excluded.username,
+                    auth_user_id = excluded.auth_user_id,
+                    phone = excluded.phone,
+                    name = excluded.name,
+                    primary_role = excluded.primary_role,
+                    updated_at = now()
+      `,
+      [ids.tenantOperatorUser, ids.authTenantOperatorUser, ids.tenantSalesUser, ids.tenantAgentUser],
+    );
+
+    await client.query(
+      `
+      insert into public.platform_users (id, auth_user_id, username, phone, name, primary_role, raw_profile)
+      values ($1, $2, 'smoke_platform_admin', '13999999999', 'Smoke Platform Admin', 'platform_admin', '{"source":"smoke-seed"}'::jsonb)
+      on conflict (id)
+      do update set username = excluded.username,
+                    auth_user_id = excluded.auth_user_id,
+                    phone = excluded.phone,
+                    name = excluded.name,
+                    primary_role = excluded.primary_role,
+                    updated_at = now()
+      `,
+      [ids.platformAdminUser, ids.authPlatformAdminUser],
     );
 
     await client.query(
@@ -288,6 +330,20 @@ async function main() {
       [tenantId, ids.tenantAdminUser],
     );
 
+    await client.query(
+      `
+      insert into public.tenant_memberships (tenant_id, user_id, role, status, permissions)
+      values
+        ($1, $2, 'tenant_operator', 'active', '{"marketing:read":true}'::jsonb),
+        ($1, $3, 'platform_admin', 'active', '{"*":true}'::jsonb)
+      on conflict (tenant_id, user_id, role)
+      do update set status = 'active',
+                    permissions = excluded.permissions,
+                    updated_at = now()
+      `,
+      [tenantId, ids.tenantOperatorUser, ids.platformAdminUser],
+    );
+
     await client.query(
       `
       insert into public.student_profiles (tenant_id, user_id, stats, progress)