[Programcode]

Summary

• add secure code and targeted-email workspace invitations without a Team entity
• enforce service-only RPCs, membership/cap/rate checks, atomic redemption, removal revocation, and secret custody
• make email delivery crash-safe with pending/delivered state and a stable relay idempotency key

Verification

• focused workspace-invites Edge tests: 15 passed
• full Edge suite: 201 passed
• database gate: 6 pgTAP files, 206 assertions, both concurrency checks passed
• real simultaneous last-use race: one accepted, one rejected, one membership, one use
• lint, typecheck, docs, Deno format, shell syntax, and diff checks passed
• Terra exact-head re-review approved 7b8c1e0 after the Important delivery finding was fixed

Deployment boundary

Code only. No migration, Edge deployment, sender setup, or secret change was performed. Future environments require WORKSPACE_INVITE_SECRET and an approved idempotent email relay.

Summary by CodeRabbit

• New Features

  • Added workspace invitations using shareable codes or email delivery.
  • Supports invitation creation, rotation, revocation, expiration, and limited usage.
  • Added invitation redemption with membership enrollment and duplicate-use protection.
  • Added email delivery tracking and retry-safe processing.
  • Added safeguards for verification, rate limits, workspace capacity, and concurrent redemptions.

• Documentation

  • Added setup and configuration guidance for workspace invitations, email delivery, and local testing.

• Tests

  • Added comprehensive coverage for invitation creation, delivery, redemption, security, limits, and concurrency.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Sep 21, 2026 7:59am UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Warning

Review limit reached

Next included review available in 36 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: a666f6fa-4f0a-44c7-9c7d-5ce7ac41dbb6

📥 Commits

Reviewing files that changed from the base of the PR and between 7b8c1e0 and 24e3037.

📒 Files selected for processing (2)

• supabase/migrations/20260920182442_workspace_invites.sql
• supabase/tests/workspace_invites_test.sql

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: eb2c601e-6910-43d0-9fdd-522d53a60b98

📥 Commits

Reviewing files that changed from the base of the PR and between b7c8480 and 7b8c1e0.

📒 Files selected for processing (8)

• package.json
• scripts/test-workspace-invite-concurrency.sh
• supabase/README.md
• supabase/config.toml
• supabase/functions/workspace-invites/index.ts
• supabase/functions/workspace-invites/index_test.ts
• supabase/migrations/20260920182442_workspace_invites.sql
• supabase/tests/workspace_invites_test.sql

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds workspace invitation storage and RPCs, a workspace-invites Edge Function, code and email invitation flows, redemption controls, delivery handling, documentation, and database and concurrency tests.

Changes

Workspace invitations

Layer / File(s)	Summary
Private invite storage and access control supabase/migrations/..., supabase/tests/workspace_invites_test.sql	Adds private invite and redemption-attempt tables, audit fields, RLS, service-role guards, and restricted RPC execution.
Invitation lifecycle RPCs supabase/migrations/..., supabase/tests/workspace_invites_test.sql	Adds creation, delivery marking, revocation, redemption, idempotency, rate limits, capacity checks, membership updates, and invite cleanup.
Invitation Edge Function supabase/functions/workspace-invites/..., supabase/config.toml, supabase/README.md	Adds authenticated HTTP handling for code and email invitations, cryptographic protection, mail delivery, redemption, CORS, validation, and documented configuration.
Function and concurrency validation supabase/functions/workspace-invites/index_test.ts, scripts/test-workspace-invite-concurrency.sh, package.json	Adds Edge Function tests, database lifecycle tests, concurrent redemption assertions, and test-command wiring.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant workspace_invites
  participant SupabaseAuth
  participant SupabaseRPC
  participant Mailer
  Client->>workspace_invites: submit authenticated invitation request
  workspace_invites->>SupabaseAuth: verify bearer identity
  workspace_invites->>SupabaseRPC: create, deliver, revoke, or redeem invite
  SupabaseRPC-->>workspace_invites: return invitation result
  workspace_invites->>Mailer: send email invitation when configured
  workspace_invites-->>Client: return HTTP response

Loading

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Programcode]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.