Multi-Tenancy & Workspace Isolation

// Server-side only — never reads env vars or client headers
async function resolveCallerWorkspaceFromSupabase(userId: string) {
  const { data, error } = await supabase
    .from('workspace_members')
    .select('workspace_id, role')
    .eq('user_id', userId)
    .single();

  if (error || !data) throw new UnauthorizedError();
  return { workspaceId: data.workspace_id, role: data.role };
}

const { workspaceId, role } = await requireSettingsAccess(req, ['owner', 'admin']);
// workspaceId is now trusted — use it for all subsequent queries

// DEPRECATED — do not use
const workspace = await readSingleWorkspace();

// CORRECT — resolve from the authenticated user
const { workspaceId } = await resolveCallerWorkspaceFromSupabase(userId);
const workspace = await getWorkspaceById(workspaceId);

export async function GET(req: NextRequest) {
  const { workspaceId, role } = await requireSettingsAccess(req, ['owner', 'admin', 'developer']);

  const settings = await db
    .select()
    .from(workspaceSettings)
    .where(eq(workspaceSettings.workspaceId, workspaceId))  // always scoped
    .limit(1);

  return Response.json(settings);
}

async function dispatchMessageViaMetaInSupabase(job: MessageJob) {
  // Credentials fetched from the workspace that owns this job
  const credentials = await getWorkspaceMetaCredentials(job.workspace_id);
  // workspace A's jobs always use workspace A's Meta token
  return sendViaMetaAPI(credentials, job.payload);
}

// API key deletion — always scoped to caller's workspace
await db.delete(apiKeys)
  .where(
    and(
      eq(apiKeys.id, keyId),
      eq(apiKeys.workspaceId, workspaceId)  // cannot delete keys from other workspaces
    )
  );