Evaluation — Invite System (React + Supabase)

Stack: React (TypeScript) + Supabase

Evaluator: ___________

Submission Date: ___________

Pass Threshold: 90%

How to Mark

[✓] Fully correct
[~] Partial — note the gap below the item
[✗] Missing or wrong

1. Database — `workspace_invites` Table

id: UUID, default gen_random_uuid()
workspace_id: UUID, FK → workspaces.id, ON DELETE CASCADE
email: text, NOT NULL
role: text, NOT NULL, default 'member'
token: text, NOT NULL, UNIQUE — generated from gen_random_uuid()::text (not a sequential ID)
status: text, NOT NULL, default 'pending'
invited_by: UUID, FK → auth.users.id
expires_at: timestamptz, NOT NULL, default now() + interval '7 days'
accepted_at: timestamptz, nullable
created_at: timestamptz, default now()
CHECK constraint: role IN ('admin', 'member')
CHECK constraint: status IN ('pending', 'accepted', 'revoked', 'expired')
UNIQUE INDEX on token column
Index on (workspace_id, status)
Index on email
RLS enabled

2. RLS Policies — `workspace_invites`

SELECT: workspace admin/owner can view all invites for their workspace
SELECT: a user can view their own pending invite via email = auth.email()
INSERT: workspace admin/owner only
UPDATE: workspace admin/owner only (for revoke — status change)
DELETE: not allowed — soft delete only via status='revoked'
Policies use auth.uid() or auth.email() correctly — not hardcoded

3. Edge Function — `send-workspace-invite`

Function validates the JWT — rejects unauthenticated requests (401)
Parses body: workspace_id, email, role
Validates email format — returns 400 if invalid
Validates role is 'admin' or 'member' — returns 400 if invalid
Checks caller is admin/owner of the workspace — returns 403 if not
Checks email is not already an active member of the workspace — returns 409 if already a member
Checks no pending invite already exists for this email in this workspace — if found, returns 409 with existing invite details (so frontend can offer "Resend")
Creates invite record with generated token and expires_at = now() + 7 days
Sends invite email via Resend (or configured email provider)
Email subject includes admin's name and workspace name
Email body includes workspace name, role, and invite link: {APP_BASE_URL}/accept-invite?token={token}
Returns: { "data": { invite_id, email, role, expires_at } }
RESEND_API_KEY and APP_BASE_URL read from environment variables (not hardcoded)
Error responses use consistent format with HTTP codes and error codes

4. RPC — `accept_workspace_invite`

Function uses SECURITY DEFINER (required to write workspace_members)
First line inside function body: v_user_id uuid := auth.uid() — auth checked immediately
Raises AUTH_REQUIRED if auth.uid() is NULL
Finds invite by p_token — raises NOT_FOUND if not found
Checks status = 'pending' — raises BUSINESS_RULE_VIOLATION if already accepted/revoked/expired
Checks expires_at >= now() — if expired, sets status='expired' and raises BUSINESS_RULE_VIOLATION
Checks caller's email matches invite email — raises FORBIDDEN if different email
Checks user is not already a workspace member — raises DUPLICATE if already a member
Inserts into workspace_members with correct workspace_id, user_id, role, status='active'
Updates invite: status='accepted', accepted_at=now()
Both INSERT and UPDATE are atomic (within the same function transaction)
Returns: { "data": { workspace_id, role }, "message": "..." }

5. React — Members & Invites Page

Page URL: /workspaces/{id}/members
Two tabs: "Members" and "Pending Invites"
Tab state in URL: ?tab=members or ?tab=invites
"Pending Invites" tab: hidden entirely for member-role users (not just empty)
Tab label shows pending count: "Pending Invites (3)"

Members Tab:

Lists all active workspace members
Columns: Avatar · Name · Email · Role badge · Joined Date · Actions
Role change: inline dropdown → saves immediately with "Saving…" indicator while API updates
Remove member: shows confirmation "Remove [Name] from workspace?" before deletion
Loading state: skeleton rows
Empty state: "No members yet."
Error state: error + retry button

Pending Invites Tab:

Lists only pending status invites (not accepted/revoked)
Expired invites shown separately with "Expired" badge — no action buttons on expired
Columns: Email · Role · Invited By · Expires On · Actions (Copy Link, Resend, Revoke)
Copy Link: copies full {APP_BASE_URL}/accept-invite?token={token} to clipboard, "Link copied." toast
Resend: calls Edge Function again with same email/role, "Invite resent." toast
Revoke: confirmation "Revoke invite to [email]?" → updates status='revoked' (not a delete)
Loading state: skeleton rows
Empty state: "No pending invites."

6. React — Send Invite Modal

"Invite Member" button: visible to admin/owner only
Modal fields: Email (email input) + Role (dropdown: Member / Admin)
Email required — error if blank or invalid format
Submit calls the Edge Function
Loading state on submit button
On success: "Invite sent to [email]." toast, invites list refreshes
If already pending (409 with existing invite): "An invite to this email is already pending. Resend it?" with Resend button — not a generic error
If already a member (409): "This email is already a member of this workspace." as field error
API error: banner shown above the submit button

7. React — Accept Invite Page

URL: /accept-invite?token={token}
Token extracted from URL query params on page load
Loading state: spinner + "Verifying your invite…" shown while checking token
Valid invite: shows workspace name, invited role, invited email
Valid invite: "Accept Invite" button calls accept_workspace_invite RPC
On accept success: redirects to workspace dashboard with "Welcome to [Workspace]!" toast
If user is not logged in: "Please sign in with [email] to accept this invite." + sign-in link
Invalid token / already used: "This invite link is invalid or has already been used."
Expired invite: "This invite has expired. Ask your admin to send a new one."
Wrong email (logged in as different email): "This invite was sent to a different email address."
Already a member: "You are already a member of this workspace." + link to workspace
All 5 error states have distinct messages — not a single generic "Something went wrong"

8. Standards Compliance

Token uses UUID format (not sequential integer or guessable string)
Revoked invites: status='revoked' (not deleted from DB)
SECURITY DEFINER used only on accept_workspace_invite — not create_folder style functions unnecessarily
No sensitive data (tokens, secrets) stored client-side beyond the URL
TypeScript interfaces defined for Invite, Member (no any types)
Custom hooks for data fetching returning { data, isLoading, error, refetch }
All async actions have loading states
No silent failures
Mobile tested at 375px and 768px

Score Summary

Section	Total Items	✓ Pass	~ Partial	✗ Fail
1. Database Table	16
2. RLS Policies	6
3. Edge Function	14
4. RPC Function	13
5. Members & Invites Page	18
6. Send Invite Modal	8
7. Accept Invite Page	11
8. Standards	9
Total	95

Score: ___ / 95 (___%) — Pass / Conditional / Fail

Evaluator Notes

_Record specific failures, partial items, or other observations here._