Add Multi-Team Support Implementation Plan #120
Conversation
- Detailed phased implementation approach for multi-team functionality - Database schema design with safe migration strategy - Authentication and API update requirements - Data isolation strategy using Row Level Security - Critical migration considerations and risk mitigation 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
⏳ I'm reviewing this pull request for security vulnerabilities and code quality issues. I'll provide an update when I'm done |
Reviewer's GuideThis PR introduces a comprehensive, phased implementation plan for multi-team support in Pulse by adding a detailed documentation file that covers schema design, data migration, authentication/API changes, UI updates, and data isolation strategies. Class diagram for new and updated types in multi-team supportclassDiagram
class Team {
+UUID id
+String name
+String slug
+DateTime created_at
+UUID owner_id
}
class TeamMember {
+UUID team_id
+UUID user_id
+String role
+DateTime joined_at
}
class User {
+UUID id
+UUID current_team_id
...
}
class Submission {
+UUID id
+UUID team_id
...
}
class Project {
+UUID id
+UUID team_id
...
}
class Question {
+UUID id
+UUID team_id
...
}
Team "1" -- "*" TeamMember : has
User "1" -- "*" TeamMember : member_of
Team "1" -- "*" Submission : owns
Team "1" -- "*" Project : owns
Team "1" -- "*" Question : owns
User "1" -- "*" Submission : submits
User "1" -- "*" Project : creates
User "1" -- "*" Question : asks
TeamMember "*" -- "1" User : user
TeamMember "*" -- "1" Team : team
Submission "*" -- "1" Team : team
Project "*" -- "1" Team : team
Question "*" -- "1" Team : team
User "*" -- "1" Team : current_team
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
WalkthroughA detailed plan for introducing multi-team support to the Pulse app is documented. The plan describes new database tables for teams and team memberships, schema changes to link entities to teams, removal of domain-based restrictions, team-specific authentication and UI changes, data isolation strategies, phased implementation steps, migration scripts, and open design questions. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant AuthService
participant TeamService
participant API
participant Database
User->>AuthService: Log in / Authenticate
AuthService->>TeamService: Fetch user teams
TeamService->>Database: Query team_members table
Database-->>TeamService: Return teams for user
TeamService-->>AuthService: Return team list
AuthService->>User: Present team selection
User->>API: Make request with selected team context
API->>Database: Query data filtered by team_id
Database-->>API: Return team-specific data
API-->>User: Respond with isolated data
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @harley - I've reviewed your changes - here's some feedback:
- Add an idempotency guard to the migration script to prevent creating duplicate default teams if the script is run more than once.
- Move index creation on all new team_id columns before enforcing NOT NULL and RLS policies to avoid performance regressions during the transition.
- Clarify in Phase 3 how the auth callback will resolve ambiguous team context for users belonging to multiple teams to ensure deterministic routing.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Add an idempotency guard to the migration script to prevent creating duplicate default teams if the script is run more than once.
- Move index creation on all new team_id columns before enforcing NOT NULL and RLS policies to avoid performance regressions during the transition.
- Clarify in Phase 3 how the auth callback will resolve ambiguous team context for users belonging to multiple teams to ensure deterministic routing.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
✅ I finished the code review, and didn't find any security or code quality issues. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
docs/multi-team-support-plan.md (2)
31-33: Minor wording duplication in bullet list.LanguageTool flags a possible repeated word around “users select or are routed to their team ‑ Team admins…”.
Consider splitting the sentence or removing the second “Team” after the dash to avoid stuttering.
118-122: Plan for indexes on the newteam_idcolumns.Every query in a multi-team environment will filter by
team_id; missing indexes will become an immediate performance bottleneck once data grows.Proposed addition right after the
ALTER TABLE … ADD COLUMNstatements:CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_users_current_team ON users(current_team_id); CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_submissions_team ON submissions(team_id); CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_projects_team ON projects(team_id); CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_questions_team ON questions(team_id);
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
docs/multi-team-support-plan.md(1 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/multi-team-support-plan.md
[duplication] ~32-~32: Possible typo: you repeated a word.
Context: ...in, users select or are routed to their team - Team admins can manage members, roles, and s...
(ENGLISH_WORD_REPEAT_RULE)
[duplication] ~124-~124: Possible typo: you repeated a word.
Context: ...ENCES teams(id); ### Phase 2: Data Migration **Migration Script:**sql -- Create default team...
(ENGLISH_WORD_REPEAT_RULE)
🔇 Additional comments (2)
docs/multi-team-support-plan.md (2)
143-145:users.current_team_idremains nullable—verify this is intentional.After back-filling, the migration makes
team_idin other tablesNOT NULLbut leavesusers.current_team_iduntouched.
If every user must always have an active team, consider tightening the constraint; otherwise document the scenarios where it can be null (e.g., during signup before team creation).
101-119: Circular reference betweenteams.owner_id ↔ users.current_team_id.
teams.owner_idreferencesusers(id)whileusers.current_team_idreferencesteams(id). Inserts are possible but require careful ordering or deferrable constraints.If you anticipate bulk imports or transactional inserts touching both tables, mark at least one of the FK constraints
DEFERRABLE INITIALLY DEFERREDto avoid deadlocks.
| -- Enable RLS on all team-scoped tables | ||
| ALTER TABLE submissions ENABLE ROW LEVEL SECURITY; | ||
| ALTER TABLE projects ENABLE ROW LEVEL SECURITY; | ||
| ALTER TABLE questions ENABLE ROW LEVEL SECURITY; | ||
|
|
||
| -- Create policies for team isolation | ||
| CREATE POLICY team_isolation_submissions ON submissions | ||
| FOR ALL USING (team_id IN ( | ||
| SELECT team_id FROM team_members WHERE user_id = auth.uid() | ||
| )); |
There was a problem hiding this comment.
🛠️ Refactor suggestion
RLS policy created only for submissions; extend to other team-scoped tables.
Projects and questions are listed as team-scoped but do not yet have matching policies. The omission leaves them unprotected once RLS is enabled.
-- Example for projects
CREATE POLICY team_isolation_projects ON projects
FOR ALL USING (
team_id IN (
SELECT team_id FROM team_members WHERE user_id = auth.uid()
)
);
-- Same pattern for questions …🤖 Prompt for AI Agents
In docs/multi-team-support-plan.md around lines 169 to 178, the RLS policy is
created only for the submissions table but missing for projects and questions
tables. To fix this, add equivalent CREATE POLICY statements for projects and
questions tables using the same team isolation logic, ensuring each table has a
policy restricting access based on the user's team membership.
| CREATE TABLE teams ( | ||
| id UUID PRIMARY KEY DEFAULT gen_random_uuid(), | ||
| name TEXT NOT NULL, | ||
| slug TEXT UNIQUE NOT NULL, | ||
| created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(), | ||
| owner_id UUID REFERENCES users(id) | ||
| ); | ||
|
|
||
| CREATE TABLE team_members ( | ||
| team_id UUID REFERENCES teams(id) ON DELETE CASCADE, | ||
| user_id UUID REFERENCES users(id) ON DELETE CASCADE, | ||
| role TEXT DEFAULT 'member', -- 'owner', 'admin', 'member' | ||
| joined_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(), | ||
| PRIMARY KEY (team_id, user_id) | ||
| ); |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add an explicit CHECK constraint on role for stronger data integrity.
Defining role as free-text invites accidental typos (“admni”, “owner ”, etc.). A simple CHECK keeps the data clean and removes the need for application-side validation.
- role TEXT DEFAULT 'member', -- 'owner', 'admin', 'member'
+ role TEXT DEFAULT 'member'
+ CHECK (role IN ('owner', 'admin', 'member')),📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| CREATE TABLE teams ( | |
| id UUID PRIMARY KEY DEFAULT gen_random_uuid(), | |
| name TEXT NOT NULL, | |
| slug TEXT UNIQUE NOT NULL, | |
| created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(), | |
| owner_id UUID REFERENCES users(id) | |
| ); | |
| CREATE TABLE team_members ( | |
| team_id UUID REFERENCES teams(id) ON DELETE CASCADE, | |
| user_id UUID REFERENCES users(id) ON DELETE CASCADE, | |
| role TEXT DEFAULT 'member', -- 'owner', 'admin', 'member' | |
| joined_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(), | |
| PRIMARY KEY (team_id, user_id) | |
| ); | |
| CREATE TABLE teams ( | |
| id UUID PRIMARY KEY DEFAULT gen_random_uuid(), | |
| name TEXT NOT NULL, | |
| slug TEXT UNIQUE NOT NULL, | |
| created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(), | |
| owner_id UUID REFERENCES users(id) | |
| ); | |
| CREATE TABLE team_members ( | |
| team_id UUID REFERENCES teams(id) ON DELETE CASCADE, | |
| user_id UUID REFERENCES users(id) ON DELETE CASCADE, | |
| role TEXT DEFAULT 'member' | |
| CHECK (role IN ('owner', 'admin', 'member')), | |
| joined_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(), | |
| PRIMARY KEY (team_id, user_id) | |
| ); |
🤖 Prompt for AI Agents
In docs/multi-team-support-plan.md around lines 101 to 115, the role column in
the team_members table is defined as free-text, which risks invalid values due
to typos. Add an explicit CHECK constraint on the role column to restrict its
values to 'owner', 'admin', or 'member'. Modify the table definition to include
a CHECK(role IN ('owner', 'admin', 'member')) constraint to enforce data
integrity at the database level.
Summary
Implementation Phases
Key Benefits
Test Plan
🤖 Generated with Claude Code
Summary by Sourcery
Add a comprehensive implementation plan for Pulse’s multi-team support, outlining phased schema changes, data migration, authentication/API updates, UI enhancements, and data isolation strategies.
Documentation:
Summary by CodeRabbit