Multi-tenant RBAC

create table orgs (id uuid primary key default gen_random_uuid(), name text not null);

create table org_members (
  org_id   uuid references orgs(id) on delete cascade,
  user_id  uuid references auth.users(id) on delete cascade,
  roles    text[] not null default '{}',
  primary key (org_id, user_id)
);

Deno.serve(async (req) => {
  // Request: { event, project_id, user_id, email, role }, signed with X-Hook-Signature.
  const { user_id } = await req.json()
  const { data: m } = await aura
    .from('org_members')
    .select('org_id, roles')
    .eq('user_id', user_id).single()

  // Response: { claims: { … } }. Its keys are merged into app_metadata. A hook that fails,
  // answers with anything else, or sets a protected claim (sub, role, aud…) refuses the sign-in.
  return Response.json({
    claims: { tenant: m?.org_id, roles: m?.roles || [] },
  })
})

-- Any member of the org sees the projects
create policy "projects_read" on projects
  for select to aura_authenticated
  using (org_id = auth.tenant());

-- Only admin can create/delete
create policy "projects_admin" on projects
  for all to aura_authenticated
  using (org_id = auth.tenant() and auth.has_role('admin'))
  with check (org_id = auth.tenant());