supabase-add-tenant-user

Add a new multi-tenant user: $ARGUMENTS

$ARGUMENTS can include any of:

• email (required)
• display name / full name
• role preference (user | author | creator | editor | subscriber | admin) — default user
• organization slug if joining an existing tenant (no new org created)
• membership role (owner | admin | member) — default owner if new org, member if joining
• Supabase project id / ref if not inferrable

Operating principles

1. Never grant role = 'admin' in user_profiles unless the user is explicitly the Movemental platform account. Platform admin is reserved for the operator of the SaaS. Creators on the platform are author or creator, not admin.
2. One auth user = one owned organization. The handle_new_user trigger provisions a personal org automatically. Only bypass when joining an existing tenant.
3. Never insert an organization_memberships row pointing to a non-existent org or user. Verify both exist first.
4. Never commit plaintext passwords to the repo. Prefer magic-link invites (supabase.auth.admin.inviteUserByEmail) or passwordless OTP. If a password is required, print it once to the operator and do not persist.
5. Always prefer the DB trigger over manual inserts. handle_new_user is idempotent (ON CONFLICT DO NOTHING / existence checks) and will fill user_profiles, organizations, and organization_memberships automatically.