Migrate Phase 1 user-facing functions

Refactor export-user-data, notify-user-submission-status, and resend-deletion-code to use createEdgeFunction wrapper. Remove manual CORS, auth, rate limiting boilerplate; adopt standardized EdgeFunctionContext (supabase, user, span, requestId), and integrate built-in tracing, rate limiting, and logging through the wrapper. Update handlers to rely on wrapper context and ensure consistent error handling and observability.

supabase/functions/export-user-data/index.ts

@@ -1,10 +1,7 @@
-import { serve } from 'https://deno.land/std@0.168.0/http/server.ts';
-import { createClient } from 'https://esm.sh/@supabase/supabase-js@2.57.4';
+import { serve } from 'https://deno.land/std@0.190.0/http/server.ts';
+import { createEdgeFunction, type EdgeFunctionContext } from '../_shared/edgeFunctionWrapper.ts';
 import { corsHeaders } from '../_shared/cors.ts';
-import { rateLimiters, withRateLimit } from '../_shared/rateLimiter.ts';
-import { sanitizeError } from '../_shared/errorSanitizer.ts';
-import { edgeLogger, startRequest, endRequest, logSpanToDatabase, startSpan, endSpan } from '../_shared/logger.ts';
-import { formatEdgeError } from '../_shared/errorFormatter.ts';
+import { addSpanEvent } from '../_shared/logger.ts';
 
 interface ExportOptions {
   include_reviews: boolean;
@@ -14,76 +11,12 @@ interface ExportOptions {
   format: 'json';
 }
 
-// Apply strict rate limiting (5 req/min) for expensive data export operations
-// This prevents abuse and manages server load from large data exports
-serve(withRateLimit(async (req) => {
-  const tracking = startRequest();
+const handler = async (req: Request, { supabase, user, span, requestId }: EdgeFunctionContext) => {
+  addSpanEvent(span, 'processing_export_request', { userId: user.id });
 
-  // Handle CORS preflight requests
-  if (req.method === 'OPTIONS') {
-    return new Response(null, { 
-      headers: { 
-        ...corsHeaders,
-        'X-Request-ID': tracking.requestId 
-      } 
-    });
-  }
-
-  try {
-    const supabaseClient = createClient(
-      Deno.env.get('SUPABASE_URL') ?? '',
-      Deno.env.get('SUPABASE_ANON_KEY') ?? '',
-      {
-        global: {
-          headers: { Authorization: req.headers.get('Authorization')! },
-        },
-      }
-    );
-
-    // Get authenticated user
-    const {
-      data: { user },
-      error: authError,
-    } = await supabaseClient.auth.getUser();
-
-    if (authError || !user) {
-      const duration = endRequest(tracking);
-      edgeLogger.error('Authentication failed', { 
-        action: 'export_auth',
-        requestId: tracking.requestId,
-        duration 
-      });
-      
-      // Persist error to database
-      const authErrorSpan = startSpan('export-user-data-auth-error', 'SERVER');
-      endSpan(authErrorSpan, 'error', authError);
-      logSpanToDatabase(authErrorSpan, tracking.requestId);
-      return new Response(
-        JSON.stringify({ 
-          error: 'Unauthorized', 
-          success: false,
-          requestId: tracking.requestId 
-        }),
-        { 
-          status: 401, 
-          headers: { 
-            ...corsHeaders, 
-            'Content-Type': 'application/json',
-            'X-Request-ID': tracking.requestId 
-          } 
-        }
-      );
-    }
-
-    edgeLogger.info('Processing export request', { 
-      action: 'export_start', 
-      requestId: tracking.requestId,
-      userId: user.id 
-    });
-
-    // Check rate limiting - max 1 export per hour
+  // Additional rate limiting - max 1 export per hour
   const oneHourAgo = new Date(Date.now() - 60 * 60 * 1000).toISOString();
-    const { data: recentExports, error: rateLimitError } = await supabaseClient
+  const { data: recentExports, error: rateLimitError } = await supabase
     .from('profile_audit_log')
     .select('created_at')
     .eq('user_id', user.id)
@@ -92,35 +25,21 @@ serve(withRateLimit(async (req) => {
     .limit(1);
 
   if (rateLimitError) {
-      edgeLogger.error('Rate limit check failed', { action: 'export_rate_limit', requestId: tracking.requestId, error: rateLimitError });
+    addSpanEvent(span, 'rate_limit_check_failed', { error: rateLimitError.message });
   }
 
   if (recentExports && recentExports.length > 0) {
-      const duration = endRequest(tracking);
     const nextAvailableAt = new Date(new Date(recentExports[0].created_at).getTime() + 60 * 60 * 1000).toISOString();
-      edgeLogger.warn('Rate limit exceeded for export', { 
-        action: 'export_rate_limit',
-        requestId: tracking.requestId,
-        userId: user.id,
-        duration,
-        nextAvailableAt 
-      });
+    addSpanEvent(span, 'rate_limit_exceeded', { nextAvailableAt });
+    
     return new Response(
       JSON.stringify({
         success: false,
         error: 'Rate limited. You can export your data once per hour.',
         rate_limited: true,
         next_available_at: nextAvailableAt,
-          requestId: tracking.requestId
       }),
-        { 
-          status: 429, 
-          headers: { 
-            ...corsHeaders, 
-            'Content-Type': 'application/json',
-            'X-Request-ID': tracking.requestId 
-          } 
-        }
+      { status: 429 }
     );
   }
 
@@ -134,40 +53,32 @@ serve(withRateLimit(async (req) => {
     format: 'json'
   };
 
-    edgeLogger.info('Export options', { 
-      action: 'export_options', 
-      requestId: tracking.requestId,
-      userId: user.id 
-    });
+  addSpanEvent(span, 'export_options_parsed', { options });
 
   // Fetch profile data
-    const { data: profile, error: profileError } = await supabaseClient
+  const { data: profile, error: profileError } = await supabase
     .from('profiles')
     .select('username, display_name, bio, preferred_pronouns, personal_location, timezone, preferred_language, theme_preference, privacy_level, ride_count, coaster_count, park_count, review_count, reputation_score, created_at, updated_at')
     .eq('user_id', user.id)
     .single();
 
   if (profileError) {
-      edgeLogger.error('Profile fetch failed', { 
-        action: 'export_profile',
-        requestId: tracking.requestId,
-        userId: user.id 
-      });
+    addSpanEvent(span, 'profile_fetch_failed', { error: profileError.message });
     throw new Error('Failed to fetch profile data');
   }
 
   // Fetch statistics
-    const { count: photoCount } = await supabaseClient
+  const { count: photoCount } = await supabase
     .from('photos')
     .select('*', { count: 'exact', head: true })
     .eq('submitted_by', user.id);
 
-    const { count: listCount } = await supabaseClient
+  const { count: listCount } = await supabase
     .from('user_lists')
     .select('*', { count: 'exact', head: true })
     .eq('user_id', user.id);
 
-    const { count: submissionCount } = await supabaseClient
+  const { count: submissionCount } = await supabase
     .from('content_submissions')
     .select('*', { count: 'exact', head: true })
     .eq('user_id', user.id);
@@ -188,7 +99,7 @@ serve(withRateLimit(async (req) => {
   // Fetch reviews if requested
   let reviews = [];
   if (options.include_reviews) {
-      const { data: reviewsData, error: reviewsError } = await supabaseClient
+    const { data: reviewsData, error: reviewsError } = await supabase
       .from('reviews')
       .select(`
         id,
@@ -216,7 +127,7 @@ serve(withRateLimit(async (req) => {
   // Fetch lists if requested
   let lists = [];
   if (options.include_lists) {
-      const { data: listsData, error: listsError } = await supabaseClient
+    const { data: listsData, error: listsError } = await supabase
       .from('user_lists')
       .select('id, name, description, is_public, created_at')
       .eq('user_id', user.id)
@@ -225,7 +136,7 @@ serve(withRateLimit(async (req) => {
     if (!listsError && listsData) {
       lists = await Promise.all(
         listsData.map(async (list) => {
-            const { count } = await supabaseClient
+          const { count } = await supabase
             .from('user_list_items')
             .select('*', { count: 'exact', head: true })
             .eq('list_id', list.id);
@@ -246,7 +157,7 @@ serve(withRateLimit(async (req) => {
   // Fetch activity log if requested
   let activity_log = [];
   if (options.include_activity_log) {
-      const { data: activityData, error: activityError } = await supabaseClient
+    const { data: activityData, error: activityError } = await supabase
       .from('profile_audit_log')
       .select('id, action, changes, created_at, changed_by, ip_address_hash, user_agent')
       .eq('user_id', user.id)
@@ -267,7 +178,7 @@ serve(withRateLimit(async (req) => {
   };
 
   if (options.include_preferences) {
-      const { data: prefsData } = await supabaseClient
+    const { data: prefsData } = await supabase
       .from('user_preferences')
       .select('unit_preferences, accessibility_options, notification_preferences, privacy_settings')
       .eq('user_id', user.id)
@@ -308,7 +219,7 @@ serve(withRateLimit(async (req) => {
   };
 
   // Log the export action
-    await supabaseClient.from('profile_audit_log').insert([{
+  await supabase.from('profile_audit_log').insert([{
     user_id: user.id,
     changed_by: user.id,
     action: 'data_exported',
@@ -316,17 +227,11 @@ serve(withRateLimit(async (req) => {
       export_options: options,
       timestamp: new Date().toISOString(),
       data_size: JSON.stringify(exportData).length,
-        requestId: tracking.requestId
+      requestId
     }
   }]);
 
-    const duration = endRequest(tracking);
-    edgeLogger.info('Export completed successfully', { 
-      action: 'export_complete', 
-      requestId: tracking.requestId,
-      traceId: tracking.traceId,
-      userId: user.id,
-      duration,
+  addSpanEvent(span, 'export_completed', { 
     dataSize: JSON.stringify(exportData).length 
   });
 
@@ -334,47 +239,21 @@ serve(withRateLimit(async (req) => {
     JSON.stringify({ 
       success: true, 
       data: exportData,
-        requestId: tracking.requestId 
     }),
     { 
-        status: 200, 
       headers: { 
-          ...corsHeaders, 
-          'Content-Type': 'application/json',
         'Content-Disposition': `attachment; filename="thrillwiki-data-export-${new Date().toISOString().split('T')[0]}.json"`,
-          'X-Request-ID': tracking.requestId
       } 
     }
   );
+};
 
-  } catch (error) {
-    const duration = endRequest(tracking);
-    edgeLogger.error('Export error', { 
-      action: 'export_error', 
-      requestId: tracking.requestId,
-      duration,
-      error: formatEdgeError(error) 
-    });
-    
-    // Persist error to database for monitoring
-    const errorSpan = startSpan('export-user-data-error', 'SERVER');
-    endSpan(errorSpan, 'error', error);
-    logSpanToDatabase(errorSpan, tracking.requestId);
-    const sanitized = sanitizeError(error, 'export-user-data');
-    return new Response(
-      JSON.stringify({ 
-        ...sanitized,
-        success: false,
-        requestId: tracking.requestId 
-      }),
-      { 
-        status: 500, 
-        headers: { 
-          ...corsHeaders, 
-          'Content-Type': 'application/json',
-          'X-Request-ID': tracking.requestId 
-        } 
-      }
-    );
-  }
-}, rateLimiters.strict, corsHeaders));
+serve(createEdgeFunction({
+  name: 'export-user-data',
+  requireAuth: true,
+  corsHeaders,
+  enableTracing: true,
+  logRequests: true,
+  logResponses: true,
+  rateLimitTier: 'strict', // 5 requests per minute
+}, handler));

supabase/functions/notify-user-submission-status/index.ts

@@ -1,7 +1,7 @@
 import { serve } from "https://deno.land/std@0.190.0/http/server.ts";
-import { createClient } from "https://esm.sh/@supabase/supabase-js@2.57.4";
-import { corsHeadersWithTracing as corsHeaders } from '../_shared/cors.ts';
-import { edgeLogger, startRequest, endRequest } from "../_shared/logger.ts";
+import { createEdgeFunction, type EdgeFunctionContext } from '../_shared/edgeFunctionWrapper.ts';
+import { corsHeaders } from '../_shared/cors.ts';
+import { addSpanEvent } from '../_shared/logger.ts';
 
 interface RequestBody {
   submission_id: string;
@@ -81,21 +81,15 @@ async function constructEntityURL(
   return `${baseURL}`;
 }
 
-serve(async (req) => {
-  if (req.method === 'OPTIONS') {
-    return new Response(null, { headers: corsHeaders });
-  }
-
-  const tracking = startRequest('notify-user-submission-status');
-
-  try {
-    const supabaseUrl = Deno.env.get('SUPABASE_URL')!;
-    const supabaseServiceKey = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!;
-    
-    const supabase = createClient(supabaseUrl, supabaseServiceKey);
-
+const handler = async (req: Request, { supabase, span, requestId }: EdgeFunctionContext) => {
   const { submission_id, user_id, submission_type, status, reviewer_notes } = await req.json() as RequestBody;
 
+  addSpanEvent(span, 'notification_request', { 
+    submissionId: submission_id, 
+    userId: user_id,
+    status 
+  });
+
   // Fetch submission items to get entity data
   const { data: items, error: itemsError } = await supabase
     .from('submission_items')
@@ -126,7 +120,6 @@ serve(async (req) => {
   let payload: Record<string, string>;
   
   if (status === 'approved') {
-      // Approval payload
     payload = {
       baseUrl: 'https://www.thrillwiki.com',
       entityType,
@@ -136,7 +129,6 @@ serve(async (req) => {
       moderationNotes: reviewer_notes || '',
     };
   } else {
-      // Rejection payload
     payload = {
       baseUrl: 'https://www.thrillwiki.com',
       rejectionReason: reviewer_notes || 'No reason provided',
@@ -172,42 +164,22 @@ serve(async (req) => {
       is_duplicate: true
     }).eq('id', existingLog.id);
 
-      edgeLogger.info('Duplicate notification prevented', { 
-        action: 'notify_user_submission_status',
-        userId: user_id,
+    addSpanEvent(span, 'duplicate_notification_prevented', { 
       idempotencyKey,
-        submissionId: submission_id,
-        requestId: tracking.requestId 
+      submissionId: submission_id
     });
 
-      endRequest(tracking, 200);
-
-      return new Response(
-        JSON.stringify({
+    return {
       success: true,
       message: 'Duplicate notification prevented',
       idempotencyKey,
-          requestId: tracking.requestId
-        }),
-        {
-          headers: { 
-            ...corsHeaders, 
-            'Content-Type': 'application/json',
-            'X-Request-ID': tracking.requestId
-          },
-          status: 200,
-        }
-      );
+    };
   }
 
-    edgeLogger.info('Sending notification to user', { 
-      action: 'notify_user_submission_status',
-      userId: user_id, 
+  addSpanEvent(span, 'sending_notification', { 
     workflowId, 
     entityName,
-      status,
-      idempotencyKey,
-      requestId: tracking.requestId 
+    idempotencyKey
   });
 
   // Call trigger-notification function
@@ -239,45 +211,21 @@ serve(async (req) => {
     }
   });
 
-    edgeLogger.info('User notification sent successfully', { action: 'notify_user_submission_status', requestId: tracking.requestId, result: notificationResult });
+  addSpanEvent(span, 'notification_sent', { 
+    transactionId: notificationResult?.transactionId 
+  });
 
-    endRequest(tracking, 200);
-
-    return new Response(
-      JSON.stringify({
+  return {
     success: true,
     transactionId: notificationResult?.transactionId,
-        requestId: tracking.requestId
-      }),
-      {
-        headers: { 
-          ...corsHeaders, 
-          'Content-Type': 'application/json',
-          'X-Request-ID': tracking.requestId
-        },
-        status: 200,
-      }
-    );
-  } catch (error: unknown) {
-    const errorMessage = error instanceof Error ? error.message : 'Unknown error occurred';
-    edgeLogger.error('Error notifying user about submission status', { action: 'notify_user_submission_status', requestId: tracking.requestId, error: errorMessage });
+  };
+};
 
-    endRequest(tracking, 500, errorMessage);
-
-    return new Response(
-      JSON.stringify({
-        success: false,
-        error: errorMessage,
-        requestId: tracking.requestId
-      }),
-      {
-        headers: { 
-          ...corsHeaders, 
-          'Content-Type': 'application/json',
-          'X-Request-ID': tracking.requestId
-        },
-        status: 500,
-      }
-    );
-  }
-});
+serve(createEdgeFunction({
+  name: 'notify-user-submission-status',
+  requireAuth: false,
+  useServiceRole: true,
+  corsHeaders,
+  enableTracing: true,
+  logRequests: true,
+}, handler));

supabase/functions/resend-deletion-code/index.ts

@@ -1,63 +1,13 @@
-import { serve } from 'https://deno.land/std@0.168.0/http/server.ts';
-import { createClient } from 'https://esm.sh/@supabase/supabase-js@2';
+import { serve } from 'https://deno.land/std@0.190.0/http/server.ts';
+import { createEdgeFunction, type EdgeFunctionContext } from '../_shared/edgeFunctionWrapper.ts';
 import { corsHeaders } from '../_shared/cors.ts';
-import { rateLimiters, withRateLimit } from '../_shared/rateLimiter.ts';
-import { edgeLogger, startRequest, endRequest, logSpanToDatabase, startSpan, endSpan } from '../_shared/logger.ts';
+import { addSpanEvent } from '../_shared/logger.ts';
 
-// Apply moderate rate limiting (10 req/min) to prevent deletion code spam
-// Protects against abuse while allowing legitimate resend requests
-serve(withRateLimit(async (req) => {
-  const tracking = startRequest();
-  
-  if (req.method === 'OPTIONS') {
-    return new Response(null, { 
-      headers: { 
-        ...corsHeaders,
-        'X-Request-ID': tracking.requestId 
-      } 
-    });
-  }
-
-  try {
-    const supabaseClient = createClient(
-      Deno.env.get('SUPABASE_URL') ?? '',
-      Deno.env.get('SUPABASE_ANON_KEY') ?? '',
-      {
-        global: {
-          headers: { Authorization: req.headers.get('Authorization')! },
-        },
-      }
-    );
-
-    // Get authenticated user
-    const {
-      data: { user },
-      error: userError,
-    } = await supabaseClient.auth.getUser();
-
-    if (userError || !user) {
-      const duration = endRequest(tracking);
-      edgeLogger.error('Authentication failed', { 
-        action: 'resend_deletion_code',
-        requestId: tracking.requestId,
-        duration 
-      });
-      
-      // Persist error to database
-      const authErrorSpan = startSpan('resend-deletion-code-auth-error', 'SERVER');
-      endSpan(authErrorSpan, 'error', userError);
-      logSpanToDatabase(authErrorSpan, tracking.requestId);
-      throw new Error('Unauthorized');
-    }
-
-    edgeLogger.info('Resending deletion code for user', { 
-      action: 'resend_deletion_code',
-      requestId: tracking.requestId,
-      userId: user.id 
-    });
+const handler = async (req: Request, { supabase, user, span, requestId }: EdgeFunctionContext) => {
+  addSpanEvent(span, 'resending_deletion_code', { userId: user.id });
 
   // Find pending deletion request
-    const { data: deletionRequest, error: requestError } = await supabaseClient
+  const { data: deletionRequest, error: requestError } = await supabase
     .from('account_deletion_requests')
     .select('*')
     .eq('user_id', user.id)
@@ -68,17 +18,21 @@ serve(withRateLimit(async (req) => {
     throw new Error('No pending deletion request found');
   }
 
-    // Check rate limiting (max 3 resends per hour)
+  // Check rate limiting (max 3 resends per hour - ~20 minutes between resends)
   const lastSent = new Date(deletionRequest.confirmation_code_sent_at);
   const now = new Date();
   const hoursSinceLastSend = (now.getTime() - lastSent.getTime()) / (1000 * 60 * 60);
 
-    if (hoursSinceLastSend < 0.33) { // ~20 minutes between resends
+  if (hoursSinceLastSend < 0.33) {
+    addSpanEvent(span, 'resend_rate_limited', { 
+      hoursSinceLastSend,
+      minRequired: 0.33 
+    });
     throw new Error('Please wait at least 20 minutes between resend requests');
   }
 
   // Generate new confirmation code
-    const { data: codeData, error: codeError } = await supabaseClient
+  const { data: codeData, error: codeError } = await supabase
     .rpc('generate_deletion_confirmation_code');
 
   if (codeError) {
@@ -88,7 +42,7 @@ serve(withRateLimit(async (req) => {
   const confirmationCode = codeData as string;
 
   // Update deletion request with new code
-    const { error: updateError } = await supabaseClient
+  const { error: updateError } = await supabase
     .from('account_deletion_requests')
     .update({
       confirmation_code: confirmationCode,
@@ -102,6 +56,10 @@ serve(withRateLimit(async (req) => {
 
   const scheduledDate = new Date(deletionRequest.scheduled_deletion_at);
 
+  addSpanEvent(span, 'new_code_generated', { 
+    scheduledDeletionDate: scheduledDate.toISOString() 
+  });
+
   // Send email with new code
   const forwardEmailKey = Deno.env.get('FORWARDEMAIL_API_KEY');
   const fromEmail = Deno.env.get('FROM_EMAIL_ADDRESS') || 'noreply@thrillwiki.com';
@@ -130,64 +88,27 @@ serve(withRateLimit(async (req) => {
           `,
         }),
       });
-        edgeLogger.info('New confirmation code email sent', { requestId: tracking.requestId });
+      addSpanEvent(span, 'email_sent', { email: user.email });
     } catch (emailError) {
-        edgeLogger.error('Failed to send email', { 
-          requestId: tracking.requestId,
-          error: emailError.message
+      addSpanEvent(span, 'email_send_failed', { 
+        error: emailError instanceof Error ? emailError.message : String(emailError) 
       });
     }
   }
 
-    const duration = endRequest(tracking);
-    edgeLogger.info('New confirmation code sent successfully', { 
-      action: 'resend_deletion_code',
-      requestId: tracking.requestId,
-      userId: user.id,
-      duration 
-    });
+  addSpanEvent(span, 'resend_completed', { userId: user.id });
 
-    return new Response(
-      JSON.stringify({
+  return {
     success: true,
     message: 'New confirmation code sent successfully',
-        requestId: tracking.requestId,
-      }),
-      {
-        status: 200,
-        headers: { 
-          ...corsHeaders, 
-          'Content-Type': 'application/json',
-          'X-Request-ID': tracking.requestId 
-        },
-      }
-    );
-  } catch (error) {
-    const duration = endRequest(tracking);
-    edgeLogger.error('Error resending code', { 
-      action: 'resend_deletion_code',
-      requestId: tracking.requestId,
-      duration,
-      error: error.message 
-    });
+  };
+};
 
-    // Persist error to database for monitoring
-    const errorSpan = startSpan('resend-deletion-code-error', 'SERVER');
-    endSpan(errorSpan, 'error', error);
-    logSpanToDatabase(errorSpan, tracking.requestId);
-    return new Response(
-      JSON.stringify({ 
-        error: error.message,
-        requestId: tracking.requestId 
-      }),
-      {
-        status: 400,
-        headers: { 
-          ...corsHeaders, 
-          'Content-Type': 'application/json',
-          'X-Request-ID': tracking.requestId 
-        },
-      }
-    );
-  }
-}, rateLimiters.moderate, corsHeaders));
+serve(createEdgeFunction({
+  name: 'resend-deletion-code',
+  requireAuth: true,
+  corsHeaders,
+  enableTracing: true,
+  logRequests: true,
+  rateLimitTier: 'moderate', // 10 requests per minute
+}, handler));