Add intensity-based preferences and harden E2EE payload verification

apps/supabase/functions/admin-decrypt-message/index.ts

@@ -67,14 +67,14 @@ Deno.serve(async (req) => {
         return json({ error: "Missing encryption metadata" }, 400);
       }
 
-      const adminPrivateKeyJwkStr = Deno.env.get("ADMIN_PRIVATE_KEY_JWK");
-      if (!adminPrivateKeyJwkStr) {
+      const adminPrivateKeyJwk = getAdminPrivateKey(keysMetadata.admin_key_id);
+      if (!adminPrivateKeyJwk) {
         return json({ error: "Admin decryption key not configured" }, 500);
       }
 
       const rawAesKey = await unwrapWithAdminKey(
         keysMetadata.admin_wrapped_key,
-        JSON.parse(adminPrivateKeyJwkStr)
+        adminPrivateKeyJwk
       );
 
       const aesKey = await crypto.subtle.importKey(
@@ -166,3 +166,28 @@ async function assertSuperAdmin(
     throw new Error("Access denied");
   }
 }
+
+function getAdminPrivateKey(keyId?: string | null): JsonWebKey | null {
+  const keysJson = Deno.env.get("ADMIN_KEYS_JSON");
+  if (keysJson && keyId) {
+    try {
+      const keys = JSON.parse(keysJson);
+      if (keys[keyId]) {
+        return keys[keyId];
+      }
+    } catch {
+      console.error("Failed to parse ADMIN_KEYS_JSON");
+    }
+  }
+
+  const singleKeyJson = Deno.env.get("ADMIN_PRIVATE_KEY_JWK");
+  if (singleKeyJson) {
+    try {
+      return JSON.parse(singleKeyJson);
+    } catch {
+      console.error("Failed to parse ADMIN_PRIVATE_KEY_JWK");
+    }
+  }
+
+  return null;
+}

apps/supabase/functions/manage-couple/index.ts

@@ -177,20 +177,42 @@ Deno.serve(async (req) => {
                     );
                 }
 
-                // Update user's profile with couple_id
-                await supabase
-                    .from("profiles")
-                    .update({ couple_id: couple.id })
-                    .eq("id", user.id);
-
-                return new Response(
-                    JSON.stringify({
-                        success: true,
-                        couple_id: couple.id,
-                        invite_code: couple.invite_code
-                    }),
-                    { headers: { ...corsHeaders, "Content-Type": "application/json" } }
-                );
+                // Update user's profile with couple_id
+                await supabase
+                    .from("profiles")
+                    .update({ couple_id: couple.id })
+                    .eq("id", user.id);
+
+                const { data: safePacks, error: safePacksError } = await supabase
+                    .from("question_packs")
+                    .select("id")
+                    .lte("avg_intensity", 2)
+                    .eq("is_public", true);
+
+                if (safePacksError) {
+                    console.error("Failed to fetch safe packs:", safePacksError);
+                } else if (safePacks?.length) {
+                    const { error: insertError } = await supabase
+                        .from("couple_packs")
+                        .insert(safePacks.map((pack: { id: string }) => ({
+                            couple_id: couple.id,
+                            pack_id: pack.id,
+                            enabled: true,
+                        })));
+
+                    if (insertError) {
+                        console.error("Failed to enable safe packs:", insertError);
+                    }
+                }
+
+                return new Response(
+                    JSON.stringify({
+                        success: true,
+                        couple_id: couple.id,
+                        invite_code: couple.invite_code
+                    }),
+                    { headers: { ...corsHeaders, "Content-Type": "application/json" } }
+                );
             }
         }