feat(messaging): expose the supabase auth email setup as mcp tools

products/messaging/backend/presentation/views/supabase_auth_emails.py

@@ -110,20 +110,24 @@ class SupabaseAuthEmailSettingsUpdateSerializer(serializers.Serializer):
         required=False,
         allow_blank=True,
         max_length=200,
-        help_text="The Supabase project URL, such as https://abcdefgh.supabase.co.",
+        help_text="The Supabase project URL, such as https://abcdefgh.supabase.co, from the project's API settings in "
+        "the Supabase dashboard. It must use https.",
     )
     hook_secret = serializers.CharField(
         required=False,
         allow_blank=True,
         write_only=True,
         max_length=500,
-        help_text="The Send Email Hook secret from Supabase, starting with v1,whsec_. Leave it out to keep the "
-        "stored secret.",
+        help_text="The Send Email Hook secret, starting with v1,whsec_. Supabase generates it under Authentication, "
+        "Hooks, Send Email hook. Leave it out to keep the stored secret.",
     )
     templates = serializers.DictField(
         child=serializers.UUIDField(),
         required=False,
-        help_text="Supabase email action type to transactional message template id. Replaces the whole mapping. "
+        help_text="Supabase email action type to the id of the email template that sends it. Each template must be "
+        "transactional and marked sensitive. This replaces the whole mapping: include every type to keep, and leave a "
+        "type out to unmap it. A core auth email with no template fails in Supabase, and a notification with no "
+        "template is skipped. "
         f"Valid action types: {', '.join(SupabaseEmailActionType.values)}.",
     )
 

products/messaging/mcp/tools.yaml

@@ -113,3 +113,53 @@ tools:
         description: >
             Opt a recipient back in to the message category named by category_key, or to all marketing messages if
             omitted. Use to honor a resubscribe recorded in your own app. Repeating a call is safe.
+    supabase-auth-emails-settings-get:
+        operation: messaging_supabase_auth_emails_settings_retrieve
+        enabled: true
+        scopes:
+            - hog_flow:read
+        title: Get the Supabase auth email settings
+        description: >
+            Get how the project sends a Supabase project's auth emails through PostHog email templates, including the
+            hook URL to paste into Supabase and every email type it can map. Call this before
+            supabase-auth-emails-settings-update, because that tool replaces the whole template mapping.
+        feature_flag: workflows-supabase-auth-emails
+    supabase-auth-emails-settings-update:
+        operation: messaging_supabase_auth_emails_settings_partial_update
+        enabled: true
+        scopes:
+            - hog_flow:write
+        annotations:
+            readOnly: false
+            destructive: true
+            idempotent: true
+        title: Update the Supabase auth email settings
+        description: >
+            Update how the project sends a Supabase project's auth emails. Send only the fields to change. To get
+            templates to map, call supabase-auth-emails-starter-templates-create or use the email template tools. Ask
+            the user for the hook secret. Never invent one. Sending starts when the user turns on the Send Email hook in
+            Supabase, so map the core emails before telling them to.
+        feature_flag: workflows-supabase-auth-emails
+        response:
+            exclude:
+                - email_types
+                - hook_url
+    supabase-auth-emails-starter-templates-create:
+        operation: messaging_supabase_auth_emails_starter_templates_create
+        enabled: true
+        scopes:
+            - hog_flow:write
+        annotations:
+            readOnly: false
+            destructive: false
+            idempotent: false
+        title: Create starter templates for the Supabase auth emails
+        description: >
+            Create and map an email template for each core Supabase auth email that has no usable template yet. A repeat
+            call skips types that still have one. Needs a verified email sender on the project. Edit the templates
+            afterwards with the email template tools.
+        feature_flag: workflows-supabase-auth-emails
+        response:
+            exclude:
+                - email_types
+                - hook_url

services/mcp/schema/tool-definitions-all.json

@@ -14943,6 +14943,54 @@
             "readOnlyHint": false
         }
     },
+    "supabase-auth-emails-settings-get": {
+        "description": "Get how the project sends a Supabase project's auth emails through PostHog email templates, including the hook URL to paste into Supabase and every email type it can map. Call this before supabase-auth-emails-settings-update, because that tool replaces the whole template mapping.",
+        "category": "Messaging",
+        "feature": "messaging",
+        "summary": "Get the Supabase auth email settings",
+        "title": "Get the Supabase auth email settings",
+        "required_scopes": ["hog_flow:read"],
+        "api_operations": ["GET /api/projects/{project_id}/messaging_supabase_auth_emails/settings/"],
+        "annotations": {
+            "destructiveHint": false,
+            "idempotentHint": true,
+            "openWorldHint": true,
+            "readOnlyHint": true
+        },
+        "feature_flag": "workflows-supabase-auth-emails"
+    },
+    "supabase-auth-emails-settings-update": {
+        "description": "Update how the project sends a Supabase project's auth emails. Send only the fields to change. To get templates to map, call supabase-auth-emails-starter-templates-create or use the email template tools. Ask the user for the hook secret. Never invent one. Sending starts when the user turns on the Send Email hook in Supabase, so map the core emails before telling them to.",
+        "category": "Messaging",
+        "feature": "messaging",
+        "summary": "Update the Supabase auth email settings",
+        "title": "Update the Supabase auth email settings",
+        "required_scopes": ["hog_flow:write"],
+        "api_operations": ["PATCH /api/projects/{project_id}/messaging_supabase_auth_emails/settings/"],
+        "annotations": {
+            "destructiveHint": true,
+            "idempotentHint": true,
+            "openWorldHint": true,
+            "readOnlyHint": false
+        },
+        "feature_flag": "workflows-supabase-auth-emails"
+    },
+    "supabase-auth-emails-starter-templates-create": {
+        "description": "Create and map an email template for each core Supabase auth email that has no usable template yet. A repeat call skips types that still have one. Needs a verified email sender on the project. Edit the templates afterwards with the email template tools.",
+        "category": "Messaging",
+        "feature": "messaging",
+        "summary": "Create starter templates for the Supabase auth emails",
+        "title": "Create starter templates for the Supabase auth emails",
+        "required_scopes": ["hog_flow:write"],
+        "api_operations": ["POST /api/projects/{project_id}/messaging_supabase_auth_emails/starter_templates/"],
+        "annotations": {
+            "destructiveHint": false,
+            "idempotentHint": false,
+            "openWorldHint": true,
+            "readOnlyHint": false
+        },
+        "feature_flag": "workflows-supabase-auth-emails"
+    },
     "survey-create": {
         "description": "Creates a new survey in the project. For the draft, targeting, preview, and launch workflow, load the creating-surveys skill when available. Use this for both in-app surveys and hosted forms. Prefer draft creation by default and do not set start_date unless the user explicitly asks to launch immediately. For in-app surveys, popover is the default unless the user asks for widget or api. For hosted forms, use external_survey. Keep surveys short unless the user asks for a longer flow. Survey content is public: anyone can read the name, questions, and appearance text. In-app surveys send them to every visitor's browser, and a hosted survey shows them on its public page. Tell the user before putting a customer name or other private detail in a survey. For substantial visual changes, preview the final draft once before launch if browser access is already available. Skip browser checks for small edits.",
         "category": "Surveys",