You connect Notion → Jarvis can "Create a page in my Notion"
You connect Slack → Jarvis can "Post to #general in my Slack"
You connect Linear → Jarvis can "Create issue in my Linear"

GET /api/integrations/notion/authorize

GET /api/integrations/callback?code=xxx&state=yyy

// Encrypted and stored in tenant_connections
{
  tenant_id: "xxx",
  integration_id: "notion-uuid",
  connection_type: "oauth",
  access_token_encrypted: "encrypted...",
  refresh_token_encrypted: "encrypted...",
  token_expires_at: "2025-02-15T00:00:00Z",
  scopes: ["read_content", "update_content"],
  external_account_name: "Jeff's Workspace"
}

User: "Create a page in my Notion called 'Meeting Notes'"

Jarvis: [checks tenant_connections for Notion]
        [decrypts token]
        [calls Notion API]
        "Done! Created 'Meeting Notes' in your Notion workspace."

// POST /api/integrations/connect
{
  "integration_id": "supabase-uuid",
  "connection_type": "mcp",
  "mcp_server_url": "https://mcp.supabase.com",
  "mcp_auth_type": "bearer",
  "mcp_auth_token": "your-supabase-key"
}

// POST /api/integrations/connect
{
  "integration_id": "custom-uuid",
  "connection_type": "mcp",
  "display_name": "Internal CRM",
  "mcp_server_url": "https://mcp.yourcompany.com",
  "mcp_auth_type": "api_key",
  "mcp_auth_token": "your-api-key"
}

{
  "tools": [
    {
      "name": "notion:create_page",
      "description": "Create a new page in a Notion database",
      "inputSchema": {...}
    },
    {
      "name": "notion:search",
      "description": "Search across Notion workspace",
      "inputSchema": {...}
    }
  ]
}

// POST /api/connections/:id/permissions
{
  "tool_name": "slack:post_message",
  "allowed": true,
  "restrictions": {
    "channels": ["C123456", "C789012"]  // Only these channels
  }
}

{
  "connection_id": "xxx",
  "tool_name": "notion:create_page",
  "action": "write",
  "triggered_by": "jarvis",
  "user_id": "xxx",
  "success": true,
  "response_time_ms": 234
}

-- Stored encrypted, never in plaintext
access_token_encrypted = vault.encrypt(access_token)

// Background job runs hourly
if (connection.token_expires_at < now + 1 hour) {
  const newTokens = await refreshOAuthToken(connection);
  await updateConnection(connection.id, newTokens);
}

CREATE POLICY "tenant_connections_isolation" ON tenant_connections
  FOR ALL USING (
    tenant_id IN (SELECT get_user_tenant_ids())
  );

// Minimal MCP server
import { Server } from '@modelcontextprotocol/sdk/server';

const server = new Server({
  name: 'my-integration',
  version: '1.0.0'
});

server.setRequestHandler('tools/list', async () => ({
  tools: [
    {
      name: 'my_tool',
      description: 'Does something useful',
      inputSchema: {
        type: 'object',
        properties: {
          input: { type: 'string' }
        }
      }
    }
  ]
}));

server.setRequestHandler('tools/call', async (request) => {
  if (request.params.name === 'my_tool') {
    return { result: 'Done!' };
  }
});

server.listen(3001);