Josh Rogers
d9ffe18b21
Family admins can now invite new members by email. The recipient gets a
templated email with a single-use, time-limited join link; clicking it
opens the registration form bound to the invite, and submitting the
form simultaneously consumes the invite and marks the email confirmed.
Self-registration via the shareable family code remains available.
Backend
- New Invite entity (token hash only — raw token never stored), with
per-family uniqueness on the active hash.
- User gains nullable Email and EmailConfirmedAt; partial unique index
so legacy rows with no email do not collide.
- /api/family/invites — admin endpoints to list pending, issue, resend
(rotates the token), and revoke.
- /api/auth/invite/{token} — public lookup returning email + family name
so the registration form can show "you have been invited to X".
- /api/auth/register accepts InviteToken; the invite vouches for the
email, so any client-supplied email field is ignored. Falls back to
FamilyCode when no invite token is present.
- AppUrlOptions / AppBaseUrl plumbed through so emails build absolute
links to the deployed frontend.
Frontend
- /login reads ?invite=<token>, looks it up, and switches the form into
invite-registration mode (pre-binding to the invited email + family).
- /family admin section gains an invite-by-email form, a pending list,
and resend/revoke actions with a confirmation modal.
Tests
- 14 new integration tests covering: admin issue, member-forbidden,
lookup, valid/expired/consumed/unknown-token registration, resend
rotation, revocation, pending-only list filter, and conflict for
inviting an existing member. RecordingEmailSender captures dispatched
messages so tests can assert on the link without standing up SMTP.
26 lines
843 B
C#
26 lines
843 B
C#
namespace YesChef.Api.Entities;
|
|
|
|
/// <summary>
|
|
/// Single-use, time-limited invitation to join a family. The raw token is sent
|
|
/// to the recipient by email; only its SHA-256 hash is stored, so a database
|
|
/// leak doesn't yield active invites.
|
|
/// </summary>
|
|
public class Invite
|
|
{
|
|
public int Id { get; set; }
|
|
public int FamilyId { get; set; }
|
|
public Family Family { get; set; } = null!;
|
|
|
|
public required string Email { get; set; }
|
|
public required string TokenHash { get; set; }
|
|
|
|
public int IssuedByUserId { get; set; }
|
|
public User IssuedByUser { get; set; } = null!;
|
|
public DateTime IssuedAt { get; set; } = DateTime.UtcNow;
|
|
public DateTime ExpiresAt { get; set; }
|
|
|
|
public DateTime? ConsumedAt { get; set; }
|
|
public int? ConsumedByUserId { get; set; }
|
|
public User? ConsumedByUser { get; set; }
|
|
}
|