TalexDreamSoul/teatea-pension
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(task): archive 07-03-invite-link-limits

Browse Source
This commit is contained in:
admin
2026-07-03 05:00:01 -07:00
parent 9fd2088a2a
commit 0a77e87d55
6 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
.trellis/tasks/archive/2026-07/07-03-invite-link-limits/prd.md Normal file
View File

@@ -0,0 +1,48 @@
# Invite link limits
## Goal
Allow organization admins to configure invitation link validity and usage limits when creating invite links.
This should make invite links safer to distribute by letting admins choose how long a link remains valid and how many times it may be used.
## Confirmed Facts
- Invitation links are created from `modules/settings/components/OrganizationInviteDialog.tsx`.
- The invitation create API is `app/api/organizations/[id]/invitations/route.ts`.
- Invitation persistence is backed by the `organization_invitations` table in `modules/core/server/schema.ts`.
- Invitations already have an `expiresAt` column and are currently created with a fixed 7-day validity window.
- Registration consumes invitation tokens through `modules/core/server/auth.ts`.
- The current registration flow marks an invitation as `accepted` after one successful invitation registration, so existing invite links behave as single-use links.
- Invitation rows are shown in `modules/settings/components/OrganizationDetailClient.tsx`, currently with target, role, status, expiry, and copy action.
## Requirements
- Admins can configure an invitation link's validity period when creating an organization invitation.
- Admins can configure the maximum usage count for an invitation link when creating an organization invitation.
- Existing behavior remains compatible by default: if the admin does not change the controls, a new invite should expire after 7 days and be usable once.
- The backend validates create-invitation inputs and rejects invalid limit values with structured API failures.
- The registration path rejects expired or exhausted invitation links.
- Invitation list data exposes enough information to show configured limits and current usage.
- The UI makes the configured validity and usage limit visible when creating and reviewing invitations.
- Maximum access count means maximum successful invitation registrations, not page loads or token preview requests.
## Out of Scope
- Invitation revocation management beyond existing status behavior.
- Editing limits after an invitation has been created.
- Tracking anonymous page views unless product intent explicitly requires page-load based access counting.
## Acceptance Criteria
- [x] Creating an invitation with default form values produces a 7-day, one-use invitation.
- [x] Creating an invitation with a custom validity period stores and displays the corresponding expiry.
- [x] Creating an invitation with a custom maximum usage count stores and displays the configured usage limit.
- [x] Registration with an expired invitation fails with the existing invalid/expired invitation behavior.
- [x] Registration after the invitation has reached its maximum allowed uses fails.
- [x] Successful invitation registration increments usage accounting and only exhausts the link when the configured maximum is reached.
- [x] Type-check, lint, and relevant tests/build checks pass.
## Notes
- Recommended interpretation: count successful invitation registrations as usage. Counting page loads would make links vulnerable to browser refreshes, previews, bots, and accidental visits, and it would require adding a separate token validation/view endpoint.