multica/server/migrations/041_workspace_invitation.down.sql at fix/table-wrapper-overflow - multica - Gitea: Git with a cup of tea

highperfocused/multica

mirror of https://github.com/multica-ai/multica.git synced 2026-06-17 03:38:32 +02:00

Files

Bohan Jiang ff1d348274 feat(security): invitation acceptance flow for workspace members (#1019 )

* feat(security): replace instant member-add with invitation acceptance flow

Users invited to a workspace must now explicitly accept the invitation
before becoming a member. This fixes the security vulnerability where
knowing someone's email was enough to auto-register their runtime to
your workspace.

Changes:
- Add workspace_invitation table with pending/accepted/declined/expired states
- Replace CreateMember with CreateInvitation (same endpoint, new behavior)
- Add accept/decline/revoke/list invitation API endpoints
- Add invitation WS events for real-time notification
- Frontend: invitation accept/decline UI in workspace switcher
- Frontend: pending invitations section in members settings tab

* fix(invitation): address PR review nits

- Fix invitation:revoked listener to send event to invitee user (was no-op)
- Remove duplicate queryClient2 in app-sidebar.tsx, reuse existing queryClient
- Add expires_at > now() filter to ListPendingInvitationsByWorkspace query

2026-04-15 00:01:18 +08:00

2 lines

43 B

SQL

Raw Permalink Blame History

DROP TABLE IF EXISTS workspace_invitation;