mirror of
https://github.com/multica-ai/multica.git
synced 2026-07-14 21:59:30 +02:00
ff1d348274
* feat(security): replace instant member-add with invitation acceptance flow Users invited to a workspace must now explicitly accept the invitation before becoming a member. This fixes the security vulnerability where knowing someone's email was enough to auto-register their runtime to your workspace. Changes: - Add workspace_invitation table with pending/accepted/declined/expired states - Replace CreateMember with CreateInvitation (same endpoint, new behavior) - Add accept/decline/revoke/list invitation API endpoints - Add invitation WS events for real-time notification - Frontend: invitation accept/decline UI in workspace switcher - Frontend: pending invitations section in members settings tab * fix(invitation): address PR review nits - Fix invitation:revoked listener to send event to invitee user (was no-op) - Remove duplicate queryClient2 in app-sidebar.tsx, reuse existing queryClient - Add expires_at > now() filter to ListPendingInvitationsByWorkspace query
51 lines
1.5 KiB
SQL
51 lines
1.5 KiB
SQL
-- name: CreateInvitation :one
|
|
INSERT INTO workspace_invitation (workspace_id, inviter_id, invitee_email, invitee_user_id, role)
|
|
VALUES ($1, $2, $3, $4, $5)
|
|
RETURNING *;
|
|
|
|
-- name: GetInvitation :one
|
|
SELECT * FROM workspace_invitation
|
|
WHERE id = $1;
|
|
|
|
-- name: ListPendingInvitationsByWorkspace :many
|
|
SELECT wi.*,
|
|
u.name AS inviter_name,
|
|
u.email AS inviter_email
|
|
FROM workspace_invitation wi
|
|
JOIN "user" u ON u.id = wi.inviter_id
|
|
WHERE wi.workspace_id = $1 AND wi.status = 'pending' AND wi.expires_at > now()
|
|
ORDER BY wi.created_at DESC;
|
|
|
|
-- name: ListPendingInvitationsForUser :many
|
|
SELECT wi.*,
|
|
w.name AS workspace_name,
|
|
u.name AS inviter_name,
|
|
u.email AS inviter_email
|
|
FROM workspace_invitation wi
|
|
JOIN workspace w ON w.id = wi.workspace_id
|
|
JOIN "user" u ON u.id = wi.inviter_id
|
|
WHERE wi.status = 'pending'
|
|
AND (wi.invitee_user_id = $1 OR wi.invitee_email = $2)
|
|
AND wi.expires_at > now()
|
|
ORDER BY wi.created_at DESC;
|
|
|
|
-- name: AcceptInvitation :one
|
|
UPDATE workspace_invitation
|
|
SET status = 'accepted', updated_at = now()
|
|
WHERE id = $1 AND status = 'pending'
|
|
RETURNING *;
|
|
|
|
-- name: DeclineInvitation :one
|
|
UPDATE workspace_invitation
|
|
SET status = 'declined', updated_at = now()
|
|
WHERE id = $1 AND status = 'pending'
|
|
RETURNING *;
|
|
|
|
-- name: RevokeInvitation :exec
|
|
DELETE FROM workspace_invitation
|
|
WHERE id = $1 AND status = 'pending';
|
|
|
|
-- name: GetPendingInvitationByEmail :one
|
|
SELECT * FROM workspace_invitation
|
|
WHERE workspace_id = $1 AND invitee_email = $2 AND status = 'pending';
|