Invitation flow for regular users with admin-configurable quota #332

New Issue

fable-5 · 2026-08-05T12:09:31+02:00

fable-5 commented

2026-08-05 12:09:31 +02:00

Problem

On instances with closed registration, existing users cannot bring in collaborators; only a site admin can help (see companion issue on admin user creation). A lightweight, spam-resistant invitation flow is missing.

Proposal

Let any authenticated user invite people by email, guarded by a per-user quota that the site admin configures:

New invitations table: inviter, invitee email, token (stored hashed), status (pending / accepted / revoked), createdAt, expiresAt, acceptedUserId.
POST /api/v1/invitations sends a mail with an invitation link; GET /api/v1/invitations lists own invitations; DELETE /api/v1/invitations/:id revokes a pending one.
Accepting: the registration screen accepts an invitation token and allows account creation even when auth.registrationMode = closed (token is single-use, expires).
Quota against spam: new instance setting invitations.maxOpenPerUser, default 5 open (pending, unexpired) invitations per user; 0 disables inviting. Editable in the admin settings form (mind the react-hook-form dot-in-name trap, use the flat-key mapping from #322).
Audit actions (invitation.created, invitation.revoked, invitation.accepted) -> catalogue + docs + minor bump.
New settings key needs its hardening-guide line (M30) and the VS-NfD profile triage (#243).
UI: an Invitations section on the personal settings page (list, create, revoke, remaining quota); i18n de+en; accessible; e2e coverage.

Acceptance criteria

User can create an invitation while under quota; the 6th open invitation is rejected with a clear message (default quota).
Invitee can register through the link while registration is closed; token is single-use and expiring.
Revoked/expired tokens are rejected.
Admin can change the quota in the settings UI and the change takes effect (saved through the UI, per the #322 fence).
Audit events recorded and catalogued; settings key triaged for VS-NfD; hardening guide updated.
API e2e-db tests + web e2e test for the full invite -> register loop.

## Problem On instances with closed registration, existing users cannot bring in collaborators; only a site admin can help (see companion issue on admin user creation). A lightweight, spam-resistant invitation flow is missing. ## Proposal Let **any authenticated user invite people by email**, guarded by a per-user quota that the site admin configures: - New `invitations` table: inviter, invitee email, token (stored hashed), status (`pending` / `accepted` / `revoked`), `createdAt`, `expiresAt`, `acceptedUserId`. - `POST /api/v1/invitations` sends a mail with an invitation link; `GET /api/v1/invitations` lists own invitations; `DELETE /api/v1/invitations/:id` revokes a pending one. - Accepting: the registration screen accepts an invitation token and allows account creation **even when `auth.registrationMode = closed`** (token is single-use, expires). - **Quota against spam**: new instance setting `invitations.maxOpenPerUser`, default **5** open (pending, unexpired) invitations per user; `0` disables inviting. Editable in the admin settings form (mind the react-hook-form dot-in-name trap, use the flat-key mapping from #322). - Audit actions (`invitation.created`, `invitation.revoked`, `invitation.accepted`) -> catalogue + docs + minor bump. - New settings key needs its hardening-guide line (M30) and the VS-NfD profile triage (#243). - UI: an *Invitations* section on the personal settings page (list, create, revoke, remaining quota); i18n de+en; accessible; e2e coverage. ## Acceptance criteria - [ ] User can create an invitation while under quota; the 6th open invitation is rejected with a clear message (default quota). - [ ] Invitee can register through the link while registration is closed; token is single-use and expiring. - [ ] Revoked/expired tokens are rejected. - [ ] Admin can change the quota in the settings UI and the change takes effect (saved through the UI, per the #322 fence). - [ ] Audit events recorded and catalogued; settings key triaged for VS-NfD; hardening guide updated. - [ ] API e2e-db tests + web e2e test for the full invite -> register loop.

fable-5 referenced this issue from a commit

2026-08-05 12:44:23 +02:00

Invitation flow with per-user quota (#332)

fable-5 referenced this issue

2026-08-05 12:44:39 +02:00

Invitation flow with per-user quota (#332) #334

fable-5 referenced this issue from a commit

2026-08-05 13:06:34 +02:00

settings-nav fence: 10 sections since the invitations section (#332)

fable-5 closed this issue

2026-08-05 13:40:49 +02:00

Sign in to join this conversation.