Invitation System

@@unique([companyId, email, status], name: "unique_pending_invite")

POST /api/companies/:companyId/members/invite
{
  "userId": "existing-user-uuid",
  "position": "Senior Developer",
  "department": "Engineering"
}

// SSE event sent to the user
{
  "event": "invitation:new",
  "data": {
    "id": "membership-uuid",
    "company": { "name": "Acme Corp", "slug": "acme-corp" },
    "roles": [{ "name": "Member", "color": "#6B7280" }],
    "invitedAt": "2024-01-01T00:00:00Z"
  }
}

import crypto from 'crypto';
import bcrypt from 'bcryptjs';

// 1. Generate cryptographically secure random token
const plainToken = crypto.randomBytes(32).toString('hex');
// Result: "a1b2c3d4e5f6..." (64 characters)

// 2. Hash token before storing
const tokenHash = await bcrypt.hash(plainToken, 10);
// Result: "$2a$10$..." (bcrypt hash)

// 3. Store only the hash
await prisma.companyInvite.create({
  data: {
    email: '[email protected]',
    tokenHash, // Never store plain token
    // ...
  }
});

// 4. Send plain token to user (via email, etc.)
return plainToken; // This is the only time we have access to it

import bcrypt from 'bcryptjs';

const validateInvite = async (plainToken: string, email: string) => {
  // 1. Find invite by email
  const invite = await prisma.companyMemberInvite.findFirst({
    where: { email, status: 'PENDING' }
  });
  
  if (!invite) {
    throw new Error('Invite not found');
  }
  
  // 2. Check expiration
  if (new Date() > invite.expiresAt) {
    throw new Error('Invite has expired');
  }
  
  // 3. Verify token hash
  const isValid = await bcrypt.compare(plainToken, invite.tokenHash);
  
  if (!isValid) {
    throw new Error('Invalid invite token');
  }
  
  return invite;
};

// Update expired invites
await prisma.companyInvite.updateMany({
  where: {
    status: 'PENDING',
    expiresAt: { lt: new Date() }
  },
  data: { status: 'EXPIRED' }
});

await prisma.companyMemberInvite.updateMany({
  where: {
    status: 'PENDING',
    expiresAt: { lt: new Date() }
  },
  data: { status: 'EXPIRED' }
});

import { sseManager } from '@/common/services/sse.manager';

// Send notification to invited user
sseManager.sendToUser(userId, 'invitation:new', {
  id: membership.id,
  company: {
    id: company.id,
    name: company.name,
    slug: company.slug,
    logo: company.logo
  },
  roles: [{ id: role.id, name: role.name, color: role.color }],
  invitedAt: new Date().toISOString()
});

const eventSource = new EventSource('/api/sse');

eventSource.addEventListener('invitation:new', (event) => {
  const invitation = JSON.parse(event.data);
  // Show notification to user
  showNotification(
    `You've been invited to join ${invitation.company.name}`
  );
});