opencode/yao
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update team invitation handling and user invitation acceptance logic

Browse source 
- Refactored the team invitation creation function to utilize the new authorized package for improved user authentication checks.
- Enhanced the invitation acceptance logic to include the user ID of the person who updated the invitation, improving tracking and accountability.
- Adjusted the invitation data preparation to incorporate user-specific scopes, ensuring proper permissions are applied during invitation processing.
This commit is contained in:
Max 2025-10-23 11:22:10 +08:00
parent 976eb2769d
commit 5d6f346601
2 changed files with 15 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
openapi/oauth/providers/user/member.go
View file

@ -278,7 +278,8 @@ func (u *DefaultUser) AcceptInvitation(ctx context.Context, invitationID string,
updateData := maps.MapStrAny{
"status": "active",
"joined_at": time.Now(),
"invitation_token": nil, // Clear the token
"invitation_token": nil, // Clear the token
"__yao_updated_by": userID, // Set the updated by user ID
}
// If invitation doesn't have a user_id (unregistered user invitation), update it with provided userID

23
openapi/user/team_invitation.go
View file

@ -19,6 +19,7 @@ import (
"github.com/yaoapp/yao/messenger"
messengertypes "github.com/yaoapp/yao/messenger/types"
"github.com/yaoapp/yao/openapi/oauth"
"github.com/yaoapp/yao/openapi/oauth/authorized"
"github.com/yaoapp/yao/openapi/response"
"github.com/yaoapp/yao/share"
)
@ -216,14 +217,16 @@ func GinTeamInvitationGet(c *gin.Context) {
// GinTeamInvitationCreate handles POST /teams/:team_id/invitations - Send team invitation
func GinTeamInvitationCreate(c *gin.Context) {
// Get authorized user info
authInfo := oauth.GetAuthorizedInfo(c)
if authInfo == nil || authInfo.UserID == "" {
errorResp := &response.ErrorResponse{
Code: response.ErrInvalidClient.Code,
ErrorDescription: "User not authenticated",
authInfo := authorized.GetInfo(c)
if authInfo.Constraints.OwnerOnly || authInfo.Constraints.TeamOnly {
if authInfo == nil || authInfo.UserID == "" {
errorResp := &response.ErrorResponse{
Code: response.ErrInvalidClient.Code,
ErrorDescription: "User not authenticated",
}
response.RespondWithError(c, response.StatusUnauthorized, errorResp)
return
}
response.RespondWithError(c, response.StatusUnauthorized, errorResp)
return
}
teamID := c.Param("id")
@ -251,7 +254,7 @@ func GinTeamInvitationCreate(c *gin.Context) {
requestBaseURL := getRequestBaseURL(c)
// Prepare invitation data
invitationData := maps.MapStrAny{
invitationData := authInfo.WithCreateScope(maps.MapStrAny{
"user_id": req.UserID,
"email": req.Email,
"member_type": req.MemberType,
@ -259,7 +262,7 @@ func GinTeamInvitationCreate(c *gin.Context) {
"message": req.Message,
"expiry": req.Expiry,
"request_base_url": requestBaseURL,
}
})
// Prepare settings
settings := &InvitationSettings{}
@ -454,7 +457,7 @@ func GinTeamInvitationDelete(c *gin.Context) {
// GinTeamInvitationAccept handles POST /user/teams/invitations/:invitation_id/accept - Accept invitation and login to team
func GinTeamInvitationAccept(c *gin.Context) {
// Get authorized user info
authInfo := oauth.GetAuthorizedInfo(c)
authInfo := authorized.GetInfo(c)
if authInfo == nil || authInfo.UserID == "" {
errorResp := &response.ErrorResponse{
Code: response.ErrInvalidClient.Code,