Your teams
${teams.length}${esc(ok)}${rotation ? " Vault grants were revoked; rotate affected vault keys before re-adding this person." : ""}
` : ""}
+ ${err ? `${esc(err)}
` : ""}
${CLI_HINT(requestOrigin(req, config.origin))}
${cards || `You're not on any teams yet. Create one below or accept an invite.
New team
@@ -83,32 +122,81 @@ pagesRouter.post("/teams", requireAuth, async (req, res) => {
pagesRouter.post("/teams/:slug/invite", requireAuth, async (req, res) => {
const team = await get(`SELECT * FROM credshare_teams WHERE slug = ?`, [req.params.slug]);
const me = team && await get(`SELECT * FROM credshare_members WHERE team_id = ? AND user_id = ?`, [team.id, req.user.id]);
- if (!team || !me || (me.role !== "owner" && me.role !== "admin")) return res.redirect("/dashboard?err=not-allowed");
- const email = String(req.body.email || "").trim().toLowerCase();
- if (!email) return res.redirect("/dashboard");
- const now = Date.now();
- if (!(await get(`SELECT 1 FROM credshare_members WHERE team_id = ? AND email = ?`, [team.id, email]))) {
- const u = await get(`SELECT id FROM users WHERE email = ?`, [email]);
- await run(`INSERT INTO credshare_members (id, team_id, user_id, email, role, status, invited_by, created_at) VALUES (?,?,?,?,?,?,?,?)`,
- [id(), team.id, u?.id ?? null, email, "member", "invited", req.user.id, now]);
+ if (!team || !me) return res.redirect("/dashboard?err=not-allowed");
+ try {
+ const result = await issueTeamInvite({
+ team,
+ actor: { ...me, email: req.user.email },
+ email: req.body.email,
+ role: req.body.role
+ });
+ return res.redirect("/teams/accept?token=" + encodeURIComponent(result.token) + "&shared=1");
+ } catch (error) {
+ if (error instanceof TeamMemberError) return res.redirect("/dashboard?err=" + encodeURIComponent(error.code));
+ throw error;
+ }
+});
+
+async function teamMemberContext(req) {
+ const team = await get(`SELECT * FROM credshare_teams WHERE slug = ?`, [req.params.slug]);
+ const actor = team && await get(`SELECT * FROM credshare_members WHERE team_id = ? AND user_id = ? AND status = 'active'`, [team.id, req.user.id]);
+ return team && actor ? { team, actor } : null;
+}
+
+pagesRouter.post("/teams/:slug/members/:memberId/resend", requireAuth, async (req, res) => {
+ const ctx = await teamMemberContext(req);
+ const target = ctx && await get(`SELECT * FROM credshare_members WHERE id = ? AND team_id = ?`, [req.params.memberId, ctx.team.id]);
+ if (!ctx || !target || target.status !== "invited") return res.redirect("/dashboard?err=member-not-found");
+ try {
+ const result = await issueTeamInvite({
+ team: ctx.team,
+ actor: { ...ctx.actor, email: req.user.email },
+ email: target.email,
+ role: target.role
+ });
+ return res.redirect("/teams/accept?token=" + encodeURIComponent(result.token) + "&shared=1&resent=1");
+ } catch (error) {
+ if (error instanceof TeamMemberError) return res.redirect("/dashboard?err=" + encodeURIComponent(error.code));
+ throw error;
+ }
+});
+
+pagesRouter.post("/teams/:slug/members/:memberId/role", requireAuth, async (req, res) => {
+ const ctx = await teamMemberContext(req);
+ if (!ctx) return res.redirect("/dashboard?err=not-allowed");
+ try {
+ await changeMemberRole({ team: ctx.team, actor: ctx.actor, memberId: req.params.memberId, role: req.body.role });
+ return res.redirect("/dashboard?ok=member-updated");
+ } catch (error) {
+ if (error instanceof TeamMemberError) return res.redirect("/dashboard?err=" + encodeURIComponent(error.code));
+ throw error;
+ }
+});
+
+pagesRouter.post("/teams/:slug/members/:memberId/delete", requireAuth, async (req, res) => {
+ const ctx = await teamMemberContext(req);
+ if (!ctx) return res.redirect("/dashboard?err=not-allowed");
+ try {
+ const result = await removeTeamMember({ team: ctx.team, actor: ctx.actor, memberId: req.params.memberId });
+ return res.redirect(`/dashboard?ok=member-removed${result.rotationRequired ? "&rotation=1" : ""}`);
+ } catch (error) {
+ if (error instanceof TeamMemberError) return res.redirect("/dashboard?err=" + encodeURIComponent(error.code));
+ throw error;
}
- const tok = token(24);
- await run(`INSERT INTO credshare_invites (id, team_id, email, role, token_hash, created_by, expires_at, created_at) VALUES (?,?,?,?,?,?,?,?)`,
- [id(), team.id, email, "member", sha256(tok), req.user.id, now + 7 * 864e5, now]);
- res.redirect("/teams/accept?token=" + encodeURIComponent(tok) + "&shared=1");
});
// ---- accept invite ----
pagesRouter.get("/teams/accept", requireAuth, (req, res) => {
const tok = String(req.query.token || "");
const shared = req.query.shared;
+ const resent = req.query.resent;
const err = req.query.err;
const body = `${appBar(req)}
Accept team invite
${err ? `${esc(String(err).replace(/-/g, " "))}
` : ""}
- ${shared ? `Invite created. Share this link with the teammate, or accept below if it's for you.
` : ""}
+ ${shared ? `${resent ? "Invite replaced. The previous key is invalid; share this new link with the teammate." : "Invite created. Share this link with the teammate, or accept below if it's for you."}
` : ""}