Team Invitations
Invite members by email, manage pending requests, and accept invites.
A team owner chooses an email address and the MEMBER or OWNER role. team.inviteMember normalizes the address, saves or refreshes a unique team/email invitation with a seven-day expiry, and sends the teamInvitation email. Existing users also receive an in-app notification.
The link opens /team/invitation?code=<id>. The invitee signs in or creates an account, verifies the matching email, reviews the invitation, and accepts through an explicit Accept action. Opening or prefetching the link alone never creates a membership. team.acceptInvitation checks expiry and email ownership, consumes the invitation, and creates the membership in one database transaction. An existing membership keeps its current role.
Expired, missing or already-consumed invitations cannot be accepted. The owner can revoke an outstanding invitation or send it again: resending rotates the acceptance token, so the previous link stops working. A mail-delivery failure can leave the saved invitation in place, so use the existing resend flow rather than assuming no record was created.