email template

backend/app/routers/auth.py

@@ -18,9 +18,12 @@ from app.schemas import (
     AccountRegister,
     AccountRead,
     AuthResponse,
+    InviteAcceptRequest,
+    InvitePreview,
     LoginRequest,
     PasswordChangeRequest,
 )
+from app.services.member_invitations import get_valid_invitation
 from app.services.domain_policy import assert_company_domain_allowed
 from app.services.domain_provisioning import account_is_domain_owner
 from app.services.domain_provisioning import (
@@ -230,8 +233,65 @@ async def login(
             detail="Incorrect email or password.",
         )
     if account.member_status == "invited":
-        account.member_status = "active"
-        await session.commit()
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Accept your invitation email to set your password before signing in.",
+        )
+    return AuthResponse(
+        access_token=create_access_token(account),
+        account=await account_read(session, account),
+    )
+
+
+@router.get("/invites/{token}", response_model=InvitePreview)
+async def preview_invite(
+    token: str,
+    session: AsyncSession = Depends(get_postgres_session),
+) -> InvitePreview:
+    try:
+        invitation, account = await get_valid_invitation(session, token)
+    except ValueError as error:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=str(error),
+        ) from error
+
+    manager_name = "Your administrator"
+    if account.created_by_id:
+        manager = await session.get(Account, account.created_by_id)
+        if manager is not None:
+            manager_name = f"{manager.first_name} {manager.last_name}".strip()
+
+    return InvitePreview(
+        work_email=account.email,
+        first_name=account.first_name,
+        organization=account.company_domain or settings.platform_domain,
+        invited_by=manager_name,
+        expires_at=invitation.expires_at,
+    )
+
+
+@router.post("/invites/{token}/accept", response_model=AuthResponse)
+async def accept_invite(
+    token: str,
+    payload: InviteAcceptRequest,
+    session: AsyncSession = Depends(get_postgres_session),
+) -> AuthResponse:
+    validate_password(payload.password)
+    try:
+        invitation, account = await get_valid_invitation(session, token)
+    except ValueError as error:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=str(error),
+        ) from error
+
+    account.password_hash = password_hash.hash(payload.password)
+    account.member_status = "active"
+    account.must_change_password = False
+    invitation.used_at = datetime.now(timezone.utc)
+    await session.commit()
+    await session.refresh(account)
     return AuthResponse(
         access_token=create_access_token(account),
         account=await account_read(session, account),