Skip to content

feat(dashboard): add ephemeral invitation links - #159

Merged
tomi-stipancik merged 8 commits into
mainfrom
feat/ephemeral-invitation-links
Sep 16, 2026
Merged

tomi-stipancik merged 8 commits into
mainfrom
feat/ephemeral-invitation-links

Conversation

@cubeorgdev

@cubeorgdev cubeorgdev Bot commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

Summary

  • return issuance-only invitation URLs from create and regeneration
  • rotate invitation IDs transactionally while invalidating prior links
  • add dashboard create/regenerate link dialogs and OIDC-aware invitation gating
  • synchronize the OpenAPI contract

Validation

  • cargo check -p control-api
  • targeted control-api URL test
  • dashboard TypeScript check
  • targeted members-view tests
  • SQLx query guard
  • docs contract check

Draft PR. An issue reference was not available in the supplied task context.

@cubeorgdev

cubeorgdev Bot commented Sep 16, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was created from a Blocks session.

View in dashboard | View on desktop

@tomi-stipancik
tomi-stipancik marked this pull request as ready for review September 16, 2026 21:10
@tomi-stipancik
tomi-stipancik requested a review from a team as a code owner September 16, 2026 21:10
@tomi-stipancik
tomi-stipancik enabled auto-merge (squash) September 16, 2026 21:10
tomi-stipancik
tomi-stipancik previously approved these changes Sep 16, 2026
Comment thread deploy/docker-compose.yml Outdated
BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:-local-development-secret-change-before-production}
HARNESS_BOOTSTRAP_ADMIN_EMAIL: ${HARNESS_BOOTSTRAP_ADMIN_EMAIL:-admin@example.com}
HARNESS_BOOTSTRAP_ADMIN_PASSWORD: ${HARNESS_BOOTSTRAP_ADMIN_PASSWORD:-change-me-in-production}
HARNESS_BOOTSTRAP_ADMIN_PASSWORD: ${HARNESS_BOOTSTRAP_ADMIN_PASSWORD:-change-me-before-testing}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This default password change looks unrelated to the ephemeral invitation links feature and breaks consistency with the documented local stack. README.md still tells users the bootstrap password is change-me-in-production, and tests/e2e/support/dashboard.ts / tests/e2e/docker-compose.yml also hard-code that value. Unless this is intentionally changing the local default (in which case README and any related docs/tests should be updated), I’d revert it to keep the PR focused.

Severity 7/10 · View on dashboard

Co-authored-by: Blocks Task Runner <tomislav@blocksorg.com>
@tomi-stipancik
tomi-stipancik merged commit d713d90 into main Sep 16, 2026
34 checks passed
@tomi-stipancik
tomi-stipancik deleted the feat/ephemeral-invitation-links branch September 16, 2026 22:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants