Method GetInvitationByCode

internal/store/workspace_members.go:688–734

GetInvitationByCode retrieves a pending invitation by its join code. Looks up by SHA-256 hash first (new invitations), then falls back to plaintext lookup for legacy invitations created before hashing.

(code string)

// Looks up by SHA-256 hash first (new invitations), then falls back to
// plaintext lookup for legacy invitations created before hashing.
func (s *Store) GetInvitationByCode(code string) (*models.WorkspaceInvitation, error) {
	// Hash the provided code for lookup
	hash := sha256.Sum256([]byte(code))
	codeHash := hex.EncodeToString(hash[:])

	var inv models.WorkspaceInvitation
	var acceptedAt, expiresAt *string
	var createdAt string

	// Try hashed lookup first (new invitations)
	err := s.db.QueryRow(s.q(`
		SELECT id, workspace_id, email, role, invited_by, code, accepted_at, expires_at, created_at
		FROM workspace_invitations WHERE code_hash = ? AND accepted_at IS NULL
	`), codeHash).Scan(
		&inv.ID, &inv.WorkspaceID, &inv.Email, &inv.Role, &inv.InvitedBy,
		&inv.Code, &acceptedAt, &expiresAt, &createdAt,
	)
	if err == nil {
		inv.CreatedAt = parseTime(createdAt)
		inv.AcceptedAt = parseTimePtr(acceptedAt)
		inv.ExpiresAt = parseTimePtr(expiresAt)
		return &inv, nil
	}
	if err != sql.ErrNoRows {
		return nil, fmt.Errorf("get invitation by code hash: %w", err)
	}

	// Fall back to plaintext lookup (legacy invitations)
	err = s.db.QueryRow(s.q(`
		SELECT id, workspace_id, email, role, invited_by, code, accepted_at, expires_at, created_at
		FROM workspace_invitations WHERE code = ? AND accepted_at IS NULL
	`), code).Scan(
		&inv.ID, &inv.WorkspaceID, &inv.Email, &inv.Role, &inv.InvitedBy,
		&inv.Code, &acceptedAt, &expiresAt, &createdAt,
	)
	if err == sql.ErrNoRows {
		return nil, nil
	}
	if err != nil {
		return nil, fmt.Errorf("get invitation by code: %w", err)
	}

	inv.CreatedAt = parseTime(createdAt)
	inv.AcceptedAt = parseTimePtr(acceptedAt)
	inv.ExpiresAt = parseTimePtr(expiresAt)
	return &inv, nil
}

// AcceptInvitation marks an invitation as accepted.
func (s *Store) AcceptInvitation(id string) error {