Function consumeInviteCode

apps/host-selfhost/src/auth/invites.ts:142–153

(
  client: Client,
  code: string,
  by: { usedBy: string; usedByEmail: string },
)

// Mark a code consumed. The `used_at IS NULL` guard makes this the single-use
// gate even under a race: rowsAffected === 0 means someone redeemed it first.
export const consumeInviteCode = async (
  client: Client,
  code: string,
  by: { usedBy: string; usedByEmail: string },
): Promise<boolean> => {
  const result = await client.execute({
    sql: `UPDATE invite_code SET used_by = ?, used_by_email = ?, used_at = ?
          WHERE code = ? AND used_at IS NULL`,
    args: [by.usedBy, by.usedByEmail, new Date().toISOString(), code.trim().toUpperCase()],
  });
  return result.rowsAffected > 0;
};