Invitation Lifecycle Contract Repair

The problem

Invitation logic often drifts across tenants, roles, and authentication paths, leading to leaked access or duplicate memberships. Security risks arise when tokens are stored in plaintext, resend actions fail to invalidate old links, or inviter authority is never revalidated at the moment of acceptance.

What it does

• Identifies cross-tenant invitation risks and guessable token vulnerabilities.
• Fixes broken lifecycles where resending or revoking leaves legacy links active.
• Repairs transactional gaps that mark invitations as accepted before membership is successfully committed.
• Centralizes role-ceiling and domain-restriction logic across registration and login flows.
• Implements idempotent dispatch commands to prevent duplicate emails and audit events during retries.

Frameworks & tools

Works with repository-local materials including Prisma, TypeORM, SQLAlchemy, Django ORM, Redis, Celery, BullMQ, Auth0, Clerk, and standard email adapters.

Why this beats prompting it yourself

General prompts often miss edge cases like revoke-accept races or seat-limit revalidation during concurrent requests. This skill uses a structured contract register to ensure every state transition, from dispatch to audit, is transactionally sound and tenant-safe.

Use cases

• Preventing a user from accepting an invitation into the wrong organization or workspace.
• Rotating and versioning tokens so that resending an invite supersedes all previous links.
• Ensuring inviter authority is checked at acceptance, not just at initial creation.
• Reconciling duplicate membership attempts when users accept invitations via multiple tabs or retries.

Known limitations

Does not access production databases, send live emails, or perform production migrations. Policy decisions regarding role hierarchy or guest access require human approval.