feat(auth): add server invite links - #1983
Merged
Merged
Conversation
hmans
force-pushed
the
hmans/server-invites-design
branch
from
August 11, 2026 12:49
129b6d0 to
241ccb5
Compare
hmans
changed the title
…design * origin/main: fix(i18n): restore regional locale fallback chains (#1987) feat(rooms): allow flexible Unicode names (#1986) # Conflicts: # apps/frontend/messages/de-AT/admin.json # apps/frontend/messages/de-AT/auth.json # apps/frontend/messages/de-AT/rbac.json # apps/frontend/messages/de-CH/admin.json # apps/frontend/messages/de-CH/auth.json # apps/frontend/messages/de-CH/rbac.json
hmans
added a commit
that referenced
this pull request
Aug 11, 2026
…ideas * origin/main: feat(auth): add server invite links (#1983) # Conflicts: # cli/internal/pb/chatto/core/v1/event.pb.go # docs/fdr/INDEX.md
hmans
added a commit
that referenced
this pull request
Aug 11, 2026
…-0-details * origin/main: docs(events): document integration and logging contracts (#2004) fix(events): guard single-run lifecycles (#2003) fix(events): add bounded subject reads (#2002) fix(events): validate snapshot bindings (#2001) fix(events): require pointer projections (#2000) fix(events): make nil loggers safe (#1999) ci: run pull request workflows for stack bases (#1998) feat(auth): add server invite links (#1983) # Conflicts: # apps/frontend/src/lib/api-client-tests/viewer.spec.ts # cli/internal/connectapi/api_contract_test.go # cli/internal/core/projection_wiring.go # cli/internal/evtstream/publisher.go # cli/internal/pb/chatto/core/v1/event.pb.go # docs/adr/INDEX.md # docs/architecture/interfaces.md
hmans
added a commit
that referenced
this pull request
Aug 11, 2026
* origin/main: feat(messages): add pinned channel messages (#1990) docs(events): document integration and logging contracts (#2004) fix(events): guard single-run lifecycles (#2003) fix(events): add bounded subject reads (#2002) fix(events): validate snapshot bindings (#2001) fix(events): require pointer projections (#2000) fix(events): make nil loggers safe (#1999) ci: run pull request workflows for stack bases (#1998) feat(auth): add server invite links (#1983) fix(i18n): restore regional locale fallback chains (#1987) feat(rooms): allow flexible Unicode names (#1986) feat(rooms): add slow mode (#1980) chore(agent): add session wrap-up skill (#1981) fix(workers): harden durable recovery (#1978) feat(admin): report durable worker health (#1979) perf(core): defer server member detail hydration (#1977) refactor(core): use durable consumers for cleanup (#1974) fix(core): make user key shredding crash-safe (#1973) test(e2e): add large-server performance CI (#1976) feat(events): add durable pull-worker execution (#1972) # Conflicts: # apps/frontend/messages/de-AT/rbac.json # apps/frontend/messages/de-CH/rbac.json # apps/frontend/src/lib/components/chat/adminNav.test.ts # apps/frontend/src/lib/components/chat/adminNav.ts # apps/frontend/src/routes/chat/[serverId]/manage/+layout.svelte # cli/internal/core/user_auth_projection.go # cli/internal/core/user_projection.go # cli/internal/core/user_projection_snapshot_test.go # cli/internal/core/users.go # cli/internal/evtstream/subjects.go # cli/internal/pb/chatto/core/v1/event.pb.go # cli/internal/pb/chatto/core/v1/models.pb.go # cli/internal/pb/chatto/core/v1/projection_snapshots.pb.go # cli/internal/pb/chatto/core/v1/user_events.pb.go # docs/adr/INDEX.md # docs/architecture/interfaces.md # docs/fdr/INDEX.md # proto/chatto/core/v1/event.proto
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Self-hosted servers need an operator-controlled way to restrict new account creation without making email a requirement for SSO identities. Invite links also need auditable lifecycle facts and correct use limits across multiple Chatto replicas.
What changed
open/invite_onlyaccount admission configuration, defaulting toopenuser.invitepermissionEVT, with a replayable invitation projectionhttps://<server>/invite/{token}links with fixed 16-character URL-safe opaque tokenscore.secret_key; raw bearer tokens are not persistedEVTOCC boundaryAdminInviteLinkService, the invite-link administration UI, translations, public discovery metadata, generated API clients/reference docs, operator documentation, FDR-036, ADR-070, architecture inventory updates, and glossary terminologyCompatibility, rollout, and security
main. The 16-character token format and finaluser.invitepermission name are unreleased refinements within this feature.AccountCreationPolicyis absent on older servers and new clients treat absent or unknown values asopen.ProviderMetadata.auto_provisionis optional; new clients treat absence from older servers as unknown/capable, while new servers explicitly describe whether a provider may create accounts.invite_only, because older replicas do not enforce invite-link admission.user.invite, and fresh default administrators receive it./invite/*from request and internal-error logs and returns no-store, no-referrer, and noindex directives; reverse proxies and CDNs must redact the path suffix in their own access logs.core.secret_keyinvalidates shared links while retaining durable invite-link records so administrators can copy newly derived links.Test plan
-race, including deterministic 16-character derivation, secret rotation, validation, and projection-index refreshmise test-climise test-e2e— 651 passedmise lintmise license-checkCloses #1014.