feat: Change resolveSignupToken to use new JWT for invite urls

[BGZStephen]

Summary

This PR updates resolveSignupToken to use the new JWT for validating invite urls IF the feature is enabled

Related Linear tickets, Github issues, and Community forum posts

PAY-4392

Review / Merge checklist

• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with release/backport (if the PR is an urgent fix that needs to be backported)

[codecov]

Codecov Report

❌ Patch coverage is 80.55556% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/cli/src/services/user.service.ts	78.78%	7 Missing ⚠️

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

3 issues found across 5 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/cli/src/controllers/__tests__/auth.controller.test.ts">

<violation number="1" location="packages/cli/src/controllers/__tests__/auth.controller.test.ts:576">
P2: Test title doesn't match what's being tested. The title says "neither token nor inviterId/inviteeId are provided" but the payload actually contains `inviterId`. Consider either:
1. Renaming to "throws BadRequestError if only inviterId is provided without inviteeId", or
2. Changing the payload to `{} as ResolveSignupTokenQueryDto` to match the current title</violation>
</file>

<file name="packages/cli/src/services/user.service.ts">

<violation number="1" location="packages/cli/src/services/user.service.ts:454">
P1: `getInvitationIdsFromPayload()` gates JWT vs legacy parsing using the **instance owner’s** feature flags, but `sendEmails()` chooses JWT vs legacy based on the **inviter’s** feature flags. This mismatch can cause valid invite URLs to be rejected (and invalid formats accepted) depending on who created the invite link. Consider determining the flag based on the inviter (token.inviterId after verification, or payload.inviterId for legacy) rather than the global owner.</violation>

<violation number="2" location="packages/cli/src/services/user.service.ts:464">
P2: `getInvitationIdsFromPayload()` calls `postHog.getFeatureFlags()` without a timeout, even though this file already documents PostHog can block ~10s (plus retries). Consider applying the same `Promise.race` timeout pattern (or other bounded timeout) here to avoid slow invite resolution when PostHog is degraded.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[currents-bot]

✅

E2E Tests: n8n tests passed after 4m 17.7s

🟢 45 · 🔴 0 · ⚪️ 1

View Run Details

Run Details

• Project: n8n

• Groups: 1

• Framework: Playwright

• Run Status: Passed

• Commit: 768be08

• Spec files: 10

• Overall tests: 46

• Duration: 4m 17.7s

• Parallelization: 1

---

This message was posted automatically by currents.dev | Integration Settings

[guillaumejacquart]

1 comment, otherwise LGTM