fix(invite): reject invalidated invites in acceptInvite
Same invalidatedAt gap as getInviteInfo: a superseded invite (status still 'pending', invalidatedAt set) could still be used to create an account and join the household. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -205,7 +205,9 @@ public class HouseholdService {
|
||||
HouseholdInvite invite = householdInviteRepository.findByInviteCode(code)
|
||||
.orElseThrow(() -> new ResourceNotFoundException("Invite not found or invalid"));
|
||||
|
||||
if ("used".equals(invite.getStatus()) || invite.getExpiresAt().isBefore(Instant.now())) {
|
||||
if ("used".equals(invite.getStatus())
|
||||
|| invite.getInvalidatedAt() != null
|
||||
|| invite.getExpiresAt().isBefore(Instant.now())) {
|
||||
throw new ResourceNotFoundException("Invite not found or invalid");
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user