fix(auth): scanner-proof invite links via /accept + force resend
Mail gateways redeemed Supabase single-use action_links on delivery, burning invites for the whole LAWS3850 cohort. Email a token_hash to an inert /accept page instead; verifyOtp runs only on click. Also fix the invite target filter (loadActivatedEmails, not profile rows) and add force resend to recover falsely-activated accounts.
| Repository | pdombkins/rose_lawyer |
|---|---|
| Author | Peter Dombkins <pdombkins@gmail.com> |
| Authored | |
| Parents | f2bf415c |
| Stats | 8 files changed , +390 , -85 |
| Part of | Auth/account: invite-only access, password reset, invite hardening |
Capture this commit into my fork
Download a Markdown prompt that tells Claude how to port this
exact commit into your working tree. Run it via
claude -p < capture-commit-240c4cf8.md
from inside the repo you want the change in.