feat(hub): invitation-link tickets bound to a verified address

group_invite_links holds sha256(ticket) and the invitee's address blind
index; redeeming grants membership to that account only. Owner-only
create/list/cancel (a node token may create, never mail), 20 outstanding
per group, optional mail written by the hub itself and capped at 10 per
sender per day (mail.invite_link_daily_cap). MESHBAY_DESIGN.md §3.4 now
carries the whole link design.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index 9b9a189..a994acb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -35,6 +35,7 @@ from meshbay_hub.db.engine import get_db
 from meshbay_hub.db.models import (
     EmailVerification,
     Group,
+    GroupInviteLink,
     GroupMember,
     IPLog,
     Node,
@@ -1396,6 +1397,10 @@ async def erase_account(db: AsyncSession, user: User, owned_groups: str = "refus
     await db.execute(delete(UserDevice).where(UserDevice.user_id == user.id))
     await db.execute(delete(SwarmSource).where(SwarmSource.node_id == user.id))
     await db.execute(delete(EmailVerification).where(EmailVerification.user_id == user.id))
+    # Links this account issued for a group it no longer owns; the ones for its
+    # own groups went with them above. A used link keeps pointing at the
+    # tombstone of whoever used it, which is the record of the join.
+    await db.execute(delete(GroupInviteLink).where(GroupInviteLink.created_by == user.id))
 
     username = user.username
     # Before the name is released: the connection log is kept for its legal