feat(hub): invitation-link tickets bound to a verified address

group_invite_links holds sha256(ticket) and the invitee's address blind
index; redeeming grants membership to that account only. Owner-only
create/list/cancel (a node token may create, never mail), 20 outstanding
per group, optional mail written by the hub itself and capped at 10 per
sender per day (mail.invite_link_daily_cap). MESHBAY_DESIGN.md §3.4 now
carries the whole link design.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 15 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py b/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py
index 1ef7796..b0ef4d4 100644
--- a/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py
+++ b/packages/meshbay-hub/src/meshbay_hub/tasks/cleanup.py
@@ -7,7 +7,7 @@ from datetime import UTC, datetime, timedelta
 from sqlalchemy import delete, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from meshbay_hub.db.models import EmailVerification, Group, IPLog, User
+from meshbay_hub.db.models import EmailVerification, Group, GroupInviteLink, IPLog, User
 
 log = logging.getLogger(__name__)
 
@@ -42,6 +42,17 @@ async def purge_stale_pending_users(db: AsyncSession,
     return result.rowcount
 
 
+async def purge_invite_links(db: AsyncSession) -> int:
+    """Unused invitation links once expired; used ones after a month."""
+    from meshbay_hub.api.invite_links import KEEP_REDEEMED
+    now = datetime.now(UTC)
+    result = await db.execute(delete(GroupInviteLink).where(
+        (GroupInviteLink.redeemed_by.is_(None) & (GroupInviteLink.expires_at <= now))
+        | (GroupInviteLink.redeemed_at < now - KEEP_REDEEMED)))
+    await db.commit()
+    return result.rowcount
+
+
 async def cleanup_loop(get_session):
     """Run cleanup once at startup, then every 24 hours."""
     try:
@@ -71,6 +82,9 @@ async def cleanup_loop(get_session):
                     throttled = await login_throttle.purge_expired(db)
                     if throttled:
                         log.info("Purged %d expired sign-in counters", throttled)
+                    links = await purge_invite_links(db)
+                    if links:
+                        log.info("Purged %d spent or expired invitation links", links)
             except asyncio.CancelledError:
                 raise
             except Exception as e: