From 95cec0e0bbc28e930f297f44bbd3dbf4d63f0bc2 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 23 Sep 2026 19:30:47 +0200 Subject: fix(hub): a redeemed invitation link leaves the owner's list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The list under "Invite by link" answered every ticket the group had ever minted, so a link that somebody had already used sat there saying "used by " for the thirty days of KEEP_REDEEMED — beside the member row it had just produced, and above the links that still wait for somebody, which are the only ones there is anything to do about. The node's own `member list` had never shown them: it selects `used_at IS NULL`. The listing now selects `redeemed_by IS NULL`, and drops the `redeemed` status and the `redeemed_by` field with it. The row itself still lives for KEEP_REDEEMED, which is what lets a reload or a second tab of the invitation page be answered rather than refused; its comment says that now instead of naming a list it is no longer in. The SPA filters too, because the desktop client's copy of this interface can be newer than the hub it is signed into. Co-Authored-By: Claude Opus 5 --- docs/MESHBAY_DESIGN.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'docs/MESHBAY_DESIGN.md') diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 673ad05..325a3c5 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -1811,7 +1811,12 @@ account, and an unknown, used, expired or cancelled ticket, or a group no longer active, is one uniform refusal. Creating a link says nothing about whether the address has an account (**M1**). At most twenty outstanding per group, as on the node; a lifetime clamped to thirty days; a node token may create one for its own -operator's group (the CLI) and may not ask for mail. What the binding holds +operator's group (the CLI) and may not ask for mail. **The list answered to the +owner holds the links nobody has used yet**, which are the ones there is still +something to do about: a redeemed one has become the member row it produced, and +showing both says the same thing twice. The row itself outlives the list by +thirty days, so the account that used a link is answered on a reload or in a +second tab rather than refused. What the binding holds against, per the convention: **third parties** — a messaging service that previews the link, a forwarded mail — and not this hub, which verifies the addresses it compares and could already be anybody. -- cgit v1.2.3