From 375ad7d0435a176ad593a32045a5f0182a36d505 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Sun, 20 Sep 2026 18:56:58 +0200 Subject: fix: removing someone who never redeemed their invitation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A member row appears only when a code is consumed, so revoking someone invited to the wrong group was refused for having no row — and the node's refusal aborted the browser's removal before its hub half, leaving them a member everywhere with a live code. Revoking now cancels unredeemed codes for that group, and a node refusal no longer cancels the hub removal. Co-Authored-By: Claude Opus 5 --- packages/meshbay-node/src/meshbay_node/roster.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'packages/meshbay-node/src/meshbay_node/roster.py') diff --git a/packages/meshbay-node/src/meshbay_node/roster.py b/packages/meshbay-node/src/meshbay_node/roster.py index 9478a32..9533f25 100644 --- a/packages/meshbay-node/src/meshbay_node/roster.py +++ b/packages/meshbay-node/src/meshbay_node/roster.py @@ -1081,6 +1081,21 @@ class Roster: await self._db.commit() return code + async def drop_invites(self, group_id: str, user_id: str) -> int: + """ + Cancel any code this person has not redeemed yet for this group. + + A code already used is left alone: `used_at` is the record that the join + happened, and it is the only thing that makes a second attempt fail. + """ + assert self._db + cur = await self._db.execute( + "DELETE FROM invites WHERE group_id = ? AND user_id = ? AND used_at IS NULL", + (group_id, user_id), + ) + await self._db.commit() + return cur.rowcount + async def consume_invite(self, code: str, user_id: str) -> dict | None: """ Redeem a code for `user_id`, or return None. -- cgit v1.2.3