Fix invalid token for logged-in users (#208)

* fix invalid token

* reword invalid link message

* fix test_invitation_acceptance

* fix: address review nits on invitation warning pages

Match the login/register header wording to the expired vs. invalid
warning shown, and dedupe the repeated user/invitation_token_warning
check into a single template variable. Type-hint the shared test
helper and assert the correct heading per warning type.

* fix: harden profile-form htmx swap tests against CI timing flakiness

Synchronize each Edit/Cancel/Save click on its underlying htmx response
instead of polling the DOM cold, and raise the post-swap visibility
timeout to 10s to match the margin already used by similar swap
assertions elsewhere in the browser suite. This removes a race that
intermittently failed test_edit_profile_swap_cycle in CI without
hiding genuine swap failures, since the assertions still fail on a
truly broken swap.

---------

Co-authored-by: chriscarrollsmith <chriscarrollsmith@gmail.com>

Author: rafizamankhan

templates/account/login.html

@@ -1,8 +1,11 @@
 {% extends "account/auth_base.html" %}
 
-{% block title %}Login{% endblock %}
+{% set show_warning_only = user and invitation_token_warning %}
+{% set warning_heading = "Invitation link expired" if invitation_token_warning == 'expired' else "Invitation link invalid" %}
 
-{% block auth_header %}Login{% endblock %}
+{% block title %}{% if show_warning_only %}{{ warning_heading }}{% else %}Login{% endif %}{% endblock %}
+
+{% block auth_header %}{% if show_warning_only %}{{ warning_heading }}{% else %}Login{% endif %}{% endblock %}
 
 {% block auth_content %}
 <div class="login-form">
@@ -15,6 +18,12 @@
         This invitation link is no longer valid. If you were invited again recently, use the link from the most recent invitation email.
     </div>
     {% endif %}
+
+    {% if show_warning_only %}
+    <div class="d-grid">
+        <a href="{{ url_for('read_dashboard') }}" class="btn btn-primary">Return to dashboard</a>
+    </div>
+    {% else %}
     <form method="POST" action="{{ url_for('login') }}"
           hx-post="{{ url_for('login') }}" hx-swap="none"
           class="needs-validation" novalidate>
@@ -55,5 +64,6 @@
 
     <!-- Register Link -->
     <p class="text-center">Don't have an account? <a href="{{ url_for('read_register') }}">Register here</a></p>
+    {% endif %}
 </div>
-{% endblock %}
+{% endblock %}

templates/account/register.html

@@ -1,8 +1,11 @@
 {% extends "account/auth_base.html" %}
 
-{% block title %}Register{% endblock %}
+{% set show_warning_only = user and invitation_token_warning %}
+{% set warning_heading = "Invitation link expired" if invitation_token_warning == 'expired' else "Invitation link invalid" %}
 
-{% block auth_header %}Register{% endblock %}
+{% block title %}{% if show_warning_only %}{{ warning_heading }}{% else %}Register{% endif %}{% endblock %}
+
+{% block auth_header %}{% if show_warning_only %}{{ warning_heading }}{% else %}Register{% endif %}{% endblock %}
 
 {% block auth_content %}
 <div class="register-form">
@@ -15,6 +18,12 @@
         This invitation link is no longer valid. If you were invited again recently, use the link from the most recent invitation email.
     </div>
     {% endif %}
+
+    {% if show_warning_only %}
+    <div class="d-grid">
+        <a href="{{ url_for('read_dashboard') }}" class="btn btn-primary">Return to dashboard</a>
+    </div>
+    {% else %}
     <form method="POST" action="{{ url_for('register') }}"
           hx-post="{{ url_for('register') }}" hx-swap="none"
           class="needs-validation" novalidate>
@@ -78,8 +87,10 @@
 
     <!-- Login Link -->
     <p class="mt-3 text-center">Already have an account? <a href="{{ url_for('read_login') }}">Login here</a></p>
+    {% endif %}
 </div>
 
+{% if not show_warning_only %}
 <script>
     (function () {
         const password = document.getElementById('password');
@@ -97,4 +108,5 @@
         confirmPassword.addEventListener('input', syncConfirmPasswordValidity);
     })();
 </script>
-{% endblock %}
+{% endif %}
+{% endblock %}

tests/browser/test_profile_forms.py

@@ -44,6 +44,11 @@ def profile_page(browser, live_server: str, _register_profile_user):
     context.close()
 
 
+# Generous bound for htmx round trips under CI load; the assertions below
+# still fail fast on a genuinely broken swap since they poll, not sleep.
+HTMX_SWAP_TIMEOUT_MS = 10_000
+
+
 def test_edit_profile_swap_cycle(profile_page: Page):
     """Clicking Edit fetches the form via hx-get; submitting swaps back to display."""
     page = profile_page
@@ -53,16 +58,27 @@ def test_edit_profile_swap_cycle(profile_page: Page):
     expect(card.locator("button:has-text('Edit')")).to_be_visible()
     expect(card.locator("form")).to_have_count(0)
 
-    # Click Edit — fetches form partial via hx-get
-    card.locator("button:has-text('Edit')").click()
-    expect(card.locator('button:has-text("Save Changes")')).to_be_visible(timeout=5_000)
+    # Click Edit — fetches form partial via hx-get. Wait for the response
+    # itself (not just the eventual DOM state) so a slow server round trip
+    # produces a clear network-timeout failure rather than a flaky locator
+    # mismatch.
+    with page.expect_response("**/user/edit-form"):
+        card.locator("button:has-text('Edit')").click()
+    expect(card.locator('button:has-text("Save Changes")')).to_be_visible(
+        timeout=HTMX_SWAP_TIMEOUT_MS
+    )
 
     # Submit the form
-    card.locator('button[type="submit"]').click()
+    with page.expect_response("**/user/update"):
+        card.locator('button[type="submit"]').click()
 
     # Should swap back to display mode
-    expect(card.locator("button:has-text('Edit')")).to_be_visible(timeout=5_000)
-    expect(card.locator('button[type="submit"]')).to_have_count(0, timeout=5_000)
+    expect(card.locator("button:has-text('Edit')")).to_be_visible(
+        timeout=HTMX_SWAP_TIMEOUT_MS
+    )
+    expect(card.locator('button[type="submit"]')).to_have_count(
+        0, timeout=HTMX_SWAP_TIMEOUT_MS
+    )
 
 
 def test_edit_profile_cancel(profile_page: Page):
@@ -71,15 +87,23 @@ def test_edit_profile_cancel(profile_page: Page):
     card = page.locator("#profile-card")
 
     # Click Edit
-    card.locator("button:has-text('Edit')").click()
-    expect(card.locator('button:has-text("Save Changes")')).to_be_visible(timeout=5_000)
+    with page.expect_response("**/user/edit-form"):
+        card.locator("button:has-text('Edit')").click()
+    expect(card.locator('button:has-text("Save Changes")')).to_be_visible(
+        timeout=HTMX_SWAP_TIMEOUT_MS
+    )
 
     # Click Cancel
-    card.locator("button:has-text('Cancel')").click()
+    with page.expect_response("**/user/profile-display"):
+        card.locator("button:has-text('Cancel')").click()
 
     # Should swap back to display mode
-    expect(card.locator("button:has-text('Edit')")).to_be_visible(timeout=5_000)
-    expect(card.locator('button[type="submit"]')).to_have_count(0, timeout=5_000)
+    expect(card.locator("button:has-text('Edit')")).to_be_visible(
+        timeout=HTMX_SWAP_TIMEOUT_MS
+    )
+    expect(card.locator('button[type="submit"]')).to_have_count(
+        0, timeout=HTMX_SWAP_TIMEOUT_MS
+    )
 
 
 def test_add_email_form_resets_after_submit(profile_page: Page):
@@ -94,7 +118,8 @@ def test_add_email_form_resets_after_submit(profile_page: Page):
     email_input.fill("new-browser-test@example.com")
     assert email_input.input_value() == "new-browser-test@example.com"
 
-    page.click('form:has(input[name="new_email"]) button[type="submit"]')
+    with page.expect_response("**/account/emails/add"):
+        page.click('form:has(input[name="new_email"]) button[type="submit"]')
 
     # hx-on::after-settle resets the form after the swap completes
-    expect(email_input).to_have_value("", timeout=5_000)
+    expect(email_input).to_have_value("", timeout=HTMX_SWAP_TIMEOUT_MS)

tests/routers/core/test_invitation_acceptance.py

@@ -1,3 +1,4 @@
+import httpx
 import pytest
 from fastapi.testclient import TestClient
 from sqlmodel import Session, select
@@ -10,6 +11,21 @@
 # --- Test Scenarios ---
 
 
+def _assert_authenticated_invitation_warning_page(
+    response: httpx.Response,
+    *,
+    warning_substring: str,
+    heading_substring: str = "invitation link invalid",
+) -> None:
+    """Logged-in users with a bad invite token see a warning and dashboard CTA only."""
+    assert response.status_code == 200
+    assert warning_substring in response.text.lower()
+    assert 'name="password"' not in response.text
+    assert "return to dashboard" in response.text.lower()
+    assert app.url_path_for("read_dashboard") in response.text
+    assert heading_substring in response.text.lower()
+
+
 # 1. Success: New User Registration Flow
 def test_accept_invitation_new_user_get_redirects_to_register(
     unauth_client: TestClient, test_invitation: Invitation
@@ -289,8 +305,47 @@ def test_accept_invitation_logged_in_user_sees_expired_warning(
     ]
 
     auth_response = auth_client_invitee.get(response.headers["location"])
-    assert auth_response.status_code == 200
-    assert "invitation link has expired" in auth_response.text.lower()
+    _assert_authenticated_invitation_warning_page(
+        auth_response,
+        warning_substring="invitation link has expired",
+        heading_substring="invitation link expired",
+    )
+
+
+def test_accept_invitation_logged_in_user_sees_invalid_warning_on_login(
+    auth_client_owner: TestClient,
+):
+    """Logged-in users with an unknown invite token get a warning, not a login form."""
+    response = auth_client_owner.get(
+        app.url_path_for("read_login"),
+        params={"invitation_token": "invalid-token-string"},
+    )
+    _assert_authenticated_invitation_warning_page(
+        response,
+        warning_substring="no longer valid",
+    )
+
+
+def test_accept_invitation_logged_in_user_sees_expired_warning_on_register(
+    auth_client_owner: TestClient,
+    expired_invitation: Invitation,
+):
+    """Logged-in users redirected to register for a bad invite still get the dashboard CTA."""
+    response = auth_client_owner.get(
+        app.url_path_for("accept_invitation"),
+        params={"token": expired_invitation.token},
+        follow_redirects=False,
+    )
+    assert response.status_code == 303
+    parsed_url = urlparse(response.headers["location"])
+    assert parsed_url.path == app.url_path_for("read_register")
+
+    auth_response = auth_client_owner.get(response.headers["location"])
+    _assert_authenticated_invitation_warning_page(
+        auth_response,
+        warning_substring="invitation link has expired",
+        heading_substring="invitation link expired",
+    )
 
 
 @pytest.mark.parametrize(

tests/test_templates.py

@@ -59,6 +59,20 @@ def test_base_template_includes_viewport_meta():
     assert "width=device-width" in content
 
 
+def test_login_template_hides_form_for_authenticated_invitation_warning():
+    content = Path("templates/account/login.html").read_text()
+    assert "user and invitation_token_warning" in content
+    assert "Return to dashboard" in content
+    assert "read_dashboard" in content
+
+
+def test_register_template_hides_form_for_authenticated_invitation_warning():
+    content = Path("templates/account/register.html").read_text()
+    assert "user and invitation_token_warning" in content
+    assert "Return to dashboard" in content
+    assert "read_dashboard" in content
+
+
 def test_toast_partial_exists():
     assert Path("templates/base/partials/toast.html").is_file()