feat(auth): invite-gated signup UI

[PierreBrisorgueil]

Summary

• What changed: Pinia auth store signup now relays an inviteToken as a URL query param (backend reads req.query) + new verifyInvite(token) action. signup.view.vue reads ?inviteToken, verifies it on mount, reveals the credentials form + prefills the invited email when public signup is disabled, and passes the token through to signup.
• Why: Cross-stack feature — when the Node backend is configured with signupMode: invite-only, the UI must gate the signup form behind a valid invite token fetched from ?inviteToken.
• Related issues: Closes feat(auth): invite-gated signup UI #4211

Scope

• Modules impacted: modules/auth/ (store, view)
• Cross-module impact: none
• Risk level: low

Validation

• npm run lint
• npm run test:unit
• npm run build
• Manual checks done (if applicable)

Guardrails check

• No secrets or credentials introduced (.env*, secrets/**, keys, tokens)
• No risky rename/move of core stack paths
• Changes remain merge-friendly for downstream projects
• Tests added or updated when behavior changed

Optional: Infra/Stack alignment details

Before vs After (key changes only)

Area	Before	After	Notes
auth.store.js signup()	No invite token relay	Appends ?inviteToken=<token> to signup URL query	Backend reads via req.query
auth.store.js	No verifyInvite action	verifyInvite(token) calls GET /api/auth/invitations/verify/:token	Returns { email }
signup.view.vue	Always shows form	Reads ?inviteToken on mount, verifies token, reveals form + prefills email	No-op when inviteToken absent (public signup mode unchanged)

• Upstream parity target / source: pierreb-devkit/Node — same branch feat/invite-only-signup-gate adds invitation endpoints + signup gate that this UI drives
• Automation or policy impact: none
• Rollback plan: revert commits on both stacks; Node gate defaults to signupMode: open so no data loss

Notes for reviewers

• Security considerations: inviteToken is a short-lived JWT issued by the backend; the UI only relays it — no client-side validation of the token's claims.
• Mergeability considerations: cross-stack pair with pierreb-devkit/Node feat/invite-only-signup-gate — Node PR should merge first (or simultaneously) so the verify endpoint exists.
• Follow-up tasks: downstream propagation to trawl_vue, pierreb_vue, comes_vue, montaine_vue via /update-project after both stacks merge.

Cross-stack pair

Node counterpart PR: pierreb-devkit/Node branch feat/invite-only-signup-gate — adds invitation model, service, endpoints + signup gate.

Test plan

• npm run lint — passes
• npm run test:unit — 1918 tests, all green; auth.store coverage 99/92/100/100
• npm run build — passes (note: src/config/index.js is generated/gitignored; CI regenerates via scripts/generateConfig.js)

Doc-sync ack

• No deleted files vs master
• No stale i18n/TODO/FIXME comments (Phase 0.5 clean)

[coderabbitai]

Warning

Review limit reached

@PierreBrisorgueil, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 16 minutes and 22 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3e2b9bec-04cb-44cf-a5fe-f00da62cf576

📥 Commits

Reviewing files that changed from the base of the PR and between a92952c and e252c16.

📒 Files selected for processing (4)

• src/modules/auth/stores/auth.store.js
• src/modules/auth/tests/auth.signup.view.unit.tests.js
• src/modules/auth/tests/auth.store.unit.tests.js
• src/modules/auth/views/signup.view.vue

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/invite-only-signup-gate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.56%. Comparing base (a3207c6) to head (e252c16).
⚠️ Report is 9 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4212   +/-   ##
=======================================
  Coverage   99.56%   99.56%           
=======================================
  Files          31       31           
  Lines        1151     1159    +8     
  Branches      329      330    +1     
=======================================
+ Hits         1146     1154    +8     
  Misses          5        5           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR adds invite-gated signup support to the auth module by verifying an inviteToken from the signup page URL and relaying that token to the backend during signup, enabling “invite-only” signup mode compatibility.

Changes:

• Update signup view to read ?inviteToken, verify it on creation, prefill invited email, and allow the credentials form when the invite is valid even if public signup is disabled.
• Update auth store signup() to relay inviteToken via URL query (and omit it from the POST body).
• Add a new verifyInvite(token) store action plus unit tests covering invite relay and invite-gated rendering.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
src/modules/auth/views/signup.view.vue	Adds invite verification flow and gates form visibility based on inviteToken validity.
src/modules/auth/stores/auth.store.js	Relays inviteToken via query param on signup and introduces verifyInvite() action.
src/modules/auth/tests/auth.store.unit.tests.js	Adds tests for inviteToken relay on signup and verifyInvite behavior.
src/modules/auth/tests/auth.signup.view.unit.tests.js	Adds tests for invite-only signup gating, email prefill, and passing inviteToken to signup().

[PierreBrisorgueil]

@coderabbitai full review

[coderabbitai]

✅ Actions performed

Full review triggered.