deckhearth/pages/api/invite/accept.js

import { sql } from '../../../lib/sql.js';

export default async function handler(req, res) {
  if (req.method !== 'POST') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  try {
    const { token } = req.body;

    if (!token) {
      return res.status(400).json({ error: 'Invitation token is required' });
    }

    // Find the invitation
    const invitationResult = await sql`
      SELECT cp.*, c.name as collection_name, u.email
      FROM collection_permissions cp
      JOIN collections c ON cp.collection_id = c.id
      JOIN users u ON cp.user_id = u.id
      WHERE cp.invite_token = ${token} AND cp.status = 'pending'
    `;

    if (invitationResult.rows.length === 0) {
      return res.status(404).json({ error: 'Invalid or expired invitation' });
    }

    const invitation = invitationResult.rows[0];

    // Check if invitation is expired (7 days)
    const inviteDate = new Date(invitation.created_at);
    const expiryDate = new Date(inviteDate.getTime() + 7 * 24 * 60 * 60 * 1000);
    
    if (new Date() > expiryDate) {
      return res.status(410).json({ error: 'Invitation has expired' });
    }

    // Accept the invitation
    const result = await sql`
      UPDATE collection_permissions 
      SET status = 'active', invite_token = NULL, updated_at = NOW()
      WHERE invite_token = ${token}
      RETURNING *
    `;

    // If user was pending, activate them
    if (invitation.email) {
      await sql`
        UPDATE users 
        SET is_pending = false 
        WHERE id = ${invitation.user_id} AND is_pending = true
      `;
    }

    // Log activity
    await sql`
      INSERT INTO collection_activity (collection_id, user_id, action, details)
      VALUES (${invitation.collection_id}, ${invitation.user_id}, 'invitation_accepted', ${JSON.stringify({ token })})
    `;

    res.status(200).json({
      message: 'Invitation accepted successfully',
      collection: {
        id: invitation.collection_id,
        name: invitation.collection_name
      },
      permission: result.rows[0]
    });

  } catch (error) {
    console.error('Error accepting invitation:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
}