feat(auth): add register API route by chemist-god · Pull Request #54 · chemist-god/smart-todo

chemist-god · 2025-11-21T00:12:02Z

Invite & Auth: invite APIs, landing pages, and social-share improvements

Summary

This PR implements a complete invite flow (API endpoints, landing pages, and client components), updates authentication/signup to integrate invites, enhances stake-sharing endpoints, and improves social sharing UI and service logic. These changes enable invite-based onboarding, better share metadata/links across platforms, and new UI for managing invitations.

What changed (high level)

Backend / API

src/app/api/auth/register/route.ts — update/add registration behavior to support invite association
src/app/api/invite/[code]/accept/route.ts — accept invite by code
src/app/api/invite/[code]/route.ts — lookup invite details by code
src/app/api/invite/code/route.ts — generate invite codes
src/app/api/invite/invitations/route.ts — create/list invitations
src/app/api/invite/stats/route.ts — invite metrics endpoint
src/app/api/stakes/[id]/share/route.ts — improve stake share endpoint (metadata / platform links)
src/app/api/stakes/route.ts — stakes collection improvements for invites/sharing

Frontend / Pages / Components

src/app/invite/[code]/page.tsx — invite landing page
src/app/stakes/invite/[id]/page.tsx — stake invite page updates
src/app/auth/signup/page.tsx — signup adjustments to accept invites
New components:
- src/components/invite/InviteLandingClient.tsx
- src/components/invite/PlatformInviteLanding.tsx
- src/components/settings/InvitationManagement.tsx
Updates:
- src/components/settings/InviteFriendsSettings.tsx
- src/components/stakes/EnhancedSocialShare.tsx
- src/components/stakes/EnhancedUniversalShareModal.tsx

Libraries / Services

src/lib/social-share-service.ts — updated logic for building share metadata, platform links, and invite-aware sharing behavior

Why

Provide a robust invite flow for user acquisition and friend referrals (code generation, landing/accept, stats).
Surface invites in onboarding and stake flows to boost conversion.
Improve social sharing reliability and metadata across platforms to increase click-through and correct behavior on different devices and social channels.
Add invite management UI for admins/users to manage invites.

How to test (smoke checklist)

Start dev server:
- npm run dev

Invite API checks

Generate a code:

curl -X POST http://localhost:3000/api/invite/code -H "Content-Type: application/json" -d '{}'

Verify response contains an invite code.

Create and list invites:

curl -X POST http://localhost:3000/api/invite/invitations -H "Content-Type: application/json" -d '{"targetEmail":"test@example.com"}'
curl http://localhost:3000/api/invite/invitations

Accept invite:

curl -X POST http://localhost:3000/api/invite/<code>/accept -H "Content-Type: application/json" -d '{"userId":"<id>"}'

Confirm the invite is consumed and user association occurs (or expected join behavior).

Check stats:

curl http://localhost:3000/api/invite/stats

Invite landing page
- Visit http://localhost:3000/invite/<code> in a browser.
- Confirm the landing CTA shows invite details and routes to signup/sign-in if needed.
Signup flow
- Go through /auth/signup while carrying an invite code; ensure the created account is associated with the invite (or the UI highlights invite benefits).
Share & stake flows
- Use the stake share modal and confirm that:
  - The share endpoint (/api/stakes/[id]/share) returns proper metadata.
  - Platform links (Twitter, WhatsApp, copy link) include invite/referral when appropriate.
- Validate EnhancedSocialShare and EnhancedUniversalShareModal render correctly and produce expected share data.
UI sanity checks
- Open InvitationManagement and InviteFriendsSettings pages; verify lists, actions (revoke/resend), and toggles work.
Lint & tests
- npm run lint
- npm test (if available)

Database / Migrations

This PR does not intentionally include any schema-breaking changes. If migration files are present, run:
- npx prisma generate
- Local: npx prisma db push
- Staging/Prod: npx prisma migrate deploy

If any DB errors occur, report them and we can prepare a migration or revert strategy.

Review notes / Focus areas

Invite acceptance edge cases:
- Expired codes
- Already-accepted codes
- Wrong-account acceptance attempts
Security:
- Ensure invite tokens/codes are validated and not logged in plaintext
- Rate-limit code generation endpoints if necessary
Sharing logic:
- Verify metadata and de-duplication across platforms (mobile vs desktop link previews)
Signup flow:
- Confirm it doesn’t regress non-invite signups or social login flows
Integration:
- Make sure share URLs and landing page behavior works with deployed domains (env/runtime link generation)

vercel · 2025-11-21T00:12:07Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
smart-todo	Error			Nov 22, 2025 0:16am
smart-todo-wum3	Error			Nov 22, 2025 0:16am

Copilot

Pull Request Overview

This PR implements a comprehensive invite system for the Smart Todo platform, integrating invite flows for both platform-level and stake-specific invitations. The changes enable users to invite friends via unique codes, track invitation metrics, and accept invitations during signup or while logged in.

Key Changes:

Added complete invite API infrastructure with code generation, lookup, acceptance, and statistics endpoints
Integrated invite codes into the signup/registration flow with automatic invitation acceptance
Enhanced social sharing with security codes for more secure and trackable stake invitations
Added UI components for managing invitations and displaying invite landing pages

Reviewed Changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 25 comments.

Show a summary per file

File	Description
`src/app/api/auth/register/route.ts`	Extended registration to accept and validate invite codes, automatically linking new users to their inviters
`src/app/api/invite/[code]/route.ts`	Unified endpoint to fetch invitation details for both platform and stake invitations by code
`src/app/api/invite/[code]/accept/route.ts`	Handles platform invitation acceptance with validation and referral tracking
`src/app/api/invite/code/route.ts`	Generates and retrieves user referral codes, creates platform invitations
`src/app/api/invite/invitations/route.ts`	CRUD operations for managing user's sent invitations (list, resend, cancel)
`src/app/api/invite/stats/route.ts`	Provides referral statistics including invitation counts, acceptance rates, and view metrics
`src/app/api/stakes/[id]/share/route.ts`	Changed from POST to GET; returns shareable links with security codes for stake invitations
`src/app/api/stakes/route.ts`	Pre-generates public stake invitations with security codes during SOCIAL_STAKE creation
`src/app/invite/[code]/page.tsx`	Unified landing page that routes to appropriate invite component based on invitation type
`src/app/stakes/invite/[id]/page.tsx`	Redirects legacy stake invite URLs to new unified invite route using security codes
`src/app/auth/signup/page.tsx`	Captures invite codes from URL parameters and passes them to registration endpoint
`src/components/invite/InviteLandingClient.tsx`	Client component for stake invitation landing pages with auto-accept functionality
`src/components/invite/PlatformInviteLanding.tsx`	Client component for platform invitation landing pages with authentication flow
`src/components/settings/InvitationManagement.tsx`	New UI for managing sent invitations with filtering, resending, and cancellation
`src/components/settings/InviteFriendsSettings.tsx`	Updated to fetch real stats from API and embed invitation management component
`src/components/stakes/EnhancedSocialShare.tsx`	Fetches and uses security codes for generating shareable stake URLs
`src/components/stakes/EnhancedUniversalShareModal.tsx`	Updated to use security codes in QR codes, direct links, and embed codes
`src/lib/social-share-service.ts`	Enhanced to generate URLs using security codes when available, falling back to stake IDs
`.gitignore`	Added documentation file to ignore list

Comments suppressed due to low confidence (1)

src/components/settings/InvitationManagement.tsx:59

Unused variable url.

            const url = type ? `/api/invite/invitations?type=${type}` : '/api/invite/invitations?type=PLATFORM';

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-21T00:19:09Z

src/components/invite/PlatformInviteLanding.tsx

+    useEffect(() => {
+        if (typeof window !== "undefined" && session && invitation?.status === 'PENDING') {
+            const params = new URLSearchParams(window.location.search);
+            if (params.get("autoAccept") === "1" && !accepting) {
+                handleAccept();
+            }
+        }
+    }, [session, invitation]);


The useEffect has a missing dependency: handleAccept. Either include it in the dependency array or wrap the function in useCallback. Additionally, the dependency array [session, invitation] should also include accepting to prevent calling handleAccept multiple times while a request is in progress.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2025-11-21T00:19:09Z

src/app/stakes/invite/[id]/page.tsx

+                    data: {
+                        stakeId: stake.id,
+                        inviterId: stake.userId,
+                        inviteeEmail: 'public@share.com', // Placeholder for public shares


The placeholder email 'public@share.com' is hardcoded here, which creates a magic string that's repeated across multiple files (also in /api/stakes/route.ts and /api/stakes/[id]/share/route.ts). This should be extracted to a constant in a shared location to improve maintainability and reduce the risk of typos.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2025-11-21T00:19:09Z

src/app/invite/[code]/page.tsx

+  const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || process.env.VERCEL_URL || 'http://localhost:3000';
+


The server component fetches data using fetch with baseUrl constructed from environment variables. However, on server-side, NEXT_PUBLIC_BASE_URL or VERCEL_URL might not include the protocol (http/https), especially for VERCEL_URL. This could result in malformed URLs like vercel-deployment.vercel.app/api/invite/... instead of https://vercel-deployment.vercel.app/api/invite/.... Consider adding protocol handling or using a more robust URL construction method.

Suggested change

const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || process.env.VERCEL_URL || 'http://localhost:3000';

let baseUrl = process.env.NEXT_PUBLIC_BASE_URL || process.env.VERCEL_URL || 'http://localhost:3000';

// Ensure baseUrl includes protocol

if (!/^https?:\/\//i.test(baseUrl)) {

baseUrl = `https://${baseUrl}`;

}

Copilot · 2025-11-21T00:19:10Z

src/app/api/invite/invitations/route.ts

+
+            await prisma.stakeInvitation.update({
+                where: { id: invitationId },
+                data: { status: 'DECLINED' } // Use DECLINED for cancelled stake invitations


The status update to 'DECLINED' is used for cancelled stake invitations, but 'DECLINED' typically means the invitee rejected the invitation, not that the inviter cancelled it. Consider using 'CANCELLED' for consistency with platform invitations, or ensure the schema supports 'CANCELLED' status for stake invitations as well.

Suggested change

data: { status: 'DECLINED' } // Use DECLINED for cancelled stake invitations

data: { status: 'CANCELLED' } // Use CANCELLED for cancelled stake invitations

Copilot · 2025-11-21T00:19:10Z

src/app/api/invite/[code]/accept/route.ts

+        // Check if this invitation was already accepted by someone else
+        if (invitation.acceptedBy) {


This check prevents multiple users from accepting the same invitation, but it doesn't handle the case where inviteeEmail is set to a specific email. Platform invitations can be accepted by anyone if no inviteeEmail is specified, but when an inviteeEmail is set, only one person should accept it. However, the current logic allows the same invitation code to be accepted only once regardless of whether it was targeted. Consider whether this is the intended behavior - if invitations without inviteeEmail should be reusable codes, this check would prevent that.

Suggested change

// Check if this invitation was already accepted by someone else

if (invitation.acceptedBy) {

// For invitations with inviteeEmail, only allow one acceptance

if (invitation.inviteeEmail && invitation.acceptedBy) {

Copilot · 2025-11-21T00:19:14Z

src/components/invite/PlatformInviteLanding.tsx

+"use client";
+
+import React, { useState, useEffect } from "react";
+import { signIn, useSession } from "next-auth/react";


Unused import signIn.

Suggested change

import { signIn, useSession } from "next-auth/react";

import { useSession } from "next-auth/react";

Copilot · 2025-11-21T00:19:14Z

src/components/invite/PlatformInviteLanding.tsx

+}
+
+export default function PlatformInviteLanding({ invitation, error }: PlatformInviteLandingProps) {
+    const { data: session, status: sessionStatus } = useSession();


Unused variable sessionStatus.

Suggested change

const { data: session, status: sessionStatus } = useSession();

const { data: session } = useSession();

Copilot · 2025-11-21T00:19:15Z

src/components/invite/PlatformInviteLanding.tsx

+export default function PlatformInviteLanding({ invitation, error }: PlatformInviteLandingProps) {
+    const { data: session, status: sessionStatus } = useSession();
+    const router = useRouter();
+    const [loading, setLoading] = useState(false);


Unused variable loading.

Suggested change

const [loading, setLoading] = useState(false);

Copilot · 2025-11-21T00:19:15Z

src/components/invite/PlatformInviteLanding.tsx

+export default function PlatformInviteLanding({ invitation, error }: PlatformInviteLandingProps) {
+    const { data: session, status: sessionStatus } = useSession();
+    const router = useRouter();
+    const [loading, setLoading] = useState(false);


Unused variable setLoading.

Suggested change

const [loading, setLoading] = useState(false);

Copilot · 2025-11-21T00:19:15Z

src/components/settings/InvitationManagement.tsx

+    TrashIcon,
+    EyeIcon
+} from "@heroicons/react/24/outline";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";


Unused imports CardDescription, CardHeader, CardTitle.

Suggested change

import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";

import { Card, CardContent } from "@/components/ui/card";

…tate

Copilot · 2025-11-22T23:36:38Z

@chemist-god I've opened a new pull request, #55, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2025-11-22T23:36:58Z

@chemist-god I've opened a new pull request, #56, to work on those changes. Once the pull request is ready, I'll request review from you.

feat(auth): add register API route

b3f4e5b

chemist-god requested a review from Copilot November 21, 2025 00:12

Copilot started reviewing on behalf of chemist-god November 21, 2025 00:12 View session

Copilot finished reviewing on behalf of chemist-god November 21, 2025 00:15

Copilot AI reviewed Nov 21, 2025

View reviewed changes

chemist-god added 13 commits November 21, 2025 11:13

chore: update .gitignore

0be371e

chore(db): update Prisma schema

571e76c

feat(auth): update register endpoint

57a47fc

feat(goals): update progress API for goal progress

da959ee

feat(invite): accept invite by code (server)

3d22070

feat(invite): lookup invite by code

a3a433b

feat(invite): list/create invitations

3d98466

feat(invite): invite stats endpoint

641642a

feat(auth): integrate invites into signup

4569a69

feat(invite): invite landing page

2d7ed64

ui(stakes): update stake invite page

0154e70

feat(welcome): add welcome landing page

805ea31

ui(invite): refine PlatformInviteLanding

c2344c7

vercel bot had a problem deploying to Preview – smart-todo November 21, 2025 11:14 Failure

vercel bot had a problem deploying to Preview – smart-todo-wum3 November 21, 2025 11:16 Failure

chemist-god added 3 commits November 22, 2025 11:48

feat(invite): update invite code endpoint

d7927d4

feat(auth): integrate invite code into signup

458d70e

ui(invite): refine PlatformInviteLanding

d4f66c4

vercel bot had a problem deploying to Preview – smart-todo November 22, 2025 11:50 Failure

vercel bot had a problem deploying to Preview – smart-todo-wum3 November 22, 2025 11:51 Failure

chemist-god added 2 commits November 22, 2025 12:12

feat(signup): add loading spinner to SignUpPage component

9aa5f01

feat(welcome): wrap WelcomeContent in Suspense for improved loading s…

f7e5a81

…tate

vercel bot had a problem deploying to Preview – smart-todo-wum3 November 22, 2025 12:15 Failure

vercel bot had a problem deploying to Preview – smart-todo November 22, 2025 12:16 Failure

Copilot AI mentioned this pull request Nov 22, 2025

Fix useEffect dependencies in PlatformInviteLanding #55

Draft

Copilot AI mentioned this pull request Nov 22, 2025

refactor: extract public share email to shared constant #56

Draft

chemist-god merged commit 5cba20a into main Nov 22, 2025
1 of 3 checks passed

		const baseUrl = process.env.NEXT_PUBLIC_BASE_URL \|\| process.env.VERCEL_URL \|\| 'http://localhost:3000';

-  const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || process.env.VERCEL_URL || 'http://localhost:3000';
+  let baseUrl = process.env.NEXT_PUBLIC_BASE_URL || process.env.VERCEL_URL || 'http://localhost:3000';
+  // Ensure baseUrl includes protocol
+  if (!/^https?:\/\//i.test(baseUrl)) {
+    baseUrl = `https://${baseUrl}`;
+  }

	data: { status: 'DECLINED' } // Use DECLINED for cancelled stake invitations
	data: { status: 'CANCELLED' } // Use CANCELLED for cancelled stake invitations

		// Check if this invitation was already accepted by someone else
		if (invitation.acceptedBy) {

	import { signIn, useSession } from "next-auth/react";
	import { useSession } from "next-auth/react";

	const { data: session, status: sessionStatus } = useSession();
	const { data: session } = useSession();

	import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
	import { Card, CardContent } from "@/components/ui/card";

Comments

Conversation

chemist-god commented Nov 21, 2025

Invite & Auth: invite APIs, landing pages, and social-share improvements

Summary

What changed (high level)

Backend / API

Frontend / Pages / Components

Libraries / Services

Why

How to test (smoke checklist)

Database / Migrations

Review notes / Focus areas

Uh oh!

vercel bot commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

chemist-god Nov 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

chemist-god Nov 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Nov 22, 2025

Uh oh!

Copilot AI commented Nov 22, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel bot commented Nov 21, 2025 •

edited

Loading