@allbluecn/web-app 0.4.16 → 0.4.18

package/src/server/serverFns/team.ts

@@ -1,6 +1,6 @@
 import { createServerFn } from '@tanstack/react-start'
 import { getRequest } from '@tanstack/react-start/server'
-import { randomUUID } from 'node:crypto'
+import crypto from 'node:crypto'
 import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
 import { requireAuth } from '@/server/auth-helpers'
@@ -8,14 +8,24 @@ import { requireTeamSeats } from '@/server/resources'
 import { auditLog } from '@/server/audit'
 import { getEmailSender } from '@/server/email/sender'
 import { USER_BRIEF_SELECT } from '@/server/team-access'
+import { createNotification } from '@/server/notifications/notification-service'
 
 const INVITE_EXPIRES_DAYS = 7
-const OWNER_SELECT = { id: true, username: true, email: true } as const
+const OWNER_SELECT = { id: true, username: true, email: true, avatarConfig: true, bgShape: true, bgColor: true } as const
+const INVITE_TOKEN_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
+
+function generateInviteToken(length = 6): string {
+  const bytes = Buffer.allocUnsafe(length)
+  crypto.randomFillSync(bytes)
+  return Array.from(bytes).map((b) => INVITE_TOKEN_CHARS[b % INVITE_TOKEN_CHARS.length]).join('')
+}
 
 const createInvitationSchema = z.object({
   email: z.string().email().optional(),
   seatType: z.enum(['member', 'guest']),
   channel: z.enum(['email', 'link']).default('email'),
+  expiresInDays: z.number().int().min(1).max(30).optional(),
+  message: z.string().max(500).optional(),
 })
 
 export const createTeamInvitationFn = createServerFn({ method: 'POST' })
@@ -25,7 +35,7 @@ export const createTeamInvitationFn = createServerFn({ method: 'POST' })
     const session = await requireAuth(request)
     const ownerId = session.user!.id!
 
-    const email = data.channel === 'link' ? (data.email?.toLowerCase() ?? '') : data.email!.toLowerCase()
+    const email = data.channel === 'email' ? data.email!.toLowerCase() : null
 
     if (data.channel === 'email') {
       const owner = await prisma.user.findUnique({
@@ -36,7 +46,7 @@ export const createTeamInvitationFn = createServerFn({ method: 'POST' })
         throw new Error('不能邀请自己')
       }
       const targetUser = await prisma.user.findUnique({
-        where: { email },
+        where: { email: email! },
         select: { id: true },
       })
       if (targetUser) {
@@ -54,17 +64,14 @@ export const createTeamInvitationFn = createServerFn({ method: 'POST' })
       })
       if (pendingAnywhere) throw new Error('该邮箱已有待处理的团队邀请')
     } else {
-      // link 邀请不绑定邮箱（email=''），同一 owner 同一时刻仅允许一个 pending 链接（@@unique([ownerId, email]) 语义）
-      const pendingLink = await prisma.teamInvitation.findFirst({
-        where: { ownerId, channel: 'link', status: 'pending' },
-      })
-      if (pendingLink) throw new Error('已存在待使用的邀请链接，请先撤销或等待接受')
+      // link 邀请不绑定邮箱（email=''），有效期内不限次数申请，无需检查已有 pending 链接
     }
 
     await requireTeamSeats(ownerId, data.seatType, 1)
 
-    const token = randomUUID()
-    const expiresAt = new Date(Date.now() + INVITE_EXPIRES_DAYS * 24 * 60 * 60 * 1000)
+    const token = generateInviteToken()
+    const expiresInDays = data.expiresInDays ?? INVITE_EXPIRES_DAYS
+    const expiresAt = new Date(Date.now() + expiresInDays * 24 * 60 * 60 * 1000)
 
     let invitation
     try {
@@ -77,6 +84,7 @@ export const createTeamInvitationFn = createServerFn({ method: 'POST' })
           token,
           status: 'pending',
           expiresAt,
+          message: data.message,
         },
       })
     } catch (err) {
@@ -114,23 +122,81 @@ export const createTeamInvitationFn = createServerFn({ method: 'POST' })
   })
 
 export const listTeamInvitationsFn = createServerFn({ method: 'GET' }).handler(async () => {
-  const request = getRequest()
-  const session = await requireAuth(request)
-  const ownerId = session.user!.id!
-  const now = new Date()
-  await prisma.teamInvitation.updateMany({
-    where: { ownerId, status: 'pending', expiresAt: { lt: now } },
-    data: { status: 'expired' },
-  })
-  return prisma.teamInvitation.findMany({
-    where: { ownerId, status: { in: ['pending', 'accepted'] } },
-    orderBy: { createdAt: 'desc' },
-    include: { owner: { select: OWNER_SELECT } },
-  })
+  try {
+    const request = getRequest()
+    const session = await requireAuth(request)
+    const ownerId = session.user!.id!
+    const now = new Date()
+
+    await prisma.teamInvitation.updateMany({
+      where: {
+        ownerId,
+        status: { in: ['pending', 'pending_approval'] },
+        expiresAt: { lt: now },
+      },
+      data: { status: 'expired' },
+    })
+    await prisma.teamJoinRequest.updateMany({
+      where: {
+        ownerId,
+        status: 'pending',
+        invitation: { channel: 'link', status: { in: ['expired', 'revoked'] } },
+      },
+      data: { status: 'invalidated', processedAt: now },
+    })
+
+    const [invitations, joinRequests] = await Promise.all([
+      prisma.teamInvitation.findMany({
+        where: {
+          ownerId,
+          OR: [
+            { status: { in: ['pending', 'pending_approval', 'accepted', 'expired', 'revoked'] } },
+            { channel: 'link' },
+          ],
+        },
+        orderBy: { createdAt: 'desc' },
+        include: { owner: { select: OWNER_SELECT } },
+      }),
+      prisma.teamJoinRequest.findMany({
+        where: { ownerId },
+        orderBy: { createdAt: 'desc' },
+        take: 50,
+        select: {
+          id: true, email: true, userId: true, status: true, seatType: true,
+          createdAt: true, processedAt: true,
+          applicant: { select: USER_BRIEF_SELECT },
+        },
+      }),
+    ])
+    return { invitations, joinRequests }
+  } catch (error) {
+    console.error('[listTeamInvitationsFn] ERROR:', error instanceof Error ? error.message : 'unknown')
+    throw error
+  }
 })
 
 const revokeSchema = z.object({ invitationId: z.string() })
 
+export const clearExpiredInvitationsFn = createServerFn({ method: 'POST' })
+  .validator(z.object({}))
+  .handler(async () => {
+    const request = getRequest()
+    const session = await requireAuth(request)
+    const ownerId = session.user!.id!
+    const res = await prisma.teamInvitation.deleteMany({
+      where: { ownerId, status: 'expired' },
+    })
+    await auditLog({
+      workspaceId: '',
+      userId: ownerId,
+      resourceType: 'teamInvitation',
+      resourceId: '',
+      action: 'team.invite.clear-expired',
+      metadata: { count: res.count },
+    })
+    return { success: true, count: res.count }
+  })
+
 export const revokeTeamInvitationFn = createServerFn({ method: 'POST' })
   .validator(revokeSchema)
   .handler(async ({ data }) => {
@@ -139,7 +205,13 @@ export const revokeTeamInvitationFn = createServerFn({ method: 'POST' })
     const ownerId = session.user!.id!
     const inv = await prisma.teamInvitation.findUnique({ where: { id: data.invitationId } })
     if (!inv || inv.ownerId !== ownerId) throw new Error('邀请不存在')
-    if (inv.status !== 'pending') throw new Error('仅待处理邀请可撤销')
+    if (inv.status !== 'pending' && inv.status !== 'pending_approval') throw new Error('仅待处理/待批准邀请可撤销')
+    if (inv.channel === 'link') {
+      await prisma.teamJoinRequest.updateMany({
+        where: { invitationId: inv.id, status: 'pending' },
+        data: { status: 'invalidated', processedAt: new Date() },
+      })
+    }
     await prisma.teamInvitation.update({
       where: { id: inv.id },
       data: { status: 'revoked' },
@@ -166,7 +238,7 @@ export const resendTeamInvitationFn = createServerFn({ method: 'POST' })
       throw new Error('仅待处理/已过期邀请可重发')
     }
     await requireTeamSeats(ownerId, inv.seatType as 'member' | 'guest', 1)
-    const token = randomUUID()
+    const token = generateInviteToken()
     await prisma.teamInvitation.update({
       where: { id: inv.id },
       data: {
@@ -187,24 +259,95 @@ export const resendTeamInvitationFn = createServerFn({ method: 'POST' })
     return { success: true, token }
   })
 
+export const refreshTeamInvitationLinkFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ expiresInDays: z.number().int().min(1).max(365).optional() }))
+  .handler(async ({ data }) => {
+    const request = getRequest()
+    const session = await requireAuth(request)
+    const ownerId = session.user!.id!
+
+    await requireTeamSeats(ownerId, 'member', 1)
+
+    const expiresInDays = data.expiresInDays ?? INVITE_EXPIRES_DAYS
+    const token = generateInviteToken()
+    const expiresAt = new Date(Date.now() + expiresInDays * 24 * 60 * 60 * 1000)
+    const invitation = await prisma.$transaction(async (tx) => {
+      await tx.teamJoinRequest.updateMany({
+        where: {
+          ownerId,
+          status: 'pending',
+          invitation: { channel: 'link', status: { in: ['pending', 'pending_approval'] } },
+        },
+        data: { status: 'invalidated', processedAt: new Date() },
+      })
+      await tx.teamInvitation.deleteMany({
+        where: { ownerId, channel: 'link', status: { in: ['pending', 'pending_approval'] } },
+      })
+      return tx.teamInvitation.create({
+        data: {
+          ownerId,
+          email: null,
+          seatType: 'member',
+          channel: 'link',
+          token,
+          status: 'pending',
+          expiresAt,
+        },
+      })
+    })
+
+    await auditLog({
+      workspaceId: '',
+      userId: ownerId,
+      resourceType: 'teamInvitation',
+      resourceId: invitation.id,
+      action: 'team.invite.refresh',
+    })
+
+    return { success: true, token, invitationId: invitation.id }
+  })
+
 // ---------- 成员管理 ----------
 
 export const listTeamMembersFn = createServerFn({ method: 'GET' }).handler(async () => {
   const request = getRequest()
   const session = await requireAuth(request)
   const ownerId = session.user!.id!
-  return prisma.teamMembership.findMany({
-    where: { ownerId },
-    orderBy: { joinedAt: 'asc' },
-    select: {
-      id: true,
-      ownerId: true,
-      memberId: true,
-      seatType: true,
-      joinedAt: true,
-      member: { select: USER_BRIEF_SELECT },
-    },
+
+  // 以 memberId 判当前用户的归属：避免为已是别家成员的账号创建自引用 owner 记录（P2002）
+  const ownEntry = await prisma.teamMembership.findUnique({
+    where: { memberId: ownerId },
   })
+  if (!ownEntry) {
+    const membership = await prisma.teamMembership.create({
+      data: { ownerId, memberId: ownerId, seatType: 'owner' },
+      select: {
+        id: true,
+        ownerId: true,
+        memberId: true,
+        seatType: true,
+        joinedAt: true,
+        member: { select: USER_BRIEF_SELECT },
+      },
+    })
+    return [membership]
+  }
+  if (ownEntry.ownerId === ownerId) {
+    return prisma.teamMembership.findMany({
+      where: { ownerId },
+      orderBy: { joinedAt: 'asc' },
+      select: {
+        id: true,
+        ownerId: true,
+        memberId: true,
+        seatType: true,
+        joinedAt: true,
+        member: { select: USER_BRIEF_SELECT },
+      },
+    })
+  }
+  // 当前用户是别家团队成员，非本团队 owner → 返回空（成员视图由 teamUsers 兜底）
+  return []
 })
 
 const removeMemberSchema = z.object({ membershipId: z.string() })
@@ -222,6 +365,14 @@ export const removeTeamMemberFn = createServerFn({ method: 'POST' })
       await tx.teamMembership.delete({ where: { id: m.id } })
       await tx.projectMember.deleteMany({ where: { userId: m.memberId } })
     })
+
+    void createNotification({
+      userId: m.memberId,
+      category: 'team',
+      type: 'team.member_removed',
+      title: '你已被移出团队',
+    })
+
     await auditLog({
       workspaceId: '',
       userId: ownerId,
@@ -249,9 +400,129 @@ export const leaveTeamFn = createServerFn({ method: 'POST' }).validator(z.object
     resourceId: m.id,
     action: 'team.member.leave',
   })
-  return { success: true }
+return { success: true }
+  })
+
+const joinRequestSchema = z.object({ requestId: z.string() })
+
+const approveJoinRequestSchema = z.object({
+  requestId: z.string(),
+  seatType: z.enum(['member', 'guest']),
 })
 
+export const approveTeamJoinRequestFn = createServerFn({ method: 'POST' })
+  .validator(approveJoinRequestSchema)
+  .handler(async ({ data }) => {
+    const request = getRequest()
+    const session = await requireAuth(request)
+    const ownerId = session.user!.id!
+
+    const reqRow = await prisma.teamJoinRequest.findUnique({
+      where: { id: data.requestId },
+      include: { invitation: { select: { id: true, status: true, channel: true, expiresAt: true } } },
+    })
+    if (!reqRow || reqRow.ownerId !== ownerId) throw new Error('申请不存在')
+    if (reqRow.status !== 'pending') throw new Error('仅待审批申请可操作')
+
+    if (reqRow.invitation.status !== 'pending' || reqRow.invitation.expiresAt < new Date()) {
+      await prisma.teamJoinRequest.update({
+        where: { id: reqRow.id },
+        data: { status: 'invalidated', processedAt: new Date() },
+      })
+      throw new Error('邀请链接已过期或失效，无法批准')
+    }
+
+    let applicantUserId = reqRow.userId
+    if (!applicantUserId) {
+      const applicant = await prisma.user.findUnique({
+        where: { email: reqRow.email },
+        select: { id: true },
+      })
+      applicantUserId = applicant?.id ?? null
+    }
+    if (!applicantUserId) throw new Error('申请人尚未注册，无法批准')
+
+    const membership = await prisma.teamMembership.findUnique({
+      where: { memberId: applicantUserId },
+    })
+    if (membership) throw new Error('该用户已加入团队，无法批准')
+
+    await requireTeamSeats(ownerId, data.seatType, 1)
+
+    try {
+      await prisma.$transaction(async (tx) => {
+        await tx.teamMembership.create({
+          data: { ownerId, memberId: applicantUserId, seatType: data.seatType },
+        })
+        await tx.teamJoinRequest.update({
+          where: { id: reqRow.id },
+          data: { status: 'approved', seatType: data.seatType, processedAt: new Date() },
+        })
+      })
+    } catch (err) {
+      if ((err as { code?: string })?.code === 'P2002') throw new Error('该用户已加入团队')
+      throw err
+    }
+
+    void createNotification({
+      userId: applicantUserId,
+      category: 'team',
+      type: 'team.invite_approved',
+      title: '你的加入申请已被批准',
+      link: '/settings/team',
+    })
+
+    await auditLog({
+      workspaceId: '',
+      userId: ownerId,
+      resourceType: 'teamJoinRequest',
+      resourceId: reqRow.id,
+      action: 'team.join.approve',
+      metadata: { seatType: data.seatType, email: reqRow.email },
+    })
+    return { success: true }
+  })
+
+export const rejectTeamJoinRequestFn = createServerFn({ method: 'POST' })
+  .validator(joinRequestSchema)
+  .handler(async ({ data }) => {
+    const request = getRequest()
+    const session = await requireAuth(request)
+    const ownerId = session.user!.id!
+
+    const reqRow = await prisma.teamJoinRequest.findUnique({ where: { id: data.requestId } })
+    if (!reqRow || reqRow.ownerId !== ownerId) throw new Error('申请不存在')
+    if (reqRow.status !== 'pending') throw new Error('仅待审批申请可操作')
+
+    await prisma.teamJoinRequest.update({
+      where: { id: reqRow.id },
+      data: { status: 'rejected', processedAt: new Date() },
+    })
+
+    const applicant = await prisma.user.findUnique({
+      where: { email: reqRow.email?.toLowerCase() ?? '' },
+      select: { id: true },
+    })
+    if (applicant?.id) {
+      void createNotification({
+        userId: applicant.id,
+        category: 'team',
+        type: 'team.invite_rejected',
+        title: '你的加入申请未被通过',
+      })
+    }
+
+    await auditLog({
+      workspaceId: '',
+      userId: ownerId,
+      resourceType: 'teamJoinRequest',
+      resourceId: reqRow.id,
+      action: 'team.join.reject',
+      metadata: { email: reqRow.email },
+    })
+    return { success: true }
+  })
+
 export const listTeamUsersFn = createServerFn({ method: 'GET' }).handler(async () => {
   const request = getRequest()
   const session = await requireAuth(request)
@@ -272,18 +543,181 @@ export const listTeamUsersFn = createServerFn({ method: 'GET' }).handler(async (
 
 // ---------- 邀请接受 ----------
 
-const tokenSchema = z.object({ token: z.string() })
+const tokenSchema = z.object({
+  token: z.string(),
+  userId: z.string().nullable().optional(),
+})
 
 export const getTeamInvitationByTokenFn = createServerFn({ method: 'GET' })
   .validator(tokenSchema)
   .handler(async ({ data }) => {
     const inv = await prisma.teamInvitation.findUnique({
       where: { token: data.token },
-      select: { status: true, expiresAt: true, seatType: true, channel: true, email: true, owner: { select: OWNER_SELECT } },
+      select: { status: true, expiresAt: true, seatType: true, channel: true, email: true, id: true, ownerId: true, owner: { select: OWNER_SELECT }, acceptedBy: true, applicantEmail: true },
     })
-    if (!inv) throw new Error('邀请不存在')
-    const expired = inv.status === 'pending' && inv.expiresAt < new Date()
-    return { ...inv, effectiveStatus: expired ? 'expired' : inv.status }
+    if (!inv) return null
+
+    let effectiveStatus = inv.status
+    if (
+      (inv.status === 'pending' || inv.status === 'pending_approval') &&
+      inv.expiresAt < new Date()
+    ) {
+      try {
+        await prisma.teamInvitation.update({ where: { id: inv.id }, data: { status: 'expired' } })
+        await prisma.teamJoinRequest.updateMany({
+          where: { invitationId: inv.id, status: 'pending' },
+          data: { status: 'invalidated', processedAt: new Date() },
+        })
+      } catch { /* ignore */ }
+      effectiveStatus = 'expired'
+    }
+
+    if (
+      data.userId &&
+      inv.channel === 'email' &&
+      effectiveStatus === 'pending_approval' &&
+      inv.acceptedBy === data.userId
+    ) {
+      const membership = await prisma.teamMembership.findUnique({
+        where: { memberId: data.userId },
+      })
+      if (!membership || membership.ownerId !== inv.ownerId) {
+        try {
+          await prisma.teamInvitation.update({ where: { id: inv.id }, data: { status: 'pending' } })
+          effectiveStatus = 'pending'
+        } catch { /* ignore */ }
+      }
+    }
+
+    let alreadyJoined = false
+    let joinedOwnerId: string | null = null
+    let myRequestStatus: string | null = null
+    if (data.userId) {
+      const membership = await prisma.teamMembership.findUnique({
+        where: { memberId: data.userId },
+      })
+      if (membership) {
+        alreadyJoined = true
+        joinedOwnerId = membership.ownerId
+      }
+      if (inv.channel === 'link' && !alreadyJoined) {
+        const me = await prisma.user.findUnique({
+          where: { id: data.userId },
+          select: { email: true },
+        })
+        if (me?.email) {
+          const reqRow = await prisma.teamJoinRequest.findUnique({
+            where: { invitationId_email: { invitationId: inv.id, email: me.email.toLowerCase() } },
+          })
+          myRequestStatus = reqRow?.status ?? null
+        }
+      }
+    }
+
+    return {
+      ...inv,
+      effectiveStatus,
+      selectedRole: inv.seatType as 'member' | 'guest',
+      alreadyJoined,
+      joinedOwnerId,
+      myRequestStatus,
+    }
+  })
+
+export const checkInviteEmailRegisteredFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ email: z.string().email() }))
+  .handler(async ({ data }) => {
+    const user = await prisma.user.findUnique({
+      where: { email: data.email.toLowerCase() },
+      select: { id: true },
+    })
+    return { registered: !!user }
+  })
+
+export const applyTeamInvitationFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ token: z.string(), email: z.string().email() }))
+  .handler(async ({ data }) => {
+    const inv = await prisma.teamInvitation.findUnique({
+      where: { token: data.token },
+      include: { owner: { select: { id: true, email: true } } },
+    })
+    if (!inv) throw new Error('邀请链接不存在')
+    if (inv.status !== 'pending' && !(inv.channel === 'email' && inv.status === 'pending_approval')) {
+      throw new Error('邀请已失效')
+    }
+    if (inv.expiresAt < new Date()) throw new Error('邀请已过期，请联系团队所有者重新生成邀请链接')
+
+    const email = data.email.toLowerCase()
+    if (inv.channel === 'email' && inv.email && email !== inv.email) {
+      throw new Error('申请邮箱与邀请邮箱不一致')
+    }
+    if (email === inv.owner.email?.toLowerCase()) {
+      throw new Error('不能加入自己的团队')
+    }
+
+    if (inv.channel === 'email') {
+      const existing = await prisma.teamInvitation.findFirst({
+        where: { id: inv.id, status: 'pending_approval', applicantEmail: email },
+      })
+      if (!existing) {
+        await prisma.teamInvitation.update({
+          where: { id: inv.id },
+          data: { status: 'pending_approval', applicantEmail: email },
+        })
+      }
+      void createNotification({
+        userId: inv.ownerId,
+        category: 'team',
+        type: 'team.invite_request',
+        title: `${email} 申请加入你的团队`,
+        link: '/settings/team',
+      })
+      return { success: true, requiresApproval: true, duplicate: !!existing }
+    }
+
+    const existingUser = await prisma.user.findUnique({ where: { email }, select: { id: true } })
+    if (existingUser) {
+      const membership = await prisma.teamMembership.findUnique({
+        where: { memberId: existingUser.id },
+      })
+      if (membership) throw new Error('该账号已加入团队（每账号仅可加入一个团队）')
+    }
+
+    const existingRequest = await prisma.teamJoinRequest.findUnique({
+      where: { invitationId_email: { invitationId: inv.id, email } },
+    })
+    if (existingRequest?.status === 'pending') {
+      return { success: true, requiresApproval: true, duplicate: true }
+    }
+    await prisma.teamJoinRequest.upsert({
+      where: { invitationId_email: { invitationId: inv.id, email } },
+      create: {
+        invitationId: inv.id,
+        ownerId: inv.ownerId,
+        email,
+        userId: existingUser?.id ?? null,
+        status: 'pending',
+      },
+      update: { status: 'pending', userId: existingUser?.id ?? null, processedAt: null },
+    })
+
+    void createNotification({
+      userId: inv.ownerId,
+      category: 'team',
+      type: 'team.invite_request',
+      title: `${email} 申请加入你的团队`,
+      link: '/settings/team',
+    })
+
+    await auditLog({
+      workspaceId: '',
+      userId: '',
+      resourceType: 'teamJoinRequest',
+      resourceId: inv.id,
+      action: 'team.join.apply',
+      metadata: { applicantEmail: email },
+    })
+    return { success: true, requiresApproval: true, duplicate: false }
   })
 
 export const acceptTeamInvitationFn = createServerFn({ method: 'POST' })
@@ -292,39 +726,125 @@ export const acceptTeamInvitationFn = createServerFn({ method: 'POST' })
     const request = getRequest()
     const session = await requireAuth(request)
     const userId = session.user!.id!
-    const email = (session.user!.email ?? '').toLowerCase()
+    const currentUser = await prisma.user.findUnique({
+      where: { id: userId },
+      select: { email: true },
+    })
+    const email = (currentUser?.email ?? session.user!.email ?? '').toLowerCase()
+    if (!email) throw new Error('当前账号缺少邮箱，无法申请')
 
     const inv = await prisma.teamInvitation.findUnique({ where: { token: data.token } })
     if (!inv) throw new Error('邀请不存在')
     if (inv.status !== 'pending') throw new Error('邀请已失效')
-    if (inv.expiresAt < new Date()) throw new Error('邀请已过期，请联系邀请人重发')
-    if (inv.ownerId === userId) throw new Error('不能接受自己发出的邀请')
+    if (inv.expiresAt < new Date()) throw new Error('邀请已过期，请联系团队所有者重新生成邀请链接')
+    if (inv.ownerId === userId) throw new Error('不能加入自己的团队')
 
     const joined = await prisma.teamMembership.findUnique({ where: { memberId: userId } })
     if (joined) throw new Error('你已加入团队（每账号仅可加入一个团队）')
 
-    if (inv.channel === 'email' && inv.email && email !== inv.email) {
-      throw new Error('邀请邮箱与当前账号邮箱不一致')
+    if (inv.channel === 'email') {
+      if (inv.email && email !== inv.email) {
+        throw new Error('邀请邮箱与当前账号邮箱不一致')
+      }
+      await prisma.teamInvitation.update({
+        where: { id: inv.id },
+        data: { status: 'pending_approval', applicantEmail: email, acceptedBy: userId },
+      })
+      await auditLog({
+        workspaceId: '',
+        userId,
+        resourceType: 'teamInvitation',
+        resourceId: inv.id,
+        action: 'team.invite.accept',
+      })
+      return { success: true, requiresApproval: true }
+    }
+
+    const existingRequest = await prisma.teamJoinRequest.findUnique({
+      where: { invitationId_email: { invitationId: inv.id, email } },
+    })
+    if (existingRequest?.status === 'pending') {
+      return { success: true, requiresApproval: true, duplicate: true }
+    }
+    await prisma.teamJoinRequest.upsert({
+      where: { invitationId_email: { invitationId: inv.id, email } },
+      create: { invitationId: inv.id, ownerId: inv.ownerId, email, userId, status: 'pending' },
+      update: { status: 'pending', userId, processedAt: null },
+    })
+    await auditLog({
+      workspaceId: '',
+      userId,
+      resourceType: 'teamJoinRequest',
+      resourceId: inv.id,
+      action: 'team.join.apply',
+      metadata: { applicantEmail: email },
+    })
+    return { success: true, requiresApproval: true, duplicate: false }
+  })
+
+const approveSchema = z.object({
+  invitationId: z.string(),
+  seatType: z.enum(['member', 'guest']),
+})
+
+export const approveTeamInvitationFn = createServerFn({ method: 'POST' })
+  .validator(approveSchema)
+  .handler(async ({ data }) => {
+    const request = getRequest()
+    const session = await requireAuth(request)
+    const ownerId = session.user!.id!
+
+    const inv = await prisma.teamInvitation.findUnique({
+      where: { id: data.invitationId },
+    })
+    if (!inv || inv.ownerId !== ownerId) throw new Error('邀请不存在')
+    if (inv.status !== 'pending_approval') throw new Error('仅待批准邀请可操作')
+    if (inv.expiresAt < new Date()) throw new Error('邀请已过期，无法批准')
+    if (inv.channel !== 'email') throw new Error('链接渠道申请请使用 approveTeamJoinRequestFn')
+
+    // 批准前复查席位
+    await requireTeamSeats(ownerId, data.seatType, 1, { excludeInvitationId: inv.id })
+
+    let applicantUserId = inv.acceptedBy
+    if (!applicantUserId && inv.applicantEmail) {
+      const applicantUser = await prisma.user.findUnique({
+        where: { email: inv.applicantEmail.toLowerCase() },
+        select: { id: true },
+      })
+      applicantUserId = applicantUser?.id ?? null
     }
+    if (!applicantUserId) throw new Error('无法确定申请人身份，请让申请人重新申请')
 
     try {
       await prisma.$transaction(async (tx) => {
-        await tx.teamInvitation.update({ where: { id: inv.id }, data: { status: 'accepted', acceptedBy: userId } })
         await tx.teamMembership.create({
-          data: { ownerId: inv.ownerId, memberId: userId, seatType: inv.seatType },
+          data: { ownerId, memberId: applicantUserId, seatType: data.seatType },
+        })
+        await tx.teamInvitation.update({
+          where: { id: inv.id },
+          data: { seatType: data.seatType, status: 'accepted' },
         })
       })
     } catch (err) {
-      if ((err as any)?.code === 'P2002') throw new Error('你已加入团队')
+      if ((err as any)?.code === 'P2002') throw new Error('该用户已加入团队')
       throw err
     }
 
+    void createNotification({
+      userId: applicantUserId,
+      category: 'team',
+      type: 'team.invite_approved',
+      title: '你的加入申请已被批准',
+      link: '/settings/team',
+    })
+
     await auditLog({
       workspaceId: '',
-      userId,
+      userId: ownerId,
       resourceType: 'teamInvitation',
       resourceId: inv.id,
-      action: 'team.invite.accept',
+      action: 'team.invite.approve',
+      metadata: { seatType: data.seatType },
     })
     return { success: true }
   })