@fayz-ai/db 0.12.0 → 0.13.0

package/migrations/061_create_tenant.sql

@@ -0,0 +1,125 @@
+-- ============================================================================
+-- 061_create_tenant.sql — one transactional RPC creates a tenant (#134, PRD 01 R7).
+--
+-- public.create_tenant(name, slug, kind, vertical, template, settings, hq_name)
+-- creates, in one transaction and as the SIGNED-IN user: the tenant row, its
+-- system roles from the vertical template (app.seed_role_template), its
+-- headquarters unit and the owner membership (all_units) of the caller. The
+-- actor is auth.uid() — there is no p_user_id — and a call without a session
+-- raises 42501. Nobody can create a tenant on behalf of someone else through
+-- this surface; a platform process acts with a signed token whose `sub` is
+-- the future owner.
+--
+-- public.create_tenant_with_owner(name, slug, p_user_id, …) — the legacy
+-- SECURITY DEFINER function of 001 that trusted p_user_id — is REPLACED by a
+-- shim with the same signature (the admin adapter's rpc keeps working for the
+-- self case) that refuses any p_user_id other than auth.uid() (42501) and
+-- delegates to create_tenant. p_plan is ignored: a plan is assigned by billing,
+-- not chosen by the client. Removal of the shim: Phase 1 (admin adapter on
+-- create_tenant).
+--
+-- Idempotent: CREATE OR REPLACE; explicit REVOKE/GRANT allowlist re-asserted
+-- (001's replay re-grants EXECUTE ON ALL FUNCTIONS to anon; 009 and this file
+-- take it back — the chain converges).
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.create_tenant(
+  p_name        text,
+  p_slug        text,
+  p_kind        text    DEFAULT 'business',
+  p_vertical_id text    DEFAULT NULL,
+  p_template    text    DEFAULT 'generic',
+  p_settings    jsonb   DEFAULT '{}'::jsonb,
+  p_hq_name     text    DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = ''
+AS $$
+DECLARE
+  v_uid        uuid := auth.uid();
+  v_tenant     uuid;
+  v_unit       uuid;
+  v_membership uuid;
+  v_owner_role uuid;
+  v_template   text;
+  v_slug       text;
+  v_name       text;
+BEGIN
+  IF v_uid IS NULL THEN
+    RAISE EXCEPTION 'create_tenant: the actor is derived from the session and there is no session'
+      USING ERRCODE = '42501';
+  END IF;
+  IF p_kind IS NULL OR p_kind NOT IN ('network', 'business') THEN
+    RAISE EXCEPTION 'create_tenant: kind must be network or business (got %)', coalesce(p_kind, '<null>')
+      USING ERRCODE = '22023';
+  END IF;
+  v_name := nullif(btrim(coalesce(p_name, '')), '');
+  IF v_name IS NULL THEN
+    RAISE EXCEPTION 'create_tenant: name is required' USING ERRCODE = '22023';
+  END IF;
+  v_slug := lower(btrim(coalesce(p_slug, '')));
+  IF v_slug !~ '^[a-z0-9]+([._-][a-z0-9]+)*$' OR length(v_slug) > 100 THEN
+    RAISE EXCEPTION 'create_tenant: slug must be lowercase letters and digits separated by single . _ - (got %)', coalesce(nullif(v_slug, ''), '<empty>')
+      USING ERRCODE = '22023';
+  END IF;
+  IF EXISTS (SELECT 1 FROM public.tenants t WHERE t.slug = v_slug) THEN
+    RAISE EXCEPTION 'create_tenant: slug % is already taken', v_slug USING ERRCODE = '23505';
+  END IF;
+
+  -- Template: explicit, else the vertical's own template when one exists, else generic.
+  v_template := coalesce(
+    p_template,
+    CASE WHEN p_vertical_id IS NOT NULL AND EXISTS (SELECT 1 FROM app.role_templates rt WHERE rt.template = p_vertical_id)
+         THEN p_vertical_id ELSE 'generic' END);
+  IF NOT EXISTS (SELECT 1 FROM app.role_templates rt WHERE rt.template = v_template) THEN
+    RAISE EXCEPTION 'create_tenant: unknown role template %', v_template USING ERRCODE = '22023';
+  END IF;
+
+  INSERT INTO public.tenants (name, slug, plan, vertical_id, kind, settings, role_template)
+  VALUES (v_name, v_slug, 'free', p_vertical_id, p_kind, coalesce(p_settings, '{}'::jsonb), v_template)
+  RETURNING id INTO v_tenant;
+
+  v_owner_role := app.seed_role_template(v_tenant, v_template);
+
+  INSERT INTO app.units (tenant_id, kind, name, slug, active)
+  VALUES (v_tenant, 'hq', coalesce(nullif(btrim(coalesce(p_hq_name, '')), ''), v_name), 'hq', true)
+  RETURNING id INTO v_unit;
+
+  -- The owner: role from the template (holds the whole catalog), every unit.
+  INSERT INTO app.memberships (tenant_id, user_id, role_id, all_units, active)
+  VALUES (v_tenant, v_uid, v_owner_role, true, true)
+  RETURNING id INTO v_membership;
+
+  RETURN jsonb_build_object(
+    'tenant',     (SELECT to_jsonb(t) FROM public.tenants t WHERE t.id = v_tenant),
+    'hq_unit',    (SELECT to_jsonb(u) FROM app.units u WHERE u.id = v_unit),
+    'membership', (SELECT to_jsonb(m) FROM app.memberships m WHERE m.id = v_membership)
+  );
+END $$;
+REVOKE ALL ON FUNCTION public.create_tenant(text, text, text, text, text, jsonb, text) FROM public, anon;
+GRANT EXECUTE ON FUNCTION public.create_tenant(text, text, text, text, text, jsonb, text) TO authenticated, service_role;
+
+-- ── the legacy entry point, now a shim ──────────────────────────────────
+CREATE OR REPLACE FUNCTION public.create_tenant_with_owner(
+  p_name text, p_slug text, p_user_id uuid,
+  p_vertical_id text DEFAULT NULL, p_plan text DEFAULT 'free', p_settings jsonb DEFAULT '{}'
+)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = ''
+AS $$
+DECLARE v_result jsonb;
+BEGIN
+  IF auth.uid() IS NULL OR p_user_id IS DISTINCT FROM auth.uid() THEN
+    RAISE EXCEPTION 'create_tenant_with_owner: the actor is derived from the session; p_user_id must be the caller'
+      USING ERRCODE = '42501';
+  END IF;
+  -- p_plan is deliberately not honoured: billing assigns plans.
+  v_result := public.create_tenant(p_name, p_slug, 'business', p_vertical_id, NULL, p_settings, NULL);
+  RETURN v_result -> 'tenant';
+END $$;
+COMMENT ON FUNCTION public.create_tenant_with_owner(text, text, uuid, text, text, jsonb) IS
+  'DEPRECATED (#134): shim over public.create_tenant. Refuses p_user_id <> auth.uid() (42501); p_plan ignored. Removal: Phase 1.';
+REVOKE ALL ON FUNCTION public.create_tenant_with_owner(text, text, uuid, text, text, jsonb) FROM public, anon;
+GRANT EXECUTE ON FUNCTION public.create_tenant_with_owner(text, text, uuid, text, text, jsonb) TO authenticated, service_role;

package/migrations/062_invitations.sql

@@ -0,0 +1,329 @@
+-- ============================================================================
+-- 062_invitations.sql — the transactional invite flow onto app.* (#134, PRD 01 R7).
+--
+-- public.invitations stays the table (the admin adapter reads and writes it by
+-- name) and grows the columns the new flow needs:
+--   role_id     → app.roles          the invited role (the legacy `role` text key is kept in step)
+--   unit_ids[]  / all_units           the unit scope of the future membership
+--   token_hash                        sha256 of the bearer token; the token itself is
+--                                     returned ONCE by invite_member and never stored
+--   accepted_by                       who consumed it
+-- The legacy `token` column (a random string readable by every member of the
+-- tenant) is retired: no default, nullable, nulled — nothing ever consumed it.
+--
+-- RPCs (SECURITY DEFINER, search_path '', actor = auth.uid(), tenant =
+-- app.current_tenant_id(), permission = app.has_permission):
+--   invite_member(email, role_key, unit_ids, all_units, ttl) → {invitation_id, token, …}
+--       needs members.manage; the invited role's permission set must be a subset of
+--       the inviter's (no privilege escalation by invitation); the token is what the
+--       e-mail carries.
+--   accept_invitation(token) → {tenant_id, membership_id, role_key, units, all_units}
+--       single-use, expiring, bound to the e-mail it was issued to (auth.users.email
+--       of the caller must match, case-insensitively — a forwarded link is not an
+--       invitation); creates the membership + membership_units in one transaction;
+--       the fan-out triggers of 042 fill user_unit_access.
+--   accept_pending_invitations() → integer  (re-authored from 022, same contract)
+--       converts every pending, non-expired invitation addressed to the caller's
+--       e-mail into a membership. Called by the admin adapter right after sign-in.
+--
+-- All denials are ERRCODE 42501 with an English message; malformed input is 22023.
+-- Idempotent and replay-safe.
+-- ============================================================================
+
+-- ── columns ─────────────────────────────────────────────────────────────
+ALTER TABLE public.invitations
+  ADD COLUMN IF NOT EXISTS role_id     uuid,
+  ADD COLUMN IF NOT EXISTS unit_ids    uuid[] NOT NULL DEFAULT '{}'::uuid[],
+  ADD COLUMN IF NOT EXISTS all_units   boolean NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS token_hash  text,
+  ADD COLUMN IF NOT EXISTS accepted_by uuid;
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'invitations_role_id_fkey' AND conrelid = 'public.invitations'::regclass) THEN
+    ALTER TABLE public.invitations
+      ADD CONSTRAINT invitations_role_id_fkey FOREIGN KEY (role_id) REFERENCES app.roles(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'invitations_status_check' AND conrelid = 'public.invitations'::regclass) THEN
+    ALTER TABLE public.invitations
+      ADD CONSTRAINT invitations_status_check CHECK (status IN ('pending', 'accepted', 'revoked', 'expired'));
+  END IF;
+END $$;
+CREATE UNIQUE INDEX IF NOT EXISTS invitations_token_hash_uidx ON public.invitations (token_hash) WHERE token_hash IS NOT NULL;
+CREATE INDEX IF NOT EXISTS invitations_pending_email_idx ON public.invitations (lower(email)) WHERE status = 'pending';
+
+-- The legacy bearer column is retired: it was never consumed by anything in the
+-- repo (accept always matched by e-mail) and a raw random secret readable by
+-- every member of the tenant is not a credential we keep.
+ALTER TABLE public.invitations ALTER COLUMN token DROP NOT NULL;
+ALTER TABLE public.invitations ALTER COLUMN token DROP DEFAULT;
+UPDATE public.invitations SET token = NULL WHERE token IS NOT NULL;
+
+-- ── normalisation trigger: both column sets stay coherent ───────────────
+-- Legacy writers (the admin adapter) insert (tenant_id, email, role, location_ids);
+-- the RPC inserts (role_id, unit_ids, token_hash). Whichever side is written,
+-- the other is derived so every reader sees the same invitation.
+CREATE OR REPLACE FUNCTION public.trg_invitations_normalize()
+RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE v_key text;
+BEGIN
+  NEW.email := lower(btrim(coalesce(NEW.email, '')));
+  IF NEW.email = '' THEN
+    RAISE EXCEPTION 'invitations: email is required' USING ERRCODE = '22023';
+  END IF;
+  NEW.token := NULL;
+
+  -- role: whichever side was written wins; validated on insert and on change
+  IF TG_OP = 'INSERT' OR NEW.role_id IS DISTINCT FROM OLD.role_id OR NEW.role IS DISTINCT FROM OLD.role THEN
+    IF NEW.role_id IS NOT NULL AND (TG_OP = 'INSERT' OR NEW.role_id IS DISTINCT FROM OLD.role_id OR NEW.role IS NOT DISTINCT FROM OLD.role) THEN
+      SELECT r.key INTO v_key FROM app.roles r WHERE r.id = NEW.role_id AND r.tenant_id = NEW.tenant_id;
+      IF v_key IS NULL THEN
+        RAISE EXCEPTION 'invitations: role % does not belong to this tenant', NEW.role_id USING ERRCODE = '22023';
+      END IF;
+      NEW.role := v_key;
+    ELSIF NEW.role IS NOT NULL THEN
+      SELECT r.id INTO NEW.role_id FROM app.roles r WHERE r.tenant_id = NEW.tenant_id AND r.key = NEW.role;
+      IF NEW.role_id IS NULL THEN
+        RAISE EXCEPTION 'invitations: unknown role key % in this tenant', NEW.role USING ERRCODE = '22023';
+      END IF;
+    END IF;
+  END IF;
+
+  -- unit scope: units are the successors of locations (same ids); keep both in step
+  IF TG_OP = 'INSERT' THEN
+    IF cardinality(coalesce(NEW.unit_ids, '{}'::uuid[])) = 0 AND cardinality(coalesce(NEW.location_ids, '{}'::uuid[])) > 0 THEN
+      NEW.unit_ids := NEW.location_ids;
+    ELSE
+      NEW.location_ids := coalesce(NEW.unit_ids, '{}'::uuid[]);
+    END IF;
+  ELSIF NEW.unit_ids IS DISTINCT FROM OLD.unit_ids THEN
+    NEW.location_ids := coalesce(NEW.unit_ids, '{}'::uuid[]);
+  ELSIF NEW.location_ids IS DISTINCT FROM OLD.location_ids THEN
+    NEW.unit_ids := coalesce(NEW.location_ids, '{}'::uuid[]);
+  END IF;
+  IF (TG_OP = 'INSERT' OR NEW.unit_ids IS DISTINCT FROM OLD.unit_ids)
+     AND EXISTS (SELECT 1 FROM unnest(NEW.unit_ids) x
+                  WHERE NOT EXISTS (SELECT 1 FROM app.units u WHERE u.id = x AND u.tenant_id = NEW.tenant_id)) THEN
+    RAISE EXCEPTION 'invitations: every unit must belong to the tenant' USING ERRCODE = '22023';
+  END IF;
+  RETURN NEW;
+END $$;
+REVOKE ALL ON FUNCTION public.trg_invitations_normalize() FROM public, anon, authenticated;
+DROP TRIGGER IF EXISTS invitations_normalize ON public.invitations;
+CREATE TRIGGER invitations_normalize BEFORE INSERT OR UPDATE ON public.invitations
+  FOR EACH ROW EXECUTE FUNCTION public.trg_invitations_normalize();
+
+-- ── policies (re-authored: platform permission keys, no admin literal) ──
+DROP POLICY IF EXISTS "invites_select" ON public.invitations;
+CREATE POLICY "invites_select" ON public.invitations FOR SELECT TO authenticated
+  USING (
+    (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.read')))
+    OR lower(email) = lower(coalesce(auth.jwt() ->> 'email', ''))
+  );
+DROP POLICY IF EXISTS "invites_insert" ON public.invitations;
+CREATE POLICY "invites_insert" ON public.invitations FOR INSERT TO authenticated
+  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')));
+DROP POLICY IF EXISTS "invites_update" ON public.invitations;
+CREATE POLICY "invites_update" ON public.invitations FOR UPDATE TO authenticated
+  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')))
+  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')));
+DROP POLICY IF EXISTS "invites_delete" ON public.invitations;
+CREATE POLICY "invites_delete" ON public.invitations FOR DELETE TO authenticated
+  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')));
+
+-- ── the shared acceptance step ──────────────────────────────────────────
+-- Applies one invitation to one user: membership (an active member keeps her
+-- role — an invitation never demotes or promotes an existing member, 022's
+-- rule; an inactive membership is reactivated with the invited role), the
+-- invited units, the audit stamp. Internal: not granted to any API role.
+CREATE OR REPLACE FUNCTION app.apply_invitation(p_invitation uuid, p_user uuid)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  inv          record;
+  v_role       uuid;
+  v_membership uuid;
+BEGIN
+  SELECT * INTO inv FROM public.invitations i WHERE i.id = p_invitation FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'invitation not found' USING ERRCODE = '42501';
+  END IF;
+  v_role := inv.role_id;
+  IF v_role IS NULL AND inv.role IS NOT NULL THEN
+    SELECT r.id INTO v_role FROM app.roles r WHERE r.tenant_id = inv.tenant_id AND r.key = inv.role;
+  END IF;
+  IF v_role IS NULL THEN
+    RAISE EXCEPTION 'invitation role no longer exists in the tenant' USING ERRCODE = '22023';
+  END IF;
+
+  INSERT INTO app.memberships (tenant_id, user_id, role_id, all_units, active, invited_by)
+  VALUES (inv.tenant_id, p_user, v_role, coalesce(inv.all_units, false), true, inv.invited_by)
+  ON CONFLICT (tenant_id, user_id) DO UPDATE
+    SET active     = true,
+        role_id    = CASE WHEN app.memberships.active THEN app.memberships.role_id ELSE EXCLUDED.role_id END,
+        all_units  = app.memberships.all_units OR EXCLUDED.all_units,
+        invited_by = coalesce(app.memberships.invited_by, EXCLUDED.invited_by)
+  RETURNING id INTO v_membership;
+
+  INSERT INTO app.membership_units (tenant_id, user_id, unit_id)
+  SELECT inv.tenant_id, p_user, u.id
+    FROM app.units u
+   WHERE u.tenant_id = inv.tenant_id AND u.id = ANY (coalesce(inv.unit_ids, '{}'::uuid[]))
+  ON CONFLICT DO NOTHING;
+
+  UPDATE public.invitations
+     SET status = 'accepted', accepted_at = now(), accepted_by = p_user
+   WHERE id = inv.id;
+
+  RETURN jsonb_build_object(
+    'invitation_id', inv.id,
+    'tenant_id', inv.tenant_id,
+    'membership_id', v_membership,
+    'role_key', (SELECT r.key FROM app.roles r WHERE r.id = (SELECT m.role_id FROM app.memberships m WHERE m.id = v_membership)),
+    'all_units', (SELECT m.all_units FROM app.memberships m WHERE m.id = v_membership),
+    'units', coalesce((SELECT jsonb_agg(mu.unit_id ORDER BY mu.unit_id) FROM app.membership_units mu
+                        WHERE mu.tenant_id = inv.tenant_id AND mu.user_id = p_user), '[]'::jsonb)
+  );
+END $$;
+REVOKE ALL ON FUNCTION app.apply_invitation(uuid, uuid) FROM public, anon, authenticated;
+
+-- ── invite_member ───────────────────────────────────────────────────────
+CREATE OR REPLACE FUNCTION public.invite_member(
+  p_email     text,
+  p_role_key  text,
+  p_unit_ids  uuid[]   DEFAULT '{}'::uuid[],
+  p_all_units boolean  DEFAULT false,
+  p_ttl       interval DEFAULT '7 days'
+)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  v_uid     uuid := auth.uid();
+  v_tenant  uuid := app.current_tenant_id();
+  v_role    uuid;
+  v_email   text;
+  v_token   text;
+  v_ttl     interval := coalesce(p_ttl, interval '7 days');
+  v_id      uuid;
+  v_expires timestamptz;
+BEGIN
+  IF v_uid IS NULL OR v_tenant IS NULL THEN
+    RAISE EXCEPTION 'invite_member: no session or no active tenant' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('members.manage') THEN
+    RAISE EXCEPTION 'invite_member: members.manage is required' USING ERRCODE = '42501';
+  END IF;
+  v_email := lower(btrim(coalesce(p_email, '')));
+  IF v_email !~ '^[^@[:space:]]+@[^@[:space:]]+\.[^@[:space:]]+$' THEN
+    RAISE EXCEPTION 'invite_member: invalid e-mail' USING ERRCODE = '22023';
+  END IF;
+  SELECT r.id INTO v_role FROM app.roles r WHERE r.tenant_id = v_tenant AND r.key = p_role_key;
+  IF v_role IS NULL THEN
+    RAISE EXCEPTION 'invite_member: unknown role %', coalesce(p_role_key, '<null>') USING ERRCODE = '22023';
+  END IF;
+  -- No escalation by invitation: every permission of the invited role must be
+  -- held by the inviter (base role, tenant-wide).
+  IF EXISTS (SELECT 1 FROM app.role_permissions rp
+              WHERE rp.tenant_id = v_tenant AND rp.role_id = v_role
+                AND NOT app.has_permission(rp.permission)) THEN
+    RAISE EXCEPTION 'invite_member: cannot invite to a role holding permissions you do not have' USING ERRCODE = '42501';
+  END IF;
+  IF EXISTS (SELECT 1 FROM unnest(coalesce(p_unit_ids, '{}'::uuid[])) x
+              WHERE NOT EXISTS (SELECT 1 FROM app.units u WHERE u.id = x AND u.tenant_id = v_tenant)) THEN
+    RAISE EXCEPTION 'invite_member: every unit must belong to the current tenant' USING ERRCODE = '22023';
+  END IF;
+  IF v_ttl <= interval '0' OR v_ttl > interval '30 days' THEN
+    RAISE EXCEPTION 'invite_member: ttl must be between 1 second and 30 days' USING ERRCODE = '22023';
+  END IF;
+
+  -- 256 bits from the CSPRNG behind gen_random_uuid(); only its sha256 is stored.
+  v_token := replace(gen_random_uuid()::text || gen_random_uuid()::text, '-', '');
+  INSERT INTO public.invitations
+         (tenant_id, email, role, role_id, unit_ids, location_ids, all_units, token_hash, status, invited_by, expires_at)
+  VALUES (v_tenant, v_email, p_role_key, v_role, coalesce(p_unit_ids, '{}'::uuid[]), coalesce(p_unit_ids, '{}'::uuid[]),
+          coalesce(p_all_units, false), encode(sha256(convert_to(v_token, 'UTF8')), 'hex'), 'pending', v_uid, now() + v_ttl)
+  RETURNING id, expires_at INTO v_id, v_expires;
+
+  RETURN jsonb_build_object('invitation_id', v_id, 'token', v_token, 'email', v_email,
+                            'role_key', p_role_key, 'expires_at', v_expires);
+END $$;
+REVOKE ALL ON FUNCTION public.invite_member(text, text, uuid[], boolean, interval) FROM public, anon;
+GRANT EXECUTE ON FUNCTION public.invite_member(text, text, uuid[], boolean, interval) TO authenticated, service_role;
+
+-- ── accept_invitation ───────────────────────────────────────────────────
+CREATE OR REPLACE FUNCTION public.accept_invitation(p_token text)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  v_uid   uuid := auth.uid();
+  v_email text;
+  inv     record;
+BEGIN
+  IF v_uid IS NULL THEN
+    RAISE EXCEPTION 'accept_invitation: no session' USING ERRCODE = '42501';
+  END IF;
+  IF nullif(btrim(coalesce(p_token, '')), '') IS NULL THEN
+    RAISE EXCEPTION 'accept_invitation: invitation not found or not usable' USING ERRCODE = '42501';
+  END IF;
+  SELECT lower(u.email) INTO v_email FROM auth.users u WHERE u.id = v_uid;
+
+  SELECT i.id, i.email, i.status, i.accepted_at, i.expires_at INTO inv
+    FROM public.invitations i
+   WHERE i.token_hash = encode(sha256(convert_to(btrim(p_token), 'UTF8')), 'hex')
+   FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'accept_invitation: invitation not found or not usable' USING ERRCODE = '42501';
+  END IF;
+  IF inv.status <> 'pending' OR inv.accepted_at IS NOT NULL THEN
+    RAISE EXCEPTION 'accept_invitation: invitation already used or revoked' USING ERRCODE = '42501';
+  END IF;
+  IF inv.expires_at <= now() THEN
+    RAISE EXCEPTION 'accept_invitation: invitation expired' USING ERRCODE = '42501';
+  END IF;
+  IF v_email IS NULL OR v_email <> lower(inv.email) THEN
+    RAISE EXCEPTION 'accept_invitation: invitation was issued to a different e-mail' USING ERRCODE = '42501';
+  END IF;
+
+  RETURN app.apply_invitation(inv.id, v_uid);
+END $$;
+REVOKE ALL ON FUNCTION public.accept_invitation(text) FROM public, anon;
+GRANT EXECUTE ON FUNCTION public.accept_invitation(text) TO authenticated, service_role;
+
+-- ── accept_pending_invitations (022 re-authored, same contract) ─────────
+CREATE OR REPLACE FUNCTION public.accept_pending_invitations()
+RETURNS integer
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  v_uid   uuid := auth.uid();
+  v_email text;
+  v_count integer := 0;
+  r       record;
+BEGIN
+  IF v_uid IS NULL THEN
+    RETURN 0;
+  END IF;
+  -- From auth.users, not the JWT: survives a token without an e-mail claim.
+  SELECT lower(u.email) INTO v_email FROM auth.users u WHERE u.id = v_uid;
+  IF v_email IS NULL OR v_email = '' THEN
+    RETURN 0;
+  END IF;
+  FOR r IN
+    SELECT i.id
+      FROM public.invitations i
+     WHERE lower(i.email) = v_email
+       AND i.status = 'pending'
+       AND i.accepted_at IS NULL
+       AND i.expires_at > now()
+     ORDER BY i.created_at, i.id
+  LOOP
+    BEGIN
+      PERFORM app.apply_invitation(r.id, v_uid);
+      v_count := v_count + 1;
+    EXCEPTION WHEN SQLSTATE '22023' THEN
+      -- a role that no longer exists: leave the invitation pending for an admin to fix
+      RAISE NOTICE 'accept_pending_invitations: skipped invitation % (%)', r.id, SQLERRM;
+    END;
+  END LOOP;
+  RETURN v_count;
+END $$;
+REVOKE ALL ON FUNCTION public.accept_pending_invitations() FROM public, anon;
+GRANT EXECUTE ON FUNCTION public.accept_pending_invitations() TO authenticated, service_role;