@nextsparkjs/core 0.1.0-beta.174 → 0.1.0-beta.176

package/dist/styles/classes.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-06-25T14:35:28.210Z",
+  "generated": "2026-06-28T23:29:37.388Z",
   "totalClasses": 1081,
   "classes": [
     "!text-2xl",

package/dist/templates/app/api/v1/auth/signup-with-invite/route.ts

@@ -62,11 +62,16 @@ export const POST = withRateLimitTier(withApiLogging(
         return addCorsHeaders(response)
       }
 
-      // Step 1: Validate invitation token (without RLS since user doesn't exist yet)
+      // Step 1: Validate the invitation token via the service pool (RLS bypass).
+      // The invitee has no session yet, so the unguessable token IS the
+      // credential. Passing a 'system' string as the userId does NOT bypass RLS
+      // — it sets a bogus RLS context on the gated pool, so under enforced RLS
+      // the row is invisible and the lookup returns null (false "not found").
       const invitation = await queryOneWithRLS<TeamInvitation>(
         'SELECT * FROM "team_invitations" WHERE token = $1',
         [inviteToken],
-        'system' // Use system context for initial validation
+        undefined,
+        { service: true }
       )
 
       if (!invitation) {
@@ -165,15 +170,24 @@ export const POST = withRateLimitTier(withApiLogging(
         return addCorsHeaders(response)
       }
 
+      // Steps 3-4 run via the service pool (RLS bypass). This is a trusted
+      // server flow: the invite token was validated above and the account was
+      // just created, so there is no invitee session to drive RLS — and a
+      // `SET LOCAL app.user_id` context does not reliably propagate to the
+      // membership INSERT over a pooled (PgBouncer) connection, which makes the
+      // team_members self-join policy intermittently reject it. Writing as the
+      // service role sidesteps that; every row carries explicit ids.
+
       // Step 3: Mark email as verified (skip email verification since invitation proves email ownership)
       await mutateWithRLS(
         'UPDATE "users" SET "emailVerified" = true, "updatedAt" = CURRENT_TIMESTAMP WHERE id = $1',
         [userId],
-        userId
+        undefined,
+        { service: true }
       )
 
       // Step 4: Accept the invitation (add user to team)
-      const tx = await getTransactionClient(userId)
+      const tx = await getTransactionClient(userId, { service: true })
 
       try {
         // Add user as team member

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.174",
+  "version": "0.1.0-beta.176",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -469,7 +469,7 @@
     "tailwind-merge": "^3.3.1",
     "uuid": "^13.0.0",
     "zod": "^4.1.5",
-    "@nextsparkjs/testing": "0.1.0-beta.174"
+    "@nextsparkjs/testing": "0.1.0-beta.176"
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs || true",

package/templates/app/api/v1/auth/signup-with-invite/route.ts

@@ -62,11 +62,16 @@ export const POST = withRateLimitTier(withApiLogging(
         return addCorsHeaders(response)
       }
 
-      // Step 1: Validate invitation token (without RLS since user doesn't exist yet)
+      // Step 1: Validate the invitation token via the service pool (RLS bypass).
+      // The invitee has no session yet, so the unguessable token IS the
+      // credential. Passing a 'system' string as the userId does NOT bypass RLS
+      // — it sets a bogus RLS context on the gated pool, so under enforced RLS
+      // the row is invisible and the lookup returns null (false "not found").
       const invitation = await queryOneWithRLS<TeamInvitation>(
         'SELECT * FROM "team_invitations" WHERE token = $1',
         [inviteToken],
-        'system' // Use system context for initial validation
+        undefined,
+        { service: true }
       )
 
       if (!invitation) {
@@ -165,15 +170,24 @@ export const POST = withRateLimitTier(withApiLogging(
         return addCorsHeaders(response)
       }
 
+      // Steps 3-4 run via the service pool (RLS bypass). This is a trusted
+      // server flow: the invite token was validated above and the account was
+      // just created, so there is no invitee session to drive RLS — and a
+      // `SET LOCAL app.user_id` context does not reliably propagate to the
+      // membership INSERT over a pooled (PgBouncer) connection, which makes the
+      // team_members self-join policy intermittently reject it. Writing as the
+      // service role sidesteps that; every row carries explicit ids.
+
       // Step 3: Mark email as verified (skip email verification since invitation proves email ownership)
       await mutateWithRLS(
         'UPDATE "users" SET "emailVerified" = true, "updatedAt" = CURRENT_TIMESTAMP WHERE id = $1',
         [userId],
-        userId
+        undefined,
+        { service: true }
       )
 
       // Step 4: Accept the invitation (add user to team)
-      const tx = await getTransactionClient(userId)
+      const tx = await getTransactionClient(userId, { service: true })
 
       try {
         // Add user as team member