@nuxt-customer-portal/organizations 0.3.0

package/i18n/locales/nl.json

@@ -0,0 +1,208 @@
+{
+  "settings": {
+    "title": "Instellingen",
+    "profile": "Profiel",
+    "organization": "Organisatie",
+    "security": "Beveiliging"
+  },
+  "security": {
+    "password": {
+      "title": "Wachtwoord",
+      "description": "Bevestig uw huidige wachtwoord voordat u een nieuw wachtwoord instelt.",
+      "currentPassword": "Huidig wachtwoord",
+      "currentPasswordPlaceholder": "Voer uw huidige wachtwoord in",
+      "newPassword": "Nieuw wachtwoord",
+      "newPasswordPlaceholder": "Voer uw nieuwe wachtwoord in",
+      "updateButton": "Wachtwoord bijwerken",
+      "validation": {
+        "currentPasswordRequired": "Huidig wachtwoord is verplicht",
+        "newPasswordRequired": "Nieuw wachtwoord is verplicht",
+        "passwordsMustBeDifferent": "Nieuw wachtwoord moet verschillen van het huidige wachtwoord",
+        "passwordsMustBeDifferentShort": "Wachtwoorden moeten verschillend zijn"
+      },
+      "success": "Wachtwoord succesvol gewijzigd",
+      "error": "Wachtwoord wijzigen mislukt"
+    },
+    "account": {
+      "title": "Account beëindigen",
+      "description": "Wilt u onze service niet meer gebruiken? U kunt hier uw account verwijderen. Deze actie kan niet ongedaan worden gemaakt. Alle informatie met betrekking tot dit account wordt permanent verwijderd.",
+      "deleteButton": "Account verwijderen",
+      "deleteRequested": "Accountverwijdering aangevraagd",
+      "deleteRequestedDescription": "We hebben u een verificatie-e-mail gestuurd. Controleer uw e-mail en klik op de link om het accountverwijderingsproces te voltooien.",
+      "delete": {
+        "confirmTitle": "Accountverwijdering bevestigen",
+        "confirmMessage": "Weet u zeker dat u uw account wilt verwijderen? Deze actie kan niet ongedaan worden gemaakt.",
+        "passwordRequired": "Voer uw wachtwoord in om accountverwijdering te bevestigen",
+        "passwordPlaceholder": "Voer uw wachtwoord in",
+        "deleteButton": "Account verwijderen",
+        "cancelButton": "Annuleren",
+        "error": "Account verwijderen mislukt",
+        "emailVerificationSent": "Verificatie-e-mail verzonden. Controleer uw e-mail om de accountverwijdering te voltooien."
+      }
+    }
+  },
+  "myOrganizations": {
+    "title": "Mijn Organisaties",
+    "description": "Beheer je organisaties en wissel tussen hen"
+  },
+  "organization": {
+    "details": {
+      "title": "Organisatiegegevens",
+      "name": "Naam",
+      "slug": "Slug",
+      "created": "Aangemaakt"
+    },
+    "emailProvider": {
+      "title": "E-mailprovider",
+      "description": "Configureer het Resend-account van deze organisatie voor facturen, herinneringen en andere transactionele e-mail.",
+      "configured": "Resend is geconfigureerd",
+      "notConfigured": "Resend is niet geconfigureerd",
+      "required": "Transactionele e-mail is geblokkeerd totdat een organisatie-eigenaar een sleutel configureert.",
+      "masked": "Actieve API-sleutel eindigend op {suffix}",
+      "verifiedDomains": "Geverifieerde verzenddomeinen",
+      "keyLabel": "Resend API-sleutel",
+      "replaceLabel": "Nieuwe Resend API-sleutel",
+      "configure": "Configureren en valideren",
+      "replace": "Valideren en vervangen",
+      "checkAgain": "Domeinen opnieuw controleren",
+      "remove": "Sleutel verwijderen",
+      "saved": "Resend API-sleutel opgeslagen",
+      "documentation": "Handleiding voor domeinverificatie in Resend",
+      "invalid": "De Resend API-sleutel kon niet worden gevalideerd",
+      "invalidDescription": "Controleer of de sleutel actief is en bij het juiste Resend-account hoort.",
+      "permissionRequired": "Deze Resend-sleutel kan alleen verzenden",
+      "permissionRequiredDescription": "Maak in Resend een API-sleutel met Full access aan. Domeintoegang is nodig om te controleren of deze organisatie het ingestelde afzenderadres mag gebruiken.",
+      "checkFailed": "Resend-domeinen konden niet worden gecontroleerd",
+      "removed": "Resend API-sleutel verwijderd",
+      "statusFailed": "Status van de e-mailprovider kon niet worden geladen",
+      "statusFailedDescription": "Controleer de server en databasemigratie voordat je een sleutel configureert.",
+      "removeTitle": "Resend API-sleutel verwijderen?",
+      "removeDescription": "Facturen en herinneringen kunnen niet worden verzonden totdat een nieuwe organisatiesleutel is geconfigureerd."
+    },
+    "settings": {
+      "editButton": "Organisatie bewerken",
+      "updateSuccess": "Organisatie succesvol bijgewerkt",
+      "nameLabel": "Organisatienaam",
+      "namePlaceholder": "Organisatienaam",
+      "officialCompanyNameLabel": "Officiële bedrijfsnaam",
+      "officialCompanyNamePlaceholder": "Bedrijfsnaam zoals geregistreerd",
+      "officialCompanyNameHint": "De officiële naam waaronder de organisatie is geregistreerd.",
+      "slugLabel": "Organisatie Slug",
+      "slugPlaceholder": "organisatie-slug",
+      "slugHint": "URL-vriendelijke identifier voor je organisatie",
+      "slugChecking": "Beschikbaarheid controleren...",
+      "slugAvailable": "Slug is beschikbaar",
+      "slugUnavailable": "Slug is al in gebruik",
+      "slugError": "Slug beschikbaarheid controleren mislukt",
+      "logoLabel": "Organisatielogo",
+      "logoChoose": "Logo kiezen",
+      "logoRemove": "Logo verwijderen",
+      "avatarLogoLabel": "Avatarlogo",
+      "avatarLogoHint": "Een compact logo voor organisatielijsten. Gebruik bij voorkeur een vierkante afbeelding (PNG, JPG, GIF of WebP, maximaal 2 MB).",
+      "invoiceLogoHint": "Upload het organisatielogo als PNG, JPG, GIF of WebP.",
+      "logoHint": "Upload een PNG, JPG of GIF. Aanbevolen formaat: 280×160.",
+      "ownerOnly": "Alleen organisatie-eigenaren kunnen naam of slug wijzigen.",
+      "errors": {
+        "loadFailed": "Organisatie laden mislukt",
+        "updateFailed": "Organisatie bijwerken mislukt",
+        "slugTaken": "Organisatie slug is al in gebruik"
+      },
+      "validation": {
+        "nameRequired": "Organisatienaam is verplicht",
+        "officialCompanyNameRequired": "Officiële bedrijfsnaam is verplicht",
+        "slugRequired": "Organisatie slug is verplicht",
+        "slugInvalid": "Slug mag alleen kleine letters, cijfers en streepjes bevatten",
+        "logoInvalid": "Logo moet een geldige afbeelding zijn",
+        "logoTooLarge": "Logo moet kleiner zijn dan 2 MB"
+      }
+    },
+    "members": {
+      "loading": "Organisatiegegevens laden...",
+      "title": "Leden",
+      "empty": "Nog geen leden",
+      "role": "Rol",
+      "remove": "Lid verwijderen",
+      "removeSuccess": "Lid succesvol verwijderd",
+      "roles": {
+        "owner": "Eigenaar",
+        "admin": "Beheerder",
+        "member": "Lid"
+      },
+      "confirmRemove": {
+        "title": "Lid verwijderen?",
+        "message": "Weet je zeker dat je {name} uit deze organisatie wilt verwijderen?",
+        "confirm": "Verwijderen"
+      },
+      "invitations": {
+        "title": "Uitnodigingen",
+        "empty": "Geen openstaande uitnodigingen",
+        "expires": "Verloopt",
+        "resend": "Opnieuw Verzenden",
+        "delete": "Verwijderen",
+        "inviteButton": "Lid Uitnodigen",
+        "modalTitle": "Lid Uitnodigen",
+        "emailLabel": "E-mailadres",
+        "emailPlaceholder": "Voer het e-mailadres van het lid in",
+        "roleLabel": "Rol",
+        "roleMember": "Lid",
+        "roleAdmin": "Beheerder",
+        "sendButton": "Uitnodiging Verzenden",
+        "sendSuccess": "Uitnodiging succesvol verzonden",
+        "cancel": "Annuleren",
+        "resendSuccess": "Uitnodiging succesvol opnieuw verzonden",
+        "deleteSuccess": "Uitnodiging succesvol verwijderd"
+      },
+      "errors": {
+        "sendInvitationFailed": "Uitnodiging verzenden mislukt",
+        "resendFailed": "Uitnodiging opnieuw verzenden mislukt",
+        "cancelFailed": "Uitnodiging annuleren mislukt",
+        "removeFailed": "Lid verwijderen mislukt"
+      },
+      "confirm": {
+        "cancelInvitation": "Weet je zeker dat je deze uitnodiging wilt annuleren?"
+      },
+      "validation": {
+        "emailInvalid": "Ongeldig e-mailadres",
+        "roleRequired": "Rol is verplicht"
+      }
+    }
+  },
+  "profile": {
+    "badges": {
+      "active": "Actief"
+    },
+    "buttons": {
+      "setActive": "Activeren"
+    },
+    "description": "Beheer je persoonlijke informatie en profielinstellingen",
+    "fields": {
+      "email": "E-mail",
+      "emailDescription": "Je e-mailadres kan niet worden gewijzigd",
+      "name": "Naam",
+      "nameDescription": "Je weergavenaam",
+      "namePlaceholder": "Voer je naam in",
+      "profilePicture": "Profielfoto",
+      "profilePictureDescription": "JPG, GIF of PNG. Max. 1MB.",
+      "chooseAvatar": "Kiezen"
+    },
+    "messages": {
+      "error": "Fout",
+      "failedToActivateOrganization": "Organisatie activeren mislukt",
+      "organizationActivated": "Organisatie succesvol geactiveerd",
+      "profileUpdated": "Je profiel is succesvol bijgewerkt",
+      "success": "Succes",
+      "updateFailed": "Profiel bijwerken mislukt"
+    },
+    "sections": {
+      "organizations": "Mijn organisaties",
+      "profileInfo": "Profielinformatie"
+    },
+    "title": "Profielinstellingen",
+    "validation": {
+      "atLeastOneField": "Ten minste één veld (naam of afbeelding) moet worden ingevuld",
+      "imageInvalidUrl": "Afbeelding moet een geldige URL zijn",
+      "nameMaxLength": "Naam moet minder dan 255 tekens zijn",
+      "nameRequired": "Naam is verplicht"
+    }
+  }
+}

package/nuxt.config.ts

@@ -0,0 +1,11 @@
+export default defineNuxtConfig({
+  $meta: { name: 'nuxt-customer-portal-organizations' },
+  compatibilityDate: '2025-10-24',
+  modules: ['@nuxtjs/i18n'],
+  i18n: {
+    locales: [
+      { code: 'en', file: 'en.json' },
+      { code: 'nl', file: 'nl.json' }
+    ]
+  }
+})

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@nuxt-customer-portal/organizations",
+  "version": "0.3.0",
+  "license": "MIT",
+  "homepage": "https://nuxt-customer-portal.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ludulicious/nuxt-customer-portal.git"
+  },
+  "type": "module",
+  "main": "./nuxt.config.ts",
+  "files": [
+    "LICENSE",
+    "CHANGELOG.md",
+    "app",
+    "i18n",
+    "server",
+    "shared",
+    "nuxt.config.ts",
+    "portal.manifest.mjs",
+    "README.md"
+  ],
+  "exports": {
+    ".": "./nuxt.config.ts",
+    "./feature": "./shared/feature.ts",
+    "./portal-manifest": "./portal.manifest.mjs",
+    "./app/*": "./app/*.ts",
+    "./server/*": "./server/*.ts",
+    "./shared/*": "./shared/*.ts"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@nuxtjs/i18n": "^10.6.0",
+    "@types/pg": "8.15.5",
+    "drizzle-orm": "^0.45.2",
+    "h3": "^1.15.4",
+    "pg": "^8.22.0",
+    "zod": "^4.4.3",
+    "@nuxt/ui": "^4.10.0",
+    "@nuxt-customer-portal/core": "^0.3.0",
+    "@nuxt-customer-portal/ui": "^0.3.0"
+  },
+  "peerDependencies": {
+    "nuxt": "^4.5.1"
+  },
+  "devDependencies": {
+    "nuxt": "^4.5.1"
+  }
+}

package/portal.manifest.mjs

@@ -0,0 +1,6 @@
+export default {
+  id: 'organizations',
+  version: '0.3.0',
+  source: '@nuxt-customer-portal/organizations',
+  dependsOn: ['core', 'ui']
+}

package/server/api/organizations/[id]/index.get.ts

@@ -0,0 +1,54 @@
+import { defineEventHandler, createError, getRouterParam } from 'h3'
+import { auth } from '@nuxt-customer-portal/core/server/utils/auth'
+import { db } from '@nuxt-customer-portal/core/server/utils/db'
+import { organization as organizationTable } from '@nuxt-customer-portal/core/server/db/schema/auth-schema'
+import { eq } from 'drizzle-orm'
+import { checkOrganizationPermission } from '@nuxt-customer-portal/core/server/utils/permissions'
+import type { Organization } from '@nuxt-customer-portal/core/shared/types/index'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['General'],
+    operationId: 'generalOrganizationsByIdGet',
+    summary: 'Get an organization',
+    description:
+      'Get an organization. Uses the current authenticated session and enforces the relevant portal permissions.'
+  }
+})
+
+export default defineEventHandler(async (event): Promise<Organization> => {
+  const session = await auth.api.getSession({ headers: event.headers })
+  if (!session?.user) {
+    throw createError({ statusCode: 401, message: 'Unauthorized' })
+  }
+
+  const organizationId = getRouterParam(event, 'id')
+  if (!organizationId) {
+    throw createError({ statusCode: 400, message: 'Organization ID is required' })
+  }
+
+  // Check if user has permission to read this organization
+  const hasPermission = await checkOrganizationPermission(
+    session as { user: { id: string; role?: string } },
+    organizationId,
+    'organization',
+    'read'
+  )
+
+  if (!hasPermission) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+
+  // Get organization details
+  const [organization] = await db
+    .select()
+    .from(organizationTable)
+    .where(eq(organizationTable.id, organizationId))
+    .limit(1)
+
+  if (!organization) {
+    throw createError({ statusCode: 404, message: 'Organization not found' })
+  }
+
+  return organization as Organization
+})

package/server/api/organizations/[id]/invitations/[invitationId]/delete.post.ts

@@ -0,0 +1,42 @@
+import { defineEventHandler, createError, getRouterParam } from 'h3'
+import { auth } from '@nuxt-customer-portal/core/server/utils/auth'
+import { checkOrganizationPermission } from '@nuxt-customer-portal/core/server/utils/permissions'
+import { changePendingInvitation } from '@nuxt-customer-portal/core/server/utils/invitation-management'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['General'],
+    operationId: 'generalOrganizationsByIdInvitationsByInvitationIdDeletePost',
+    summary: 'Cancel an organization invitation',
+    description:
+      'Cancel an organization invitation. Uses the current authenticated session and enforces the relevant portal permissions.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const session = await auth.api.getSession({ headers: event.headers })
+  if (!session?.user) {
+    throw createError({ statusCode: 401, message: 'Unauthorized' })
+  }
+
+  const organizationId = getRouterParam(event, 'id')
+  const invitationId = getRouterParam(event, 'invitationId')
+
+  if (!organizationId || !invitationId) {
+    throw createError({ statusCode: 400, message: 'Organization ID and Invitation ID are required' })
+  }
+
+  // Check if user has permission to cancel invitations
+  const hasPermission = await checkOrganizationPermission(
+    session as { user: { id: string; role?: string } },
+    organizationId,
+    'invitation',
+    'cancel'
+  )
+
+  if (!hasPermission) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+
+  return changePendingInvitation(organizationId, invitationId, { status: 'canceled' })
+})

package/server/api/organizations/[id]/invitations/[invitationId]/resend.post.ts

@@ -0,0 +1,91 @@
+import { defineEventHandler, createError, getRouterParam } from 'h3'
+import { auth } from '@nuxt-customer-portal/core/server/utils/auth'
+import { db } from '@nuxt-customer-portal/core/server/utils/db'
+import {
+  invitation as invitationTable,
+  organization as organizationTable
+} from '@nuxt-customer-portal/core/server/db/schema/auth-schema'
+import { eq } from 'drizzle-orm'
+import { checkOrganizationPermission } from '@nuxt-customer-portal/core/server/utils/permissions'
+import { sendEmail } from '@nuxt-customer-portal/core/server/utils/email'
+import { getInvitationEmailContent } from '@nuxt-customer-portal/core/server/utils/email-texts'
+import type { SessionUser } from '@nuxt-customer-portal/core/shared/types/index'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['General'],
+    operationId: 'generalOrganizationsByIdInvitationsByInvitationIdResendPost',
+    summary: 'Resend an organization invitation',
+    description:
+      'Resend an organization invitation. Uses the current authenticated session and enforces the relevant portal permissions.'
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const session = await auth.api.getSession({ headers: event.headers })
+  if (!session?.user) {
+    throw createError({ statusCode: 401, message: 'Unauthorized' })
+  }
+
+  const user = session.user as SessionUser
+  const organizationId = getRouterParam(event, 'id')
+  const invitationId = getRouterParam(event, 'invitationId')
+
+  if (!organizationId || !invitationId) {
+    throw createError({ statusCode: 400, message: 'Organization ID and Invitation ID are required' })
+  }
+
+  // Check if user has permission to create invitations (resending is creating a new invitation)
+  const hasPermission = await checkOrganizationPermission(
+    session as { user: { id: string; role?: string } },
+    organizationId,
+    'invitation',
+    'create'
+  )
+
+  if (!hasPermission) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+
+  // Get invitation details
+  const [invitation] = await db.select().from(invitationTable).where(eq(invitationTable.id, invitationId)).limit(1)
+
+  if (!invitation || invitation.organizationId !== organizationId) {
+    throw createError({ statusCode: 404, message: 'Invitation not found' })
+  }
+
+  // Check if invitation is still pending
+  if (invitation.status !== 'pending') {
+    throw createError({ statusCode: 400, message: 'Can only resend pending invitations' })
+  }
+
+  // Get organization details for email
+  const [organization] = await db
+    .select()
+    .from(organizationTable)
+    .where(eq(organizationTable.id, organizationId))
+    .limit(1)
+
+  if (!organization) {
+    throw createError({ statusCode: 404, message: 'Organization not found' })
+  }
+
+  // Resend invitation email
+  const baseURL = process.env.BETTER_AUTH_URL || process.env.PUBLIC_URL || 'http://localhost:3000'
+  const invitationLink = `${baseURL}/signup?invitationId=${invitationId}`
+
+  const emailContent = getInvitationEmailContent({
+    inviterName: user.name || '',
+    inviterEmail: user.email,
+    organizationName: organization.name,
+    role: invitation.role || 'member',
+    invitationLink
+  })
+
+  await sendEmail({
+    to: invitation.email,
+    ...emailContent
+  })
+
+  return { success: true, message: 'Invitation resent successfully' }
+})

package/server/api/organizations/[id]/invitations/[invitationId].patch.ts

@@ -0,0 +1,18 @@
+import { auth } from '@nuxt-customer-portal/core/server/utils/auth'
+import { checkOrganizationPermission } from '@nuxt-customer-portal/core/server/utils/permissions'
+import { changePendingInvitation } from '@nuxt-customer-portal/core/server/utils/invitation-management'
+
+export default defineEventHandler(async (event) => {
+  const session = await auth.api.getSession({ headers: event.headers })
+  if (!session?.user) {
+    throw createError({ statusCode: 401, message: 'Unauthorized' })
+  }
+  const organizationId = getRouterParam(event, 'id')!
+  if (
+    !(await checkOrganizationPermission(session, organizationId, 'invitation', 'create')) ||
+    !(await checkOrganizationPermission(session, organizationId, 'invitation', 'cancel'))
+  ) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+  return changePendingInvitation(organizationId, getRouterParam(event, 'invitationId')!, await readBody(event))
+})

package/server/api/organizations/[id]/invitations.get.ts

@@ -0,0 +1,49 @@
+import { defineEventHandler, createError, getRouterParam } from 'h3'
+import { auth } from '@nuxt-customer-portal/core/server/utils/auth'
+import { db } from '@nuxt-customer-portal/core/server/utils/db'
+import { invitation as invitationTable } from '@nuxt-customer-portal/core/server/db/schema/auth-schema'
+import { eq, and } from 'drizzle-orm'
+import { checkOrganizationPermission } from '@nuxt-customer-portal/core/server/utils/permissions'
+import type { OrganizationInvitationsResponse } from '@nuxt-customer-portal/core/shared/types/index'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['General'],
+    operationId: 'generalOrganizationsByIdInvitationsGet',
+    summary: 'List organization invitations',
+    description:
+      'List organization invitations. Uses the current authenticated session and enforces the relevant portal permissions.'
+  }
+})
+
+export default defineEventHandler(async (event): Promise<OrganizationInvitationsResponse> => {
+  const session = await auth.api.getSession({ headers: event.headers })
+  if (!session?.user) {
+    throw createError({ statusCode: 401, message: 'Unauthorized' })
+  }
+
+  const organizationId = getRouterParam(event, 'id')
+  if (!organizationId) {
+    throw createError({ statusCode: 400, message: 'Organization ID is required' })
+  }
+
+  // Check if user has permission to list members (which includes viewing invitations)
+  const hasPermission = await checkOrganizationPermission(
+    session as { user: { id: string; role?: string } },
+    organizationId,
+    'member',
+    'list'
+  )
+
+  if (!hasPermission) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+
+  // Get all invitations for this organization
+  const invitations = await db
+    .select()
+    .from(invitationTable)
+    .where(and(eq(invitationTable.organizationId, organizationId), eq(invitationTable.status, 'pending')))
+
+  return invitations as OrganizationInvitationsResponse
+})

package/server/api/organizations/accept-invitation.post.ts

@@ -0,0 +1,131 @@
+import { defineEventHandler, createError, readBody } from 'h3'
+import { z } from 'zod'
+import { auth, generateId } from '@nuxt-customer-portal/core/server/utils/auth'
+import { db } from '@nuxt-customer-portal/core/server/utils/db'
+import {
+  invitation as invitationTable,
+  member as memberTable,
+  organization as organizationTable
+} from '@nuxt-customer-portal/core/server/db/schema/auth-schema'
+import { eq, and } from 'drizzle-orm'
+import type { SessionUser } from '@nuxt-customer-portal/core/shared/types/index'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['General'],
+    operationId: 'generalOrganizationsAcceptInvitationPost',
+    summary: 'Accept an organization invitation',
+    description:
+      'Accept an organization invitation. Uses the current authenticated session and enforces the relevant portal permissions.'
+  }
+})
+
+/**
+ * Custom endpoint to accept invitations, bypassing Better Auth's inviter membership check.
+ * This is necessary because admins who create organizations and invite owners
+ * are removed as members, but their invitations should still be valid.
+ */
+export default defineEventHandler(async (event) => {
+  const session = await auth.api.getSession({ headers: event.headers })
+  if (!session?.user) {
+    throw createError({ statusCode: 401, message: 'Unauthorized' })
+  }
+
+  const user = session.user as SessionUser
+  const parsed = z.object({ invitationId: z.string().min(1) }).safeParse(await readBody(event))
+  if (!parsed.success) {
+    throw createError({ statusCode: 400, message: 'Invitation ID is required' })
+  }
+  const { invitationId } = parsed.data
+
+  try {
+    return await db.transaction(async (tx) => {
+      // Fetch the invitation
+      const [invitation] = await tx
+        .select()
+        .from(invitationTable)
+        .where(eq(invitationTable.id, invitationId))
+        .limit(1)
+        .for('update')
+
+      if (!invitation) {
+        throw createError({ statusCode: 404, message: 'Invitation not found' })
+      }
+
+      // Validate that the invitation is still pending
+      if (invitation.status !== 'pending') {
+        throw createError({ statusCode: 400, message: 'Invitation is no longer valid' })
+      }
+
+      // Validate that the invitation hasn't expired
+      const now = new Date()
+      const expiresAt = new Date(invitation.expiresAt)
+      if (expiresAt < now) {
+        throw createError({ statusCode: 400, message: 'Invitation has expired' })
+      }
+
+      // Validate that the user's email matches the invitation email
+      if (user.email?.toLowerCase() !== invitation.email?.toLowerCase()) {
+        throw createError({
+          statusCode: 400,
+          message: 'Email mismatch: This invitation was sent to a different email address'
+        })
+      }
+
+      // Check if user is already a member
+      const [existingMember] = await tx
+        .select()
+        .from(memberTable)
+        .where(and(eq(memberTable.organizationId, invitation.organizationId), eq(memberTable.userId, user.id)))
+        .limit(1)
+
+      if (existingMember) {
+        throw createError({ statusCode: 400, message: 'You are already a member of this organization' })
+      }
+
+      // Get organization details
+      const [organization] = await tx
+        .select()
+        .from(organizationTable)
+        .where(eq(organizationTable.id, invitation.organizationId))
+        .limit(1)
+
+      if (!organization) {
+        throw createError({ statusCode: 404, message: 'Organization not found' })
+      }
+
+      // Create the member record
+      const memberId = generateId()
+      await tx.insert(memberTable).values({
+        id: memberId,
+        organizationId: invitation.organizationId,
+        userId: user.id,
+        role: invitation.role || 'member',
+        createdAt: new Date()
+      })
+
+      // Update invitation status to accepted
+      await tx.update(invitationTable).set({ status: 'accepted' }).where(eq(invitationTable.id, invitationId))
+
+      return {
+        success: true,
+        member: {
+          id: memberId,
+          organizationId: invitation.organizationId,
+          userId: user.id,
+          role: invitation.role || 'member'
+        },
+        organization: {
+          id: organization.id,
+          name: organization.name
+        }
+      }
+    })
+  } catch (err: unknown) {
+    if (err instanceof Error && 'statusCode' in err) {
+      throw err
+    }
+    const errorMessage = err instanceof Error ? err.message : 'Failed to accept invitation'
+    throw createError({ statusCode: 500, message: errorMessage })
+  }
+})