@varshylinc/team-management 0.1.0

package/src/server/routes/admin.routes.ts

@@ -0,0 +1,208 @@
+import { Router } from 'express';
+import type { Pool } from 'pg';
+import type { ServerModuleAdapter, TeamManagementFeatureFlags, OrgRole } from '../types.js';
+import { requireSuperAdmin } from '../middleware/require-super-admin.js';
+import {
+  listAllOrgs,
+  getOrgForAdmin,
+  getUserForAdmin,
+  restoreOrg,
+  appointOwner,
+  hardDeleteOrg,
+  addMemberAdmin,
+  removeMemberAdmin,
+  lockUser,
+  unlockUser,
+  triggerPasswordReset,
+} from '../services/super-admin.service.js';
+
+export function createAdminRouter(
+  pool: Pool,
+  adapter: ServerModuleAdapter,
+  flags: TeamManagementFeatureFlags,
+  baseUrl: string
+): Router {
+  const router = Router();
+  const superAdminMiddleware = requireSuperAdmin(pool, adapter, flags);
+
+  type SARequest = import('express').Request & { superAdminUserId: number };
+
+  // GET /admin/orgs
+  router.get('/orgs', superAdminMiddleware, async (req, res) => {
+    try {
+      const orgs = await listAllOrgs(pool);
+      res.json({ orgs });
+    } catch (e) {
+      adapter.logger.error('[admin] GET /orgs', { error: (e as Error).message });
+      res.status(500).json({ error: 'Failed to list organizations' });
+    }
+  });
+
+  // GET /admin/orgs/:id
+  router.get('/orgs/:id', superAdminMiddleware, async (req, res) => {
+    const orgId = parseInt(req.params.id, 10);
+    if (isNaN(orgId)) { res.status(400).json({ error: 'Invalid org ID' }); return; }
+    try {
+      const org = await getOrgForAdmin(pool, orgId);
+      res.json({ org });
+    } catch (e) {
+      const msg = (e as Error).message;
+      adapter.logger.error('[admin] GET /orgs/:id', { error: msg });
+      if (msg.includes('not found')) { res.status(404).json({ error: msg }); }
+      else { res.status(500).json({ error: 'Failed to fetch organization' }); }
+    }
+  });
+
+  // GET /admin/users/:id
+  router.get('/users/:id', superAdminMiddleware, async (req, res) => {
+    const userId = parseInt(req.params.id, 10);
+    if (isNaN(userId)) { res.status(400).json({ error: 'Invalid user ID' }); return; }
+    try {
+      const user = await getUserForAdmin(pool, adapter, userId);
+      res.json({ user });
+    } catch (e) {
+      const msg = (e as Error).message;
+      adapter.logger.error('[admin] GET /users/:id', { error: msg });
+      if (msg.includes('not found')) { res.status(404).json({ error: msg }); }
+      else { res.status(500).json({ error: 'Failed to fetch user' }); }
+    }
+  });
+
+  // POST /admin/orgs/:id/restore
+  router.post('/orgs/:id/restore', superAdminMiddleware, async (req, res) => {
+    const orgId = parseInt(req.params.id, 10);
+    if (isNaN(orgId)) { res.status(400).json({ error: 'Invalid org ID' }); return; }
+    const { reason } = req.body as { reason?: string };
+    if (!reason) { res.status(400).json({ error: 'reason is required' }); return; }
+    const saUserId = (req as SARequest).superAdminUserId;
+    try {
+      await restoreOrg(pool, { orgId, superAdminUserId: saUserId, reason });
+      res.json({ message: 'Organization restored' });
+    } catch (e) {
+      const msg = (e as Error).message;
+      adapter.logger.error('[admin] POST /orgs/:id/restore', { error: msg });
+      if (msg.includes('not found') || msg.includes('not deleted')) { res.status(404).json({ error: msg }); }
+      else { res.status(500).json({ error: 'Failed to restore organization' }); }
+    }
+  });
+
+  // POST /admin/orgs/:id/appoint-owner
+  router.post('/orgs/:id/appoint-owner', superAdminMiddleware, async (req, res) => {
+    const orgId = parseInt(req.params.id, 10);
+    if (isNaN(orgId)) { res.status(400).json({ error: 'Invalid org ID' }); return; }
+    const { targetUserId, reason } = req.body as { targetUserId?: number; reason?: string };
+    if (!targetUserId || !reason) { res.status(400).json({ error: 'targetUserId and reason are required' }); return; }
+    const saUserId = (req as SARequest).superAdminUserId;
+    try {
+      await appointOwner(pool, { orgId, targetUserId, superAdminUserId: saUserId, reason });
+      res.json({ message: 'Owner appointed' });
+    } catch (e) {
+      adapter.logger.error('[admin] POST /orgs/:id/appoint-owner', { error: (e as Error).message });
+      res.status(500).json({ error: 'Failed to appoint owner' });
+    }
+  });
+
+  // POST /admin/orgs/:id/hard-delete
+  router.post('/orgs/:id/hard-delete', superAdminMiddleware, async (req, res) => {
+    if (!flags.enableHardDelete) { res.status(403).json({ error: 'Hard delete is not enabled' }); return; }
+    const orgId = parseInt(req.params.id, 10);
+    if (isNaN(orgId)) { res.status(400).json({ error: 'Invalid org ID' }); return; }
+    const { legalBasis } = req.body as { legalBasis?: string };
+    if (!legalBasis) { res.status(400).json({ error: 'legalBasis is required' }); return; }
+    const saUserId = (req as SARequest).superAdminUserId;
+    try {
+      await hardDeleteOrg(pool, { orgId, superAdminUserId: saUserId, legalBasis });
+      res.json({ message: 'Organization permanently deleted' });
+    } catch (e) {
+      const msg = (e as Error).message;
+      adapter.logger.error('[admin] POST /orgs/:id/hard-delete', { error: msg });
+      if (msg.includes('legal basis')) { res.status(400).json({ error: msg }); }
+      else { res.status(500).json({ error: 'Failed to hard delete organization' }); }
+    }
+  });
+
+  // POST /admin/orgs/:id/members/add
+  router.post('/orgs/:id/members/add', superAdminMiddleware, async (req, res) => {
+    const orgId = parseInt(req.params.id, 10);
+    if (isNaN(orgId)) { res.status(400).json({ error: 'Invalid org ID' }); return; }
+    const { userId, role, reason } = req.body as { userId?: number; role?: string; reason?: string };
+    if (!userId || !role || !reason) { res.status(400).json({ error: 'userId, role, and reason are required' }); return; }
+    const saUserId = (req as SARequest).superAdminUserId;
+    try {
+      await addMemberAdmin(pool, { orgId, userId, role: role as OrgRole, superAdminUserId: saUserId, reason });
+      res.json({ message: 'Member added' });
+    } catch (e) {
+      adapter.logger.error('[admin] POST /orgs/:id/members/add', { error: (e as Error).message });
+      res.status(500).json({ error: 'Failed to add member' });
+    }
+  });
+
+  // POST /admin/orgs/:id/members/remove
+  router.post('/orgs/:id/members/remove', superAdminMiddleware, async (req, res) => {
+    const orgId = parseInt(req.params.id, 10);
+    if (isNaN(orgId)) { res.status(400).json({ error: 'Invalid org ID' }); return; }
+    const { userId, reason } = req.body as { userId?: number; reason?: string };
+    if (!userId || !reason) { res.status(400).json({ error: 'userId and reason are required' }); return; }
+    const saUserId = (req as SARequest).superAdminUserId;
+    try {
+      await removeMemberAdmin(pool, { orgId, userId, superAdminUserId: saUserId, reason });
+      res.json({ message: 'Member removed' });
+    } catch (e) {
+      adapter.logger.error('[admin] POST /orgs/:id/members/remove', { error: (e as Error).message });
+      res.status(500).json({ error: 'Failed to remove member' });
+    }
+  });
+
+  // POST /admin/users/:id/lock
+  router.post('/users/:id/lock', superAdminMiddleware, async (req, res) => {
+    const userId = parseInt(req.params.id, 10);
+    if (isNaN(userId)) { res.status(400).json({ error: 'Invalid user ID' }); return; }
+    const { reason } = req.body as { reason?: string };
+    if (!reason) { res.status(400).json({ error: 'reason is required' }); return; }
+    const saUserId = (req as SARequest).superAdminUserId;
+    try {
+      await lockUser(pool, adapter, { userId, superAdminUserId: saUserId, reason });
+      res.json({ message: 'User locked and sessions invalidated' });
+    } catch (e) {
+      adapter.logger.error('[admin] POST /users/:id/lock', { error: (e as Error).message });
+      res.status(500).json({ error: 'Failed to lock user' });
+    }
+  });
+
+  // POST /admin/users/:id/unlock
+  router.post('/users/:id/unlock', superAdminMiddleware, async (req, res) => {
+    const userId = parseInt(req.params.id, 10);
+    if (isNaN(userId)) { res.status(400).json({ error: 'Invalid user ID' }); return; }
+    const { reason } = req.body as { reason?: string };
+    if (!reason) { res.status(400).json({ error: 'reason is required' }); return; }
+    const saUserId = (req as SARequest).superAdminUserId;
+    try {
+      await unlockUser(pool, adapter, { userId, superAdminUserId: saUserId, reason });
+      res.json({ message: 'User unlocked' });
+    } catch (e) {
+      adapter.logger.error('[admin] POST /users/:id/unlock', { error: (e as Error).message });
+      res.status(500).json({ error: 'Failed to unlock user' });
+    }
+  });
+
+  // POST /admin/users/:id/password-reset
+  router.post('/users/:id/password-reset', superAdminMiddleware, async (req, res) => {
+    const userId = parseInt(req.params.id, 10);
+    if (isNaN(userId)) { res.status(400).json({ error: 'Invalid user ID' }); return; }
+    const { reason } = req.body as { reason?: string };
+    if (!reason) { res.status(400).json({ error: 'reason is required' }); return; }
+    const saUserId = (req as SARequest).superAdminUserId;
+    try {
+      await triggerPasswordReset(pool, adapter, { userId, superAdminUserId: saUserId, reason, baseUrl });
+      res.json({ message: 'Password reset email sent' });
+    } catch (e) {
+      const msg = (e as Error).message;
+      adapter.logger.error('[admin] POST /users/:id/password-reset', { error: msg });
+      if (msg.includes('not found')) { res.status(404).json({ error: msg }); }
+      else { res.status(500).json({ error: 'Failed to trigger password reset' }); }
+    }
+  });
+
+  return router;
+}
+

package/src/server/routes/audit.routes.ts

@@ -0,0 +1,93 @@
+import { Router } from 'express';
+import type { Pool } from 'pg';
+import type { ServerModuleAdapter, TeamManagementFeatureFlags } from '../types.js';
+import { requireMembership, type AuthenticatedRequest } from '../middleware/require-membership.js';
+import { requireRole } from '../middleware/require-role.js';
+
+const SUPER_ADMIN_DISPLAY_NAME = 'Varshyl Support';
+const DEFAULT_PAGE_LIMIT = 50;
+const MAX_PAGE_LIMIT = 200;
+
+export function createAuditRouter(
+  pool: Pool,
+  adapter: ServerModuleAdapter,
+  flags: TeamManagementFeatureFlags
+): Router {
+  const router = Router({ mergeParams: true });
+  const authMiddleware = requireMembership(pool, adapter);
+
+  // GET /orgs/:orgId/audit — paginated audit log (admin+)
+  router.get('/:orgId/audit', authMiddleware, requireRole('admin'), async (req, res) => {
+    if (!flags.enableAuditLog) {
+      res.status(501).json({ error: 'Audit log is not enabled' });
+      return;
+    }
+
+    const { orgId } = req as AuthenticatedRequest;
+    const page = Math.max(1, parseInt(req.query.page as string, 10) || 1);
+    const rawLimit = parseInt(req.query.limit as string, 10) || DEFAULT_PAGE_LIMIT;
+    const limit = Math.min(rawLimit, MAX_PAGE_LIMIT);
+    const offset = (page - 1) * limit;
+    const action = req.query.action as string | undefined;
+
+    try {
+      const params: unknown[] = [orgId, limit, offset];
+      let actionFilter = '';
+      if (action) {
+        params.push(action);
+        actionFilter = `AND ae.action = $${params.length}`;
+      }
+
+      const result = await pool.query(
+        `SELECT ae.*, sa.user_id AS is_super_admin_actor
+         FROM tm_audit_events ae
+         LEFT JOIN tm_super_admins sa ON sa.user_id = ae.actor_user_id AND sa.revoked_at IS NULL
+         WHERE ae.org_id = $1
+         ${actionFilter}
+         ORDER BY ae.created_at DESC
+         LIMIT $2 OFFSET $3`,
+        params
+      );
+
+      const countResult = await pool.query(
+        `SELECT COUNT(*) FROM tm_audit_events WHERE org_id = $1 ${action ? 'AND action = $2' : ''}`,
+        action ? [orgId, action] : [orgId]
+      );
+      const total = parseInt(countResult.rows[0].count, 10);
+
+      // Collect user IDs for enrichment (non-super-admin actors)
+      const userIds = [
+        ...new Set(
+          result.rows
+            .filter(r => r.actor_user_id && !r.is_super_admin_actor)
+            .map(r => r.actor_user_id as number)
+        ),
+      ];
+      const users = userIds.length > 0 ? await adapter.getUsersByIds(userIds) : [];
+      const userMap = new Map(users.map(u => [u.id, u]));
+
+      const events = result.rows.map(row => {
+        const { is_super_admin_actor, ...event } = row;
+        const actorDisplay = is_super_admin_actor
+          ? { id: row.actor_user_id, name: SUPER_ADMIN_DISPLAY_NAME, email: null }
+          : userMap.get(row.actor_user_id) ?? { id: row.actor_user_id, name: null, email: null };
+        return { ...event, actor: actorDisplay };
+      });
+
+      res.json({
+        events,
+        pagination: {
+          page,
+          limit,
+          total,
+          totalPages: Math.ceil(total / limit),
+        },
+      });
+    } catch (e) {
+      adapter.logger.error('[audit] GET /:orgId/audit', { error: (e as Error).message });
+      res.status(500).json({ error: 'Failed to fetch audit log' });
+    }
+  });
+
+  return router;
+}

package/src/server/routes/health.routes.ts

@@ -0,0 +1,46 @@
+import { Router } from 'express';
+import type { Pool } from 'pg';
+import type { TeamManagementConfig } from '../types.js';
+
+const MODULE_VERSION = '0.1.0';
+
+export function createHealthRouter(
+  pool: Pool,
+  config: TeamManagementConfig
+): { router: Router; handler: import('express').RequestHandler } {
+  const flags = config.featureFlags ?? {};
+
+  const handler: import('express').RequestHandler = async (_req, res) => {
+    try {
+      await pool.query('SELECT 1');
+      res.json({
+        status: 'ok',
+        module: '@varshylinc/team-management',
+        version: MODULE_VERSION,
+        db: 'connected',
+        flags: {
+          enableInvites: flags.enableInvites ?? true,
+          enableAuditLog: flags.enableAuditLog ?? true,
+          enableOwnershipTransfer: flags.enableOwnershipTransfer ?? true,
+          enableEmailChange: flags.enableEmailChange ?? true,
+          enablePasswordReset: flags.enablePasswordReset ?? true,
+          enableSuperAdmin: flags.enableSuperAdmin ?? false,
+          enableSharedAccess: flags.enableSharedAccess ?? false,
+          enableHardDelete: flags.enableHardDelete ?? false,
+        },
+      });
+    } catch (err) {
+      res.status(503).json({
+        status: 'error',
+        module: '@varshylinc/team-management',
+        version: MODULE_VERSION,
+        db: 'disconnected',
+        error: err instanceof Error ? err.message : 'Unknown error',
+      });
+    }
+  };
+
+  const router = Router();
+  router.get('/health', handler);
+  return { router, handler };
+}

package/src/server/routes/invitations.routes.ts

@@ -0,0 +1,252 @@
+import { Router } from 'express';
+import type { Pool } from 'pg';
+import type { ServerModuleAdapter, TeamManagementFeatureFlags, OrgRole } from '../types.js';
+import { requireMembership, type AuthenticatedRequest } from '../middleware/require-membership.js';
+import { requireRole } from '../middleware/require-role.js';
+import {
+  createInvitation,
+  revokeInvitation,
+  resendInvitation,
+  listPendingInvitations,
+  getInvitationWithDecryptedCode,
+  acceptInvitationByToken,
+  acceptInvitationByCode,
+} from '../services/invitations.service.js';
+import { writeAuditEvent, getClientIp } from '../services/audit.service.js';
+
+export function createInvitationsRouter(
+  pool: Pool,
+  adapter: ServerModuleAdapter,
+  flags: TeamManagementFeatureFlags,
+  baseUrl: string
+): Router {
+  const router = Router({ mergeParams: true });
+
+  function featureCheck(res: import('express').Response): boolean {
+    if (!flags.enableInvites) {
+      res.status(501).json({ error: 'Invitations feature is not enabled' });
+      return false;
+    }
+    return true;
+  }
+
+  const authMiddleware = requireMembership(pool, adapter);
+
+  // GET /orgs/:orgId/invitations — list pending (admin+)
+  router.get('/:orgId/invitations', authMiddleware, requireRole('admin'), async (req, res) => {
+    if (!featureCheck(res)) return;
+    const { orgId } = req as AuthenticatedRequest;
+    try {
+      const invitations = await listPendingInvitations(pool, orgId);
+      res.json({ invitations: invitations.map(inv => ({ ...inv, status: 'pending' })) });
+    } catch (e) {
+      adapter.logger.error('[invitations] GET list', { error: (e as Error).message });
+      res.status(500).json({ error: 'Failed to fetch invitations' });
+    }
+  });
+
+  // POST /orgs/:orgId/invitations — create (admin+)
+  router.post('/:orgId/invitations', authMiddleware, requireRole('admin'), async (req, res) => {
+    if (!featureCheck(res)) return;
+    const { orgId, userId } = req as AuthenticatedRequest;
+    const { email, role } = req.body as { email?: string; role?: string };
+
+    if (!email || !role) {
+      res.status(400).json({ error: 'email and role are required' });
+      return;
+    }
+
+    try {
+      const { invitation } = await createInvitation(pool, adapter, {
+        orgId,
+        invitedByUserId: userId,
+        email,
+        role: role as OrgRole,
+        baseUrl,
+      });
+
+      if (flags.enableAuditLog) {
+        await writeAuditEvent({
+          pool,
+          orgId,
+          actorUserId: userId,
+          action: 'member.invited',
+          targetType: 'invitation',
+          targetId: invitation.id,
+          after: { email, role },
+          ip: getClientIp(req),
+          userAgent: req.headers['user-agent'] ?? null,
+        });
+      }
+
+      res.status(201).json({ invitation: { ...invitation, status: 'pending' } });
+    } catch (e) {
+      const msg = (e as Error).message;
+      adapter.logger.error('[invitations] POST create', { error: msg });
+      if (msg.includes('already exists')) {
+        res.status(409).json({ error: msg });
+      } else {
+        res.status(500).json({ error: 'Failed to create invitation' });
+      }
+    }
+  });
+
+  // DELETE /orgs/:orgId/invitations/:id — revoke (admin+)
+  router.delete('/:orgId/invitations/:id', authMiddleware, requireRole('admin'), async (req, res) => {
+    if (!featureCheck(res)) return;
+    const { orgId, userId } = req as AuthenticatedRequest;
+    const invitationId = parseInt(req.params.id, 10);
+    if (isNaN(invitationId)) {
+      res.status(400).json({ error: 'Invalid invitation ID' });
+      return;
+    }
+    try {
+      await revokeInvitation(pool, { invitationId, revokedByUserId: userId });
+
+      if (flags.enableAuditLog) {
+        await writeAuditEvent({
+          pool,
+          orgId,
+          actorUserId: userId,
+          action: 'member.invite_revoked',
+          targetType: 'invitation',
+          targetId: invitationId,
+          ip: getClientIp(req),
+          userAgent: req.headers['user-agent'] ?? null,
+        });
+      }
+
+      res.json({ message: 'Invitation revoked' });
+    } catch (e) {
+      adapter.logger.error('[invitations] DELETE revoke', { error: (e as Error).message });
+      res.status(500).json({ error: 'Failed to revoke invitation' });
+    }
+  });
+
+  // POST /orgs/:orgId/invitations/:id/resend — resend (admin+)
+  router.post('/:orgId/invitations/:id/resend', authMiddleware, requireRole('admin'), async (req, res) => {
+    if (!featureCheck(res)) return;
+    const { orgId, userId } = req as AuthenticatedRequest;
+    const invitationId = parseInt(req.params.id, 10);
+    if (isNaN(invitationId)) {
+      res.status(400).json({ error: 'Invalid invitation ID' });
+      return;
+    }
+    try {
+      await resendInvitation(pool, adapter, { invitationId, baseUrl });
+
+      if (flags.enableAuditLog) {
+        await writeAuditEvent({
+          pool,
+          orgId,
+          actorUserId: userId,
+          action: 'org.invitation_resent',
+          targetType: 'invitation',
+          targetId: invitationId,
+          ip: getClientIp(req),
+          userAgent: req.headers['user-agent'] ?? null,
+        });
+      }
+
+      res.json({ message: 'Invitation resent' });
+    } catch (e) {
+      adapter.logger.error('[invitations] POST resend', { error: (e as Error).message });
+      res.status(500).json({ error: 'Failed to resend invitation' });
+    }
+  });
+
+  // GET /orgs/:orgId/invitations/:id/code — get decrypted code (admin+, phone fallback)
+  router.get('/:orgId/invitations/:id/code', authMiddleware, requireRole('admin'), async (req, res) => {
+    if (!featureCheck(res)) return;
+    const invitationId = parseInt(req.params.id, 10);
+    if (isNaN(invitationId)) {
+      res.status(400).json({ error: 'Invalid invitation ID' });
+      return;
+    }
+    try {
+      const result = await getInvitationWithDecryptedCode(pool, invitationId);
+      res.json({ code: result.code, expiresAt: result.expires_at });
+    } catch (e) {
+      adapter.logger.error('[invitations] GET code', { error: (e as Error).message });
+      res.status(500).json({ error: 'Failed to retrieve invitation code' });
+    }
+  });
+
+  // POST /invitations/accept/token — public, token in body
+  router.post('/accept/token', async (req, res) => {
+    if (!featureCheck(res)) return;
+    const { token } = req.body as { token?: string };
+    if (!token) {
+      res.status(400).json({ error: 'token is required' });
+      return;
+    }
+    try {
+      const userId = await adapter.getCurrentUserId(req as import('express').Request);
+      const result = await acceptInvitationByToken(pool, adapter, { token, acceptingUserId: userId ?? undefined });
+
+      if (flags.enableAuditLog) {
+        await writeAuditEvent({
+          pool,
+          orgId: result.orgId,
+          actorUserId: userId ?? null,
+          action: 'member.invite_accepted',
+          targetType: 'org',
+          targetId: result.orgId,
+          after: { role: result.role },
+          ip: getClientIp(req),
+          userAgent: req.headers['user-agent'] ?? null,
+        });
+      }
+
+      res.json({ message: 'Invitation accepted', orgId: result.orgId, role: result.role });
+    } catch (e) {
+      const msg = (e as Error).message;
+      adapter.logger.error('[invitations] POST accept/token', { error: msg });
+      if (msg.includes('not found') || msg.includes('expired') || msg.includes('used')) {
+        res.status(404).json({ error: msg });
+      } else {
+        res.status(500).json({ error: 'Failed to accept invitation' });
+      }
+    }
+  });
+
+  // POST /invitations/accept/code — public, code in body
+  router.post('/accept/code', async (req, res) => {
+    if (!featureCheck(res)) return;
+    const { email, code } = req.body as { email?: string; code?: string };
+    if (!email || !code) {
+      res.status(400).json({ error: 'email and code are required' });
+      return;
+    }
+    try {
+      const userId = await adapter.getCurrentUserId(req as import('express').Request);
+      const result = await acceptInvitationByCode(pool, adapter, { email, code, acceptingUserId: userId ?? undefined });
+
+      if (flags.enableAuditLog) {
+        await writeAuditEvent({
+          pool,
+          orgId: result.orgId,
+          actorUserId: userId ?? null,
+          action: 'member.invite_accepted',
+          targetType: 'org',
+          targetId: result.orgId,
+          after: { role: result.role },
+          ip: getClientIp(req),
+          userAgent: req.headers['user-agent'] ?? null,
+        });
+      }
+
+      res.json({ message: 'Invitation accepted', orgId: result.orgId, role: result.role });
+    } catch (e) {
+      const msg = (e as Error).message;
+      adapter.logger.error('[invitations] POST accept/code', { error: msg });
+      if (msg.includes('not found') || msg.includes('Invalid') || msg.includes('No valid')) {
+        res.status(404).json({ error: msg });
+      } else {
+        res.status(500).json({ error: 'Failed to accept invitation' });
+      }
+    }
+  });
+
+  return router;
+}