tapimo 0.5.2 → 0.6.0

package/src/apps/management/routes/faucet.test.ts

@@ -0,0 +1,79 @@
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as TestApp from '../../../../test/App.js'
+import * as Faucet from './faucet.js'
+import * as Orgs from './orgs.js'
+
+const origin = 'http://localhost'
+
+function createApp() {
+  return TestApp.create({
+    rateLimit: { now: () => new Date('2026-01-01T00:00:00.000Z') },
+    session: { wallet: { origin } },
+  })
+}
+
+async function session(app: TestApp.signIn.App) {
+  const account = privateKeyToAccount(generatePrivateKey())
+  const { cookie } = await TestApp.signIn(app, account)
+  return cookie!
+}
+
+async function organization(app: ReturnType<typeof createApp>, cookie: string) {
+  const response = await app.request('/v1/orgs', {
+    body: JSON.stringify({ name: 'Acme' }),
+    headers: { 'content-type': 'application/json', cookie },
+    method: 'POST',
+  })
+  return TestApp.json(response, Orgs.schema.Organization)
+}
+
+describe('faucet', () => {
+  test('funds a member account and rate limits repeated funding', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const recipient = privateKeyToAccount(generatePrivateKey()).address
+
+    const funded = await app.request(`/v1/orgs/${org.id}/faucet`, {
+      body: JSON.stringify({ address: recipient }),
+      headers: { 'content-type': 'application/json', cookie },
+      method: 'POST',
+    })
+    expect(funded.status).toBe(200)
+    const result = await TestApp.json(funded, Faucet.schema.FundResponse)
+    expect(result.tokens.length).toBeGreaterThan(0)
+    expect(result.tokens.every((token) => token.symbol.length > 0)).toBe(true)
+    expect(result.tokens.every((token) => BigInt(token.amount) > 0n)).toBe(true)
+    expect(result.transactionHashes).toEqual(result.tokens.map((token) => token.transactionHash))
+
+    const repeated = await app.request(`/v1/orgs/${org.id}/faucet`, {
+      body: JSON.stringify({ address: recipient }),
+      headers: { 'content-type': 'application/json', cookie },
+      method: 'POST',
+    })
+    expect(repeated.status).toBe(429)
+    expect(repeated.headers.get('ratelimit-scope')).toBe('faucet-address')
+  })
+
+  test('requires membership and a valid address', async () => {
+    const app = createApp()
+    const owner = await session(app)
+    const org = await organization(app, owner)
+    const stranger = await session(app)
+
+    const inaccessible = await app.request(`/v1/orgs/${org.id}/faucet`, {
+      body: JSON.stringify({ address: privateKeyToAccount(generatePrivateKey()).address }),
+      headers: { 'content-type': 'application/json', cookie: stranger },
+      method: 'POST',
+    })
+    expect(inaccessible.status).toBe(404)
+
+    const invalid = await app.request(`/v1/orgs/${org.id}/faucet`, {
+      body: JSON.stringify({ address: 'not-an-address' }),
+      headers: { 'content-type': 'application/json', cookie: owner },
+      method: 'POST',
+    })
+    expect(invalid.status).toBe(400)
+  })
+})

package/src/apps/management/routes/faucet.ts

@@ -0,0 +1,185 @@
+import { Hono, type Context } from 'hono'
+import * as z from 'zod/mini'
+
+import * as Auth from '../../../internal/Auth.js'
+import * as OpenApi from '../../../internal/OpenApi.js'
+import * as RateLimit from '../../../internal/RateLimit.js'
+import * as Response from '../../../internal/Response.js'
+import * as Schema from '../../../internal/Schema.js'
+import * as Viem from '../../../internal/Viem.js'
+import type { Environment } from '../App.js'
+
+const addressRateLimit = { perMinute: 1 } satisfies RateLimit.Limit
+const userRateLimit = { perMinute: 3 } satisfies RateLimit.Limit
+
+/** OpenAPI schemas owned by the sandbox faucet. */
+export namespace schema {
+  /** Faucet request body. */
+  export const FundBody = Schema.describe(
+    z.object({ address: Schema.Address }),
+    'A Tempo testnet account to fund.',
+  )
+
+  /** Faucet response. */
+  export const FundResponse = Schema.describe(
+    z.object({
+      tokens: z
+        .array(
+          z.object({
+            address: Schema.TokenAddress.check(
+              z.describe('The test token contract that minted funds.'),
+            ),
+            amount: Schema.DecimalString.check(
+              z.describe('The minted amount in the token’s smallest units.'),
+            ),
+            currency: z.string().check(z.describe('The token’s currency label.')),
+            decimals: z
+              .number()
+              .check(
+                z.int(),
+                z.nonnegative(),
+                z.describe('The number of decimal places the token uses.'),
+              ),
+            name: z.string().check(z.describe('The token’s human-readable name.')),
+            symbol: z.string().check(z.describe('The token’s symbol.')),
+            transactionHash: Schema.Hash.check(
+              z.describe('The transaction that minted this token.'),
+            ),
+          }),
+        )
+        .check(z.describe('The configured test tokens minted to the account.')),
+      transactionHashes: z
+        .array(Schema.Hash)
+        .check(z.describe('Transactions that minted the configured test tokens.')),
+    }),
+    'Test tokens minted while funding the account.',
+  )
+
+  /** Faucet path parameters. */
+  export const Params = Schema.describe(
+    z.object({
+      orgId: z
+        .string()
+        .check(
+          z.describe('The organization id (`org_…`).'),
+          z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+    }),
+    'Path parameters for the organization faucet.',
+  )
+}
+
+const bodyValidation = {
+  code: 'body_invalid',
+  message: 'Enter a valid Tempo address.',
+} as const
+const paramValidation = {
+  code: 'param_invalid',
+  message: 'Check the path parameters and try again.',
+} as const
+
+/** Mounts the session-authenticated Tempo testnet faucet. */
+export function faucet() {
+  return new Hono<Environment>().post(
+    '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/faucet',
+    Auth.policy({ session: true }),
+    Auth.ensureOrg(),
+    OpenApi.validate('param', schema.Params, paramValidation),
+    OpenApi.validate('json', schema.FundBody, bodyValidation),
+    OpenApi.describeRoute({
+      description:
+        'Funds an account with the test tokens configured on Tempo testnet. This operation is available to signed-in organization members and is rate limited.',
+      operationId: 'fundTestnetAccount',
+      responses: OpenApi.responses({
+        errors: {
+          400: {
+            codes: ['api_key_malformed', 'body_invalid', 'param_invalid'],
+            description: 'The path or account address is invalid.',
+          },
+          404: 'No accessible organization was found.',
+        },
+        success: {
+          description: 'The account was funded.',
+          schema: schema.FundResponse,
+        },
+      }),
+      summary: 'Fund testnet account',
+      tags: ['Faucet'],
+    }),
+    async (c) => {
+      if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+      if (Auth.narrowScope) return Auth.ensureOrgError(c)
+      if (OpenApi.narrowValidation) return OpenApi.validationError(c, paramValidation)
+      if (OpenApi.narrowValidation) return OpenApi.validationError(c, bodyValidation)
+
+      const { address } = c.req.valid('json')
+      const limited = await consumeRateLimit(c, address)
+      if (limited) return rateLimitError(c, limited)
+
+      try {
+        const client = c.get('getClient')(Viem.chainId.testnet)
+        const receipts = await client.faucet.fundSync({ account: address, timeout: 30_000 })
+        const tokens = await Promise.all(
+          receipts.map(async (receipt) => {
+            const event = client.token.mint.extractEvent(receipt.logs)
+            const metadata = await client.token.getMetadata({ token: event.address })
+            return {
+              address: event.address,
+              amount: event.args.amount.toString(),
+              currency: metadata.currency,
+              decimals: metadata.decimals,
+              name: metadata.name,
+              symbol: metadata.symbol,
+              transactionHash: receipt.transactionHash,
+            }
+          }),
+        )
+        const transactionHashes = tokens.map((token) => token.transactionHash)
+        return c.json(Response.validated(schema.FundResponse, { tokens, transactionHashes }), 200)
+      } catch (cause) {
+        return Response.upstream(c, cause)
+      }
+    },
+  )
+}
+
+async function consumeRateLimit(c: Context<Environment>, address: string) {
+  const principal = Auth.getPrincipal(c)
+  const store = c.get('auth').rateLimit
+  if (!principal || !store) return undefined
+
+  const user = await store.consume({
+    key: `faucet:user:${principal.id}`,
+    limit: userRateLimit,
+  })
+  if (!user.allowed) return { result: user, scope: 'faucet-user' }
+
+  const account = await store.consume({
+    key: `faucet:address:${address}`,
+    limit: addressRateLimit,
+  })
+  if (!account.allowed) return { result: account, scope: 'faucet-address' }
+  return undefined
+}
+
+function rateLimitError(
+  c: Context<Environment>,
+  limited: {
+    /** Denied quota result. */
+    result: RateLimit.Result
+    /** Quota dimension that denied the request. */
+    scope: string
+  },
+) {
+  const { result, scope } = limited
+  c.header('RateLimit-Limit', String(result.limit))
+  c.header('RateLimit-Remaining', String(result.remaining))
+  c.header('RateLimit-Reset', String(result.reset))
+  c.header('RateLimit-Scope', scope)
+  c.header('Retry-After', String(Math.max(result.reset - Math.ceil(Date.now() / 1_000), 1)))
+  return Response.error(c, {
+    code: 'rate_limit_exceeded',
+    message: 'This account was funded recently. Try again after the cooldown.',
+    status: 429,
+  })
+}

package/src/apps/management/routes/invitations.test.ts

@@ -2,6 +2,7 @@ import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as App from '../App.js'
 import * as TestApp from '../../../../test/App.js'
+import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
 import * as Invitations from '../../../db/tables/invitations.js'
 import * as InvitationsApp from './invitations.js'
 import * as Memberships from '../../../db/tables/memberships.js'
@@ -50,6 +51,7 @@ function createApp(
     db?: ReturnType<typeof TestApp.database>
     email?: App.Email
     kv?: { store: ReturnType<typeof TestApp.kvStore> }
+    tmp_earlyAccess?: boolean
   } = {},
 ) {
   return TestApp.create({
@@ -58,6 +60,7 @@ function createApp(
     ...(options.email ? { email: options.email } : {}),
     ...(options.kv ? { kv: options.kv } : {}),
     session: { wallet: { origin } },
+    ...(options.tmp_earlyAccess === undefined ? {} : { tmp_earlyAccess: options.tmp_earlyAccess }),
   })
 }
 
@@ -346,6 +349,7 @@ describe('invitations', () => {
     const expired = await Invitations.create(db, {
       email: 'dev@example.com',
       expiresAt: '2020-01-01T00:00:00.000Z',
+      grantsEarlyAccess: false,
       invitedBy: owner.userId,
       orgId: org.id,
       role: 'member',
@@ -508,3 +512,171 @@ describe('invitations', () => {
     )
   })
 })
+
+describe('early access stamping', () => {
+  test('does not persist a dormant gate bypass', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const owner = await session(app)
+    await Users.setEmail(db, owner.userId, 'owner@example.net')
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+
+    const invited = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'owner@example.net', role: 'member' }),
+    )
+    const invitation = await TestApp.json(invited, InvitationsApp.schema.Invitation)
+
+    expect((await Invitations.get(db, invitation.id))?.grantsEarlyAccess).toBe(false)
+  })
+
+  test('stamps grants_early_access from the session inviter', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db, tmp_earlyAccess: true })
+    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
+
+    // A non-early-access inviter stamps no grant.
+    const plain = await session(app)
+    const createdPlain = await app.request('/v1/orgs', json('POST', plain.cookie, { name: 'Plain' })) // prettier-ignore
+    const orgPlain = await TestApp.json(createdPlain, Orgs.schema.Organization)
+    const invitedPlain = await app.request(
+      `/v1/orgs/${orgPlain.id}/invitations`,
+      json('POST', plain.cookie, { email: 'a@example.net', role: 'member' }),
+    )
+    const invitationPlain = await TestApp.json(invitedPlain, InvitationsApp.schema.Invitation)
+    expect((await Invitations.get(db, invitationPlain.id))?.grantsEarlyAccess).toBe(false)
+
+    // An early-access inviter stamps the grant.
+    const granted = await session(app)
+    await Users.setEmail(db, granted.userId, 'owner@example.org')
+    const createdGranted = await app.request('/v1/orgs', json('POST', granted.cookie, { name: 'Granted' })) // prettier-ignore
+    const orgGranted = await TestApp.json(createdGranted, Orgs.schema.Organization)
+    const invitedGranted = await app.request(
+      `/v1/orgs/${orgGranted.id}/invitations`,
+      json('POST', granted.cookie, { email: 'b@example.net', role: 'member' }),
+    )
+    const invitationGranted = await TestApp.json(invitedGranted, InvitationsApp.schema.Invitation)
+    expect((await Invitations.get(db, invitationGranted.id))?.grantsEarlyAccess).toBe(true)
+  })
+
+  test('stamps grants_early_access true for API-key and super-admin inviters', async () => {
+    const db = TestApp.database()
+    await Organizations.create(db, { id: management.orgId, name: 'Acme' })
+    const app = createApp({
+      db,
+      tmp_earlyAccess: true,
+      kv: { store: TestApp.kvStore({ keys: [management] }) },
+    })
+
+    const viaKey = await app.request(`/v1/orgs/${management.orgId}/invitations`, {
+      body: JSON.stringify({ email: 'key@example.net', role: 'member' }),
+      headers: { 'content-type': 'application/json', 'tempo-api-key': management.token },
+      method: 'POST',
+    })
+    expect(viaKey.status).toBe(200)
+    const keyInvitation = await TestApp.json(viaKey, InvitationsApp.schema.Invitation)
+    expect((await Invitations.get(db, keyInvitation.id))?.grantsEarlyAccess).toBe(true)
+
+    const created = await app.request('/v1/orgs', {
+      body: JSON.stringify({ name: 'Provisioned' }),
+      headers: { 'content-type': 'application/json', 'tempo-api-key': secret },
+      method: 'POST',
+    })
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const viaAdmin = await app.request(`/v1/orgs/${org.id}/invitations`, {
+      body: JSON.stringify({ email: 'admin@example.net', role: 'owner' }),
+      headers: { 'content-type': 'application/json', 'tempo-api-key': secret },
+      method: 'POST',
+    })
+    expect(viaAdmin.status).toBe(200)
+    const adminInvitation = await TestApp.json(viaAdmin, InvitationsApp.schema.Invitation)
+    expect((await Invitations.get(db, adminInvitation.id))?.grantsEarlyAccess).toBe(true)
+  })
+
+  test('re-invites upgrade the grant and never downgrade it', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db, tmp_earlyAccess: true })
+    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const admin = await session(app)
+    await Users.setEmail(db, admin.userId, 'admin@example.org')
+    await Memberships.create(db, { orgId: org.id, role: 'admin', userId: admin.userId })
+
+    const first = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'x@example.net', role: 'member' }),
+    )
+    const firstInvite = await TestApp.json(first, InvitationsApp.schema.Invitation)
+    expect((await Invitations.get(db, firstInvite.id))?.grantsEarlyAccess).toBe(false)
+
+    // An early-access re-invite upgrades the same pending row.
+    const second = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', admin.cookie, { email: 'x@example.net', role: 'member' }),
+    )
+    const secondInvite = await TestApp.json(second, InvitationsApp.schema.Invitation)
+    expect(secondInvite.id).toBe(firstInvite.id)
+    expect((await Invitations.get(db, firstInvite.id))?.grantsEarlyAccess).toBe(true)
+
+    // A later non-early-access re-invite never withdraws the grant.
+    const third = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'x@example.net', role: 'member' }),
+    )
+    expect(third.status).toBe(200)
+    expect((await Invitations.get(db, firstInvite.id))?.grantsEarlyAccess).toBe(true)
+  })
+
+  test('hasEarlyAccessGrant survives acceptance and expiry, dies on revoke', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db, tmp_earlyAccess: true })
+    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
+    const owner = await session(app)
+    await Users.setEmail(db, owner.userId, 'owner@example.org')
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+
+    // Acceptance settles the invitation but keeps the grant.
+    const invited = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'z@example.net', role: 'member' }),
+    )
+    const invitation = await TestApp.json(invited, InvitationsApp.schema.Invitation)
+    const invitee = await session(app)
+    await Users.setEmail(db, invitee.userId, 'z@example.net')
+    const accepted = await app.request(`/v1/invitations/${invitation.id}/accept`, {
+      headers: { cookie: invitee.cookie },
+      method: 'POST',
+    })
+    expect(accepted.status).toBe(200)
+    expect(await Invitations.hasEarlyAccessGrant(db, 'z@example.net')).toBe(true)
+
+    // Expiry is ignored by the grant lookup.
+    await Invitations.create(db, {
+      email: 'e@example.net',
+      expiresAt: '2020-01-01T00:00:00.000Z',
+      grantsEarlyAccess: true,
+      invitedBy: owner.userId,
+      orgId: org.id,
+      role: 'member',
+    })
+    expect(await Invitations.hasEarlyAccessGrant(db, 'e@example.net')).toBe(true)
+
+    // Revocation withdraws the grant.
+    const pending = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'r@example.net', role: 'member' }),
+    )
+    const pendingInvite = await TestApp.json(pending, InvitationsApp.schema.Invitation)
+    expect(await Invitations.hasEarlyAccessGrant(db, 'r@example.net')).toBe(true)
+    const revoked = await app.request(`/v1/orgs/${org.id}/invitations/${pendingInvite.id}`, {
+      headers: { cookie: owner.cookie },
+      method: 'DELETE',
+    })
+    expect(revoked.status).toBe(200)
+    expect(await Invitations.hasEarlyAccessGrant(db, 'r@example.net')).toBe(false)
+  })
+})

package/src/apps/management/routes/invitations.ts

@@ -261,12 +261,15 @@ export function invitations() {
         const principal = Auth.getPrincipal(c)
         const invitedBy =
           principal?.type === 'api_key' ? principal.id : (caller?.userId ?? 'super_admin')
+        // Elevation transfers only from inviters who themselves have early access.
+        const grantsEarlyAccess = await Auth.tmp_earlyAccessGrant(c)
 
         const db = Db.get(c.get('db'))
         try {
           const record = await Invitations.create(db, {
             email: body.email,
             expiresAt: new Date(Date.now() + ttlDays * 86_400_000).toISOString(),
+            grantsEarlyAccess,
             invitedBy,
             orgId: Auth.org(c).id,
             role: body.role,

package/src/apps/management/routes/invite-links.test.ts

@@ -82,6 +82,7 @@ describe('inviteLinks', () => {
 
     const link = await createLink(context, org.id, admin.cookie, { role: 'member' })
     expect(link).toMatchObject({
+      allowedEmailDomains: null,
       enabled: true,
       lastUsedAt: null,
       maxUses: null,
@@ -143,6 +144,122 @@ describe('inviteLinks', () => {
     expect((await listed.json()).data).toEqual([])
   })
 
+  test('normalizes and validates allowed email domains', async () => {
+    const context = createApp()
+    const { client } = context
+    const { org, owner } = await setup(context)
+    const orgLinks = client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['invite-links']
+
+    const link = await createLink(context, org.id, owner.cookie, {
+      allowedEmailDomains: [' Example.COM ', 'example.com', 'TEMPO.XYZ'],
+      name: 'Restricted',
+    })
+    expect(link.allowedEmailDomains).toEqual(['example.com', 'tempo.xyz'])
+
+    const listed = await orgLinks.$get({ param: { orgId: org.id } }, as(owner.cookie))
+    expect(listed.status).toBe(200)
+    if (listed.status !== 200) throw new Error(`Failed to list invite links: ${listed.status}`)
+    expect((await listed.json()).data[0]?.allowedEmailDomains).toEqual(['example.com', 'tempo.xyz'])
+
+    for (const allowedEmailDomains of [
+      [],
+      ['user@example.com'],
+      ['https://example.com'],
+      ['*.example.com'],
+    ]) {
+      const response = await orgLinks.$post(
+        {
+          json: { allowedEmailDomains },
+          param: { orgId: org.id },
+        },
+        as(owner.cookie),
+      )
+      expect(response.status).toBe(400)
+      if (response.status !== 400)
+        throw new Error(`Expected invalid invite link body, received ${response.status}`)
+      expect((await response.json()).error.code).toBe('body_invalid')
+    }
+  })
+
+  test('restricts new memberships without consuming rejected attempts', async () => {
+    const db = TestApp.database()
+    const context = createApp(db)
+    const { client } = context
+    const { org, owner } = await setup(context)
+    const orgLinks = client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['invite-links']
+    const publicLinks = client.v1['invite-links']
+    const link = await createLink(context, org.id, owner.cookie, {
+      allowedEmailDomains: [' Example.COM '],
+      expiresAt: null,
+      maxUses: 1,
+      name: 'Restricted',
+    })
+
+    const member = await session(context)
+    await Users.setEmail(db, member.userId, 'member@sub.example.com')
+    await Memberships.create(db, { orgId: org.id, role: 'member', userId: member.userId })
+    const memberRetry = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(member.cookie),
+    )
+    expect(memberRetry.status).toBe(200)
+
+    const subdomain = await session(context)
+    await Users.setEmail(db, subdomain.userId, 'dev@sub.example.com')
+    const rejected = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(subdomain.cookie),
+    )
+    expect(rejected.status).toBe(403)
+    if (rejected.status !== 403)
+      throw new Error(`Expected forbidden invite link acceptance, received ${rejected.status}`)
+    expect((await rejected.json()).error.code).toBe('invite_link_email_forbidden')
+    expect(await Memberships.get(db, org.id, subdomain.userId)).toBeUndefined()
+
+    const audits = await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].redemptions.$get(
+      { param: { inviteLinkId: link.id, orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(audits.status).toBe(200)
+    if (audits.status !== 200) throw new Error(`Failed to list redemptions: ${audits.status}`)
+    expect((await audits.json()).data).toEqual([])
+
+    const beforeJoin = await orgLinks.$get({ param: { orgId: org.id } }, as(owner.cookie))
+    expect(beforeJoin.status).toBe(200)
+    if (beforeJoin.status !== 200)
+      throw new Error(`Failed to list invite links: ${beforeJoin.status}`)
+    expect((await beforeJoin.json()).data[0]).toMatchObject({ status: 'active', useCount: 0 })
+
+    const exact = await session(context)
+    await Users.setEmail(db, exact.userId, 'Dev@Example.com')
+    const accepted = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(exact.cookie),
+    )
+    expect(accepted.status).toBe(200)
+
+    const exhaustedRetry = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(member.cookie),
+    )
+    expect(exhaustedRetry.status).toBe(200)
+
+    const afterJoin = await orgLinks.$get({ param: { orgId: org.id } }, as(owner.cookie))
+    expect(afterJoin.status).toBe(200)
+    if (afterJoin.status !== 200)
+      throw new Error(`Failed to list invite links: ${afterJoin.status}`)
+    expect((await afterJoin.json()).data[0]).toMatchObject({ status: 'exhausted', useCount: 1 })
+
+    const auditsAfterJoin = await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].redemptions.$get(
+      { param: { inviteLinkId: link.id, orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(auditsAfterJoin.status).toBe(200)
+    if (auditsAfterJoin.status !== 200)
+      throw new Error(`Failed to list redemptions: ${auditsAfterJoin.status}`)
+    expect((await auditsAfterJoin.json()).data).toHaveLength(1)
+  })
+
   test('resolve reveals only a summary and hides every unavailable reason', async () => {
     const db = TestApp.database()
     const context = createApp(db)