feat: fix sharing

src/app/api/invites/[token]/route.ts

@@ -0,0 +1,67 @@
+
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db/client";
+import { workspaceInvites, workspaces, user } from "@/lib/db/schema";
+import { eq } from "drizzle-orm";
+import { withErrorHandling } from "@/lib/api/workspace-helpers";
+
+async function handleGET(
+    request: NextRequest,
+    { params }: { params: Promise<{ token: string }> }
+) {
+    const { token } = await params;
+
+    if (!token) {
+        return NextResponse.json({ error: "Token is required" }, { status: 400 });
+    }
+
+    // Find the invite
+    const [invite] = await db
+        .select({
+            email: workspaceInvites.email,
+            expiresAt: workspaceInvites.expiresAt,
+            workspaceId: workspaceInvites.workspaceId,
+            inviterId: workspaceInvites.inviterId,
+        })
+        .from(workspaceInvites)
+        .where(eq(workspaceInvites.token, token))
+        .limit(1);
+
+    if (!invite) {
+        return NextResponse.json({ error: "Invite not found" }, { status: 404 });
+    }
+
+    // Check expiration
+    if (new Date(invite.expiresAt) < new Date()) {
+        return NextResponse.json({ error: "Invite expired" }, { status: 410 });
+    }
+
+    // Get workspace details
+    const [workspace] = await db
+        .select({
+            name: workspaces.name,
+        })
+        .from(workspaces)
+        .where(eq(workspaces.id, invite.workspaceId))
+        .limit(1);
+
+    // Get inviter details
+    const [inviter] = await db
+        .select({
+            name: user.name,
+            email: user.email,
+            image: user.image
+        })
+        .from(user)
+        .where(eq(user.id, invite.inviterId))
+        .limit(1);
+
+    return NextResponse.json({
+        email: invite.email,
+        workspaceName: workspace?.name || "Workspace",
+        inviterName: inviter?.name || inviter?.email || "Someone",
+        inviterImage: inviter?.image
+    });
+}
+
+export const GET = withErrorHandling(handleGET, "GET /api/invites/[token]");

src/app/api/invites/claim/route.ts

@@ -0,0 +1,88 @@
+
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db/client";
+import { workspaceInvites, workspaceCollaborators, workspaces } from "@/lib/db/schema";
+import { eq, and } from "drizzle-orm";
+import { withErrorHandling, requireAuth } from "@/lib/api/workspace-helpers";
+import { auth } from "@/lib/auth"; // Need to get full session to check email
+
+async function handlePOST(request: NextRequest) {
+    // We need the email from the session, simpler requireAuth only returns userId.
+    // So we use auth.api.getSession directly
+    const session = await auth.api.getSession({
+        headers: request.headers,
+    });
+
+    if (!session || !session.user) {
+        return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const { token } = await request.json();
+
+    if (!token) {
+        return NextResponse.json({ error: "Token is required" }, { status: 400 });
+    }
+
+    // Find the invite
+    const [invite] = await db
+        .select()
+        .from(workspaceInvites)
+        .where(eq(workspaceInvites.token, token))
+        .limit(1);
+
+    if (!invite) {
+        return NextResponse.json({ error: "Invite not found" }, { status: 404 });
+    }
+
+    // Check expiration
+    if (new Date(invite.expiresAt) < new Date()) {
+        return NextResponse.json({ error: "Invite expired" }, { status: 410 });
+    }
+
+    // Verify email matches current user
+    if (!session.user.email || invite.email.toLowerCase() !== session.user.email.toLowerCase()) {
+        return NextResponse.json({
+            error: "Email mismatch",
+            message: `This invite is for ${invite.email}, but you are logged in as ${session.user.email}. Please log out and sign up/in with the invited email.`
+        }, { status: 403 });
+    }
+
+    // Check if already a collaborator - if so, just consume the invite
+    const [existing] = await db
+        .select()
+        .from(workspaceCollaborators)
+        .where(and(
+            eq(workspaceCollaborators.workspaceId, invite.workspaceId),
+            eq(workspaceCollaborators.userId, session.user.id)
+        ))
+        .limit(1);
+
+    if (!existing) {
+        // Add to collaborators
+        await db.insert(workspaceCollaborators).values({
+            workspaceId: invite.workspaceId,
+            userId: session.user.id,
+            permissionLevel: invite.permissionLevel,
+        });
+    }
+
+    // Clean up used invite
+    await db
+        .delete(workspaceInvites)
+        .where(eq(workspaceInvites.id, invite.id));
+
+    // Get workspace slug for redirection
+    const [workspace] = await db
+        .select({ slug: workspaces.slug, id: workspaces.id })
+        .from(workspaces)
+        .where(eq(workspaces.id, invite.workspaceId))
+        .limit(1);
+
+    return NextResponse.json({
+        success: true,
+        workspaceId: workspace?.id,
+        workspaceSlug: workspace?.slug
+    });
+}
+
+export const POST = withErrorHandling(handlePOST, "POST /api/invites/claim");

src/app/api/workspaces/[id]/collaborators/route.ts

@@ -14,7 +14,7 @@
 
 import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db/client";
-import { workspaceCollaborators, workspaces, user } from "@/lib/db/schema";
+import { workspaceCollaborators, workspaces, user, workspaceInvites } from "@/lib/db/schema";
 import { eq, and } from "drizzle-orm";
 import {
     verifyWorkspaceAccess,
@@ -69,6 +69,19 @@ async function handleGET(
         .leftJoin(user, eq(workspaceCollaborators.userId, user.id))
         .where(eq(workspaceCollaborators.workspaceId, workspaceId));
 
+    // Get pending invites
+    const invites = await db
+        .select({
+            id: workspaceInvites.id,
+            email: workspaceInvites.email,
+            permissionLevel: workspaceInvites.permissionLevel,
+            createdAt: workspaceInvites.createdAt,
+            expiresAt: workspaceInvites.expiresAt,
+            inviterId: workspaceInvites.inviterId,
+        })
+        .from(workspaceInvites)
+        .where(eq(workspaceInvites.workspaceId, workspaceId));
+
     const ownerAsCollaborator = workspaceOwner ? {
         id: `owner-${workspaceOwner.userId}`,
         userId: workspaceOwner.userId,
@@ -83,7 +96,7 @@ async function handleGET(
         ? [ownerAsCollaborator, ...collaborators]
         : collaborators;
 
-    return NextResponse.json({ collaborators: allCollaborators });
+    return NextResponse.json({ collaborators: allCollaborators, invites });
 }
 
 // POST /api/workspaces/[id]/collaborators
@@ -116,12 +129,8 @@ async function handlePOST(
         .where(eq(user.email, email.trim().toLowerCase()))
         .limit(1);
 
-    if (!invitedUser) {
-        return NextResponse.json(
-            { message: "User not found. They need to sign up first." },
-            { status: 404 }
-        );
-    }
+    // If user not found, we will create a pending invite later in the code
+    // The previous 404 block here was preventing that flow
 
     // Check if already a collaborator
     const [existing] = await db
@@ -130,7 +139,7 @@ async function handlePOST(
         .where(
             and(
                 eq(workspaceCollaborators.workspaceId, workspaceId),
-                eq(workspaceCollaborators.userId, invitedUser.id)
+                eq(workspaceCollaborators.userId, invitedUser?.id || "non-existent") // non-existent won't match
             )
         )
         .limit(1);
@@ -142,15 +151,7 @@ async function handlePOST(
         );
     }
 
-    // Can't invite yourself
-    if (invitedUser.id === currentUser.userId) {
-        return NextResponse.json(
-            { message: "You can't invite yourself" },
-            { status: 400 }
-        );
-    }
-
-    // Get workspace to check if invitee is the owner and get slug for url
+    // Get workspace details for email and token generation
     const [ws] = await db
         .select({
             userId: workspaces.userId,
@@ -161,31 +162,107 @@ async function handlePOST(
         .where(eq(workspaces.id, workspaceId))
         .limit(1);
 
-    if (ws && invitedUser.id === ws.userId) {
-        return NextResponse.json(
-            { message: "Cannot invite workspace owner as collaborator" },
-            { status: 400 }
-        );
+    // If user exists, add as collaborator directly
+    if (invitedUser) {
+        // Can't invite yourself
+        if (invitedUser.id === currentUser.userId) {
+            return NextResponse.json(
+                { message: "You can't invite yourself" },
+                { status: 400 }
+            );
+        }
+
+        if (ws && invitedUser.id === ws.userId) {
+            return NextResponse.json(
+                { message: "Cannot invite workspace owner as collaborator" },
+                { status: 400 }
+            );
+        }
+
+        // Add collaborator
+        const [newCollaborator] = await db
+            .insert(workspaceCollaborators)
+            .values({
+                workspaceId,
+                userId: invitedUser.id,
+                permissionLevel: permissionLevel === "viewer" ? "viewer" : "editor",
+            })
+            .returning();
+
+        // Send standard invitation email
+        try {
+            // Use slug if available, otherwise fallback to id
+            const identifier = ws.slug || workspaceId;
+            const workspaceUrl = `https://thinkex.app/workspace/${identifier}`;
+            const { data, error } = await resend.emails.send({
+                from: 'ThinkEx <hello@thinkex.app>',
+                to: [email],
+                subject: `You've been invited to collaborate on ${ws.name || 'a workspace'}`,
+                react: InviteEmailTemplate({
+                    inviterName: currentUser.name || 'A user',
+                    workspaceName: ws.name || 'Workspace',
+                    workspaceUrl,
+                }),
+            });
+            if (error) console.error("Failed to send invitation email:", error);
+        } catch (emailError) {
+            console.error("Error sending invitation email:", emailError);
+        }
+
+        return NextResponse.json({ collaborator: newCollaborator }, { status: 201 });
     }
 
-    // Add collaborator
-    const [newCollaborator] = await db
-        .insert(workspaceCollaborators)
-        .values({
-            workspaceId,
-            userId: invitedUser.id,
-            permissionLevel: permissionLevel === "viewer" ? "viewer" : "editor",
-        })
-        .returning();
+    // User does NOT exist - Create Pending Invite
+
+    // Import nanoid dynamically or use a simple random string generator since nanoid might be ESM only
+    // Simple secure random token generator
+    const generateToken = () => {
+        // Use Web Crypto API which is available in Node.js global scope in newer versions
+        // or fall back to Math.random for older environments if critical
+        if (typeof crypto !== 'undefined') {
+            const array = new Uint8Array(24);
+            crypto.getRandomValues(array);
+            return Array.from(array, (byte) => byte.toString(16).padStart(2, '0')).join('');
+        } else {
+            // Fallback for environments without crypto global
+            return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
+        }
+    };
+
+    const token = generateToken();
+    const expiresAt = new Date();
+    expiresAt.setDate(expiresAt.getDate() + 7); // 7 days expiry
+
+
+    // Implementation for Pending Invite
+    // 1. Delete existing invite to replace it
+    await db
+        .delete(workspaceInvites)
+        .where(
+            and(
+                eq(workspaceInvites.workspaceId, workspaceId),
+                eq(workspaceInvites.email, email.trim().toLowerCase())
+            )
+        );
 
-    // Send invitation email
+    // 2. Create new invite
+    await db.insert(workspaceInvites).values({
+        workspaceId,
+        email: email.trim().toLowerCase(),
+        token,
+        inviterId: currentUser.userId,
+        permissionLevel: permissionLevel === "viewer" ? "viewer" : "editor",
+        expiresAt: expiresAt.toISOString(),
+    });
+
+    // 3. Send Invite Email
     try {
-        const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'https://thinkex.app';
-        // Use slug if available, otherwise fallback to id (though slug should always be present for access)
         const identifier = ws.slug || workspaceId;
-        const workspaceUrl = `https://thinkex.app/workspace/${identifier}`;
-        const { data, error } = await resend.emails.send({
-            from: 'ThinkEx <hello@thinkex.app>', // Update this with your verified domain if available
+        // Append ?invite=token to the URL
+        const workspaceUrl = `https://thinkex.app/workspace/${identifier}?invite=${token}`;
+
+        await resend.emails.send({
+            from: 'ThinkEx <hello@thinkex.app>',
             to: [email],
             subject: `You've been invited to collaborate on ${ws.name || 'a workspace'}`,
             react: InviteEmailTemplate({
@@ -194,15 +271,19 @@ async function handlePOST(
                 workspaceUrl,
             }),
         });
-
-        if (error) {
-            console.error("Failed to send invitation email:", error);
-        }
     } catch (emailError) {
-        console.error("Error sending invitation email:", emailError);
+        console.error("Error sending pending invitation email:", emailError);
+        // We still return success as the invite was created
     }
 
-    return NextResponse.json({ collaborator: newCollaborator }, { status: 201 });
+    return NextResponse.json(
+        {
+            message: "Invitation sent to new user",
+            pending: true,
+            email
+        },
+        { status: 201 }
+    );
 }
 
 export const GET = withErrorHandling(handleGET, "GET /api/workspaces/[id]/collaborators");