Switch team invites to email-only flow via identity API.

Replace local member UUID invites with platform email invites, SSO post-auth redirect, and provisioner-backed pending access until accept. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-01 00:25:09 +00:00
parent 6bc52d9ef3
commit b68331cdaf
6 changed files with 216 additions and 23 deletions
@@ -6,6 +6,7 @@ use App\Http\Controllers\Controller;
 use App\Http\Controllers\Frontdesk\Concerns\ScopesToAccount;
 use App\Models\Branch;
 use App\Models\Member;
+use App\Services\Identity\IdentityTeamClient;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\View\View;
@@ -50,30 +51,50 @@ class MemberController extends Controller
        ]);
    }

-    public function store(Request $request): RedirectResponse
+    public function store(Request $request, IdentityTeamClient $identity): RedirectResponse
    {
        $this->authorizeAbility($request, 'admin.members.manage');
        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);

        $validated = $request->validate([
-            'user_ref' => ['required', 'string', 'max:255'],
+            'email' => ['required', 'email', 'max:255'],
            'role' => ['required', 'string', 'in:'.implode(',', array_keys(config('frontdesk.roles')))],
            'branch_id' => ['nullable', 'integer', 'exists:frontdesk_branches,id'],
        ]);

+        $email = strtolower(trim($validated['email']));
+
+        if ($email === strtolower((string) $request->user()->email)) {
+            return back()->withErrors(['email' => 'You cannot invite yourself.']);
+        }
+
+        $identity->inviteAppMember(
+            $owner,
+            $email,
+            ['frontdesk'],
+            [
+                'frontdesk' => [
+                    'organization_id' => $organization->id,
+                    'role' => $validated['role'],
+                    'branch_id' => $validated['branch_id'] ?? null,
+                ],
+            ],
+        );
+
        Member::updateOrCreate(
            [
                'organization_id' => $organization->id,
-                'user_ref' => $validated['user_ref'],
+                'user_ref' => $email,
            ],
            [
-                'owner_ref' => $this->ownerRef($request),
+                'owner_ref' => $owner,
                'role' => $validated['role'],
                'branch_id' => $validated['branch_id'] ?? null,
            ],
        );

-        return redirect()->route('frontdesk.members.index')->with('success', 'Member saved.');
+        return redirect()->route('frontdesk.members.index')->with('success', 'Invitation sent to '.$email.'.');
    }

    public function destroy(Request $request, Member $member): RedirectResponse