Switch team invites to email-only flow via identity API.

Replace local member UUID invites with platform email invites, SSO post-auth redirect, and provisioner-backed pending access until accept. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-01 00:25:09 +00:00
parent 6bc52d9ef3
commit b68331cdaf
6 changed files with 216 additions and 23 deletions
@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Services\Frontdesk;
+
+use App\Models\Member;
+use App\Models\User;
+use App\Services\Identity\IdentityTeamClient;
+
+class TeamMemberProvisioner
+{
+    public function __construct(
+        protected IdentityTeamClient $identity,
+    ) {}
+
+    public function sync(User $user): void
+    {
+        Member::query()
+            ->where('user_ref', strtolower((string) $user->email))
+            ->update(['user_ref' => $user->ownerRef()]);
+
+        try {
+            $access = $this->identity->teamAccess($user->ownerRef());
+        } catch (\Throwable) {
+            return;
+        }
+
+        foreach ($access as $grant) {
+            if (($grant['self'] ?? false) || ($grant['full_access'] ?? false)) {
+                continue;
+            }
+
+            $apps = (array) ($grant['apps'] ?? []);
+            if (! in_array('frontdesk', $apps, true)) {
+                continue;
+            }
+
+            $meta = (array) data_get($grant, 'metadata.frontdesk', []);
+            $organizationId = (int) ($meta['organization_id'] ?? 0);
+            if ($organizationId <= 0) {
+                continue;
+            }
+
+            Member::updateOrCreate(
+                [
+                    'organization_id' => $organizationId,
+                    'user_ref' => $user->ownerRef(),
+                ],
+                [
+                    'owner_ref' => (string) ($grant['account'] ?? $user->ownerRef()),
+                    'role' => (string) ($meta['role'] ?? 'member'),
+                    'branch_id' => $meta['branch_id'] ?? null,
+                ],
+            );
+        }
+    }
+}