feat(org): platform invites, roles, org sharing (v2 phase A1-1)

- New platform_invites table (migration a1b2c3d4e5f1) + PlatformInviteRow - Owner-only endpoints in admin_users.py: issue/list/revoke platform invites - invites.py: two-kind resolution (org + platform), email-supplied accept path - auth.py /me gains needs_onboarding (manager, 0 orgs, not owner) - organizations.py: transfer-ownership, leave (last owner guard), list/revoke org invites - contracts + web UI: admin/users invite modal, accept-invite platform variant, onboarding gating - Tests: test_org_platform_invites.py (18), org-sharing.test.tsx; report under docs/plan/reports Note: (app)/settings "اشتراک‌گذاری سازمان" section (1.10) remains presentational work; endpoints are done and tested.
2026-10-14 09:14:09 +03:30
parent 3c8296e354
commit 5095a29df9
20 changed files with 1933 additions and 37 deletions
@@ -0,0 +1,62 @@
+"""org platform: platform invites (the door into the product)
+
+Revision ID: a1b2c3d4e5f1
+Revises: a3b4c5d6e7f4
+Create Date: 2026-10-14 02:20:00.000000
+
+Agent 1's own migration. Chained after the delivery workstream's head so the
+history stays linear.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "a1b2c3d4e5f1"
+down_revision: str | None = "a3b4c5d6e7f4"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "platform_invites",
+        sa.Column("id", sa.String(length=32), primary_key=True),
+        sa.Column("token_hash", sa.String(length=64), nullable=False),
+        sa.Column("email", sa.String(length=320), nullable=True),
+        sa.Column("platform_role", sa.String(length=16), nullable=False, server_default="manager"),
+        sa.Column(
+            "created_by_user_id",
+            sa.String(length=32),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("used_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column(
+            "used_by_user_id",
+            sa.String(length=32),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column(
+            "revoked_by_user_id",
+            sa.String(length=32),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("note", sa.Text(), nullable=False, server_default=""),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+    )
+    op.create_index("ix_platform_invite_token", "platform_invites", ["token_hash"], unique=True)
+    op.create_index("ix_platform_invite_email", "platform_invites", ["email"])
+    op.create_index("ix_platform_invites_created_by_user_id", "platform_invites", ["created_by_user_id"])
+    op.create_index("ix_platform_invites_used_by_user_id", "platform_invites", ["used_by_user_id"])
+
+
+def downgrade() -> None:
+    op.drop_table("platform_invites")