Show invited people the Rule, let them copy its cards for their community, and replace an expired invitation link.

app/api/invites/rule-stakeholder/resend/route.ts

@@ -0,0 +1,138 @@
+import { NextRequest, NextResponse } from "next/server";
+import { prisma } from "../../../../../lib/server/db";
+import {
+  getSessionPepper,
+  isDatabaseConfigured,
+} from "../../../../../lib/server/env";
+import { hashSessionToken, newSessionToken } from "../../../../../lib/server/hash";
+import { sendRuleStakeholderInviteEmail } from "../../../../../lib/server/mail";
+import { apiRoute } from "../../../../../lib/server/apiRoute";
+import { logRouteError } from "../../../../../lib/server/requestId";
+import { stakeholderInviteVerifyUrl } from "../../../../../lib/server/ruleStakeholderInviteOps";
+import { STAKEHOLDER_INVITE_TTL_MS } from "../../../../../lib/server/ruleStakeholders";
+import {
+  dbUnavailable,
+  errorJson,
+  rateLimited,
+  serverMisconfigured,
+} from "../../../../../lib/server/responses";
+import { rateLimitKey } from "../../../../../lib/server/rateLimit";
+import { getPublicOrigin } from "../../../../../lib/server/publicOrigin";
+import { readLimitedJson } from "../../../../../lib/server/validation/requestBody";
+import { jsonFromZodError } from "../../../../../lib/server/validation/zodHttp";
+import { resendExpiredStakeholderInviteBodySchema } from "../../../../../lib/server/validation/createFlowSchemas";
+
+function clientIp(request: NextRequest): string {
+  return (
+    request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
+    request.headers.get("x-real-ip") ??
+    "unknown"
+  );
+}
+
+export const POST = apiRoute(
+  "invites.ruleStakeholder.resendExpired",
+  async (request: NextRequest, _ctx, { requestId }) => {
+    if (!isDatabaseConfigured()) {
+      return dbUnavailable();
+    }
+
+    const body = await readLimitedJson(request);
+    if (body.ok === false) return body.response;
+    const parsed = resendExpiredStakeholderInviteBodySchema.safeParse(body.value);
+    if (!parsed.success) return jsonFromZodError(parsed.error);
+
+    const { token, email } = parsed.data;
+    const rl = rateLimitKey(
+      `invite-resend-expired:${clientIp(request)}:${email}`,
+      60_000,
+    );
+    if (rl.ok === false) {
+      return rateLimited(rl.retryAfterMs);
+    }
+
+    let pepper: string;
+    try {
+      pepper = getSessionPepper();
+    } catch (err) {
+      logRouteError("invites.ruleStakeholder.resendExpired", requestId, err, {
+        phase: "getSessionPepper",
+      });
+      return serverMisconfigured();
+    }
+
+    const tokenHash = hashSessionToken(token, pepper);
+    const row = await prisma.ruleStakeholder.findUnique({
+      where: { inviteTokenHash: tokenHash },
+      select: {
+        id: true,
+        email: true,
+        inviteTokenHash: true,
+        inviteExpiresAt: true,
+        invitedBy: { select: { email: true } },
+        rule: {
+          select: {
+            title: true,
+            summary: true,
+            document: true,
+            user: { select: { email: true } },
+          },
+        },
+      },
+    });
+
+    if (!row || row.email !== email) {
+      return NextResponse.json({ ok: true });
+    }
+
+    const prevHash = row.inviteTokenHash;
+    const prevExp = row.inviteExpiresAt;
+    const nextToken = newSessionToken();
+    const newHash = hashSessionToken(nextToken, pepper);
+    const newExp = new Date(Date.now() + STAKEHOLDER_INVITE_TTL_MS);
+
+    await prisma.ruleStakeholder.update({
+      where: { id: row.id },
+      data: {
+        inviteTokenHash: newHash,
+        inviteExpiresAt: newExp,
+      },
+    });
+
+    const origin = getPublicOrigin(request);
+    const verifyUrl = stakeholderInviteVerifyUrl(origin, nextToken);
+    const inviterEmail =
+      row.invitedBy?.email ?? row.rule.user?.email ?? "CommunityRule";
+    try {
+      await sendRuleStakeholderInviteEmail({
+        to: row.email,
+        verifyUrl,
+        origin,
+        communityName: row.rule.title,
+        inviterEmail,
+        summary: row.rule.summary,
+        document: row.rule.document,
+      });
+    } catch (err) {
+      logRouteError("invites.ruleStakeholder.resendExpired", requestId, err, {
+        phase: "sendRuleStakeholderInviteEmail",
+      });
+      await prisma.ruleStakeholder
+        .update({
+          where: { id: row.id },
+          data: {
+            inviteTokenHash: prevHash,
+            inviteExpiresAt: prevExp,
+          },
+        })
+        .catch(() => {});
+      return errorJson(
+        "mail_failed",
+        "Could not resend stakeholder invite",
+        502,
+      );
+    }
+
+    return NextResponse.json({ ok: true });
+  },
+);

app/api/invites/rule-stakeholder/verify/route.ts

@@ -17,6 +17,12 @@ import {
   setSessionCookie,
 } from "../../../../../lib/server/session";
 import { getPublicOrigin } from "../../../../../lib/server/publicOrigin";
+import {
+  INVITE_COPY_QUERY,
+  INVITE_COPY_VALUE,
+  inviteExpiredPath,
+  invitedRulePath,
+} from "../../../../../lib/create/invitePaths";
 
 const SCOPE = "invites.ruleStakeholder.verify";
 
@@ -66,7 +72,7 @@ export async function GET(request: NextRequest) {
     ) {
       return redirectWithRequestId(
         request,
-        "/login?error=expired_link",
+        inviteExpiredPath(token),
         requestId,
       );
     }
@@ -104,7 +110,9 @@ export async function GET(request: NextRequest) {
     );
     await setSessionCookie(sessionToken, expiresAt);
 
-    const dest = `/rules/${encodeURIComponent(row.ruleId)}`;
+    const copy =
+      request.nextUrl.searchParams.get(INVITE_COPY_QUERY) === INVITE_COPY_VALUE;
+    const dest = invitedRulePath(row.ruleId, { copy });
     return redirectWithRequestId(request, dest, requestId);
   } catch (err) {
     logRouteError(SCOPE, requestId, err);

app/api/rules/[id]/make-copy/route.ts

@@ -0,0 +1,105 @@
+import { NextResponse } from "next/server";
+import { Prisma } from "@prisma/client";
+import { prisma } from "../../../../../lib/server/db";
+import { isDatabaseConfigured } from "../../../../../lib/server/env";
+import {
+  dbUnavailable,
+  forbidden,
+  notFound,
+  rateLimited,
+  unauthorized,
+} from "../../../../../lib/server/responses";
+import { getSessionUser } from "../../../../../lib/server/session";
+import { apiRoute } from "../../../../../lib/server/apiRoute";
+import { rateLimitKey } from "../../../../../lib/server/rateLimit";
+import { readLimitedJson } from "../../../../../lib/server/validation/requestBody";
+import { jsonFromZodError } from "../../../../../lib/server/validation/zodHttp";
+import {
+  makeCopyRuleBodySchema,
+  publishedRuleDocumentSchema,
+} from "../../../../../lib/server/validation/createFlowSchemas";
+import {
+  findCopiedNameHit,
+  stripCopiedRuleDocument,
+} from "../../../../../lib/create/copiedRuleDocument";
+
+type RouteContext = { params: Promise<{ id: string }> };
+
+export const POST = apiRoute<RouteContext>(
+  "rules.byId.makeCopy",
+  async (request, context) => {
+    if (!isDatabaseConfigured()) {
+      return dbUnavailable();
+    }
+
+    const user = await getSessionUser();
+    if (!user) {
+      return unauthorized();
+    }
+
+    const { id } = await context.params;
+    const body = await readLimitedJson(request);
+    if (body.ok === false) return body.response;
+    const parsed = makeCopyRuleBodySchema.safeParse(body.value);
+    if (!parsed.success) return jsonFromZodError(parsed.error);
+
+    const rl = rateLimitKey(`rule-make-copy:${user.id}:${id}`, 60_000);
+    if (rl.ok === false) {
+      return rateLimited(rl.retryAfterMs);
+    }
+
+    const stakeholder = await prisma.ruleStakeholder.findFirst({
+      where: { ruleId: id, userId: user.id },
+      select: {
+        id: true,
+        rule: {
+          select: {
+            id: true,
+            title: true,
+            document: true,
+            userId: true,
+          },
+        },
+      },
+    });
+    if (!stakeholder) {
+      return notFound();
+    }
+    if (stakeholder.rule.userId === user.id) {
+      return forbidden();
+    }
+
+    const stripped = stripCopiedRuleDocument(stakeholder.rule.document);
+    const documentParsed = publishedRuleDocumentSchema.safeParse(stripped);
+    if (!documentParsed.success) {
+      return jsonFromZodError(documentParsed.error);
+    }
+
+    const copiedNameHit = findCopiedNameHit(
+      documentParsed.data,
+      stakeholder.rule.title,
+    );
+
+    const newRule = await prisma.publishedRule.create({
+      data: {
+        userId: user.id,
+        title: parsed.data.title,
+        summary: null,
+        document: documentParsed.data as Prisma.InputJsonValue,
+      },
+    });
+
+    return NextResponse.json({
+      rule: {
+        id: newRule.id,
+        title: newRule.title,
+        summary: newRule.summary,
+        document: documentParsed.data,
+        copiedFromTitle: stakeholder.rule.title,
+        copiedNameHit,
+        createdAt: newRule.createdAt,
+        updatedAt: newRule.updatedAt,
+      },
+    });
+  },
+);