Team Management (invite, accept, role change)

Admins invite members, invitees accept and link Firebase, and roles or membership can be updated.

Sequence

sequenceDiagram
  autonumber
  participant Admin as Admin
  participant API as Hono API
  participant Team as team.service
  participant UserRepo as user.repo
  participant FB as Firebase Admin
  participant Invitee as Invitee
  participant Mongo as MongoDB

  Admin->>API: POST /v1/team/invite
  Team->>UserRepo: createUser INVITED + inviteTokenHash
  Team-->>Admin: inviteLink (logged)

  Invitee->>API: GET /v1/team/invite/:token
  Team->>Mongo: validate invite

  Invitee->>API: POST /v1/team/invite/:token/accept
  Team->>FB: createEmailUser
  Team->>FB: setCustomClaims
  Team->>UserRepo: activateInvitedUser ACTIVE
  Team-->>Invitee: user, org, custom token

  Admin->>API: PATCH /v1/team/:userId/role
  Team->>UserRepo: updateUserRole
  Team->>FB: setCustomClaims

Steps

1. Admin invites by email; invited user row is created with hashed token and expiry.
2. Invitee views invite details from the public link.
3. Accept creates or links Firebase, sets claims, and activates the user.
4. Admin can change roles (with last-admin guard) and deactivate or reactivate members.
5. Resend or revoke invite applies while the user is still invited.