A newly-invited byrå admin/member who signed up with email+password landed
on /onboarding instead of the cockpit. Root cause: team-invite acceptance
lived only in POST /api/team/accept, which the email-confirmation signup flow
never reaches before the dashboard (no session for the register page's
client-side accept), while the auth callback and the onboarding/select-company
recovery only understood company_invitations. So the invitee's byrå membership
did not exist when landing resolved, and they were funneled into creating a
company.
- New shared helper acceptPendingTeamInviteByToken (lib/company/pending-invites)
is the single server-side implementation of team-invite acceptance.
- POST /api/team/accept delegates to it; HTTP contract unchanged.
- /auth/callback accepts a team invite BEFORE the silent-team check and before
resolveLandingDestination runs, so an owner/admin resolves to /clients; the
invite cookie is cleared on success, kept otherwise for the retry.
- acceptPendingInviteByToken (onboarding/select-company recovery) tries the
company path, then falls back to the team helper.
- hasPendingInviteForEmail checks both invite tables, so a tokenless byrå
invitee is not misread as a first-timer.
No migration (team invite tables already exist). Company-invite and
non-invite flows are untouched.
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Mattsson
52e99295de