Invitation flow validates tenant membership

Invitation flows are a privileged code path: they grant access to a tenant's data before the invitee is a verified member. CWE-330 (Insufficient Randomness) allows token prediction; CWE-613 (Insufficient Session Expiration) keeps compromised tokens valid indefinitely; CWE-285 allows a token issued by Org A to be accepted against Org B. OWASP A07 (Identification & Authentication Failures) covers all three. The real-world consequence is that an attacker who intercepts or guesses an invitation token can join any organization without being explicitly invited.

Use cryptographically random tokens, enforce expiration, and validate the token's organization at acceptance time:

// Generation — in src/lib/invitations.ts
const token = crypto.randomUUID() // or randomBytes(32).toString('hex') — 128+ bits of entropy
await db.invitation.create({
  data: {
    token,
    email: invitedEmail,
    organizationId: currentOrgId,
    expiresAt: new Date(Date.now() + 72 * 60 * 60 * 1000) // 72-hour window
  }
})

// Acceptance — validate all constraints atomically
const invite = await db.invitation.findFirst({
  where: {
    token,
    organizationId: params.orgId,  // must match the org in the URL
    expiresAt: { gt: new Date() }, // must not be expired
    acceptedAt: null               // must be unused
  }
})
if (!invite) return new Response('Invalid or expired invitation', { status: 400 })
if (invite.email.toLowerCase() !== session.user.email.toLowerCase()) {
  return new Response('This invitation is for a different email address', { status: 403 })
}