Invitation flow

Admin clicks "Invite member" → modal with email + role
  → POST /api/invitations { email, role }
       → Grit creates an invitation row (UUID token, 7-day expiry)
       → Job worker sends an email with /accept/<token>

Invitee opens link → /accept/abc123
  → /api/invitations/abc123  returns { email, role, tenant_name }
  → Frontend shows "Join Acme as Staff" + password form
  → POST /api/invitations/abc123/accept { password }
       → Grit creates the user (tenant + role from the invitation)
       → Marks invitation as accepted
       → Returns access + refresh tokens — user is signed in

type Invitation struct {
    ID         uuid.UUID  `gorm:"type:uuid;primaryKey" json:"id"`
    Token      string     `gorm:"uniqueIndex;not null" json:"-"`     // never serialise
    Email      string     `gorm:"index;not null" json:"email"`
    Role       string     `gorm:"not null" json:"role"`
    TenantID   uuid.UUID  `gorm:"type:uuid;not null" json:"tenant_id"`
    InvitedBy  uuid.UUID  `gorm:"type:uuid;not null" json:"invited_by"`
    AcceptedAt *time.Time `json:"accepted_at"`
    ExpiresAt  time.Time  `gorm:"index;not null" json:"expires_at"`
    CreatedAt  time.Time  `json:"created_at"`
}

'use client'
import { useState } from 'react'

export function InviteMemberModal({ onClose }) {
  const [email, setEmail] = useState('')
  const [role, setRole] = useState<'user' | 'staff' | 'admin'>('staff')

  async function onSubmit() {
    await fetch('/api/invitations', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email, role }),
    })
    toast.success('Invitation sent')
    onClose()
  }

  return (
    <Dialog open onOpenChange={onClose}>
      <DialogContent>
        <DialogTitle>Invite a teammate</DialogTitle>
        <input value={email} onChange={e => setEmail(e.target.value)} placeholder="alex@example.com" />
        <select value={role} onChange={e => setRole(e.target.value as any)}>
          <option value="user">User</option>
          <option value="staff">Staff</option>
          <option value="admin">Admin</option>
        </select>
        <Button onClick={onSubmit}>Send invitation</Button>
      </DialogContent>
    </Dialog>
  )
}

export default async function AcceptPage({ params }) {
  const inv = await fetch(`${API}/api/invitations/${params.token}`).then(r => r.json())
  if (!inv?.data) return <p>This invitation is invalid or expired.</p>

  return (
    <AcceptForm
      token={params.token}
      email={inv.data.email}
      tenantName={inv.data.tenant_name}
      role={inv.data.role}
    />
  )
}