updated invitation log

Author: waleedlatif1

apps/sim/app/api/workspaces/invitations/[invitationId]/route.ts

@@ -27,7 +27,10 @@ export async function GET(
     // For token-based acceptance flows, redirect to login
     if (isAcceptFlow) {
       return NextResponse.redirect(
-        new URL(`/invite/${token}?token=${token}`, env.NEXT_PUBLIC_APP_URL || 'https://sim.ai')
+        new URL(
+          `/invite/${invitationId}?token=${token}`,
+          env.NEXT_PUBLIC_APP_URL || 'https://sim.ai'
+        )
       )
     }
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
@@ -51,7 +54,10 @@ export async function GET(
     if (new Date() > new Date(invitation.expiresAt)) {
       if (isAcceptFlow) {
         return NextResponse.redirect(
-          new URL(`/invite/${token}?error=expired`, env.NEXT_PUBLIC_APP_URL || 'https://sim.ai')
+          new URL(
+            `/invite/${invitation.id}?error=expired`,
+            env.NEXT_PUBLIC_APP_URL || 'https://sim.ai'
+          )
         )
       }
       return NextResponse.json({ error: 'Invitation has expired' }, { status: 400 })
@@ -67,7 +73,7 @@ export async function GET(
       if (isAcceptFlow) {
         return NextResponse.redirect(
           new URL(
-            `/invite/${token}?error=workspace-not-found`,
+            `/invite/${invitation.id}?error=workspace-not-found`,
             env.NEXT_PUBLIC_APP_URL || 'https://sim.ai'
           )
         )
@@ -79,7 +85,7 @@ export async function GET(
       if (invitation.status !== ('pending' as WorkspaceInvitationStatus)) {
         return NextResponse.redirect(
           new URL(
-            `/invite/${token}?error=already-processed`,
+            `/invite/${invitation.id}?error=already-processed`,
             env.NEXT_PUBLIC_APP_URL || 'https://sim.ai'
           )
         )
@@ -97,7 +103,7 @@ export async function GET(
       if (!userData) {
         return NextResponse.redirect(
           new URL(
-            `/invite/${token}?error=user-not-found`,
+            `/invite/${invitation.id}?error=user-not-found`,
             env.NEXT_PUBLIC_APP_URL || 'https://sim.ai'
           )
         )
@@ -108,7 +114,7 @@ export async function GET(
       if (!isValidMatch) {
         return NextResponse.redirect(
           new URL(
-            `/invite/${token}?error=email-mismatch`,
+            `/invite/${invitation.id}?error=email-mismatch`,
             env.NEXT_PUBLIC_APP_URL || 'https://sim.ai'
           )
         )

apps/sim/app/api/workspaces/invitations/route.ts

@@ -206,6 +206,7 @@ export async function POST(req: NextRequest) {
       to: email,
       inviterName: session.user.name || session.user.email || 'A user',
       workspaceName: workspaceDetails.name,
+      invitationId: invitationData.id,
       token: token,
     })
 
@@ -221,17 +222,19 @@ async function sendInvitationEmail({
   to,
   inviterName,
   workspaceName,
+  invitationId,
   token,
 }: {
   to: string
   inviterName: string
   workspaceName: string
+  invitationId: string
   token: string
 }) {
   try {
     const baseUrl = env.NEXT_PUBLIC_APP_URL || 'https://sim.ai'
-    // Always use the client-side invite route with token parameter
-    const invitationLink = `${baseUrl}/invite/${token}?token=${token}`
+    // Use invitation ID in path, token in query parameter for security
+    const invitationLink = `${baseUrl}/invite/${invitationId}?token=${token}`
 
     const emailHtml = await render(
       WorkspaceInvitationEmail({

apps/sim/app/invite/[id]/invite.tsx

@@ -51,12 +51,10 @@ export default function Invite() {
     async function fetchInvitationDetails() {
       setIsLoading(true)
       try {
-        const workspaceInviteResponse = await fetch(
-          `/api/workspaces/invitations/${token}?token=${token}`,
-          {
-            method: 'GET',
-          }
-        )
+        // Fetch invitation details using the invitation ID from the URL path
+        const workspaceInviteResponse = await fetch(`/api/workspaces/invitations/${inviteId}`, {
+          method: 'GET',
+        })
 
         if (workspaceInviteResponse.ok) {
           const data = await workspaceInviteResponse.json()
@@ -118,7 +116,7 @@ export default function Invite() {
     setIsAccepting(true)
 
     if (invitationType === 'workspace') {
-      window.location.href = `/api/workspaces/invitations/${encodeURIComponent(token || '')}?token=${encodeURIComponent(token || '')}`
+      window.location.href = `/api/workspaces/invitations/${encodeURIComponent(inviteId)}?token=${encodeURIComponent(token || '')}`
     } else {
       try {
         const response = await client.organization.acceptInvitation({