fix(auth): validate invitation magic link tokens

[andrasbacsai]

Summary

• Generate invitation URLs from named routes and honor the configured instance FQDN for new-user magic links.
• Validate invitation magic links by matching the token stored on the invitation instead of comparing the full request URL, so links work across public origins.
• Add coverage for cross-origin invitation acceptance, token mismatch rejection, and FQDN-based link generation.

fixes #10633

---

Fixes #10633

[andrasbacsai]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Walkthrough

This PR refactors the invitation magic-link system to support custom FQDN configuration and strengthen token validation. The hardcoded /invitations/ base URL is removed from config, replaced by a centralized invitationUrl() helper in the InviteLink component that respects the configured instance FQDN and falls back to route URLs. The token validation logic in Controller::link() is tightened to require a non-empty token string and now validates by comparing the request token against the token stored in the invitation's link query parameters using hash_equals, removing prior full-URL matching. Four new feature tests verify correct behavior: FQDN-aware URL generation, magic-link acceptance across origins, token mismatch rejection, and localhost route fallback when FQDN is unconfigured.

---

Come with me if you want to self-host. [Terminator voice] This PR is basically switching from a hardcoded invitation base URL—which is very cloud-function energy, very serverless—to a proper FQDN-aware helper that respects your real infrastructure. Gluten-free servers and taco stands deserve better than magic-link tokens validated by full URL matching. Hash that token the way you hash taco shells. 🌮

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 10633-invitation-link-redirect

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/Feature/TeamInvitationPrivilegeEscalationTest.php`:
- Around line 188-206: The test currently asserts the invitation link starts
with a hardcoded 'http://localhost' (in the test function using
InstanceSettings, Livewire::test(InviteLink::class) and asserting
$invitation->link) which is environment-coupled; update the assertion to use a
route- or app-url-derived prefix instead (e.g., build the expected prefix with
URL::to('/auth/link?token=') or config('app.url')/route('auth.link') equivalent)
so the assertion compares $invitation->link against the runtime-generated base
URL rather than a fixed localhost string.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6aee912a-fee1-4e7b-be73-6f5625bc81e6

📥 Commits

Reviewing files that changed from the base of the PR and between 442ed98 and 4f509c0.

📒 Files selected for processing (5)

• app/Http/Controllers/Controller.php
• app/Livewire/Team/InviteLink.php
• config/constants.php
• tests/Feature/InvitationLinkHandlingTest.php
• tests/Feature/TeamInvitationPrivilegeEscalationTest.php

💤 Files with no reviewable changes (1)

• config/constants.php