feat(invites): role-granting + usage-capped invites; audit hardening (P7)

Invites
- migration 029: space_invites.role (member_role enum, default
  'member' — legacy invites and the spaces.invite_code path keep
  granting member). schema.sql + types/database.ts mirrored
- lib/invite-logic.ts (pure, tested): canAssignInviteRole — admin may
  grant any role; board may grant anything except admin; nobody else.
  Privilege-escalation guard on top of the existing admin/board gate
- createInvite/updateInvite take + enforce role via that guard;
  createInviteSchema/updateInviteSchema validate the enum
- joinSpace applies the invite's granted role (validated), default
  member; uses_count/max_uses/expiry already enforced
- invites panel: role picker (filtered to what the creator may grant),
  one-click "single use", per-invite role badge
- space-scoped invite link /join/<space>?code=… via a presentational
  app/join/[space] landing that hands off to the proven
  /signup?invite= flow; /join added to middleware PUBLIC_ROUTES

Audit hardening (from this pass's review)
- /login now honors a validated same-origin ?next= (was hardcoded to
  /dashboard) so the public_auth form sign-in round-trips; OAuth
  threads next through the callback (which already honored it)
- submitForm requires formId; submitFormSchema drops the now-ambiguous
  slug path (form slugs are per-space after 028). Both callers already
  pass formId. Tests updated

337 tests; build verified (Compiled successfully, exit 0). No deploy.

__tests__/forms.test.ts

@@ -23,6 +23,8 @@ import {
   slugify,
   deriveFieldKeys,
 } from '@/lib/forms-logic'
+import { INVITE_ROLES, isInviteRole, canAssignInviteRole } from '@/lib/invite-logic'
+import { createInviteSchema, updateInviteSchema } from '@/lib/validations'
 
 // ─── formSlug ────────────────────────────────────────────────────────────────
 
@@ -197,27 +199,24 @@ describe('getPublicFormSchema', () => {
 
 describe('submitFormSchema', () => {
   const ID = '11111111-1111-1111-1111-111111111111'
-  it('requires formId or slug', () => {
+  it('requires a valid formId (slug is no longer accepted post-028)', () => {
     expect(submitFormSchema.safeParse({ answers: {} }).success).toBe(false)
-    expect(submitFormSchema.safeParse({ slug: 'a', answers: {} }).success).toBe(true)
+    expect(submitFormSchema.safeParse({ slug: 'a', answers: {} }).success).toBe(false)
+    expect(submitFormSchema.safeParse({ formId: 'nope' }).success).toBe(false)
     expect(submitFormSchema.safeParse({ formId: ID }).success).toBe(true)
   })
   it('defaults answers to an empty object', () => {
-    const r = submitFormSchema.safeParse({ slug: 'a' })
+    const r = submitFormSchema.safeParse({ formId: ID })
     expect(r.success).toBe(true)
     if (r.success) expect(r.data.answers).toEqual({})
   })
-  it('rejects a bad formId or slug', () => {
-    expect(submitFormSchema.safeParse({ formId: 'nope' }).success).toBe(false)
-    expect(submitFormSchema.safeParse({ slug: 'Bad Slug' }).success).toBe(false)
-  })
   it('email is optional/nullable and normalized; consent is boolean', () => {
-    expect(submitFormSchema.safeParse({ slug: 'a', email: null }).success).toBe(true)
-    expect(submitFormSchema.safeParse({ slug: 'a', email: 'not-an-email' }).success).toBe(false)
-    const r = submitFormSchema.safeParse({ slug: 'a', email: '[email protected]', consent: true })
+    expect(submitFormSchema.safeParse({ formId: ID, email: null }).success).toBe(true)
+    expect(submitFormSchema.safeParse({ formId: ID, email: 'not-an-email' }).success).toBe(false)
+    const r = submitFormSchema.safeParse({ formId: ID, email: '[email protected]', consent: true })
     expect(r.success).toBe(true)
     if (r.success) expect(r.data.email).toBe('[email protected]')
-    expect(submitFormSchema.safeParse({ slug: 'a', consent: 'yes' }).success).toBe(false)
+    expect(submitFormSchema.safeParse({ formId: ID, consent: 'yes' }).success).toBe(false)
   })
 })
 
@@ -462,6 +461,45 @@ describe('evaluateRequiredFormStep', () => {
 
 // ─── slugify / deriveFieldKeys ───────────────────────────────────────────────
 
+describe('invite role policy', () => {
+  it('INVITE_ROLES is the member_role set; isInviteRole guards it', () => {
+    expect([...INVITE_ROLES].sort()).toEqual(
+      ['admin', 'associate', 'board', 'member', 'treasurer'].sort(),
+    )
+    expect(isInviteRole('admin')).toBe(true)
+    expect(isInviteRole('superuser')).toBe(false)
+    expect(isInviteRole('')).toBe(false)
+  })
+
+  it('admin may grant any role', () => {
+    for (const r of INVITE_ROLES) expect(canAssignInviteRole('admin', r), r).toBe(true)
+  })
+
+  it('board may grant anything except admin', () => {
+    expect(canAssignInviteRole('board', 'admin')).toBe(false)
+    for (const r of ['board', 'treasurer', 'member', 'associate']) {
+      expect(canAssignInviteRole('board', r), r).toBe(true)
+    }
+  })
+
+  it('non-admin/board (or unknown) cannot grant anything, and unknown targets are rejected', () => {
+    expect(canAssignInviteRole('member', 'member')).toBe(false)
+    expect(canAssignInviteRole('treasurer', 'associate')).toBe(false)
+    expect(canAssignInviteRole('admin', 'superuser')).toBe(false)
+  })
+
+  it('createInviteSchema defaults role to member and validates the enum', () => {
+    const r = createInviteSchema.safeParse({})
+    expect(r.success).toBe(true)
+    if (r.success) expect(r.data.role).toBe('member')
+    expect(createInviteSchema.safeParse({ role: 'admin' }).success).toBe(true)
+    expect(createInviteSchema.safeParse({ role: 'superuser' }).success).toBe(false)
+    expect(updateInviteSchema.safeParse({ role: 'board' }).success).toBe(true)
+    expect(updateInviteSchema.safeParse({}).success).toBe(true)
+    expect(updateInviteSchema.safeParse({ role: 'nope' }).success).toBe(false)
+  })
+})
+
 describe('slugify / deriveFieldKeys', () => {
   it('slugifies with the requested separator and trims runs', () => {
     expect(slugify('Hello World', '-')).toBe('hello-world')