API
Invite API
Server-side member invites with Instant admin SDK and ownership checks.
Invite API
File: api/invite.js
Request
POST with body { boardId, email, role }.
Auth: Instant refresh token from token header or body refreshToken.
Flow
- Validate method / env / body
- Verify refresh token via admin SDK
- Load board owner + members
- Ensure caller is board owner
- Look up target registered user by email
- Reject self-invite
- Existing member → update role + editor link
- Else create member (+ editor link if editor)
Env: INSTANT_APP_ID or VITE_INSTANT_APP_ID, INSTANT_ADMIN_TOKEN.
Reuses member-policy.js helpers so client and server stay aligned.