From eb3a44b5d1658b0917befd9508e4dfe9f2b5c2fd Mon Sep 17 00:00:00 2001
From: yuanhe <yuanhe@minimaxi.com>
Date: Thu, 9 Jul 2026 13:27:57 +0800
Subject: [PATCH 1/2] feat: replace temp password with HMAC invite links &
 protect owner role
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Replace temp-password invitation with HMAC-SHA256 signed invite links
- Admin creates invitation → gets a link → shares via IM
- Invitee opens link → sets own password → auto-joins workspace
- Token: base64url(payload).base64url(hmac), SHA-256 hash stored in DB
- CAS pattern for single-use acceptance, 72h TTL
- Rate limit on public accept endpoint (10 req/min/IP)
- Token passed via POST body to avoid proxy log leakage
- Set workspace ID in localStorage on accept for correct routing
- Protect owner: cannot edit/remove owner role, cannot promote to owner
- Owner role dropdown hidden in UI, remove button hidden for owner
- Delete temp password generation code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 apps/web/src/lib/api-invitations.ts           | 122 ++++++
 apps/web/src/lib/api-types.ts                 |   8 +-
 apps/web/src/main.tsx                         |  13 +
 apps/web/src/pages/InviteAcceptPage.tsx       | 123 ++++++
 apps/web/src/pages/admin/MembersPage.tsx      | 130 ++----
 server/cmd/server/main.go                     |  15 +
 server/internal/auth/invite/invite.go         | 146 +++++++
 server/internal/auth/password/temp.go         |  35 --
 server/internal/auth/password/temp_test.go    |  63 ---
 server/internal/db/queries/store.sql          |  58 +++
 server/internal/db/sqlc/models.go             |  13 +
 server/internal/db/sqlc/store.sql.go          | 190 +++++++++
 server/internal/dev/routes.go                 | 390 +++++++++++++++---
 server/internal/dev/routes_test.go            |  16 +
 server/internal/store/email.go                |   4 +
 server/internal/store/store.go                | 265 ++++++++++--
 server/internal/store/store_test.go           |  30 +-
 .../000007_workspace_invitations.sql          |  27 ++
 18 files changed, 1337 insertions(+), 311 deletions(-)
 create mode 100644 apps/web/src/lib/api-invitations.ts
 create mode 100644 apps/web/src/pages/InviteAcceptPage.tsx
 create mode 100644 server/internal/auth/invite/invite.go
 delete mode 100644 server/internal/auth/password/temp.go
 delete mode 100644 server/internal/auth/password/temp_test.go
 create mode 100644 server/migrations/000007_workspace_invitations.sql

diff --git a/apps/web/src/lib/api-invitations.ts b/apps/web/src/lib/api-invitations.ts
new file mode 100644
index 00000000..5874a71d
--- /dev/null
+++ b/apps/web/src/lib/api-invitations.ts
@@ -0,0 +1,122 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
+import { apiRequest, noUnreachableRetry } from "./api-client"
+import type { MemberRole } from "./api-types"
+
+export interface CreateInvitationRequest {
+  email: string
+  name?: string
+  role: MemberRole
+}
+
+export interface CreateInvitationResponse {
+  invitation_id: string
+  invite_link: string
+  email: string
+  role: MemberRole
+  expires_at: string
+}
+
+export interface PendingInvitation {
+  id: string
+  email: string
+  role: MemberRole
+  invited_by: string
+  invited_by_name: string
+  expires_at: string
+  created_at: string
+}
+
+export interface InviteInfoResponse {
+  workspace_name: string
+  email: string
+  role: string
+}
+
+export interface AcceptInviteRequest {
+  token: string
+  password: string
+}
+
+export interface AcceptInviteResponse {
+  user_id: string
+  email: string
+  workspace_id: string
+}
+
+const KEY_INVITATIONS = (wsId: string) =>
+  ["admin", "invitations", wsId] as const
+
+export function useCreateInvitation(wsId: string | null) {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: async (body: CreateInvitationRequest) => {
+      if (!wsId) throw new Error("no workspace selected")
+      return apiRequest<CreateInvitationResponse>(
+        `/api/v1/workspaces/${wsId}/invitations`,
+        { method: "POST", body }
+      )
+    },
+    onSuccess: () => {
+      void qc.invalidateQueries({ queryKey: KEY_INVITATIONS(wsId ?? "_none") })
+    },
+  })
+}
+
+export function usePendingInvitations(wsId: string | null) {
+  return useQuery({
+    queryKey: KEY_INVITATIONS(wsId ?? "_none"),
+    queryFn: () =>
+      apiRequest<PendingInvitation[]>(
+        `/api/v1/workspaces/${wsId}/invitations`,
+        { method: "GET" }
+      ),
+    enabled: !!wsId,
+    retry: noUnreachableRetry,
+    staleTime: 30_000,
+  })
+}
+
+export function useRevokeInvitation(wsId: string | null) {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: async (invitationId: string) => {
+      if (!wsId) throw new Error("no workspace selected")
+      return apiRequest<void>(
+        `/api/v1/workspaces/${wsId}/invitations/${invitationId}`,
+        { method: "DELETE" }
+      )
+    },
+    onSuccess: () => {
+      void qc.invalidateQueries({ queryKey: KEY_INVITATIONS(wsId ?? "_none") })
+    },
+  })
+}
+
+export async function fetchInviteInfo(token: string): Promise<InviteInfoResponse> {
+  return apiRequest<InviteInfoResponse>("/api/v1/invite/info", {
+    method: "POST",
+    body: { token },
+  })
+}
+
+export function useInviteInfo(token: string) {
+  return useQuery({
+    queryKey: ["invite", "info", token],
+    queryFn: () => fetchInviteInfo(token),
+    enabled: !!token,
+    retry: false,
+  })
+}
+
+export async function acceptInviteRequest(body: AcceptInviteRequest): Promise<AcceptInviteResponse> {
+  return apiRequest<AcceptInviteResponse>("/api/v1/invite/accept", {
+    method: "POST",
+    body,
+  })
+}
+
+export function useAcceptInvite() {
+  return useMutation({
+    mutationFn: acceptInviteRequest,
+  })
+}
diff --git a/apps/web/src/lib/api-types.ts b/apps/web/src/lib/api-types.ts
index 1ff7dd59..266632cf 100644
--- a/apps/web/src/lib/api-types.ts
+++ b/apps/web/src/lib/api-types.ts
@@ -860,22 +860,16 @@ export interface ListWorkspaceMembersResponse {
  *  upserted by email. */
 export interface AddWorkspaceMemberRequest {
   email: string
-  /** Defaults server-side to the local-part of email when omitted. */
   name?: string
   role: MemberRole
-  /** When true AND the invitee is a brand-new user, the server mints
-   *  a temporary password and returns it once in `temp_password`. */
-  invite?: boolean
 }
 
 /** Response from POST .../members: the resulting membership row plus
  *  a `user_created` flag telling the UI whether a fresh user was minted
- *  or an existing one reused. `temp_password` is present only on
- *  successful invite flows for brand-new users. */
+ *  or an existing one reused. */
 export interface AddWorkspaceMemberResponse {
   member: WorkspaceMember
   user_created: boolean
-  temp_password?: string
 }
 
 /** Response from DELETE .../members/{userId}: the removed membership row. */
diff --git a/apps/web/src/main.tsx b/apps/web/src/main.tsx
index df9b56bb..5e7702f3 100644
--- a/apps/web/src/main.tsx
+++ b/apps/web/src/main.tsx
@@ -8,6 +8,7 @@ import {
   JoinWorkspaceLanding,
   popPendingJoinIntent,
 } from './pages/JoinWorkspaceLanding'
+import { InviteAcceptPage } from './pages/InviteAcceptPage'
 import { bootstrapWorkspace } from './lib/bootstrap'
 import { AuthProvider, useAuth } from './lib/auth-context'
 import { useMyWorkspaces } from './lib/api-workspaces'
@@ -66,6 +67,7 @@ function Root() {
   // Matched before the auth-aware admin shell so an unauthenticated user on
   // this URL hits the landing page directly.
   const joinWsId = parseJoinWorkspaceId()
+  const inviteToken = parseInviteToken()
 
   // OAuth callback returns to "/" by design. If we stashed an intent before
   // the OAuth bounce, re-issue it now. Guarded on isAuthenticated to avoid a
@@ -79,6 +81,9 @@ function Root() {
     }
   }, [isLoading, isAuthenticated, joinWsId])
 
+  if (inviteToken !== null) {
+    return <InviteAcceptPage token={inviteToken} />
+  }
   if (joinWsId !== null) {
     return <JoinWorkspaceLanding workspaceId={joinWsId} />
   }
@@ -100,6 +105,14 @@ function parseJoinWorkspaceId(): string | null {
   return id && id.length > 0 ? id : null
 }
 
+function parseInviteToken(): string | null {
+  if (typeof window === "undefined") return null
+  const prefix = "/invite/"
+  if (!window.location.pathname.startsWith(prefix)) return null
+  const token = window.location.pathname.slice(prefix.length)
+  return token.length > 0 ? token : null
+}
+
 createRoot(document.getElementById('root')!).render(
   <StrictMode>
     <QueryClientProvider client={queryClient}>
diff --git a/apps/web/src/pages/InviteAcceptPage.tsx b/apps/web/src/pages/InviteAcceptPage.tsx
new file mode 100644
index 00000000..8c1f0d48
--- /dev/null
+++ b/apps/web/src/pages/InviteAcceptPage.tsx
@@ -0,0 +1,123 @@
+import { useState } from "react"
+import { useInviteInfo, useAcceptInvite } from "../lib/api-invitations"
+import { setWorkspaceId } from "../lib/workspace"
+
+export function InviteAcceptPage({ token }: { token: string }) {
+  const infoQ = useInviteInfo(token)
+  const acceptMut = useAcceptInvite()
+  const [password, setPassword] = useState("")
+  const [confirm, setConfirm] = useState("")
+  const [errMsg, setErrMsg] = useState<string | null>(null)
+
+  if (infoQ.isLoading) {
+    return (
+      <main className="grid min-h-screen place-items-center bg-surface">
+        <p className="text-sm text-fg-subtle">Loading invitation...</p>
+      </main>
+    )
+  }
+
+  if (infoQ.isError || !infoQ.data) {
+    return (
+      <main className="grid min-h-screen place-items-center bg-surface">
+        <div className="w-full max-w-sm space-y-3 rounded-lg border border-line p-6">
+          <h1 className="text-base font-semibold text-fg">Invalid Invitation</h1>
+          <p className="text-sm text-fg-subtle">
+            This invitation link is invalid, expired, or has already been used.
+          </p>
+        </div>
+      </main>
+    )
+  }
+
+  const { workspace_name, email, role } = infoQ.data
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    setErrMsg(null)
+    if (password !== confirm) {
+      setErrMsg("Passwords do not match")
+      return
+    }
+    if (password.length < 8) {
+      setErrMsg("Password must be at least 8 characters")
+      return
+    }
+    try {
+      const res = await acceptMut.mutateAsync({ token, password })
+      setWorkspaceId(res.workspace_id)
+      window.location.assign("/")
+    } catch (err) {
+      setErrMsg(err instanceof Error ? err.message : "Failed to accept invitation")
+    }
+  }
+
+  return (
+    <main className="grid min-h-screen place-items-center bg-surface">
+      <div className="w-full max-w-sm space-y-4 rounded-lg border border-line p-6">
+        <div className="space-y-1">
+          <h1 className="text-base font-semibold text-fg">
+            Join {workspace_name}
+          </h1>
+          <p className="text-sm text-fg-subtle">
+            You've been invited as <span className="font-medium">{role}</span>.
+            Set a password to activate your account.
+          </p>
+        </div>
+
+        <form onSubmit={handleSubmit} className="space-y-3">
+          <div className="space-y-1">
+            <label className="text-xs font-medium text-fg-subtle">Email</label>
+            <input
+              type="email"
+              value={email}
+              readOnly
+              className="w-full rounded-md border border-line bg-surface-subtle px-3 py-2 text-sm text-fg-subtle"
+            />
+          </div>
+
+          <div className="space-y-1">
+            <label className="text-xs font-medium text-fg-subtle">Password</label>
+            <input
+              type="password"
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              placeholder="Set your password"
+              required
+              autoFocus
+              autoComplete="new-password"
+              className="w-full rounded-md border border-line bg-surface px-3 py-2 text-sm text-fg placeholder:text-fg-faint focus:border-line-strong focus:outline-none focus:ring-1 focus:ring-slate-200"
+            />
+          </div>
+
+          <div className="space-y-1">
+            <label className="text-xs font-medium text-fg-subtle">Confirm Password</label>
+            <input
+              type="password"
+              value={confirm}
+              onChange={(e) => setConfirm(e.target.value)}
+              placeholder="Confirm password"
+              required
+              autoComplete="new-password"
+              className="w-full rounded-md border border-line bg-surface px-3 py-2 text-sm text-fg placeholder:text-fg-faint focus:border-line-strong focus:outline-none focus:ring-1 focus:ring-slate-200"
+            />
+          </div>
+
+          {errMsg && (
+            <p className="rounded-md border border-danger-border bg-danger-subtle px-3 py-2 text-xs text-danger-emphasis">
+              {errMsg}
+            </p>
+          )}
+
+          <button
+            type="submit"
+            disabled={acceptMut.isPending}
+            className="w-full rounded-md bg-fg px-3 py-2 text-sm font-medium text-bg hover:bg-fg/90 disabled:opacity-50"
+          >
+            {acceptMut.isPending ? "Joining..." : "Set Password & Join"}
+          </button>
+        </form>
+      </div>
+    </main>
+  )
+}
diff --git a/apps/web/src/pages/admin/MembersPage.tsx b/apps/web/src/pages/admin/MembersPage.tsx
index 0a1a7ebe..e8eb5d23 100644
--- a/apps/web/src/pages/admin/MembersPage.tsx
+++ b/apps/web/src/pages/admin/MembersPage.tsx
@@ -4,7 +4,7 @@ import {
   Check,
   Copy,
   Inbox,
-  KeyRound,
+  Link2,
   Loader2,
   MoreHorizontal,
   Plus,
@@ -54,7 +54,7 @@ import {
   useUpdateWorkspaceMemberRole,
   useWorkspaceMembers,
 } from "../../lib/api-members"
-import { useBootstrapStatus } from "../../lib/api-bootstrap"
+import { useCreateInvitation } from "../../lib/api-invitations"
 import type {
   AddWorkspaceMemberRequest,
   MemberRole,
@@ -246,9 +246,8 @@ export function MembersPage() {
         <InviteMemberDialog
           onClose={() => {
             setInviteOpen(false)
-            addWsMut.reset()
           }}
-          invite={(body) => addWsMut.mutateAsync(body)}
+          wsId={wsId}
         />
       )}
 
@@ -376,7 +375,7 @@ function MembersTable({
                 <UserCell name={m.user_name} email={m.user_email} />
               </TableCell>
               <TableCell>
-                {writable && onChangeRole ? (
+                {writable && onChangeRole && m.role !== "owner" ? (
                   <select
                     value={m.role}
                     disabled={roleChangePending}
@@ -385,7 +384,7 @@ function MembersTable({
                     }
                     className="rounded-md border border-line bg-surface px-2 py-1 text-sm text-fg focus:border-line-strong focus:outline-none focus:ring-1 focus:ring-slate-200 disabled:opacity-50"
                   >
-                    {ROLES.map((r) => (
+                    {ROLES.filter((r) => r !== "owner").map((r) => (
                       <option key={r} value={r}>
                         {t(`members.role.${r}`)}
                       </option>
@@ -405,7 +404,7 @@ function MembersTable({
               </TableCell>
               {writable && (
                 <TableCell className="text-right">
-                  {onRemove ? (
+                  {onRemove && m.role !== "owner" ? (
                     <Button
                       variant="ghost"
                       size="sm"
@@ -596,27 +595,23 @@ function AddMemberDialog({
 /* ------------------------------------------------------------------ */
 /*  Invite member dialog                                               */
 /*                                                                     */
-/*  Two-step: (1) form → POST /members {invite:true} → (2) result      */
-/*  screen shows the plaintext temp password exactly once. The         */
-/*  password is held in local state; if the admin closes the dialog    */
-/*  without copying, it is gone forever (there is no read-back API).   */
+/*  Two-step: (1) form → POST /invitations → (2) result screen shows  */
+/*  the invite link. Admin copies the link and sends to the invitee.   */
 /* ------------------------------------------------------------------ */
 
 interface InviteResult {
   email: string
-  tempPassword: string
-  userCreated: boolean
+  inviteLink: string
 }
 
 function InviteMemberDialog({
   onClose,
-  invite,
+  wsId,
 }: {
   onClose: () => void
-  invite: (body: AddWorkspaceMemberRequest) => Promise<AddWorkspaceMemberResponseLike>
+  wsId: string
 }) {
   const { t } = useTranslation("admin")
-  const bootstrapQ = useBootstrapStatus()
   const [email, setEmail] = useState("")
   const [name, setName] = useState("")
   const [role, setRole] = useState<MemberRole>("member")
@@ -624,35 +619,24 @@ function InviteMemberDialog({
   const [errMsg, setErrMsg] = useState<string | null>(null)
   const [result, setResult] = useState<InviteResult | null>(null)
   const [copied, setCopied] = useState(false)
+  const createInvitation = useCreateInvitation(wsId)
 
   const canSubmit = email.trim() !== "" && !pending
 
-  // Login URL priority: operator-configured PARSAR_PUBLIC_URL (comes
-  // through bootstrap.status.public_url — the same trusted source the
-  // pairing dialog uses), else current window origin. Trailing slash
-  // stripped so we can always append the path with a single "/".
-  const loginURL = (() => {
-    const raw = (bootstrapQ.data?.public_url ?? "").trim()
-    const base = raw !== "" ? raw : window.location.origin
-    return base.replace(/\/+$/, "") + "/login"
-  })()
-
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault()
     if (!canSubmit) return
     setErrMsg(null)
     setPending(true)
     try {
-      const res = await invite({
+      const res = await createInvitation.mutateAsync({
         email: email.trim(),
         name: name.trim() || undefined,
         role,
-        invite: true,
       })
       setResult({
-        email: res.member.user_email,
-        tempPassword: res.temp_password ?? "",
-        userCreated: res.user_created,
+        email: res.email,
+        inviteLink: res.invite_link,
       })
     } catch (err) {
       setErrMsg(
@@ -667,27 +651,14 @@ function InviteMemberDialog({
     }
   }
 
-  // The copy payload bundles all three pieces the invitee needs so
-  // the admin can paste it into any IM verbatim. Format is stable and
-  // machine-parseable enough for the invitee to eyeball.
-  const copyPayload = result
-    ? [
-        `Sign in: ${loginURL}`,
-        `Email: ${result.email}`,
-        `Password: ${result.tempPassword}`,
-      ].join("\n")
-    : ""
-
   const handleCopy = async () => {
-    if (!copyPayload) return
+    if (!result) return
     try {
-      await navigator.clipboard.writeText(copyPayload)
+      await navigator.clipboard.writeText(result.inviteLink)
       setCopied(true)
       window.setTimeout(() => setCopied(false), 2000)
     } catch {
-      // Clipboard write can fail on non-HTTPS or older browsers; the
-      // credentials are still visible in the modal so the admin can
-      // copy them by hand. Silently swallow.
+      // Silently swallow — link is visible in the modal for manual copy.
     }
   }
 
@@ -778,7 +749,7 @@ function InviteMemberDialog({
           <div>
             <DialogHeader className="space-y-1 border-b border-line-muted px-5 py-3 pr-10">
               <DialogTitle className="flex items-center gap-2 text-sm">
-                <KeyRound className="h-4 w-4 text-success" />
+                <Link2 className="h-4 w-4 text-success" />
                 {t("members.invite.resultTitle")}
               </DialogTitle>
               <DialogDescription className="text-xs leading-relaxed">
@@ -786,39 +757,23 @@ function InviteMemberDialog({
               </DialogDescription>
             </DialogHeader>
             <div className="space-y-3 px-5 py-4">
-              {result.userCreated && result.tempPassword ? (
-                <>
-                  <div className="space-y-2 rounded-md border border-line bg-surface-subtle/60 p-3">
-                    <InviteCredentialRow
-                      label={t("members.invite.credential.url")}
-                      value={loginURL}
-                    />
-                    <InviteCredentialRow
-                      label={t("members.invite.credential.email")}
-                      value={result.email}
-                    />
-                    <InviteCredentialRow
-                      label={t("members.invite.credential.password")}
-                      value={result.tempPassword}
-                      mono
-                    />
-                  </div>
-                  <Button
-                    type="button"
-                    size="sm"
-                    variant="outline"
-                    onClick={handleCopy}
-                    className="w-full"
-                  >
-                    <Copy className="h-3.5 w-3.5" />
-                    {copied ? t("members.invite.copied") : t("members.invite.copyAll")}
-                  </Button>
-                </>
-              ) : (
-                <p className="rounded-md border border-warning-border bg-warning-subtle/40 px-3 py-2 text-xs text-warning-emphasis">
-                  {t("members.invite.existingUserNotice")}
-                </p>
-              )}
+              <div className="space-y-2 rounded-md border border-line bg-surface-subtle/60 p-3">
+                <InviteCredentialRow
+                  label="Link"
+                  value={result.inviteLink}
+                  mono
+                />
+              </div>
+              <Button
+                type="button"
+                size="sm"
+                variant="outline"
+                onClick={handleCopy}
+                className="w-full"
+              >
+                <Copy className="h-3.5 w-3.5" />
+                {copied ? t("members.invite.copied") : t("members.invite.copyAll")}
+              </Button>
             </div>
             <DialogFooter className="flex flex-row items-center justify-end gap-2 border-t border-line-muted bg-surface-subtle/60 px-4 py-3">
               <Button type="button" size="sm" onClick={onClose}>
@@ -855,19 +810,6 @@ function InviteCredentialRow({
   )
 }
 
-/**
- * Local structural type used to loosen invite()'s parameter — the
- * useAddWorkspaceMember mutation returns AddWorkspaceMemberResponse
- * but its `temp_password` is only populated on the invite path. We
- * type explicitly so the invite dialog does not accidentally read
- * fields the store hook does not surface.
- */
-interface AddWorkspaceMemberResponseLike {
-  member: { user_email: string }
-  user_created: boolean
-  temp_password?: string
-}
-
 function DialogField({
   label,
   required,
diff --git a/server/cmd/server/main.go b/server/cmd/server/main.go
index d49f15f8..3ac69237 100644
--- a/server/cmd/server/main.go
+++ b/server/cmd/server/main.go
@@ -47,6 +47,7 @@ import (
 	"github.com/MiniMax-AI-Dev/parsar/server/internal/auth"
 	"github.com/MiniMax-AI-Dev/parsar/server/internal/auth/feishu"
 	authgithub "github.com/MiniMax-AI-Dev/parsar/server/internal/auth/github"
+	authinvite "github.com/MiniMax-AI-Dev/parsar/server/internal/auth/invite"
 	authpassword "github.com/MiniMax-AI-Dev/parsar/server/internal/auth/password"
 	"github.com/MiniMax-AI-Dev/parsar/server/internal/bootstrap"
 	"github.com/MiniMax-AI-Dev/parsar/server/internal/config"
@@ -677,6 +678,20 @@ func main() {
 			return cfg.BuildPublicURL("/join-workspace?id=" + workspaceID + "&from=feishu")
 		}))
 	}
+	if cfg.Secret.MasterKey != "" {
+		invSigner, err := authinvite.NewSigner(cfg.Secret.MasterKey)
+		if err != nil {
+			log.Bg().Warn("invite signer init failed", "error", err)
+		} else {
+			publicURL := strings.TrimSpace(cfg.Server.PublicURL)
+			if publicURL == "" {
+				publicURL = "http://localhost" + cfg.Server.Addr
+			}
+			sessionStore := auth.NewPostgresSessionStore(sqlc.New(pool))
+			opts = append(opts, dev.WithInvite(invSigner, sessionStore, cfg.Auth.Cookie.Secure, publicURL))
+			log.Bg().Info("invite-link system enabled")
+		}
+	}
 	dev.RegisterRoutesWithStore(r, runtimeStore, opts...)
 
 	// imHistoryResolver is bound to the outbound worker once it is built
diff --git a/server/internal/auth/invite/invite.go b/server/internal/auth/invite/invite.go
new file mode 100644
index 00000000..f5640d60
--- /dev/null
+++ b/server/internal/auth/invite/invite.go
@@ -0,0 +1,146 @@
+package invite
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
+
+// Wire format: <base64url(payload-json)>.<base64url(hmac-sha256(payload-json))>
+// Same structure as the OTLP token signer, but with a distinct derived key
+// and different claims. Tokens are URL-safe and compact enough for IM sharing.
+
+type Claims struct {
+	WorkspaceID string `json:"ws"`
+	Email       string `json:"e"`
+	Role        string `json:"r"`
+	IssuedAt    int64  `json:"iat"`
+	ExpiresAt   int64  `json:"exp"`
+	Nonce       string `json:"n,omitempty"`
+}
+
+const MaxLifetime = 72 * time.Hour
+
+var (
+	ErrMalformed      = errors.New("invite: token is malformed")
+	ErrSignatureBad   = errors.New("invite: token signature does not match")
+	ErrExpired        = errors.New("invite: token has expired")
+	ErrMissingClaim   = errors.New("invite: token is missing a required claim")
+	ErrNotConfigured  = errors.New("invite: signer has no signing key configured")
+	ErrLifetimeTooLong = errors.New("invite: requested lifetime exceeds max")
+)
+
+type Signer struct {
+	key []byte
+	now func() time.Time
+}
+
+func NewSigner(masterKey string) (*Signer, error) {
+	if strings.TrimSpace(masterKey) == "" {
+		return nil, ErrNotConfigured
+	}
+	// Derive a sub-key so invite tokens are domain-separated from OTLP tokens.
+	mac := hmac.New(sha256.New, []byte(masterKey))
+	mac.Write([]byte("parsar-invite-v1"))
+	return &Signer{key: mac.Sum(nil), now: time.Now}, nil
+}
+
+func (s *Signer) Sign(workspaceID, email, role string, lifetime time.Duration) (string, error) {
+	if s == nil {
+		return "", ErrNotConfigured
+	}
+	if lifetime <= 0 || lifetime > MaxLifetime {
+		return "", fmt.Errorf("%w: got %s, max %s", ErrLifetimeTooLong, lifetime, MaxLifetime)
+	}
+	if workspaceID == "" || email == "" || role == "" {
+		return "", fmt.Errorf("%w: workspace_id, email, and role required", ErrMissingClaim)
+	}
+
+	nonce, err := randomNonce()
+	if err != nil {
+		return "", err
+	}
+
+	now := s.now()
+	claims := Claims{
+		WorkspaceID: workspaceID,
+		Email:       email,
+		Role:        role,
+		IssuedAt:    now.Unix(),
+		ExpiresAt:   now.Add(lifetime).Unix(),
+		Nonce:       nonce,
+	}
+
+	payloadJSON, err := json.Marshal(claims)
+	if err != nil {
+		return "", fmt.Errorf("invite: marshal claims: %w", err)
+	}
+
+	sig := s.sign(payloadJSON)
+	return b64(payloadJSON) + "." + b64(sig), nil
+}
+
+func (s *Signer) Verify(token string) (Claims, error) {
+	if s == nil {
+		return Claims{}, ErrNotConfigured
+	}
+	parts := strings.SplitN(strings.TrimSpace(token), ".", 2)
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return Claims{}, ErrMalformed
+	}
+
+	payloadBytes, err := unb64(parts[0])
+	if err != nil {
+		return Claims{}, fmt.Errorf("%w: payload: %v", ErrMalformed, err)
+	}
+	sigBytes, err := unb64(parts[1])
+	if err != nil {
+		return Claims{}, fmt.Errorf("%w: signature: %v", ErrMalformed, err)
+	}
+
+	expected := s.sign(payloadBytes)
+	if !hmac.Equal(expected, sigBytes) {
+		return Claims{}, ErrSignatureBad
+	}
+
+	var claims Claims
+	if err := json.Unmarshal(payloadBytes, &claims); err != nil {
+		return Claims{}, fmt.Errorf("%w: json: %v", ErrMalformed, err)
+	}
+	if claims.WorkspaceID == "" || claims.Email == "" || claims.Role == "" || claims.ExpiresAt == 0 {
+		return Claims{}, ErrMissingClaim
+	}
+	if s.now().Unix() >= claims.ExpiresAt {
+		return Claims{}, ErrExpired
+	}
+	return claims, nil
+}
+
+// TokenHash returns SHA-256 of the raw token string for DB storage/lookup.
+func TokenHash(token string) []byte {
+	h := sha256.Sum256([]byte(token))
+	return h[:]
+}
+
+func (s *Signer) sign(payload []byte) []byte {
+	mac := hmac.New(sha256.New, s.key)
+	mac.Write(payload)
+	return mac.Sum(nil)
+}
+
+func b64(b []byte) string            { return base64.RawURLEncoding.EncodeToString(b) }
+func unb64(s string) ([]byte, error) { return base64.RawURLEncoding.DecodeString(s) }
+
+func randomNonce() (string, error) {
+	var buf [8]byte
+	if _, err := rand.Read(buf[:]); err != nil {
+		return "", fmt.Errorf("invite: crypto/rand: %w", err)
+	}
+	return b64(buf[:]), nil
+}
diff --git a/server/internal/auth/password/temp.go b/server/internal/auth/password/temp.go
deleted file mode 100644
index 348e5df5..00000000
--- a/server/internal/auth/password/temp.go
+++ /dev/null
@@ -1,35 +0,0 @@
-package password
-
-import (
-	"crypto/rand"
-	"errors"
-	"math/big"
-)
-
-// GenerateTemp mints a human-transcribable temporary password: 16
-// alphanumeric characters drawn from a confusables-free alphabet
-// ("l", "I", "O", "o", "0", "1" removed). The result is >= 90 bits
-// of entropy which easily clears the 60-bit floor Validate enforces
-// on the login path.
-//
-// Used by the invite flow: the admin sees this plaintext exactly
-// once in a modal, copies it to the invitee out-of-band, and the
-// server stores only the bcrypt hash. There is no forced rotation —
-// the invitee is welcome to keep this password or change it later.
-func GenerateTemp() (string, error) {
-	const alphabet = "abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789"
-	const length = 16
-	if len(alphabet) < 2 {
-		return "", errors.New("password: alphabet too small")
-	}
-	max := big.NewInt(int64(len(alphabet)))
-	buf := make([]byte, length)
-	for i := 0; i < length; i++ {
-		n, err := rand.Int(rand.Reader, max)
-		if err != nil {
-			return "", err
-		}
-		buf[i] = alphabet[n.Int64()]
-	}
-	return string(buf), nil
-}
diff --git a/server/internal/auth/password/temp_test.go b/server/internal/auth/password/temp_test.go
deleted file mode 100644
index 7942413c..00000000
--- a/server/internal/auth/password/temp_test.go
+++ /dev/null
@@ -1,63 +0,0 @@
-package password
-
-import (
-	"regexp"
-	"strings"
-	"testing"
-)
-
-func TestGenerateTempShape(t *testing.T) {
-	p, err := GenerateTemp()
-	if err != nil {
-		t.Fatalf("GenerateTemp: %v", err)
-	}
-	if len(p) != 16 {
-		t.Fatalf("length = %d, want 16 (%q)", len(p), p)
-	}
-	// No confusable characters: l, I, O, o, 0, 1 must never appear.
-	confusables := regexp.MustCompile(`[lIOo01]`)
-	if confusables.MatchString(p) {
-		t.Fatalf("contains confusable char: %q", p)
-	}
-	// Alnum only.
-	alnum := regexp.MustCompile(`^[A-Za-z2-9]+$`)
-	if !alnum.MatchString(p) {
-		t.Fatalf("contains non-alnum char: %q", p)
-	}
-}
-
-func TestGenerateTempPassesValidate(t *testing.T) {
-	// The temp password should always clear the login policy so
-	// callers can log in with it without re-prompting.
-	for i := 0; i < 10; i++ {
-		p, err := GenerateTemp()
-		if err != nil {
-			t.Fatalf("GenerateTemp: %v", err)
-		}
-		if err := Validate(p); err != nil {
-			t.Fatalf("Validate rejects generated temp %q: %v", p, err)
-		}
-	}
-}
-
-func TestGenerateTempUnique(t *testing.T) {
-	// Sanity: 20 draws should all differ with astronomical probability.
-	seen := map[string]struct{}{}
-	for i := 0; i < 20; i++ {
-		p, err := GenerateTemp()
-		if err != nil {
-			t.Fatalf("GenerateTemp: %v", err)
-		}
-		if _, dup := seen[p]; dup {
-			t.Fatalf("duplicate temp password after %d draws: %q", i, p)
-		}
-		seen[p] = struct{}{}
-	}
-	// Extra: distribution smell test — reject a result that is all
-	// digits (should be roughly 1 in 3.5B for a 16-char draw).
-	for p := range seen {
-		if strings.ContainsAny(p, "23456789") && !strings.ContainsAny(p, "abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ") {
-			t.Logf("suspicious all-digit draw: %q (statistically improbable, may be a real bug)", p)
-		}
-	}
-}
diff --git a/server/internal/db/queries/store.sql b/server/internal/db/queries/store.sql
index 8cffa10e..b981ee88 100644
--- a/server/internal/db/queries/store.sql
+++ b/server/internal/db/queries/store.sql
@@ -4520,3 +4520,61 @@ update auth_identities
 set metadata   = metadata || jsonb_build_object('last_used_at', @now_str::text),
     updated_at = @now
 where provider = 'email' and subject = @email;
+
+-- ================================================================
+-- Workspace invitations
+-- ================================================================
+
+-- name: CreateWorkspaceInvitation :exec
+insert into workspace_invitations(id, token_hash, workspace_id, email, role, invited_by, expires_at, created_at)
+values (@id::uuid, @token_hash::bytea, @workspace_id::uuid, @email, @role, @invited_by::uuid, @expires_at, @created_at);
+
+-- name: GetWorkspaceInvitationByTokenHash :one
+select
+  wi.id::text           as id,
+  wi.workspace_id::text as workspace_id,
+  wi.email,
+  wi.role,
+  wi.invited_by::text   as invited_by,
+  wi.expires_at,
+  wi.accepted_at,
+  wi.revoked_at,
+  wi.created_at,
+  w.name                as workspace_name
+from workspace_invitations wi
+join workspaces w on w.id = wi.workspace_id and w.deleted_at is null
+where wi.token_hash = @token_hash::bytea;
+
+-- name: AcceptWorkspaceInvitation :execrows
+update workspace_invitations
+set accepted_at = @now
+where token_hash = @token_hash::bytea
+  and accepted_at is null
+  and revoked_at is null
+  and expires_at > @now;
+
+-- name: RevokeWorkspaceInvitation :execrows
+update workspace_invitations
+set revoked_at = @now
+where id = @id::uuid
+  and workspace_id = @workspace_id::uuid
+  and accepted_at is null
+  and revoked_at is null;
+
+-- name: ListPendingWorkspaceInvitations :many
+select
+  wi.id::text           as id,
+  wi.email,
+  wi.role,
+  wi.invited_by::text   as invited_by,
+  u.name                as invited_by_name,
+  wi.expires_at,
+  wi.created_at
+from workspace_invitations wi
+join users u on u.id = wi.invited_by
+where wi.workspace_id = @workspace_id::uuid
+  and wi.accepted_at is null
+  and wi.revoked_at is null
+  and wi.expires_at > @now
+order by wi.created_at desc
+limit @item_limit;
diff --git a/server/internal/db/sqlc/models.go b/server/internal/db/sqlc/models.go
index 4acbf1e4..c7c071da 100644
--- a/server/internal/db/sqlc/models.go
+++ b/server/internal/db/sqlc/models.go
@@ -785,6 +785,19 @@ type WorkspaceImConnector struct {
 	DeletedAt pgtype.Timestamptz `json:"deleted_at"`
 }
 
+type WorkspaceInvitation struct {
+	ID          pgtype.UUID        `json:"id"`
+	TokenHash   []byte             `json:"token_hash"`
+	WorkspaceID pgtype.UUID        `json:"workspace_id"`
+	Email       string             `json:"email"`
+	Role        string             `json:"role"`
+	InvitedBy   pgtype.UUID        `json:"invited_by"`
+	ExpiresAt   pgtype.Timestamptz `json:"expires_at"`
+	AcceptedAt  pgtype.Timestamptz `json:"accepted_at"`
+	RevokedAt   pgtype.Timestamptz `json:"revoked_at"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+}
+
 // Workspace members and roles (with join-request state machine)
 type WorkspaceMember struct {
 	ID pgtype.UUID `json:"id"`
diff --git a/server/internal/db/sqlc/store.sql.go b/server/internal/db/sqlc/store.sql.go
index 49b84983..a9872c10 100644
--- a/server/internal/db/sqlc/store.sql.go
+++ b/server/internal/db/sqlc/store.sql.go
@@ -11,6 +11,28 @@ import (
 	"github.com/jackc/pgx/v5/pgtype"
 )
 
+const acceptWorkspaceInvitation = `-- name: AcceptWorkspaceInvitation :execrows
+update workspace_invitations
+set accepted_at = $1
+where token_hash = $2::bytea
+  and accepted_at is null
+  and revoked_at is null
+  and expires_at > $1
+`
+
+type AcceptWorkspaceInvitationParams struct {
+	Now       pgtype.Timestamptz `json:"now"`
+	TokenHash []byte             `json:"token_hash"`
+}
+
+func (q *Queries) AcceptWorkspaceInvitation(ctx context.Context, arg AcceptWorkspaceInvitationParams) (int64, error) {
+	result, err := q.db.Exec(ctx, acceptWorkspaceInvitation, arg.Now, arg.TokenHash)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
 const activeAgentSlugExists = `-- name: ActiveAgentSlugExists :one
 select exists(
   select 1 from agents
@@ -2833,6 +2855,40 @@ func (q *Queries) CreateWorkspaceConversation(ctx context.Context, arg CreateWor
 	return i, err
 }
 
+const createWorkspaceInvitation = `-- name: CreateWorkspaceInvitation :exec
+
+insert into workspace_invitations(id, token_hash, workspace_id, email, role, invited_by, expires_at, created_at)
+values ($1::uuid, $2::bytea, $3::uuid, $4, $5, $6::uuid, $7, $8)
+`
+
+type CreateWorkspaceInvitationParams struct {
+	ID          pgtype.UUID        `json:"id"`
+	TokenHash   []byte             `json:"token_hash"`
+	WorkspaceID pgtype.UUID        `json:"workspace_id"`
+	Email       string             `json:"email"`
+	Role        string             `json:"role"`
+	InvitedBy   pgtype.UUID        `json:"invited_by"`
+	ExpiresAt   pgtype.Timestamptz `json:"expires_at"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+}
+
+// ================================================================
+// Workspace invitations
+// ================================================================
+func (q *Queries) CreateWorkspaceInvitation(ctx context.Context, arg CreateWorkspaceInvitationParams) error {
+	_, err := q.db.Exec(ctx, createWorkspaceInvitation,
+		arg.ID,
+		arg.TokenHash,
+		arg.WorkspaceID,
+		arg.Email,
+		arg.Role,
+		arg.InvitedBy,
+		arg.ExpiresAt,
+		arg.CreatedAt,
+	)
+	return err
+}
+
 const deleteAgentCapability = `-- name: DeleteAgentCapability :exec
 delete from agent_capabilities
 where id = $1::uuid
@@ -5829,6 +5885,54 @@ func (q *Queries) GetWorkspaceIMConnectors(ctx context.Context, workspaceID pgty
 	return items, nil
 }
 
+const getWorkspaceInvitationByTokenHash = `-- name: GetWorkspaceInvitationByTokenHash :one
+select
+  wi.id::text           as id,
+  wi.workspace_id::text as workspace_id,
+  wi.email,
+  wi.role,
+  wi.invited_by::text   as invited_by,
+  wi.expires_at,
+  wi.accepted_at,
+  wi.revoked_at,
+  wi.created_at,
+  w.name                as workspace_name
+from workspace_invitations wi
+join workspaces w on w.id = wi.workspace_id and w.deleted_at is null
+where wi.token_hash = $1::bytea
+`
+
+type GetWorkspaceInvitationByTokenHashRow struct {
+	ID            string             `json:"id"`
+	WorkspaceID   string             `json:"workspace_id"`
+	Email         string             `json:"email"`
+	Role          string             `json:"role"`
+	InvitedBy     string             `json:"invited_by"`
+	ExpiresAt     pgtype.Timestamptz `json:"expires_at"`
+	AcceptedAt    pgtype.Timestamptz `json:"accepted_at"`
+	RevokedAt     pgtype.Timestamptz `json:"revoked_at"`
+	CreatedAt     pgtype.Timestamptz `json:"created_at"`
+	WorkspaceName string             `json:"workspace_name"`
+}
+
+func (q *Queries) GetWorkspaceInvitationByTokenHash(ctx context.Context, tokenHash []byte) (GetWorkspaceInvitationByTokenHashRow, error) {
+	row := q.db.QueryRow(ctx, getWorkspaceInvitationByTokenHash, tokenHash)
+	var i GetWorkspaceInvitationByTokenHashRow
+	err := row.Scan(
+		&i.ID,
+		&i.WorkspaceID,
+		&i.Email,
+		&i.Role,
+		&i.InvitedBy,
+		&i.ExpiresAt,
+		&i.AcceptedAt,
+		&i.RevokedAt,
+		&i.CreatedAt,
+		&i.WorkspaceName,
+	)
+	return i, err
+}
+
 const getWorkspaceMemberRole = `-- name: GetWorkspaceMemberRole :one
 select role
 from workspace_members
@@ -7819,6 +7923,69 @@ func (q *Queries) ListPendingJoinRequests(ctx context.Context, workspaceID pgtyp
 	return items, nil
 }
 
+const listPendingWorkspaceInvitations = `-- name: ListPendingWorkspaceInvitations :many
+select
+  wi.id::text           as id,
+  wi.email,
+  wi.role,
+  wi.invited_by::text   as invited_by,
+  u.name                as invited_by_name,
+  wi.expires_at,
+  wi.created_at
+from workspace_invitations wi
+join users u on u.id = wi.invited_by
+where wi.workspace_id = $1::uuid
+  and wi.accepted_at is null
+  and wi.revoked_at is null
+  and wi.expires_at > $2
+order by wi.created_at desc
+limit $3
+`
+
+type ListPendingWorkspaceInvitationsParams struct {
+	WorkspaceID pgtype.UUID        `json:"workspace_id"`
+	Now         pgtype.Timestamptz `json:"now"`
+	ItemLimit   int32              `json:"item_limit"`
+}
+
+type ListPendingWorkspaceInvitationsRow struct {
+	ID            string             `json:"id"`
+	Email         string             `json:"email"`
+	Role          string             `json:"role"`
+	InvitedBy     string             `json:"invited_by"`
+	InvitedByName string             `json:"invited_by_name"`
+	ExpiresAt     pgtype.Timestamptz `json:"expires_at"`
+	CreatedAt     pgtype.Timestamptz `json:"created_at"`
+}
+
+func (q *Queries) ListPendingWorkspaceInvitations(ctx context.Context, arg ListPendingWorkspaceInvitationsParams) ([]ListPendingWorkspaceInvitationsRow, error) {
+	rows, err := q.db.Query(ctx, listPendingWorkspaceInvitations, arg.WorkspaceID, arg.Now, arg.ItemLimit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListPendingWorkspaceInvitationsRow{}
+	for rows.Next() {
+		var i ListPendingWorkspaceInvitationsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Email,
+			&i.Role,
+			&i.InvitedBy,
+			&i.InvitedByName,
+			&i.ExpiresAt,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listSandboxPoolEntriesDueForAutoRenew = `-- name: ListSandboxPoolEntriesDueForAutoRenew :many
 select
   sandbox_id,
@@ -9923,6 +10090,29 @@ func (q *Queries) RevokeSession(ctx context.Context, arg RevokeSessionParams) er
 	return err
 }
 
+const revokeWorkspaceInvitation = `-- name: RevokeWorkspaceInvitation :execrows
+update workspace_invitations
+set revoked_at = $1
+where id = $2::uuid
+  and workspace_id = $3::uuid
+  and accepted_at is null
+  and revoked_at is null
+`
+
+type RevokeWorkspaceInvitationParams struct {
+	Now         pgtype.Timestamptz `json:"now"`
+	ID          pgtype.UUID        `json:"id"`
+	WorkspaceID pgtype.UUID        `json:"workspace_id"`
+}
+
+func (q *Queries) RevokeWorkspaceInvitation(ctx context.Context, arg RevokeWorkspaceInvitationParams) (int64, error) {
+	result, err := q.db.Exec(ctx, revokeWorkspaceInvitation, arg.Now, arg.ID, arg.WorkspaceID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
 const setAgentRunOutputMessageID = `-- name: SetAgentRunOutputMessageID :exec
 update agent_runs
 set output_message_id = $1::uuid,
diff --git a/server/internal/dev/routes.go b/server/internal/dev/routes.go
index ee740178..bf3352ea 100644
--- a/server/internal/dev/routes.go
+++ b/server/internal/dev/routes.go
@@ -20,6 +20,7 @@ import (
 
 	"github.com/MiniMax-AI-Dev/parsar/server/internal/auth"
 	authfeishu "github.com/MiniMax-AI-Dev/parsar/server/internal/auth/feishu"
+	authinvite "github.com/MiniMax-AI-Dev/parsar/server/internal/auth/invite"
 	authpassword "github.com/MiniMax-AI-Dev/parsar/server/internal/auth/password"
 	"github.com/MiniMax-AI-Dev/parsar/server/internal/connector"
 	gatewaypkg "github.com/MiniMax-AI-Dev/parsar/server/internal/gateway"
@@ -31,6 +32,8 @@ import (
 	"github.com/MiniMax-AI-Dev/parsar/server/internal/storage/blob"
 	"github.com/MiniMax-AI-Dev/parsar/server/internal/store"
 	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/httprate"
+	"github.com/google/uuid"
 )
 
 var mentionPattern = regexp.MustCompile(`@[\p{Han}A-Za-z0-9_-]+`)
@@ -173,6 +176,11 @@ type RuntimeStore interface {
 	UpdateWorkspace(ctx context.Context, input store.UpdateWorkspaceInput) (store.UserWorkspaceRead, error)
 	ArchiveWorkspace(ctx context.Context, input store.ArchiveWorkspaceInput) (store.UserWorkspaceRead, error)
 	AddWorkspaceMember(ctx context.Context, input store.AddWorkspaceMemberInput) (store.AddWorkspaceMemberResult, error)
+	AcceptInvitation(ctx context.Context, input store.AcceptInvitationInput) (store.AddWorkspaceMemberResult, error)
+	CreateInvitation(ctx context.Context, input store.CreateInvitationInput) error
+	ListPendingInvitations(ctx context.Context, workspaceID string) ([]store.PendingInvitationRead, error)
+	RevokeInvitation(ctx context.Context, workspaceID, invitationID string) (int64, error)
+	GetInvitationByTokenHash(ctx context.Context, tokenHash []byte) (store.InvitationRead, error)
 	UpdateWorkspaceMemberRole(ctx context.Context, workspaceID string, userID string, role string, now time.Time) (store.WorkspaceMemberRead, error)
 	RemoveWorkspaceMember(ctx context.Context, workspaceID string, userID string, now time.Time) (store.RemoveWorkspaceMemberResult, error)
 	SearchUsers(ctx context.Context, input store.SearchUsersInput) ([]store.SearchUsersResultItem, error)
@@ -268,6 +276,15 @@ type routerConfig struct {
 	// "Join workspace" link. Nil keeps the card link-free and
 	// falls back to "Please contact the administrator above to join".
 	feishuJoinURLBuilder func(workspaceID string) string
+
+	// inviteSigner mints and verifies HMAC-signed invite tokens.
+	inviteSigner *authinvite.Signer
+	// inviteSessions creates sessions for newly accepted invitees.
+	inviteSessions auth.SessionStore
+	// inviteCookieSecure mirrors the login handler's secure flag.
+	inviteCookieSecure bool
+	// publicURL is the base URL for invite links (e.g. https://app.example.com).
+	publicURL string
 }
 
 type feishuWebhookConfig struct {
@@ -435,6 +452,15 @@ func WithFeishuJoinURLBuilder(builder func(workspaceID string) string) RouterOpt
 	}
 }
 
+func WithInvite(signer *authinvite.Signer, sessions auth.SessionStore, cookieSecure bool, publicURL string) RouterOption {
+	return func(cfg *routerConfig) {
+		cfg.inviteSigner = signer
+		cfg.inviteSessions = sessions
+		cfg.inviteCookieSecure = cookieSecure
+		cfg.publicURL = strings.TrimRight(publicURL, "/")
+	}
+}
+
 // runnerDeps is kept so the dev HTTP-agent endpoints retain their call
 // shape. Step 5 makes httprunner HTTP-only, so no connector deps are
 // passed from the router.
@@ -512,6 +538,13 @@ func RegisterRoutesWithStore(r chi.Router, runtimeStore RuntimeStore, opts ...Ro
 			// browser session. Keep this public so Feishu can deliver URL
 			// challenges and message events.
 			r.Post("/feishu/events/message", createFeishuMessageEvent(runtimeStore, cfg.feishuWebhook, cfg.feishuJoinURLBuilder))
+			if cfg.inviteSigner != nil {
+				r.Post("/invite/info", getInviteInfo(runtimeStore, cfg))
+				r.Group(func(r chi.Router) {
+					r.Use(httprate.LimitBy(10, time.Minute, httprate.KeyByIP))
+					r.Post("/invite/accept", acceptInvitation(runtimeStore, cfg))
+				})
+			}
 			if cfg.oauthDeps != nil {
 				// Real Feishu OIDC login. start → redirect to Feishu;
 				// callback → upsert user + bind auth_identity + issue
@@ -634,6 +667,11 @@ func RegisterRoutesWithStore(r chi.Router, runtimeStore RuntimeStore, opts ...Ro
 			r.Post("/workspaces/{workspaceID}/members", addWorkspaceMember(runtimeStore))
 			r.Patch("/workspaces/{workspaceID}/members/{userID}", updateWorkspaceMemberRole(runtimeStore))
 			r.Delete("/workspaces/{workspaceID}/members/{userID}", removeWorkspaceMember(runtimeStore))
+			if cfg.inviteSigner != nil {
+				r.Post("/workspaces/{workspaceID}/invitations", createInvitation(runtimeStore, cfg))
+				r.Get("/workspaces/{workspaceID}/invitations", listInvitations(runtimeStore))
+				r.Delete("/workspaces/{workspaceID}/invitations/{invitationID}", revokeInvitation(runtimeStore))
+			}
 			// Workspace self-service join request:
 			//   POST   /workspaces/{wid}/join-requests              User submits request (identity: logged in)
 			//   DELETE /workspaces/{wid}/join-requests/mine          Requester self-withdraws own pending
@@ -4897,22 +4935,11 @@ type addWorkspaceMemberRequest struct {
 	Email string `json:"email"`
 	Name  string `json:"name"`
 	Role  string `json:"role"`
-	// Invite, when true, provisions a local email/password identity for
-	// a brand-new user and returns the plaintext temporary password
-	// once in the response body. The admin is expected to relay that
-	// password to the invitee out-of-band. False (default) preserves
-	// the pre-existing behaviour: the member row is created but no
-	// local credential is bound (Feishu / OIDC-only tenants).
-	Invite bool `json:"invite,omitempty"`
-}
-
-// addWorkspaceMemberResponse extends store.AddWorkspaceMemberResult with
-// the plaintext temp password on invite flows. Nil field means no
-// invite happened (either invite=false or the user already existed).
+}
+
 type addWorkspaceMemberResponse struct {
-	Member       store.WorkspaceMemberRead `json:"member"`
-	UserCreated  bool                      `json:"user_created"`
-	TempPassword string                    `json:"temp_password,omitempty"`
+	Member      store.WorkspaceMemberRead `json:"member"`
+	UserCreated bool                      `json:"user_created"`
 }
 
 // addWorkspaceMember adds a user to a workspace.
@@ -4962,55 +4989,282 @@ func addWorkspaceMember(runtimeStore RuntimeStore) http.HandlerFunc {
 			return
 		}
 
-		// Invite path: mint the plaintext temp password up front so
-		// we can pass its hash into the tx AND hand the plaintext back
-		// to the admin exactly once. On failure below (409, DB error,
-		// etc.) the plaintext never leaks — it lives only in this
-		// function frame.
-		var (
-			tempPassword string
-			passwordHash string
-		)
-		if req.Invite {
-			p, gErr := authpassword.GenerateTemp()
-			if gErr != nil {
-				writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to generate temp password"})
-				return
-			}
-			h, hErr := authpassword.Hash(p)
-			if hErr != nil {
-				writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to hash temp password"})
+		result, err := runtimeStore.AddWorkspaceMember(r.Context(), store.AddWorkspaceMemberInput{
+			WorkspaceID: workspaceID,
+			Email:       req.Email,
+			Name:        req.Name,
+			Role:        req.Role,
+			Now:         time.Now().UTC(),
+		})
+		if err != nil {
+			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to add workspace member"})
+			return
+		}
+
+		writeJSON(w, http.StatusCreated, addWorkspaceMemberResponse{
+			Member:      result.Member,
+			UserCreated: result.UserCreated,
+		})
+	}
+}
+
+// ── Invitation handlers ─────────────────────────────────────────
+
+type createInvitationRequest struct {
+	Email string `json:"email"`
+	Name  string `json:"name,omitempty"`
+	Role  string `json:"role"`
+}
+
+type createInvitationResponse struct {
+	InvitationID string `json:"invitation_id"`
+	InviteLink   string `json:"invite_link"`
+	Email        string `json:"email"`
+	Role         string `json:"role"`
+	ExpiresAt    string `json:"expires_at"`
+}
+
+func createInvitation(runtimeStore RuntimeStore, cfg *routerConfig) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		workspaceID := strings.TrimSpace(chi.URLParam(r, "workspaceID"))
+		if !isUUID(workspaceID) {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "workspace_id must be a valid uuid"})
+			return
+		}
+		if err := requireWorkspaceOwnerOrAdmin(r, runtimeStore, workspaceID); err != nil {
+			writeRBACError(w, err)
+			return
+		}
+		var req createInvitationRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid json body"})
+			return
+		}
+		req.Email = strings.TrimSpace(req.Email)
+		req.Role = strings.TrimSpace(req.Role)
+		if req.Email == "" {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "email is required"})
+			return
+		}
+		if !store.IsValidMemberRole(req.Role) {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "role must be one of owner|admin|member|viewer"})
+			return
+		}
+
+		token, err := cfg.inviteSigner.Sign(workspaceID, req.Email, req.Role, authinvite.MaxLifetime)
+		if err != nil {
+			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to sign invite token"})
+			return
+		}
+
+		now := time.Now().UTC()
+		expiresAt := now.Add(authinvite.MaxLifetime)
+		invID := uuid.New().String()
+
+		callerID := auth.UserIDFromContext(r.Context())
+		if callerID == "" {
+			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "missing caller identity"})
+			return
+		}
+
+		if err := runtimeStore.CreateInvitation(r.Context(), store.CreateInvitationInput{
+			ID:          invID,
+			TokenHash:   authinvite.TokenHash(token),
+			WorkspaceID: workspaceID,
+			Email:       req.Email,
+			Role:        req.Role,
+			InvitedBy:   callerID,
+			ExpiresAt:   expiresAt,
+			Now:         now,
+		}); err != nil {
+			if strings.Contains(err.Error(), "uk_workspace_invitations_pending_email") {
+				writeJSON(w, http.StatusConflict, map[string]string{"error": "an invitation is already pending for this email"})
 				return
 			}
-			tempPassword = p
-			passwordHash = h
+			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to create invitation"})
+			return
 		}
 
-		result, err := runtimeStore.AddWorkspaceMember(r.Context(), store.AddWorkspaceMemberInput{
-			WorkspaceID:  workspaceID,
-			Email:        req.Email,
-			Name:         req.Name,
+		link := cfg.publicURL + "/invite/" + token
+		writeJSON(w, http.StatusCreated, createInvitationResponse{
+			InvitationID: invID,
+			InviteLink:   link,
+			Email:        store.NormalizeEmail(req.Email),
 			Role:         req.Role,
-			PasswordHash: passwordHash,
-			Now:          time.Now().UTC(),
+			ExpiresAt:    expiresAt.Format(time.RFC3339),
 		})
+	}
+}
+
+func listInvitations(runtimeStore RuntimeStore) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		workspaceID := strings.TrimSpace(chi.URLParam(r, "workspaceID"))
+		if !isUUID(workspaceID) {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "workspace_id must be a valid uuid"})
+			return
+		}
+		if err := requireWorkspaceOwnerOrAdmin(r, runtimeStore, workspaceID); err != nil {
+			writeRBACError(w, err)
+			return
+		}
+
+		rows, err := runtimeStore.ListPendingInvitations(r.Context(), workspaceID)
 		if err != nil {
-			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to add workspace member"})
+			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to list invitations"})
 			return
 		}
+		writeJSON(w, http.StatusOK, rows)
+	}
+}
 
-		resp := addWorkspaceMemberResponse{
-			Member:      result.Member,
-			UserCreated: result.UserCreated,
+func revokeInvitation(runtimeStore RuntimeStore) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		workspaceID := strings.TrimSpace(chi.URLParam(r, "workspaceID"))
+		invitationID := strings.TrimSpace(chi.URLParam(r, "invitationID"))
+		if !isUUID(workspaceID) || !isUUID(invitationID) {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "workspace_id and invitation_id must be valid uuids"})
+			return
+		}
+		if err := requireWorkspaceOwnerOrAdmin(r, runtimeStore, workspaceID); err != nil {
+			writeRBACError(w, err)
+			return
+		}
+
+		rows, err := runtimeStore.RevokeInvitation(r.Context(), workspaceID, invitationID)
+		if err != nil {
+			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to revoke invitation"})
+			return
+		}
+		if rows == 0 {
+			writeJSON(w, http.StatusNotFound, map[string]string{"error": "invitation not found or already consumed"})
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+type inviteInfoRequest struct {
+	Token string `json:"token"`
+}
+
+type inviteInfoResponse struct {
+	WorkspaceName string `json:"workspace_name"`
+	Email         string `json:"email"`
+	Role          string `json:"role"`
+}
+
+func getInviteInfo(runtimeStore RuntimeStore, cfg *routerConfig) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req inviteInfoRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid json body"})
+			return
 		}
-		// Only surface the plaintext when we actually bound an identity.
-		// Store side won't write the hash if the user already existed;
-		// suppressing here keeps the response body honest ("password?
-		// means new + invited").
-		if req.Invite && result.UserCreated {
-			resp.TempPassword = tempPassword
+		token := strings.TrimSpace(req.Token)
+		if token == "" {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "token is required"})
+			return
+		}
+
+		claims, err := cfg.inviteSigner.Verify(token)
+		if err != nil {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid or expired token"})
+			return
+		}
+
+		inv, err := runtimeStore.GetInvitationByTokenHash(r.Context(), authinvite.TokenHash(token))
+		if err != nil {
+			writeJSON(w, http.StatusNotFound, map[string]string{"error": "invitation not found"})
+			return
 		}
-		writeJSON(w, http.StatusCreated, resp)
+		if inv.AcceptedAt != nil || inv.RevokedAt != nil || inv.ExpiresAt.Before(time.Now()) {
+			writeJSON(w, http.StatusGone, map[string]string{"error": "invitation has already been used or revoked"})
+			return
+		}
+
+		writeJSON(w, http.StatusOK, inviteInfoResponse{
+			WorkspaceName: inv.WorkspaceName,
+			Email:         claims.Email,
+			Role:          claims.Role,
+		})
+	}
+}
+
+type acceptInvitationRequest struct {
+	Token    string `json:"token"`
+	Password string `json:"password"`
+}
+
+type acceptInvitationResponse struct {
+	UserID      string `json:"user_id"`
+	Email       string `json:"email"`
+	WorkspaceID string `json:"workspace_id"`
+}
+
+func acceptInvitation(runtimeStore RuntimeStore, cfg *routerConfig) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req acceptInvitationRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid json body"})
+			return
+		}
+		req.Token = strings.TrimSpace(req.Token)
+		if req.Token == "" || req.Password == "" {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "token and password are required"})
+			return
+		}
+
+		claims, err := cfg.inviteSigner.Verify(req.Token)
+		if err != nil {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid or expired token"})
+			return
+		}
+
+		if err := authpassword.Validate(req.Password); err != nil {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+			return
+		}
+
+		hash, err := authpassword.Hash(req.Password)
+		if err != nil {
+			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to hash password"})
+			return
+		}
+
+		now := time.Now().UTC()
+		result, err := runtimeStore.AcceptInvitation(r.Context(), store.AcceptInvitationInput{
+			TokenHash:    authinvite.TokenHash(req.Token),
+			Email:        claims.Email,
+			Role:         claims.Role,
+			WorkspaceID:  claims.WorkspaceID,
+			PasswordHash: hash,
+			Now:          now,
+		})
+		if err != nil {
+			if errors.Is(err, store.ErrInvitationInvalid) {
+				writeJSON(w, http.StatusGone, map[string]string{"error": "invitation is invalid, expired, or already used"})
+				return
+			}
+			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to accept invitation"})
+			return
+		}
+
+		sid, err := cfg.inviteSessions.Create(r.Context(), auth.CreateSessionInput{
+			UserID:    result.Member.UserID,
+			UserAgent: r.UserAgent(),
+			IP:        r.RemoteAddr,
+		})
+		if err != nil {
+			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to create session"})
+			return
+		}
+		auth.IssueCookie(w, sid, 0, cfg.inviteCookieSecure)
+
+		writeJSON(w, http.StatusOK, acceptInvitationResponse{
+			UserID:      result.Member.UserID,
+			Email:       result.Member.UserEmail,
+			WorkspaceID: result.Member.WorkspaceID,
+		})
 	}
 }
 
@@ -5063,6 +5317,24 @@ func updateWorkspaceMemberRole(runtimeStore RuntimeStore) http.HandlerFunc {
 			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "role must be one of owner|admin|member|viewer"})
 			return
 		}
+		// Prevent changing the owner's role — ownership is transferred, not edited.
+		targetRole, err := runtimeStore.GetWorkspaceMemberRole(r.Context(), workspaceID, userID)
+		if err != nil {
+			if errors.Is(err, store.ErrNotMember) {
+				writeJSON(w, http.StatusNotFound, map[string]string{"error": "workspace member not found"})
+				return
+			}
+			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to look up member"})
+			return
+		}
+		if targetRole == "owner" {
+			writeJSON(w, http.StatusForbidden, map[string]string{"error": "cannot change the owner's role; use ownership transfer instead"})
+			return
+		}
+		if req.Role == "owner" {
+			writeJSON(w, http.StatusForbidden, map[string]string{"error": "cannot promote to owner; use ownership transfer instead"})
+			return
+		}
 		member, err := runtimeStore.UpdateWorkspaceMemberRole(r.Context(), workspaceID, userID, req.Role, time.Now().UTC())
 		if err != nil {
 			if errors.Is(err, store.ErrUnknownWorkspaceMember) {
@@ -5096,6 +5368,20 @@ func removeWorkspaceMember(runtimeStore RuntimeStore) http.HandlerFunc {
 			writeRBACError(w, err)
 			return
 		}
+		// Prevent removing the workspace owner.
+		targetRole, err := runtimeStore.GetWorkspaceMemberRole(r.Context(), workspaceID, userID)
+		if err != nil {
+			if errors.Is(err, store.ErrNotMember) {
+				writeJSON(w, http.StatusNotFound, map[string]string{"error": "workspace member not found"})
+				return
+			}
+			writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "failed to look up member"})
+			return
+		}
+		if targetRole == "owner" {
+			writeJSON(w, http.StatusForbidden, map[string]string{"error": "cannot remove the workspace owner"})
+			return
+		}
 		result, err := runtimeStore.RemoveWorkspaceMember(r.Context(), workspaceID, userID, time.Now().UTC())
 		if err != nil {
 			if errors.Is(err, store.ErrUnknownWorkspaceMember) {
diff --git a/server/internal/dev/routes_test.go b/server/internal/dev/routes_test.go
index 8c658626..6f4a8d24 100644
--- a/server/internal/dev/routes_test.go
+++ b/server/internal/dev/routes_test.go
@@ -4165,3 +4165,19 @@ func (stubRuntimeStore) UpsertWorkspaceFeishuConnector(ctx context.Context, inpu
 func (stubRuntimeStore) UpsertWorkspaceTeamsConnector(ctx context.Context, input store.UpsertWorkspaceTeamsConnectorInput, actorID string) (store.WorkspaceConnectorChange, error) {
 	return store.WorkspaceConnectorChange{}, nil
 }
+
+func (stubRuntimeStore) AcceptInvitation(ctx context.Context, input store.AcceptInvitationInput) (store.AddWorkspaceMemberResult, error) {
+	return store.AddWorkspaceMemberResult{}, nil
+}
+func (stubRuntimeStore) CreateInvitation(ctx context.Context, input store.CreateInvitationInput) error {
+	return nil
+}
+func (stubRuntimeStore) ListPendingInvitations(ctx context.Context, workspaceID string) ([]store.PendingInvitationRead, error) {
+	return nil, nil
+}
+func (stubRuntimeStore) RevokeInvitation(ctx context.Context, workspaceID, invitationID string) (int64, error) {
+	return 0, nil
+}
+func (stubRuntimeStore) GetInvitationByTokenHash(ctx context.Context, tokenHash []byte) (store.InvitationRead, error) {
+	return store.InvitationRead{}, nil
+}
diff --git a/server/internal/store/email.go b/server/internal/store/email.go
index a19028d8..d30c0741 100644
--- a/server/internal/store/email.go
+++ b/server/internal/store/email.go
@@ -23,3 +23,7 @@ import "strings"
 func normalizeEmail(email string) string {
 	return strings.ToLower(strings.TrimSpace(email))
 }
+
+func NormalizeEmail(email string) string {
+	return normalizeEmail(email)
+}
diff --git a/server/internal/store/store.go b/server/internal/store/store.go
index 6335a109..27eccd79 100644
--- a/server/internal/store/store.go
+++ b/server/internal/store/store.go
@@ -890,6 +890,7 @@ var ErrInvalidAgent = errors.New("invalid active agent relation")
 var ErrInvalidHTTPConnector = errors.New("agent run is not configured for http connector")
 var ErrUnknownWorkspaceMember = errors.New("unknown active workspace member")
 var ErrInvalidMemberRole = errors.New("invalid member role")
+var ErrInvitationInvalid = errors.New("invitation is invalid, expired, or already used")
 var ErrNotMember = errors.New("not an active member")
 
 // Self-service workspace join request errors:
@@ -1927,19 +1928,12 @@ func (s *Store) CountActiveFeishuBotAgents(ctx context.Context) (int, error) {
 
 // AddWorkspaceMemberInput drives admin-side member add. The user record is
 // created on the fly when the email is new (or reused if on file).
-//
-// PasswordHash is optional. When supplied AND the user row was newly
-// inserted, the tx also writes auth_identities(provider='email') so
-// the invitee can log in with the temporary password. Reusing an
-// existing user's row never overwrites their password — an admin
-// cannot silently rotate someone else's credentials by re-inviting.
 type AddWorkspaceMemberInput struct {
-	WorkspaceID  string
-	Email        string
-	Name         string
-	Role         string
-	PasswordHash string
-	Now          time.Time
+	WorkspaceID string
+	Email       string
+	Name        string
+	Role        string
+	Now         time.Time
 }
 
 // AddWorkspaceMemberResult is the membership row plus user-side metadata.
@@ -5102,29 +5096,6 @@ func (s *Store) AddWorkspaceMember(ctx context.Context, input AddWorkspaceMember
 		return AddWorkspaceMemberResult{}, err
 	}
 
-	// Bind local email/password identity ONLY when this is a fresh
-	// user row and the caller supplied a hash. Re-adding a pre-
-	// existing user to a workspace must never rotate their password.
-	if input.PasswordHash != "" && userRow.Created {
-		metaBytes, mErr := json.Marshal(map[string]string{
-			"password_hash": input.PasswordHash,
-			"hashed_at":     input.Now.Format(time.RFC3339),
-			"invited":       "true",
-		})
-		if mErr != nil {
-			return AddWorkspaceMemberResult{}, fmt.Errorf("marshal invite email identity metadata: %w", mErr)
-		}
-		if err := q.UpsertEmailPasswordIdentity(ctx, sqlc.UpsertEmailPasswordIdentityParams{
-			ID:       mustUUID(newID()),
-			UserID:   mustUUID(userRow.ID),
-			Email:    email,
-			Metadata: metaBytes,
-			Now:      timestamptz(input.Now),
-		}); err != nil {
-			return AddWorkspaceMemberResult{}, fmt.Errorf("upsert email identity for invite: %w", err)
-		}
-	}
-
 	memberRow, err := q.AddWorkspaceMember(ctx, sqlc.AddWorkspaceMemberParams{
 		ID:            mustUUID(newID()),
 		WorkspaceID:   wsUUID,
@@ -5175,6 +5146,230 @@ func (s *Store) AddWorkspaceMember(ctx context.Context, input AddWorkspaceMember
 	}, nil
 }
 
+// AcceptInvitationInput carries the data needed to atomically consume
+// an invite token and provision the user + workspace membership.
+type AcceptInvitationInput struct {
+	TokenHash    []byte
+	Email        string
+	Role         string
+	WorkspaceID  string
+	PasswordHash string
+	Now          time.Time
+}
+
+// AcceptInvitation atomically: marks the invitation consumed, upserts
+// the user, binds email/password identity, and adds workspace membership.
+func (s *Store) AcceptInvitation(ctx context.Context, input AcceptInvitationInput) (AddWorkspaceMemberResult, error) {
+	if !IsValidMemberRole(input.Role) {
+		return AddWorkspaceMemberResult{}, fmt.Errorf("%w: %s", ErrInvalidMemberRole, input.Role)
+	}
+	email := normalizeEmail(input.Email)
+	wsUUID, err := uuid(input.WorkspaceID)
+	if err != nil {
+		return AddWorkspaceMemberResult{}, err
+	}
+
+	beginner, ok := s.db.(txBeginner)
+	if !ok {
+		return AddWorkspaceMemberResult{}, fmt.Errorf("backing pool does not support transactions")
+	}
+	tx, err := beginner.Begin(ctx)
+	if err != nil {
+		return AddWorkspaceMemberResult{}, err
+	}
+	defer tx.Rollback(ctx) //nolint:errcheck
+
+	q := sqlc.New(tx)
+
+	// CAS: mark invitation consumed. Returns 0 rows if already used/revoked/expired.
+	rows, err := q.AcceptWorkspaceInvitation(ctx, sqlc.AcceptWorkspaceInvitationParams{
+		TokenHash: input.TokenHash,
+		Now:       timestamptz(input.Now),
+	})
+	if err != nil {
+		return AddWorkspaceMemberResult{}, err
+	}
+	if rows == 0 {
+		return AddWorkspaceMemberResult{}, ErrInvitationInvalid
+	}
+
+	// Upsert user by email.
+	name := email
+	if at := strings.Index(email, "@"); at > 0 {
+		name = email[:at]
+	}
+	userRow, err := q.UpsertUserByEmail(ctx, sqlc.UpsertUserByEmailParams{
+		ID:    mustUUID(newID()),
+		Email: email,
+		Name:  name,
+		Now:   timestamptz(input.Now),
+	})
+	if err != nil {
+		return AddWorkspaceMemberResult{}, err
+	}
+
+	// Bind email/password identity (create or update password).
+	metaBytes, err := json.Marshal(map[string]string{
+		"password_hash": input.PasswordHash,
+		"hashed_at":     input.Now.Format(time.RFC3339),
+		"invited":       "true",
+	})
+	if err != nil {
+		return AddWorkspaceMemberResult{}, fmt.Errorf("marshal identity metadata: %w", err)
+	}
+	if err := q.UpsertEmailPasswordIdentity(ctx, sqlc.UpsertEmailPasswordIdentityParams{
+		ID:       mustUUID(newID()),
+		UserID:   mustUUID(userRow.ID),
+		Email:    email,
+		Metadata: metaBytes,
+		Now:      timestamptz(input.Now),
+	}); err != nil {
+		return AddWorkspaceMemberResult{}, fmt.Errorf("upsert email identity: %w", err)
+	}
+
+	// Add workspace membership.
+	memberRow, err := q.AddWorkspaceMember(ctx, sqlc.AddWorkspaceMemberParams{
+		ID:            mustUUID(newID()),
+		WorkspaceID:   wsUUID,
+		UserID:        mustUUID(userRow.ID),
+		Role:          input.Role,
+		Status:        memberStatusActive,
+		RequestReason: "",
+		Now:           timestamptz(input.Now),
+	})
+	if err != nil {
+		return AddWorkspaceMemberResult{}, err
+	}
+
+	if err := tx.Commit(ctx); err != nil {
+		return AddWorkspaceMemberResult{}, err
+	}
+
+	return AddWorkspaceMemberResult{
+		Member: WorkspaceMemberRead{
+			ID:          memberRow.ID,
+			WorkspaceID: memberRow.WorkspaceID,
+			UserID:      memberRow.UserID,
+			Role:        memberRow.Role,
+			UserEmail:   userRow.Email,
+			UserName:    userRow.Name,
+			UserStatus:  userRow.Status,
+			CreatedAt:   pgTime(memberRow.CreatedAt),
+			UpdatedAt:   pgTime(memberRow.UpdatedAt),
+		},
+		UserCreated: userRow.Created,
+	}, nil
+}
+
+// ── Invitation CRUD ─────────────────────────────────────────────
+
+type CreateInvitationInput struct {
+	ID          string
+	TokenHash   []byte
+	WorkspaceID string
+	Email       string
+	Role        string
+	InvitedBy   string
+	ExpiresAt   time.Time
+	Now         time.Time
+}
+
+type PendingInvitationRead struct {
+	ID            string    `json:"id"`
+	Email         string    `json:"email"`
+	Role          string    `json:"role"`
+	InvitedBy     string    `json:"invited_by"`
+	InvitedByName string    `json:"invited_by_name"`
+	ExpiresAt     time.Time `json:"expires_at"`
+	CreatedAt     time.Time `json:"created_at"`
+}
+
+type InvitationRead struct {
+	ID            string     `json:"id"`
+	WorkspaceID   string     `json:"workspace_id"`
+	Email         string     `json:"email"`
+	Role          string     `json:"role"`
+	InvitedBy     string     `json:"invited_by"`
+	ExpiresAt     time.Time  `json:"expires_at"`
+	AcceptedAt    *time.Time `json:"accepted_at"`
+	RevokedAt     *time.Time `json:"revoked_at"`
+	CreatedAt     time.Time  `json:"created_at"`
+	WorkspaceName string     `json:"workspace_name"`
+}
+
+func (s *Store) CreateInvitation(ctx context.Context, input CreateInvitationInput) error {
+	q := sqlc.New(s.db)
+	return q.CreateWorkspaceInvitation(ctx, sqlc.CreateWorkspaceInvitationParams{
+		ID:          mustUUID(input.ID),
+		TokenHash:   input.TokenHash,
+		WorkspaceID: mustUUID(input.WorkspaceID),
+		Email:       normalizeEmail(input.Email),
+		Role:        input.Role,
+		InvitedBy:   mustUUID(input.InvitedBy),
+		ExpiresAt:   timestamptz(input.ExpiresAt),
+		CreatedAt:   timestamptz(input.Now),
+	})
+}
+
+func (s *Store) ListPendingInvitations(ctx context.Context, workspaceID string) ([]PendingInvitationRead, error) {
+	q := sqlc.New(s.db)
+	rows, err := q.ListPendingWorkspaceInvitations(ctx, sqlc.ListPendingWorkspaceInvitationsParams{
+		WorkspaceID: mustUUID(workspaceID),
+		Now:         timestamptz(time.Now().UTC()),
+		ItemLimit:   100,
+	})
+	if err != nil {
+		return nil, err
+	}
+	out := make([]PendingInvitationRead, len(rows))
+	for i, r := range rows {
+		out[i] = PendingInvitationRead{
+			ID:            r.ID,
+			Email:         r.Email,
+			Role:          r.Role,
+			InvitedBy:     r.InvitedBy,
+			InvitedByName: r.InvitedByName,
+			ExpiresAt:     r.ExpiresAt.Time,
+			CreatedAt:     r.CreatedAt.Time,
+		}
+	}
+	return out, nil
+}
+
+func (s *Store) RevokeInvitation(ctx context.Context, workspaceID, invitationID string) (int64, error) {
+	q := sqlc.New(s.db)
+	return q.RevokeWorkspaceInvitation(ctx, sqlc.RevokeWorkspaceInvitationParams{
+		ID:          mustUUID(invitationID),
+		WorkspaceID: mustUUID(workspaceID),
+		Now:         timestamptz(time.Now().UTC()),
+	})
+}
+
+func (s *Store) GetInvitationByTokenHash(ctx context.Context, tokenHash []byte) (InvitationRead, error) {
+	q := sqlc.New(s.db)
+	row, err := q.GetWorkspaceInvitationByTokenHash(ctx, tokenHash)
+	if err != nil {
+		return InvitationRead{}, err
+	}
+	inv := InvitationRead{
+		ID:            row.ID,
+		WorkspaceID:   row.WorkspaceID,
+		Email:         row.Email,
+		Role:          row.Role,
+		InvitedBy:     row.InvitedBy,
+		ExpiresAt:     row.ExpiresAt.Time,
+		CreatedAt:     row.CreatedAt.Time,
+		WorkspaceName: row.WorkspaceName,
+	}
+	if row.AcceptedAt.Valid {
+		inv.AcceptedAt = &row.AcceptedAt.Time
+	}
+	if row.RevokedAt.Valid {
+		inv.RevokedAt = &row.RevokedAt.Time
+	}
+	return inv, nil
+}
+
 // UpdateWorkspaceMemberRole flips an existing member's role. Returns
 // ErrUnknownWorkspaceMember when no active row exists.
 func (s *Store) UpdateWorkspaceMemberRole(ctx context.Context, workspaceID string, userID string, role string, now time.Time) (WorkspaceMemberRead, error) {
diff --git a/server/internal/store/store_test.go b/server/internal/store/store_test.go
index f4a28e67..fbab2f5e 100644
--- a/server/internal/store/store_test.go
+++ b/server/internal/store/store_test.go
@@ -3434,18 +3434,12 @@ func TestAddWorkspaceMemberLowercasesInviteEmail(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// Precomputed bcrypt hash stand-in — this test does not exercise
-	// bcrypt (that's covered in auth/password). We only need a
-	// non-empty PasswordHash to trigger the email-identity write.
-	const fakeHash = "$2a$10$fakehashthisisnotarealbcryptoutputbutlongenoughforstorage"
-
 	if _, err := store.AddWorkspaceMember(ctx, AddWorkspaceMemberInput{
-		WorkspaceID:  ids.WorkspaceID,
-		Email:        "  Bob@Company.COM  ",
-		Name:         "Bob",
-		Role:         "member",
-		PasswordHash: fakeHash,
-		Now:          time.Now().UTC(),
+		WorkspaceID: ids.WorkspaceID,
+		Email:       "  Bob@Company.COM  ",
+		Name:        "Bob",
+		Role:        "member",
+		Now:         time.Now().UTC(),
 	}); err != nil {
 		t.Fatalf("AddWorkspaceMember: %v", err)
 	}
@@ -3463,20 +3457,6 @@ func TestAddWorkspaceMemberLowercasesInviteEmail(t *testing.T) {
 	if _, err := q.GetActiveUserIDByEmail(ctx, "Bob@Company.COM"); err == nil {
 		t.Fatalf("mixed-case lookup should miss the folded row")
 	}
-
-	// auth_identities.subject must be the folded email too so the
-	// LEFT JOIN in GetPasswordHashByEmail (users.email = ai.subject)
-	// still lines up.
-	row, err := q.GetPasswordHashByEmail(ctx, "bob@company.com")
-	if err != nil {
-		t.Fatalf("GetPasswordHashByEmail: %v", err)
-	}
-	if row.PasswordHash == "" {
-		t.Fatalf("expected password_hash bound to folded email, got empty")
-	}
-	if row.PasswordHash != fakeHash {
-		t.Fatalf("password_hash mismatch: got %q", row.PasswordHash)
-	}
 }
 
 // TestMarkAgentRunRunningStateTransitionsAndConversationGuard pins the
diff --git a/server/migrations/000007_workspace_invitations.sql b/server/migrations/000007_workspace_invitations.sql
new file mode 100644
index 00000000..22359453
--- /dev/null
+++ b/server/migrations/000007_workspace_invitations.sql
@@ -0,0 +1,27 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS workspace_invitations (
+  id           uuid PRIMARY KEY,
+  token_hash   bytea NOT NULL,
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  email        text NOT NULL,
+  role         text NOT NULL,
+  invited_by   uuid NOT NULL REFERENCES users(id),
+  expires_at   timestamptz NOT NULL,
+  accepted_at  timestamptz,
+  revoked_at   timestamptz,
+  created_at   timestamptz NOT NULL
+);
+
+CREATE UNIQUE INDEX uk_workspace_invitations_token_hash
+  ON workspace_invitations(token_hash);
+
+CREATE INDEX idx_workspace_invitations_pending
+  ON workspace_invitations(workspace_id)
+  WHERE accepted_at IS NULL AND revoked_at IS NULL;
+
+CREATE UNIQUE INDEX uk_workspace_invitations_pending_email
+  ON workspace_invitations(workspace_id, email)
+  WHERE accepted_at IS NULL AND revoked_at IS NULL;
+
+-- +goose Down
+DROP TABLE IF EXISTS workspace_invitations;

From cc3cfc37f6848610d23a0087eb8db38a3042b79a Mon Sep 17 00:00:00 2001
From: yuanhe <yuanhe@minimaxi.com>
Date: Thu, 9 Jul 2026 13:45:32 +0800
Subject: [PATCH 2/2] chore: regenerate openapi spec

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docs/openapi/openapi.yaml | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/docs/openapi/openapi.yaml b/docs/openapi/openapi.yaml
index c02d7df7..c59f40de 100644
--- a/docs/openapi/openapi.yaml
+++ b/docs/openapi/openapi.yaml
@@ -187,15 +187,6 @@ definitions:
     properties:
       email:
         type: string
-      invite:
-        description: |-
-          Invite, when true, provisions a local email/password identity for
-          a brand-new user and returns the plaintext temporary password
-          once in the response body. The admin is expected to relay that
-          password to the invitee out-of-band. False (default) preserves
-          the pre-existing behaviour: the member row is created but no
-          local credential is bound (Feishu / OIDC-only tenants).
-        type: boolean
       name:
         type: string
       role: