fix(security): bind invite acceptance to invited identity

README.md

@@ -79,7 +79,7 @@ Standalone:
 python3 -m http.server 4173   # open http://127.0.0.1:4173
 ```
 
-Cloud (Node 22.13+ or 23.4+):
+Cloud (Node 22.13+ or 23.5+):
 
 ```bash
 npm install

docs/api.md

@@ -123,6 +123,13 @@ snapshot as a **new** version — history stays linear.
 
 ## Workspaces & members
 
+Invitations are **account-bound**, not registration claims. The invited email
+must already identify a ScopeWeave account; otherwise invite creation returns
+`409 { "error": "invitee must already have a ScopeWeave account" }` before a
+bearer token is minted. Possessing an invite token is not sufficient to accept
+it: the signed-in account must be the single persisted account whose
+canonicalized email matches the invitation.
+
 | Method | Path | Purpose |
 | --- | --- | --- |
 | `POST` | `/api/orgs` | `{ name }` — create an additional workspace (creator = owner) |
@@ -132,9 +139,9 @@ snapshot as a **new** version — history stays linear.
 | `GET` | `/api/orgs/:id/members` | Roster + pending invites |
 | `PATCH` | `/api/orgs/:id/members/:userId` | `{ role }` — change a member's role (manage; owner immutable) |
 | `DELETE` | `/api/orgs/:id/members/:userId` | Remove a member (manage; owner immune) |
-| `POST` | `/api/orgs/:id/invites` | `{ email, role? }` → `{ token }` invite link token (manage) |
+| `POST` | `/api/orgs/:id/invites` | `{ email, role? }` → `{ token, email, role }` (manage; invitee account must already exist; `409` otherwise) |
 | `DELETE` | `/api/orgs/:id/invites/:inviteId` | Revoke a pending invite (manage) — the token dies immediately |
-| `POST` | `/api/invites/:token/accept` | Accept an invite (any authenticated user holding the token) |
+| `POST` | `/api/invites/:token/accept` | Accept an invite as the unique authenticated account matching the invited canonical email; other identities get generic `404` |
 
 ## Billing
 
@@ -161,8 +168,8 @@ attempt is recorded.
 **Verify a delivery** — the body is signed with HMAC-SHA256:
 
 ```
-X-Scopeweave-Event:     project.update
-X-Scopeweave-Signature: sha256=<hex hmac of the raw body with your whsec_ secret>
+X-ScopeWeave-Event:     project.update
+X-ScopeWeave-Signature: sha256=<hex hmac of the raw body with your whsec_ secret>
 ```
 
 ```js

package.json

@@ -6,15 +6,15 @@
   "packageManager": "npm@10.9.2",
   "description": "Production-grade pure HTML/CSS/JS WBS planner",
   "engines": {
-    "node": "^22.13.0 || >=23.4.0"
+    "node": "^22.13.0 || >=23.5.0"
   },
   "scripts": {
     "check:python-docstrings": "node scripts/ci/static_coverage_evidence.mjs docstrings",
     "coverage": "npm run test:coverage",
     "server": "node server/server.mjs",
-    "test:api": "node tests/api/auth-secret.test.mjs && node tests/api/smoke.mjs && node tests/api/ratelimit.test.mjs && node tests/api/attachment-status.test.mjs && node tests/api/session-revocation.test.mjs && node tests/api/orchestrator-attribution.test.mjs",
+    "test:api": "node tests/api/auth-secret.test.mjs && node tests/api/invite-identity-security.test.mjs && node tests/api/smoke.mjs && node tests/api/ratelimit.test.mjs && node tests/api/attachment-status.test.mjs && node tests/api/session-revocation.test.mjs && node tests/api/orchestrator-attribution.test.mjs",
     "test:unit": "node tests/unit/opencode-config.test.mjs && node tests/unit/changelog-release-notes.test.mjs && node tests/unit/analytics.test.mjs && node tests/unit/cpm.test.mjs && node tests/unit/baseline-compare.test.mjs && node tests/unit/workload.test.mjs && node tests/unit/cost-evm.test.mjs && node tests/unit/msproject.test.mjs && node tests/unit/auth-password.test.mjs && node tests/unit/editor-unsaved.test.mjs && node tests/unit/static-coverage-evidence.test.mjs && node tests/unit/dep-types.test.mjs && node tests/unit/weekly-report.test.mjs && node tests/unit/clearfolio.test.mjs && node tests/unit/clearfolio-adapter-mock-hmac.test.mjs && node tests/unit/orchestrator.test.mjs && node tests/unit/orchestrator-coverage.test.mjs && node tests/unit/orchestrator-attribution.test.mjs && node tests/unit/sprint-stats.test.mjs && node tests/unit/burndown.test.mjs && node tests/unit/pm-analysis.test.mjs && node tests/unit/cloud-sync-security.test.mjs && node tests/unit/attachment-status.test.mjs && node tests/unit/clearfolio-status-signal.test.mjs && node tests/unit/coverage-script-contract.test.mjs && node tests/unit/toast-accessibility.test.mjs",
-    "test:coverage": "c8 --all --include=app.js --include=cloud-sync.js --include=scripts/ci/static_coverage_evidence.mjs --include=server/attachment_status.mjs --include=server/app.mjs --include=server/auth.mjs --include=server/clearfolio.mjs --include=server/orchestrator.mjs --reporter=json --reporter=json-summary npm run test:coverage:cases",
+    "test:coverage": "c8 --all --include=app.js --include=cloud-sync.js --include=scripts/ci/static_coverage_evidence.mjs --include=server/attachment_status.mjs --include=server/app.mjs --include=server/auth.mjs --include=server/clearfolio.mjs --include=server/db.mjs --include=server/email_identity.mjs --include=server/orchestrator.mjs --reporter=json --reporter=json-summary npm run test:coverage:cases",
     "test:coverage:cases": "node tests/unit/coverage-script-contract.test.mjs && node tests/unit/attachment-status.test.mjs && node tests/unit/clearfolio-status-signal.test.mjs && node tests/unit/clearfolio-adapter-mock-hmac.test.mjs && node tests/unit/orchestrator.test.mjs && node tests/unit/orchestrator-coverage.test.mjs && node tests/unit/orchestrator-attribution.test.mjs && node tests/unit/msproject.test.mjs && node tests/unit/auth-password.test.mjs && node tests/unit/editor-unsaved.test.mjs && node tests/unit/static-coverage-evidence.test.mjs && npm run test:api",
     "test:e2e": "playwright test",
     "test:e2e:headed": "playwright test --headed",

server/app.mjs

@@ -10,6 +10,7 @@ import { PLANS, planOf, orgUsage, wouldExceed, createCheckout } from './billing.
 import { clearfolioMock, mockArtifact, submitJob, jobStatus, artifactUrl } from './clearfolio.mjs';
 import { normalizeAttachmentStatusBudgetMs, normalizeAttachmentStatusConcurrency, normalizeAttachmentStatusTimeoutMs, refreshAttachmentStatuses } from './attachment_status.mjs';
 import { chat as orchestratorChat } from './orchestrator.mjs';
+import { canonicalizeMailbox } from './email_identity.mjs';
 import { computeEvm } from '../analytics.js'; // pure math, shared with the client
 
 const getOrg = (id) => db.prepare('SELECT * FROM orgs WHERE id = ?').get(id);
@@ -131,6 +132,11 @@ function deliver(orgId, event, payload) {
   }
 }
 const quietLogs = String(process.env.SCOPEWEAVE_DB || '').includes(':memory:'); // silence during tests
+// Bearer secrets that are part of a route path must never be persisted in logs.
+// Keep the route shape for incident triage while replacing only secret segments.
+const redactRequestLogPath = (path) => String(path)
+  .replace(/^\/api\/invites\/[^/]+(?=\/|$)/, '/api/invites/:token')
+  .replace(/^\/api\/shared\/[^/]+(?=\/|$)/, '/api/shared/:token');
 app.use('*', async (c, next) => {
   const t = Date.now();
   await next();
@@ -140,7 +146,7 @@ app.use('*', async (c, next) => {
     if (s >= 500) metrics.s5xx++; else if (s >= 400) metrics.s4xx++; else if (s >= 200) metrics.s2xx++;
     if (!quietLogs) {
       // structured; never logs bodies, tokens, or secrets
-      console.log(JSON.stringify({ ts: new Date().toISOString(), method: c.req.method, path: c.req.path, status: s, ms: Date.now() - t }));
+      console.log(JSON.stringify({ ts: new Date().toISOString(), method: c.req.method, path: redactRequestLogPath(c.req.path), status: s, ms: Date.now() - t }));
     }
   } catch { /* metrics/logging must never break a request */ }
 });
@@ -450,7 +456,7 @@ app.get('/api/orgs/:id/members', requireAuth, (c) => {
      JOIN users u ON u.id = m.user_id WHERE m.org_id = ? ORDER BY m.id`
   ).all(orgId);
   const invites = db.prepare(
-    `SELECT id, email, role, token, created_at AS createdAt FROM invites
+    `SELECT id, email, role, created_at AS createdAt FROM invites
      WHERE org_id = ? AND accepted_at IS NULL ORDER BY id DESC`
   ).all(orgId);
   return c.json({ members, invites });
@@ -468,30 +474,43 @@ app.delete('/api/orgs/:id/invites/:inviteId', requireAuth, (c) => {
   return c.json({ ok: true });
 });
 
-// Invite by email (owner/admin only). Returns the token (prod: email a link).
+// Invite an existing account by email (owner/admin only). Returns the token (prod: email a link).
 app.post('/api/orgs/:id/invites', requireAuth, async (c) => {
   const uid = c.get('user').sub;
   const orgId = c.req.param('id');
   const role = orgRole(uid, orgId);
   if (!role) return c.json({ error: 'not found' }, 404);
   if (!canManage(role)) return c.json({ error: 'forbidden' }, 403);
   const body = await c.req.json().catch(() => ({}));
-  const email = String(body.email || '').trim().toLowerCase();
+  const email = canonicalizeMailbox(body.email);
   const inviteRole = body.role || 'member';
   if (!email) return c.json({ error: 'email required' }, 400);
   if (!['admin', 'member', 'viewer'].includes(inviteRole)) return c.json({ error: 'invalid role' }, 400);
+  const registeredInvitee = db.prepare(
+    'SELECT id FROM users WHERE scopeweave_canonical_email(email) = ? ORDER BY id LIMIT 1'
+  ).get(email);
+  if (!registeredInvitee) {
+    return c.json({ error: 'invitee must already have a ScopeWeave account' }, 409);
+  }
   const token = randomBytes(24).toString('base64url');
   db.prepare('INSERT INTO invites(org_id,email,role,token,invited_by) VALUES(?,?,?,?,?)')
     .run(orgId, email, inviteRole, token, uid);
   logAudit(orgId, uid, 'member.invite', 'invite', email, { role: inviteRole });
   return c.json({ token, email, role: inviteRole });
 });
 
-// Accept an invite (any authenticated user holding the token). Idempotent.
+// Accept an invite only for the authenticated identity named by the invite.
 app.post('/api/invites/:token/accept', requireAuth, (c) => {
   const uid = c.get('user').sub;
   const inv = db.prepare('SELECT * FROM invites WHERE token = ?').get(c.req.param('token'));
   if (!inv || inv.accepted_at) return c.json({ error: 'invalid or used invite' }, 404);
+  const canonicalInviteEmail = canonicalizeMailbox(inv.email);
+  const identityMatches = db.prepare(
+    'SELECT id FROM users WHERE scopeweave_canonical_email(email) = ? ORDER BY id LIMIT 2'
+  ).all(canonicalInviteEmail);
+  if (identityMatches.length !== 1 || identityMatches[0].id !== uid) {
+    return c.json({ error: 'invalid or used invite' }, 404);
+  }
   const existing = orgRole(uid, inv.org_id);
   if (!existing) {
     if (wouldExceed(db, getOrg(inv.org_id), 'members')) {

server/db.mjs

@@ -4,10 +4,12 @@
 import { DatabaseSync } from 'node:sqlite';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
+import { canonicalizeMailbox } from './email_identity.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const dbPath = process.env.SCOPEWEAVE_DB || join(__dirname, '..', 'data.db');
 export const db = new DatabaseSync(dbPath);
+db.function('scopeweave_canonical_email', { deterministic: true }, canonicalizeMailbox);
 db.exec("PRAGMA journal_mode = WAL");
 db.exec("PRAGMA foreign_keys = ON");
 
@@ -171,6 +173,7 @@ CREATE INDEX IF NOT EXISTS idx_memberships_user ON memberships(user_id);
 CREATE INDEX IF NOT EXISTS idx_projects_org ON projects(org_id);
 CREATE INDEX IF NOT EXISTS idx_invites_token ON invites(token);
 `);
+db.exec('CREATE INDEX IF NOT EXISTS idx_users_canonical_email ON users(scopeweave_canonical_email(email))');
 
 // Migration for pre-existing DBs: add token_version if missing (idempotent).
 try { db.exec('ALTER TABLE users ADD COLUMN token_version INTEGER NOT NULL DEFAULT 0'); } catch { /* already there */ }