feat(invites): team invite links — admin create/revoke, public accept (#42)

* feat(branding): white-label — public /branding, admin write, shell theming

app_settings branding.* keys (product name, logo/favicon URLs, accent
color, docs/support links). Public GET /branding so login and shell
theme pre-auth; admin writes via PUT /settings.

useBranding() applies document.title, accent CSS var and favicon;
BrandWordmark replaces hardcoded wordmarks; admin Platform settings
gain a Branding form. MCP containr_branding_get + settings_update.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* feat(invites): team invite links — admin create/revoke, public accept

Admins mint single-use invite links (sha256-hashed token at rest,
optional email binding, configurable TTL). Public endpoints let the
accept page validate the link and register — working even while
public signup is disabled.

- migration + sqlc queries/model for user_invites
- POST /admin/invites (returns one-time token+url), GET list, DELETE revoke
- GET /auth/invites/:token public validation, POST /auth/accept-invite
- CLI containr invites list|create|revoke; MCP invites tools
- /auth/accept-invite page (expired/used/invalid states, bound-email lock)
- Admin page Team invites section: create, copy link, revoke
- OpenAPI + generated types + CLI guide

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/api/invites.go

@@ -0,0 +1,245 @@
+package api
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// Team invites: an admin creates a single-use link; the invitee registers
+// through it even while public signup is closed. Tokens are random 32-byte
+// values shared once — only their sha256 hash is stored.
+
+type inviteJSON struct {
+	ID        string     `json:"id"`
+	Email     *string    `json:"email,omitempty"`
+	ExpiresAt time.Time  `json:"expires_at"`
+	UsedAt    *time.Time `json:"used_at,omitempty"`
+	CreatedAt *time.Time `json:"created_at,omitempty"`
+}
+
+func toInviteJSON(i sqlcdb.UserInvite) inviteJSON {
+	out := inviteJSON{ID: i.ID.String(), ExpiresAt: i.ExpiresAt}
+	if i.Email.Valid && i.Email.String != "" {
+		out.Email = &i.Email.String
+	}
+	if i.UsedAt.Valid {
+		out.UsedAt = &i.UsedAt.Time
+	}
+	if i.CreatedAt.Valid {
+		out.CreatedAt = &i.CreatedAt.Time
+	}
+	return out
+}
+
+func inviteTokenHash(token string) string {
+	sum := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(sum[:])
+}
+
+func generateInviteToken() (string, error) {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(buf), nil
+}
+
+// POST /admin/invites — {email?, expires_in_hours?} → {invite, token, url}
+func handleAdminCreateInvite(c *gin.Context) {
+	var req struct {
+		Email          string `json:"email"`
+		ExpiresInHours *int   `json:"expires_in_hours"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		respondError(c, http.StatusBadRequest, "INVALID_BODY", "invalid request body")
+		return
+	}
+	ttl := 24 * 7
+	if req.ExpiresInHours != nil {
+		if *req.ExpiresInHours < 1 || *req.ExpiresInHours > 24*90 {
+			respondError(c, http.StatusBadRequest, "VALIDATION", "expires_in_hours must be 1–2160")
+			return
+		}
+		ttl = *req.ExpiresInHours
+	}
+	token, err := generateInviteToken()
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to generate token")
+		return
+	}
+	userID, _ := requireAuthenticatedUserUUID(c)
+	params := sqlcdb.CreateUserInviteParams{
+		TokenHash: inviteTokenHash(token),
+		CreatedBy: uuid.NullUUID{UUID: userID, Valid: true},
+		ExpiresAt: time.Now().UTC().Add(time.Duration(ttl) * time.Hour),
+	}
+	if email := strings.ToLower(strings.TrimSpace(req.Email)); email != "" {
+		params.Email = sql.NullString{String: email, Valid: true}
+	}
+	db := c.MustGet("db").(*database.DB)
+	invite, err := sqlcdb.New(db.DB).CreateUserInvite(c.Request.Context(), params)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to create invite")
+		return
+	}
+	c.JSON(http.StatusCreated, gin.H{
+		"invite": toInviteJSON(invite),
+		"token":  token,
+		"url":    "/auth/accept-invite?token=" + token,
+	})
+}
+
+// GET /admin/invites
+func handleAdminListInvites(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	invites, err := sqlcdb.New(db.DB).ListUserInvites(c.Request.Context())
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to list invites")
+		return
+	}
+	out := make([]inviteJSON, 0, len(invites))
+	for _, i := range invites {
+		out = append(out, toInviteJSON(i))
+	}
+	c.JSON(http.StatusOK, gin.H{"invites": out})
+}
+
+// DELETE /admin/invites/:id — revoke an unused invite.
+func handleAdminDeleteInvite(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "INVALID_ID", "invalid invite id")
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	if err := sqlcdb.New(db.DB).DeleteUserInvite(c.Request.Context(), id); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to delete invite")
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+// GET /auth/invites/:token — public. Lets the accept page validate the link
+// and pre-fill a bound email before the user commits to registering.
+func handleGetInvite(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	invite, err := sqlcdb.New(db.DB).GetUserInviteByTokenHash(c.Request.Context(), inviteTokenHash(c.Param("token")))
+	if err != nil {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "invite not found")
+		return
+	}
+	expired := time.Now().After(invite.ExpiresAt)
+	var email *string
+	if invite.Email.Valid && invite.Email.String != "" {
+		email = &invite.Email.String
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"valid":      !invite.UsedAt.Valid && !expired,
+		"used":       invite.UsedAt.Valid,
+		"expired":    expired,
+		"email":      email,
+		"expires_at": invite.ExpiresAt,
+	})
+}
+
+// POST /auth/accept-invite — {token, name, email, password}
+func handleAcceptInvite(c *gin.Context) {
+	var req struct {
+		Token    string `json:"token" binding:"required"`
+		Name     string `json:"name" binding:"required"`
+		Email    string `json:"email" binding:"required"`
+		Password string `json:"password" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		respondError(c, http.StatusBadRequest, "INVALID_BODY", "token, name, email and password are required")
+		return
+	}
+	if len(req.Password) < 8 {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "password must be at least 8 characters")
+		return
+	}
+	req.Email = strings.ToLower(strings.TrimSpace(req.Email))
+
+	db := c.MustGet("db").(*database.DB)
+	q := sqlcdb.New(db.DB)
+	invite, err := q.GetUserInviteByTokenHash(c.Request.Context(), inviteTokenHash(req.Token))
+	if err != nil {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "invite not found")
+		return
+	}
+	if invite.UsedAt.Valid {
+		respondError(c, http.StatusGone, "INVITE_USED", "invite already used")
+		return
+	}
+	if time.Now().After(invite.ExpiresAt) {
+		respondError(c, http.StatusGone, "INVITE_EXPIRED", "invite expired")
+		return
+	}
+	if invite.Email.Valid && invite.Email.String != "" && invite.Email.String != req.Email {
+		respondError(c, http.StatusForbidden, "INVITE_EMAIL_MISMATCH", "invite is bound to a different email")
+		return
+	}
+
+	var existing int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM users WHERE email = $1`, req.Email).Scan(&existing); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "database error")
+		return
+	}
+	if existing > 0 {
+		respondError(c, http.StatusConflict, "CONFLICT", "user already exists")
+		return
+	}
+
+	if err := createBetterAuthUser(c, strings.TrimSpace(req.Name), req.Email, req.Password); err != nil && !errors.Is(err, errBetterAuthUserExists) {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", err.Error())
+		return
+	}
+
+	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to hash password")
+		return
+	}
+
+	var user User
+	err = db.QueryRow(`
+		INSERT INTO users (email, password_hash, name)
+		VALUES ($1, $2, $3)
+		RETURNING id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
+	`, req.Email, string(hashedPassword), strings.TrimSpace(req.Name)).
+		Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
+	if err != nil {
+		respondError(c, http.StatusConflict, "CONFLICT", "user already exists")
+		return
+	}
+
+	userUUID, _ := uuid.Parse(user.ID)
+	if err := q.MarkUserInviteUsed(c.Request.Context(), sqlcdb.MarkUserInviteUsedParams{
+		ID:     invite.ID,
+		UsedBy: uuid.NullUUID{UUID: userUUID, Valid: userUUID != uuid.Nil},
+	}); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to consume invite")
+		return
+	}
+
+	jwtSecret := c.MustGet("jwt_secret").(string)
+	token, err := generateJWT(user.ID, user.Email, jwtSecret)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to generate token")
+		return
+	}
+	c.JSON(http.StatusCreated, AuthResponse{Token: token, User: user})
+}

app/backend/internal/api/routes.go

@@ -260,6 +260,11 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			public.GET("/maintenance", handleMaintenancePage)
 			public.GET("/branding", handleGetBranding)
 
+			// Invite accept flow — validates the link, then registers
+			// even while public signup is closed.
+			public.GET("/auth/invites/:token", handleGetInvite)
+			public.POST("/auth/accept-invite", handleAcceptInvite)
+
 			// Wake callback for sleep-mode placeholders. Unauthenticated but
 			// non-destructive: it only reconciles the service back to running.
 			public.Any("/internal/wake/:id", handleServiceWake)
@@ -495,6 +500,11 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			admin.POST("/admin/banners", handleAdminCreateBanner)
 			admin.PATCH("/admin/banners/:id", handleAdminUpdateBanner)
 			admin.DELETE("/admin/banners/:id", handleAdminDeleteBanner)
+
+			// Team invites — single-use registration links
+			admin.GET("/admin/invites", handleAdminListInvites)
+			admin.POST("/admin/invites", handleAdminCreateInvite)
+			admin.DELETE("/admin/invites/:id", handleAdminDeleteInvite)
 			admin.GET("/audit-logs", handleGetAuditLogs)
 			admin.GET("/audit-logs/:resource/:id", handleGetResourceAuditLogs)
 

app/backend/internal/cli/commands/invites.go

@@ -0,0 +1,92 @@
+package commands
+
+import (
+	"github.com/spf13/cobra"
+)
+
+var inviteEmail string
+var inviteTTL int
+
+// InvitesCmd manages team invite links (admin).
+var InvitesCmd = &cobra.Command{
+	Use:   "invites",
+	Short: "Manage team invite links (admin)",
+}
+
+var inviteListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List invites",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/admin/invites", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "invites")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, i := range items {
+			state := "open"
+			if _, used := i["used_at"]; used && i["used_at"] != nil {
+				state = "used"
+			}
+			rows = append(rows, []string{
+				str(i, "id"), str(i, "email"), str(i, "expires_at"), state,
+			})
+		}
+		printRows(data, []string{"ID", "EMAIL", "EXPIRES", "STATE"}, rows)
+		return nil
+	},
+}
+
+var inviteCreateCmd = &cobra.Command{
+	Use:   "create",
+	Short: "Create an invite link (--email to bind, --hours for TTL)",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		req := map[string]interface{}{}
+		if cmd.Flags().Changed("email") {
+			req["email"] = inviteEmail
+		}
+		if cmd.Flags().Changed("hours") {
+			req["expires_in_hours"] = inviteTTL
+		}
+		data, err := c.Do("POST", "/admin/invites", req)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var inviteRevokeCmd = &cobra.Command{
+	Use:   "revoke <id>",
+	Short: "Revoke an invite",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if !Confirm("Revoke invite " + args[0] + "?") {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		_, err = c.Do("DELETE", "/admin/invites/"+args[0], nil)
+		return err
+	},
+}
+
+func init() {
+	inviteCreateCmd.Flags().StringVar(&inviteEmail, "email", "", "bind invite to this email")
+	inviteCreateCmd.Flags().IntVar(&inviteTTL, "hours", 168, "invite lifetime in hours (1-2160)")
+	InvitesCmd.AddCommand(inviteListCmd, inviteCreateCmd, inviteRevokeCmd)
+}

app/backend/internal/cli/root.go

@@ -90,6 +90,7 @@ func init() {
 	rootCmd.AddCommand(commands.WebhooksCmd)
 	rootCmd.AddCommand(commands.OperationsCmd)
 	rootCmd.AddCommand(commands.BannersCmd)
+	rootCmd.AddCommand(commands.InvitesCmd)
 	rootCmd.AddCommand(commands.UpCmd)
 }
 

app/backend/internal/database/sqlcdb/invites.sql.go

@@ -0,0 +1,134 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: invites.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const createUserInvite = `-- name: CreateUserInvite :one
+INSERT INTO user_invites (token_hash, email, created_by, expires_at)
+VALUES ($1, $2, $3, $4)
+RETURNING user_invites.id, user_invites.token_hash, user_invites.email, user_invites.created_by, user_invites.expires_at, user_invites.used_by, user_invites.used_at, user_invites.created_at
+`
+
+type CreateUserInviteParams struct {
+	TokenHash string         `json:"token_hash"`
+	Email     sql.NullString `json:"email"`
+	CreatedBy uuid.NullUUID  `json:"created_by"`
+	ExpiresAt time.Time      `json:"expires_at"`
+}
+
+func (q *Queries) CreateUserInvite(ctx context.Context, arg CreateUserInviteParams) (UserInvite, error) {
+	row := q.db.QueryRowContext(ctx, createUserInvite,
+		arg.TokenHash,
+		arg.Email,
+		arg.CreatedBy,
+		arg.ExpiresAt,
+	)
+	var i UserInvite
+	err := row.Scan(
+		&i.ID,
+		&i.TokenHash,
+		&i.Email,
+		&i.CreatedBy,
+		&i.ExpiresAt,
+		&i.UsedBy,
+		&i.UsedAt,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const deleteUserInvite = `-- name: DeleteUserInvite :exec
+DELETE FROM user_invites
+WHERE id = $1
+`
+
+func (q *Queries) DeleteUserInvite(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, deleteUserInvite, id)
+	return err
+}
+
+const getUserInviteByTokenHash = `-- name: GetUserInviteByTokenHash :one
+SELECT user_invites.id, user_invites.token_hash, user_invites.email, user_invites.created_by, user_invites.expires_at, user_invites.used_by, user_invites.used_at, user_invites.created_at
+FROM user_invites
+WHERE token_hash = $1
+`
+
+func (q *Queries) GetUserInviteByTokenHash(ctx context.Context, tokenHash string) (UserInvite, error) {
+	row := q.db.QueryRowContext(ctx, getUserInviteByTokenHash, tokenHash)
+	var i UserInvite
+	err := row.Scan(
+		&i.ID,
+		&i.TokenHash,
+		&i.Email,
+		&i.CreatedBy,
+		&i.ExpiresAt,
+		&i.UsedBy,
+		&i.UsedAt,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const listUserInvites = `-- name: ListUserInvites :many
+SELECT user_invites.id, user_invites.token_hash, user_invites.email, user_invites.created_by, user_invites.expires_at, user_invites.used_by, user_invites.used_at, user_invites.created_at
+FROM user_invites
+ORDER BY created_at DESC
+`
+
+func (q *Queries) ListUserInvites(ctx context.Context) ([]UserInvite, error) {
+	rows, err := q.db.QueryContext(ctx, listUserInvites)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []UserInvite{}
+	for rows.Next() {
+		var i UserInvite
+		if err := rows.Scan(
+			&i.ID,
+			&i.TokenHash,
+			&i.Email,
+			&i.CreatedBy,
+			&i.ExpiresAt,
+			&i.UsedBy,
+			&i.UsedAt,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const markUserInviteUsed = `-- name: MarkUserInviteUsed :exec
+UPDATE user_invites
+SET used_by = $2, used_at = now()
+WHERE id = $1 AND used_at IS NULL
+`
+
+type MarkUserInviteUsedParams struct {
+	ID     uuid.UUID     `json:"id"`
+	UsedBy uuid.NullUUID `json:"used_by"`
+}
+
+func (q *Queries) MarkUserInviteUsed(ctx context.Context, arg MarkUserInviteUsedParams) error {
+	_, err := q.db.ExecContext(ctx, markUserInviteUsed, arg.ID, arg.UsedBy)
+	return err
+}

app/backend/internal/database/sqlcdb/models.go

@@ -301,6 +301,17 @@ type ServiceTemplate struct {
 	UpdatedAt   sql.NullTime          `json:"updated_at"`
 }
 
+type UserInvite struct {
+	ID        uuid.UUID      `json:"id"`
+	TokenHash string         `json:"token_hash"`
+	Email     sql.NullString `json:"email"`
+	CreatedBy uuid.NullUUID  `json:"created_by"`
+	ExpiresAt time.Time      `json:"expires_at"`
+	UsedBy    uuid.NullUUID  `json:"used_by"`
+	UsedAt    sql.NullTime   `json:"used_at"`
+	CreatedAt sql.NullTime   `json:"created_at"`
+}
+
 type UserToken struct {
 	ID         uuid.UUID    `json:"id"`
 	UserID     uuid.UUID    `json:"user_id"`

app/backend/internal/database/sqlcdb/querier.go

@@ -31,6 +31,7 @@ type Querier interface {
 	CreateOutboundWebhook(ctx context.Context, arg CreateOutboundWebhookParams) error
 	CreateProject(ctx context.Context, arg CreateProjectParams) (Project, error)
 	CreateServiceFromTemplate(ctx context.Context, arg CreateServiceFromTemplateParams) error
+	CreateUserInvite(ctx context.Context, arg CreateUserInviteParams) (UserInvite, error)
 	CreateUserTemplate(ctx context.Context, arg CreateUserTemplateParams) error
 	CreateUserToken(ctx context.Context, arg CreateUserTokenParams) (UserToken, error)
 	CreateWebhookDelivery(ctx context.Context, arg CreateWebhookDeliveryParams) error
@@ -42,6 +43,7 @@ type Querier interface {
 	DeleteDatabaseServiceByIDAndUser(ctx context.Context, arg DeleteDatabaseServiceByIDAndUserParams) error
 	DeleteOutboundWebhookByIDAndUser(ctx context.Context, arg DeleteOutboundWebhookByIDAndUserParams) error
 	DeleteProjectByID(ctx context.Context, projectID uuid.UUID) (int64, error)
+	DeleteUserInvite(ctx context.Context, id uuid.UUID) error
 	DeleteUserTemplate(ctx context.Context, arg DeleteUserTemplateParams) (int64, error)
 	GetActiveAgentAuthTokenByHash(ctx context.Context, tokenHash string) (AgentAuthToken, error)
 	GetAgent(ctx context.Context, id string) (NodeAgent, error)
@@ -63,6 +65,7 @@ type Querier interface {
 	GetProjectOwnerID(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
 	GetProjectRoleForUser(ctx context.Context, arg GetProjectRoleForUserParams) (string, error)
 	GetServiceTemplateByID(ctx context.Context, id string) (ServiceTemplate, error)
+	GetUserInviteByTokenHash(ctx context.Context, tokenHash string) (UserInvite, error)
 	GetUserTokenByHash(ctx context.Context, tokenHash string) (UserToken, error)
 	InsertAgentHeartbeat(ctx context.Context, arg InsertAgentHeartbeatParams) error
 	InsertProjectEnvironment(ctx context.Context, arg InsertProjectEnvironmentParams) error
@@ -90,10 +93,12 @@ type Querier interface {
 	ListProjectsWithStatsByUser(ctx context.Context, arg ListProjectsWithStatsByUserParams) ([]ListProjectsWithStatsByUserRow, error)
 	ListServiceTemplatesByCategoryForUser(ctx context.Context, arg ListServiceTemplatesByCategoryForUserParams) ([]ServiceTemplate, error)
 	ListServiceTemplatesForUser(ctx context.Context, ownerID uuid.NullUUID) ([]ServiceTemplate, error)
+	ListUserInvites(ctx context.Context) ([]UserInvite, error)
 	ListUserTokens(ctx context.Context, userID uuid.UUID) ([]UserToken, error)
 	ListWebhookDeliveriesByWebhook(ctx context.Context, webhookID uuid.UUID) ([]WebhookDelivery, error)
 	MarkAllNotificationsReadByUser(ctx context.Context, arg MarkAllNotificationsReadByUserParams) error
 	MarkNotificationReadByIDAndUser(ctx context.Context, arg MarkNotificationReadByIDAndUserParams) error
+	MarkUserInviteUsed(ctx context.Context, arg MarkUserInviteUsedParams) error
 	RevokeAgentAuthToken(ctx context.Context, id uuid.UUID) (AgentAuthToken, error)
 	RevokeUserToken(ctx context.Context, arg RevokeUserTokenParams) (int64, error)
 	SetDatabaseBackupRemoteKeyByID(ctx context.Context, arg SetDatabaseBackupRemoteKeyByIDParams) error

app/backend/internal/mcpserver/server.go

@@ -158,6 +158,10 @@ func init() {
 	register(spec{"containr_branding_get", "Get instance white-label branding (product name, logo, accent, links).", "GET", "/branding", nil, nil, false})
 	register(spec{"containr_settings_update", "Update platform settings (admin). Args: signup_enabled (bool), cloudflare_tunnel_token (string, empty clears), branding (object: product_name, logo_url, favicon_url, accent_color, docs_url, support_url — empty string resets a field).", "PUT", "/settings", nil, []string{"signup_enabled", "cloudflare_tunnel_token", "branding"}, false})
 
+	register(spec{"containr_invites_list", "List team invite links (admin).", "GET", "/admin/invites", nil, nil, false})
+	register(spec{"containr_invites_create", "Create a team invite link (admin). Args: email (optional bind), expires_in_hours (default 168). Returns the one-time token + accept URL.", "POST", "/admin/invites", nil, []string{"email", "expires_in_hours"}, false})
+	register(spec{"containr_invites_revoke", "Revoke a team invite (admin). Args: id. Requires confirm=true.", "DELETE", "/admin/invites/{id}", []string{"id"}, nil, true})
+
 	// Nodes / agent tokens (admin)
 	register(spec{"containr_nodes_list", "List node agents (admin)", "GET", "/agents", nil, nil, false})
 	register(spec{"containr_nodes_get", "Get a node agent (admin)", "GET", "/agents/{id}", []string{"id"}, nil, false})

app/backend/migrations_goose/20261105000000_user_invites.sql

@@ -0,0 +1,19 @@
+-- +goose Up
+-- Team invites: admin-generated single-use links that let a new user
+-- register even while public signup is closed. Tokens are sha256-hashed
+-- at rest like PATs.
+CREATE TABLE IF NOT EXISTS user_invites (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    token_hash varchar(64) NOT NULL UNIQUE,
+    email varchar(255),
+    created_by uuid REFERENCES users(id) ON DELETE SET NULL,
+    expires_at timestamptz NOT NULL,
+    used_by uuid REFERENCES users(id) ON DELETE SET NULL,
+    used_at timestamptz,
+    created_at timestamptz DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_user_invites_expires ON user_invites(expires_at);
+
+-- +goose Down
+DROP TABLE IF EXISTS user_invites;

app/backend/sqlc/queries/invites.sql

@@ -0,0 +1,23 @@
+-- name: CreateUserInvite :one
+INSERT INTO user_invites (token_hash, email, created_by, expires_at)
+VALUES ($1, $2, $3, $4)
+RETURNING user_invites.*;
+
+-- name: GetUserInviteByTokenHash :one
+SELECT user_invites.*
+FROM user_invites
+WHERE token_hash = $1;
+
+-- name: ListUserInvites :many
+SELECT user_invites.*
+FROM user_invites
+ORDER BY created_at DESC;
+
+-- name: MarkUserInviteUsed :exec
+UPDATE user_invites
+SET used_by = $2, used_at = now()
+WHERE id = $1 AND used_at IS NULL;
+
+-- name: DeleteUserInvite :exec
+DELETE FROM user_invites
+WHERE id = $1;

app/backend/sqlc/schema.sql

@@ -316,3 +316,14 @@ CREATE TABLE banners (
     created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
     updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
 );
+
+CREATE TABLE user_invites (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    token_hash VARCHAR(64) NOT NULL UNIQUE,
+    email VARCHAR(255),
+    created_by UUID REFERENCES users(id) ON DELETE SET NULL,
+    expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    used_by UUID REFERENCES users(id) ON DELETE SET NULL,
+    used_at TIMESTAMP WITH TIME ZONE,
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+);