From 4eabd56a83200271cf8f65382222291a6ba74f22 Mon Sep 17 00:00:00 2001
From: Marco Pedone <m.pedone98@gmail.com>
Date: Fri, 27 Mar 2026 19:18:54 +0100
Subject: [PATCH] feat: update Invito email template to include invite URL and
 remove sensitive user information

---
 apps/infoalloggi/emails/invito.tsx            | 21 +++++++++----------
 .../src/server/api/routers/invite.ts          | 15 ++++++++-----
 .../server/controllers/invites.controller.ts  | 14 ++++++-------
 3 files changed, 27 insertions(+), 23 deletions(-)

diff --git a/apps/infoalloggi/emails/invito.tsx b/apps/infoalloggi/emails/invito.tsx
index f5e3e12..6de708c 100644
--- a/apps/infoalloggi/emails/invito.tsx
+++ b/apps/infoalloggi/emails/invito.tsx
@@ -1,5 +1,4 @@
 import { Button, Heading, Row, Section, Text } from "@react-email/components";
-import { env } from "~/env";
 import Base from "./base";
 export type Invito_NewMail = {
 	mailType: "invito";
@@ -8,16 +7,16 @@ export type Invito_NewMail = {
 
 type InvitoProps = {
 	nome: string;
-	email: string;
-	password: string;
-	//inviteUrl: string;
+	//email: string;
+	//password: string;
+	inviteUrl: string;
 };
 
 const Invito = ({
 	nome,
-	//inviteUrl,
-	email,
-	password
+	inviteUrl,
+	//email,
+	//password
 }: InvitoProps) => {
 	return (
 		<Base preview="Procedi ora su Infoalloggi.it">
@@ -34,7 +33,7 @@ const Invito = ({
 							disponibili.
 						</Text>
 					</Row>
-					<Row>
+					{/* <Row>
 						<Text>
 							Le tue credenziali sono:
 							<br />
@@ -42,13 +41,13 @@ const Invito = ({
 							<br />
 							Password: <b>{password}</b>
 						</Text>
-					</Row>
+					</Row> */}
 
 					<Section className="mb-5">
 						<Button
 							className="mx-auto box-border inline-flex h-10 items-center justify-center whitespace-nowrap rounded-md bg-sky-500 px-4 py-2 text-center align-middle font-semibold text-white"
-							//href={inviteUrl}
-							href={`${env.BASE_URL}/area-riservata/dashboard`}
+							href={inviteUrl}
+							//href={`${env.BASE_URL}/area-riservata/dashboard`}
 						>
 							Clicca qui per procedere
 						</Button>
diff --git a/apps/infoalloggi/src/server/api/routers/invite.ts b/apps/infoalloggi/src/server/api/routers/invite.ts
index 56fcaff..2848151 100644
--- a/apps/infoalloggi/src/server/api/routers/invite.ts
+++ b/apps/infoalloggi/src/server/api/routers/invite.ts
@@ -1,12 +1,15 @@
 import { TRPCError } from "@trpc/server";
 import { z } from "zod";
+import { env } from "~/env";
 import {
 	adminProcedure,
 	createTRPCRouter,
 	publicProcedure,
 } from "~/server/api/trpc";
+import { swapAuth } from "~/server/controllers/auth.controller";
 import {
 	consumeInviteToken,
+	createInviteToken,
 	sendInvitoEmail,
 	verifyInviteToken,
 } from "~/server/controllers/invites.controller";
@@ -27,16 +30,17 @@ export const inviteRouter = createTRPCRouter({
 		.mutation(async ({ input }) => {
 			try {
 				const user = await getUser({ userId: input.id, db });
-				//const token = await createInviteToken(user.email);
 
-				//const inviteUrl = `${env.BASE_URL}/auth/accetta-invito/${token}`;
+				const token = await createInviteToken(user.email);
+
+				const inviteUrl = `${env.BASE_URL}/auth/accetta-invito/${token}`;
 
 				await sendInvitoEmail({
 					userId: input.id,
 					email: user.email,
 					nome: user.nome,
-					password: user.password,
-					//inviteUrl,
+					//password: user.password,
+					inviteUrl,
 				});
 
 				return { success: true };
@@ -73,7 +77,7 @@ export const inviteRouter = createTRPCRouter({
 				password: z.string().min(8),
 			}),
 		)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
 			const user = await findUser_byEmail({ email: input.email });
 			if (!user) {
 				throw new TRPCError({
@@ -104,6 +108,7 @@ export const inviteRouter = createTRPCRouter({
 
 			// Mark invite as used
 			await consumeInviteToken(input.token);
+			await swapAuth({ ctx, userId: user.id });
 
 			return { success: true };
 		}),
diff --git a/apps/infoalloggi/src/server/controllers/invites.controller.ts b/apps/infoalloggi/src/server/controllers/invites.controller.ts
index 332bfad..c25054e 100644
--- a/apps/infoalloggi/src/server/controllers/invites.controller.ts
+++ b/apps/infoalloggi/src/server/controllers/invites.controller.ts
@@ -67,25 +67,25 @@ export async function consumeInviteToken(token: string) {
 export const sendInvitoEmail = async ({
 	userId,
 	email,
-	password,
+	//password,
 	nome,
-	//inviteUrl,
+	inviteUrl,
 }: {
 	userId: UsersId;
 	email: string;
-	password: string;
+	//password: string;
 	nome: string;
-	//inviteUrl: string;
+	inviteUrl: string;
 }) => {
 	try {
 		await NewMail({
 			template: {
 				mailType: "invito",
 				props: {
-					email,
+					//email,
 					nome,
-					password,
-					//inviteUrl,
+					//password,
+					inviteUrl,
 				},
 			},
 			mail: {