Creates a single-use, app-scoped invite, persists its hashed token, and
(when a communication provider is configured and params.SendEmail !== false) emails the link.
invite parameters
the authenticated internal user issuing the invite
Optionalprovider: IMetadataProviderthe request's metadata provider; falls back to the global default
Redeems a raw token: validates the invite, atomically consumes one use, provisions/links the user with the restricted role + app, and mints a session JWT. Runs in the public (pre-auth) path, so it uses the global provider and a configured provisioning context user.
Single-use is enforced by the guarded UPDATE inside the spConsumeMagicLinkInvite
procedure (consumeInvite) BEFORE the token is minted — two concurrent
redemptions of a single-use link race on the same row and exactly one wins. The consume is the gate:
if a later step fails, the use is already burned (fail-closed). That is the
correct trade-off for a single-use credential — burning a token on a server
error is recoverable (re-issue); allowing replay is not.
Optionalaudit: RedeemAuditContextVerifies a signed redirect binding (rt) against the raw invite token's hash AND the host's
allowed frontend origins. Returns the verified redirect URL, or undefined if absent/invalid.
Revokes an existing invite so subsequent redemptions fail with 'revoked'.
Requires the acting user to hold invite-issuance authority (CanIssueInvites).
Optionalprovider: IMetadataProviderUpdates the expiration timestamp of an existing non-revoked, non-consumed invite.
Requires the acting user to hold invite-issuance authority (CanIssueInvites).
Optionalprovider: IMetadataProviderVerifies a magic-link session JWT against this service's configured issuer and audience.
Magic-link service. One instance per server, constructed with the resolved public URL and the validated config. Implements IServerExtensionMagicLinkService so
BaseServerExtensionimplementations can mint, revoke, extend, and verify invites viacontext.services.GetMagicLinkService?.().