Creates a single-use, app-scoped invite, persists its hashed token, and (when a communication provider is configured) emails the link.
invite parameters
the authenticated internal user issuing the invite
Optionalprovider: IMetadataProviderthe request's metadata provider; falls back to the global default
Redeems a raw token: validates the invite, atomically consumes one use, provisions/links the user with the restricted role + app, and mints a session JWT. Runs in the public (pre-auth) path, so it uses the global provider and a configured provisioning context user.
Single-use is enforced by the guarded UPDATE inside the spConsumeMagicLinkInvite
procedure (consumeInvite) BEFORE the token is minted — two concurrent
redemptions of a single-use link race on the same row and exactly one wins. The consume is the gate:
if a later step fails, the use is already burned (fail-closed). That is the
correct trade-off for a single-use credential — burning a token on a server
error is recoverable (re-issue); allowing replay is not.
Optionalaudit: RedeemAuditContext
Magic-link service. One instance per server, constructed with the resolved public URL and the validated config.