Handle invited users on first sign-in

[RhysSullivan]

Summary

• Invited users with an unaccepted invitation were 500ing on the auth callback. The handler picked the first membership returned by WorkOS (which can be pending for unaccepted invites) and tried to refresh the session into it, which 400s. Now the rehydrate path filters to active memberships and treats refresh failure as best-effort.
• Onboarding now surfaces pending invitations so invited users can explicitly accept them. Inviter (name + email) and relative invite age are shown alongside the org name as a phishing signal — bypasses the WorkOS consent gate that the invite-link click would have provided.
• Callback schema relaxed to allow stateless redirects; CSRF check is still enforced when state is present.

New endpoints:

• GET /auth/pending-invitations
• POST /auth/accept-invitation

Test plan

• Unit: callback skips a pending-only membership and leaves session org-less
• Unit: callback falls through to org-less session when refresh fails
• Unit: callback accepts a redirect without state (CSRF check skipped)
• Unit: callback still rejects mismatched state when present
• Manual: sign in as invited user → onboarding shows the invite with inviter attribution → click Accept → land in the org
• Manual: sign in as user with no invites → onboarding shows create-org form
• Manual: multi-invite case — list renders, only one Accept active at a time, per-row error on failure

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	4881833	Commit Preview URL Branch Preview URL	May 04 2026, 06:58 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	4881833	May 04 2026, 06:59 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@517

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@517

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@517

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@517

@executor-js/storage-core

npm i https://pkg.pr.new/@executor-js/storage-core@517

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@517

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@517

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@517

@executor-js/plugin-google-discovery

npm i https://pkg.pr.new/@executor-js/plugin-google-discovery@517

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@517

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@517

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@517

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@517

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@517

executor

npm i https://pkg.pr.new/executor@517

commit: 4881833