wms-app/app/login/invited_onboarding.php

<?php
    require '../session.php';
    require '../config.php';
    require '../dbconn.php';

    $token = trim($_GET['token'] ?? '');

    if (!$token) {
        header('Location: ' . $server_url . 'login/index.php');
        exit;
    }

    // Validate token — must match a pending invited user (license='user') that has not expired
    $sth = $pdo1->prepare(
        "SELECT u.user_id, u.email, u.verify_expires_at, c.company_name
         FROM user u
         JOIN company_map_user m ON m.user_id = u.user_id
         JOIN company_list c ON c.company_id = m.company_id
         WHERE u.verify_token = :token
           AND u.status       = 'pending'
           AND u.license      = 'user'
         LIMIT 1"
    );
    $sth->execute([':token' => $token]);
    $row = $sth->fetch(PDO::FETCH_ASSOC);

    // Determine error state: cancelled (no row) or expired (row found but past expiry)
    $invite_error = null;
    if (!$row) {
        $invite_error = 'cancelled';
    } elseif (strtotime($row['verify_expires_at']) <= time()) {
        $invite_error = 'expired';
    }

    if ($invite_error) {
        require '../include_header.php';
        $msg = $invite_error === 'expired'
            ? ['icon' => 'ti-clock-x', 'title' => 'Invitation Expired',
               'body' => 'This invitation link has expired. Please contact your administrator to send a new invitation.']
            : ['icon' => 'ti-user-x',  'title' => 'Invitation Cancelled',
               'body' => 'This invitation has been cancelled. Please contact your administrator if you believe this is a mistake.'];
?>
<body>
  <div class="container py-5" style="max-width:480px;">
    <div class="text-center mb-5">
      <a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
        <img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
        <span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
      </a>
    </div>
    <div class="card text-center">
      <div class="card-body p-5">
        <i class="ti <?php echo $msg['icon']; ?> text-danger mb-3" style="font-size:3rem;"></i>
        <h2 class="fs-4 mb-2"><?php echo $msg['title']; ?></h2>
        <p class="text-muted mb-4"><?php echo $msg['body']; ?></p>
        <a href="<?php echo $server_url?>login/index.php" class="btn btn-primary">
          Back to Sign In
        </a>
      </div>
    </div>
  </div>
</body>
</html>
<?php
        exit;
    }

    $_SESSION['invited_user_id'] = (int)$row['user_id'];
    $_SESSION['invited_token']   = $token;

    if (empty($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }

    $company_name = htmlspecialchars($row['company_name']);
    $invite_email = htmlspecialchars($row['email']);

    require '../include_header.php';
?>

<body>

  <div class="container py-5" style="max-width:520px;">

    <div class="text-center mb-5">
      <a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
        <img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
        <span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
      </a>
      <h1 class="h4 mb-1">You've been invited!</h1>
      <p class="text-muted">Complete your account setup to join <strong><?php echo $company_name ?></strong>.</p>
    </div>

    <div class="card">
      <div class="card-body p-5">
        <h2 class="fs-5 mb-1"><i class="ti ti-user-check me-2"></i>Account Setup</h2>
        <p class="text-muted small mb-4">Your email: <strong><?php echo $invite_email ?></strong></p>

        <div class="row g-3">
          <div class="col-md-6">
            <label class="form-label">First Name <span class="text-danger">*</span></label>
            <input type="text" class="form-control" id="name" placeholder="First name">
          </div>
          <div class="col-md-6">
            <label class="form-label">Last Name <span class="text-danger">*</span></label>
            <input type="text" class="form-control" id="surname" placeholder="Last name">
          </div>
          <div class="col-12">
            <label class="form-label">Username <span class="text-danger">*</span></label>
            <input type="text" class="form-control" id="username" placeholder="Lowercase letters, numbers, underscores">
            <div class="form-text">Used to log in. Cannot be changed later.</div>
          </div>
          <div class="col-12">
            <label class="form-label">Password <span class="text-danger">*</span></label>
            <div class="input-group">
              <input type="password" class="form-control" id="password" placeholder="Choose a strong password">
              <button class="btn btn-outline-secondary toggle-pw" type="button" data-target="password">
                <i class="ti ti-eye"></i>
              </button>
            </div>
          </div>
          <div class="col-12">
            <label class="form-label">Confirm Password <span class="text-danger">*</span></label>
            <div class="input-group">
              <input type="password" class="form-control" id="confirm_password" placeholder="Repeat your password">
              <button class="btn btn-outline-secondary toggle-pw" type="button" data-target="confirm_password">
                <i class="ti ti-eye"></i>
              </button>
            </div>
          </div>
        </div>

      </div>
    </div>

    <div class="d-flex justify-content-end mt-4">
      <button class="btn btn-primary px-5" id="btn_finish" onclick="finish_setup()">
        <i class="ti ti-rocket me-1"></i>Complete Setup
      </button>
    </div>

  </div>

  <script>

  $(function () {
    $(document).on('click', '.toggle-pw', function () {
      const $input = $('#' + $(this).data('target'));
      const isText = $input.attr('type') === 'text';
      $input.attr('type', isText ? 'password' : 'text');
      $(this).find('i').toggleClass('ti-eye ti-eye-off');
    });
  });

  function finish_setup() {
    const name     = $('#name').val().trim();
    const surname  = $('#surname').val().trim();
    const username = $('#username').val().trim();
    const password = $('#password').val();
    const confirm  = $('#confirm_password').val();

    if (!name || !surname || !username || !password || !confirm) {
      bootbox.alert('All fields are required.');
      return;
    }

    if (password !== confirm) {
      bootbox.alert('Passwords do not match.');
      return;
    }

    const $btn = $('#btn_finish');
    $btn.prop('disabled', true).html('<i class="ti ti-loader-2 me-1"></i>Setting up…');

    ajax_request({
      url:         '<?php echo $server_url?>login/api/engine/invited_onboarding.php',
      autoPrepare: false,
      data: { json: JSON.stringify({ name, surname, username, password, confirm_password: confirm }) },
      onSuccess: function () {
        bootbox.alert('Account setup complete! Please sign in.', function () {
          window.location.href = '<?php echo $server_url?>login/index.php';
        });
      },
      onError: function () {
        $btn.prop('disabled', false).html('<i class="ti ti-rocket me-1"></i>Complete Setup');
      },
    });
  }

  </script>

</body>
</html>