wms-app/app/login/accept_invite.php

<?php
    require '../session.php';
    require '../config.php';
    require '../dbconn.php';

    $token = trim($_GET['token'] ?? '');

    if (!$token) {
        header('Location: ' . $server_url . 'login/index.php');
        exit;
    }

    // Reject if a user is already logged in — opening an invite link in an active
    // session would bind invite state into the current session.
    if (!empty($_SESSION['login_company_id'])) {
        require '../include_header.php';
?>
<body>
  <div class="container py-5" style="max-width:480px;">
    <div class="text-center mb-5">
      <a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
        <img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
        <span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
      </a>
    </div>
    <div class="card text-center">
      <div class="card-body p-5">
        <i class="ti ti-user-check text-warning mb-3" style="font-size:3rem;"></i>
        <h2 class="fs-4 mb-2">Already Signed In</h2>
        <p class="text-muted mb-4">You are already signed in. Please sign out first before accepting an invitation.</p>
        <a href="<?php echo $server_url?>login/index.php" class="btn btn-primary">Go to Dashboard</a>
      </div>
    </div>
  </div>
</body>
</html>
<?php
        exit;
    }

    // Look up token — must exist in company_map_user and not be expired
    $sth = $pdo1->prepare(
        "SELECT m.map_id, m.role, m.invite_expires_at,
                c.company_name,
                u.email, u.name, u.surname
         FROM company_map_user m
         JOIN company_list c ON c.company_id = m.company_id
         JOIN user u ON u.user_id = m.user_id
         WHERE m.invite_token = :token
         LIMIT 1"
    );
    $sth->execute([':token' => $token]);
    $row = $sth->fetch(PDO::FETCH_ASSOC);

    $invite_error = null;
    if (!$row) {
        $invite_error = 'invalid';
    } elseif ($row['invite_expires_at'] && strtotime($row['invite_expires_at']) <= time()) {
        $invite_error = 'expired';
    }

    if ($invite_error) {
        require '../include_header.php';
        $msg = $invite_error === 'expired'
            ? ['icon' => 'ti-clock-x', 'title' => 'Invitation Expired',
               'body' => 'This invitation link has expired. Please contact the company administrator to resend your invitation.']
            : ['icon' => 'ti-user-x',  'title' => 'Invalid Invitation',
               'body' => 'This invitation link is invalid or has already been used.'];
?>
<body>
  <div class="container py-5" style="max-width:480px;">
    <div class="text-center mb-5">
      <a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
        <img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
        <span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
      </a>
    </div>
    <div class="card text-center">
      <div class="card-body p-5">
        <i class="ti <?php echo $msg['icon']; ?> text-danger mb-3" style="font-size:3rem;"></i>
        <h2 class="fs-4 mb-2"><?php echo $msg['title']; ?></h2>
        <p class="text-muted mb-4"><?php echo $msg['body']; ?></p>
        <a href="<?php echo $server_url?>login/index.php" class="btn btn-primary">Back to Sign In</a>
      </div>
    </div>
  </div>
</body>
</html>
<?php
        exit;
    }

    // Regenerate session ID before binding invite identity to prevent session fixation
    session_regenerate_id(true);

    $_SESSION['accept_invite_token'] = $token;
    $_SESSION['csrf_token']          = bin2hex(random_bytes(32));

    $company_name = htmlspecialchars($row['company_name']);
    $invite_email = htmlspecialchars($row['email']);
    $invite_role  = htmlspecialchars(ucfirst($row['role']));

    require '../include_header.php';
?>

<body>

  <div class="container py-5" style="max-width:480px;">

    <div class="text-center mb-5">
      <a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
        <img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
        <span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
      </a>
      <h1 class="h4 mb-1">You've been invited!</h1>
      <p class="text-muted">Accept the invitation to join <strong><?php echo $company_name ?></strong>.</p>
    </div>

    <div class="card">
      <div class="card-body p-5 text-center">
        <i class="ti ti-building mb-3 text-primary" style="font-size:3rem;"></i>
        <h2 class="fs-5 mb-1"><?php echo $company_name ?></h2>
        <p class="text-muted mb-1">You are invited as: <strong><?php echo $invite_role ?></strong></p>
        <p class="text-muted small">Account: <?php echo $invite_email ?></p>
      </div>
    </div>

    <div class="d-flex justify-content-end mt-4">
      <button class="btn btn-primary px-5" id="btn_accept" onclick="accept_invite()">
        <i class="ti ti-check me-1"></i>Accept Invitation
      </button>
    </div>

  </div>

  <script>
  function accept_invite() {
    const $btn = $('#btn_accept');
    $btn.prop('disabled', true).html('<i class="ti ti-loader-2 me-1"></i>Accepting…');

    ajax_request({
      url:         '<?php echo $server_url?>login/api/engine/accept_invite.php',
      autoPrepare: false,
      data:        { json: JSON.stringify({}) },
      onSuccess: function () {
        bootbox.alert('Invitation accepted! You can now sign in.', function () {
          window.location.href = '<?php echo $server_url?>login/index.php';
        });
      },
      onError: function () {
        $btn.prop('disabled', false).html('<i class="ti ti-check me-1"></i>Accept Invitation');
      },
    });
  }
  </script>

</body>
</html>