Commit Graph
1 Commits
Author SHA1 Message Date
yuneng-jiangandClaude Sonnet 4.6 c2e7cf160f fix(onboarding): prevent invite link reuse for password reset
Moves is_accepted=True from GET /onboarding/get_token to POST /onboarding/claim_token,
so the flag accurately reflects that a password has been set. Both endpoints now reject
already-used links, with get_token rejecting before any user data is returned.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-28 17:39:03 -08:00